Rule detection monitoring method, system and equipment based on time dotting

Abstract

The invention relates to the technical field of rule monitoring management, and provides a rule detection monitoring method, system and device based on time dotting, and the method comprises the steps: starting a time dotting module through a function enabling module, and triggering a traffic construction module through the time dotting module to construct HTTP traffic; when the flow construction module constructs the HTTP flow, time dotting is carried out through the time dotting module, and after the construction of the HTTP flow is completed, the rule engine module verifies the loaded rule by detecting the HTTP flow; and the time processing module collects the detection time parameters of the rule engine module, calculates a detection result according to the collected detection time parameters, and sends the detection result to the result recording module for display. According to the method, accurate rule processing time data can be provided, identification of performance bottlenecks is facilitated, the overall performance and response speed of the system are improved, monitoring and optimization of the rule processing performance are efficiently and accurately achieved, the overall user experience of the system is improved, and human input is remarkably reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of rule monitoring management, and in particular to a rule detection and monitoring method, system and equipment based on time marking. Background Art

[0002] In modern computer systems, engine rule systems play a vital role. They are responsible for processing and monitoring large amounts of data streams to ensure the stable operation of the system and business continuity.

[0003] However, although these systems have made significant progress in monitoring CPU and memory usage, they have the following obvious deficiencies in monitoring rule detection duration: 1. Lack of monitoring of rule detection duration. The current engine rule system mainly focuses on monitoring CPU and memory usage, but ignores the monitoring of rule detection duration. 1. This bias leads to an incomplete evaluation of system performance, which cannot accurately reflect the execution efficiency of each rule. 2. There are business risks. Due to the lack of monitoring of rule detection time, the system cannot identify rules that may cause business access timeouts in advance, causing users to suffer economic losses and affecting business stability and reliability. 3. The performance data is rough. The existing system can only provide rough statistical data on CPU, memory and overall detection time, but cannot accurately determine the processing time of each rule. This generalized data makes it difficult to locate performance bottlenecks, thereby increasing the difficulty of optimizing the system. 4. The lack of performance analysis tools. The lack of detailed performance analysis tools cannot provide in-depth processing time analysis and bottleneck identification, which limits the comprehensive evaluation and optimization of the rule engine and affects the overall performance improvement of the system. 5. The lack of sample library management, the verification sample is single, and it cannot cover the customer's real traffic sample, resulting in insufficient representativeness of the test results and difficulty in reflecting the problems that may be encountered in actual operation. 6. The cost of manpower investment is high. Each update of the rule library requires human support, which not only increases the manpower cost, but also reduces the efficiency and response speed of rule updates.

[0004] Therefore, how to provide a technology that can accurately monitor and analyze the detection time of rules, improve system performance, reduce business risks and reduce labor costs has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a time-based rule detection and monitoring method, system and device.

[0006] According to a first aspect of the present invention, a time-based rule detection and monitoring method is provided, the method comprising:

[0007] Use the function activation module to start the time management module, and use the time management module to trigger the traffic construction module to construct HTTP traffic;

[0008] While the traffic construction module constructs HTTP traffic, the time marking module performs time marking. After the HTTP traffic is constructed, the rule engine module verifies the loaded rules by detecting the HTTP traffic.

[0009] The time processing module collects the detection time parameters of the rule engine module, calculates the detection results according to the collected detection time parameters, and sends the detection results to the result recording module for display.

[0010] Preferably, in the rule detection and monitoring method based on time dotting of the present invention, a function enabling module is used to start a time dotting module, and the time dotting module is used to trigger a traffic construction module to construct HTTP traffic, including:

[0011] The function enabling module sends a start notification to the time management module, and the time management module sends a flow construction request to the flow construction module after receiving the start notification;

[0012] After receiving the traffic construction request, the traffic construction module obtains traffic samples from the sample library and constructs HTTP traffic based on the obtained traffic samples.

[0013] Preferably, in the rule detection and monitoring method based on time dotting of the present invention, a function enabling module is used to start a time dotting module, and the time dotting module is used to trigger a traffic construction module to construct HTTP traffic, and further includes:

[0014] After receiving the traffic construction request sent by the time management module, the traffic construction module sends a traffic sample acquisition request to the sample library. After receiving the traffic sample acquisition request, the sample library sends the traffic sample to the traffic construction module.

[0015] When the traffic construction module fails to construct HTTP traffic using the acquired traffic samples, it continues to send traffic sample acquisition requests to the sample library to obtain new traffic samples to construct HTTP traffic;

[0016] When the traffic construction module fails to construct HTTP traffic using all the traffic samples in the sample library, the result of the traffic construction failure is sent to the time processing module.

[0017] Preferably, in the rule-based detection and monitoring method based on time marking of the present invention, when the traffic construction module fails to construct HTTP traffic using all the traffic samples in the sample library, the result of the traffic construction failure is sent to the time processing module, including: after the time processing module receives the result of the traffic construction failure, it notifies the time marking module to cancel the time marking, and after successfully canceling the time marking, sends the traffic construction failure result and the reason for the traffic construction failure to the result recording module.

[0018] Preferably, in the rule detection and monitoring method based on time marking of the present invention, while the traffic construction module constructs HTTP traffic, time marking is performed through the time marking module, including: the time marking module marks the rule verification start time and the rule verification end time before and after detecting the HTTP traffic constructed by the traffic construction module, and marks the verification start time and the verification end time of each rule used to detect HTTP traffic.

[0019] Preferably, in the rule detection and monitoring method based on time marking of the present invention, after completing the construction of HTTP traffic, the rule engine module verifies the loaded rules by detecting HTTP traffic, including: the rule engine module verifies the currently loaded rules by detecting HTTP traffic, if the currently loaded rule is not the last rule, after completing the verification of the currently loaded rule, continue to load the next rule and verify the next loaded rule by detecting HTTP traffic.

[0020] Preferably, in the rule detection and monitoring method based on time marking of the present invention, the time processing module collects the detection time parameters of the rule engine module, and calculates the detection result according to the collected detection time parameters, including:

[0021] The time processing module collects the rule verification start time and the rule verification end time, and collects the verification start time and verification end time of each rule;

[0022] The total rule verification time is calculated according to the rule verification start time and the rule verification end time, and the verification time of each rule is calculated according to the verification start time and the verification end time of each rule. The total rule verification time and the verification time of each rule are taken as the detection result.

[0023] Preferably, in the time-based rule detection and monitoring method of the present invention, the detection result is sent to the result recording module for display, including:

[0024] The result recording module determines the verification result of the rule according to the received calculation detection result;

[0025] When the verification result of the judgment rule is successful, the verification result and the processing time of each rule and the total processing time of all rules are displayed;

[0026] When the verification result of the judgment rule is failed, the verification result and the reason for the verification failure are displayed.

[0027] According to a second aspect of the present invention, a rule detection and monitoring system based on time marking is provided, the system includes a detection and monitoring server, the detection and monitoring server is used to: use a function activation module to start the time marking module, trigger the traffic construction module through the time marking module to construct HTTP traffic; while the traffic construction module constructs the HTTP traffic, the time marking is performed through the time marking module, after the construction of the HTTP traffic is completed, the rule engine module verifies the loaded rules by detecting the HTTP traffic; the time processing module collects the detection time parameters of the rule engine module, calculates the detection result according to the collected detection time parameters, and sends the calculated detection result to the result recording module for display.

[0028] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0029] The time-based rule detection and monitoring method, system and device of the present invention have the following beneficial technical effects:

[0030] 1. By timestamping the key time points in processing each rule, the present invention can accurately measure the processing time of each rule and the total processing time, provide precise rule processing time data, help identify performance bottlenecks, and provide detailed performance analysis;

[0031] 2. By recording detailed rule processing time data and timeout information, it provides valuable basis for performance optimization, helps developers to carry out targeted optimization, and improves the overall performance and response speed of the system;

[0032] 3. By integrating the processing flow into the existing rule engine system in a friendly way, the monitoring and optimization of rule processing performance can be realized efficiently and accurately through code embedding and module integration;

[0033] 4. By providing users with detailed processing time and timeout information, users can better understand the system performance status, make timely adjustments and optimizations, and improve the overall user experience of the system;

[0034] 5. Every time the rule base is released, the rules can be verified without the need for manpower investment in detection and verification, which significantly reduces manpower investment. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 This is a diagram showing an example of the architecture of a rule-based detection and monitoring system based on time points according to an embodiment of the present invention;

[0037] Figure 2 A flowchart of a time-based rule detection and monitoring method according to an embodiment of the present invention;

[0038] Figure 3 A technical principle diagram of a time-based rule detection and monitoring method according to an embodiment of the present invention;

[0039] Figure 4 This is an example diagram of the execution flow of a rule detection and monitoring method based on time marking according to an embodiment of the present invention;

[0040] Figure 5 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0041] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0042] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0043] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0044] Figure 1 FIG. 1 is a schematic diagram of an architecture of a rule-based detection and monitoring system based on time points according to an embodiment of the present invention. Figure 1As shown, the system may include a detection and monitoring server 101, a communication network 102 and / or one or more detection and monitoring clients 103. Figure 1 The example shown is a plurality of detection monitoring clients 103 .

[0045] The detection and monitoring server 101 can be any appropriate server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the detection and monitoring server 101 can perform appropriate functions. For example, in some embodiments, the detection and monitoring server 101 can be used to verify rules based on time marking. As an optional example, in some embodiments, the detection and monitoring server 101 can be used to: use the function enabling module to start the time marking module, and trigger the traffic construction module through the time marking module to construct HTTP traffic; while the traffic construction module constructs HTTP traffic, the time marking module is used to perform time marking. After completing the construction of HTTP traffic, the rule engine module verifies the loaded rules by detecting HTTP traffic; the time processing module collects the detection time parameters of the rule engine module, calculates the detection results based on the collected detection time parameters, and sends the calculated detection results to the result recording module for display.

[0046] As another example, in some embodiments, the detection and monitoring server 101 may send the time-based rule-based detection and monitoring method to the detection and monitoring client 103 for user use according to the request of the detection and monitoring client 103 .

[0047] As an optional example, in some embodiments, the detection and monitoring client 103 is used to provide a visual detection and monitoring interface, which is used to receive a user's selection input operation to verify the rules based on time points, and, in response to the selection input operation, obtain the detection and monitoring interface corresponding to the option selected by the selection input operation from the detection and monitoring server 101 and display the detection and monitoring interface, wherein the detection and monitoring interface at least displays information on verifying the rules based on time points and operation options for the information on verifying the rules based on time points.

[0048] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN) and / or any other suitable communication network. The detection monitoring client 103 can be connected to the communication network 102 by one or more communication links (for example, communication link 104), and the communication network 102 can be linked to the detection monitoring service end 101 via one or more communication links (for example, communication link 105). The communication link can be any communication link suitable for transmitting data between the detection monitoring client 103 and the detection monitoring service end 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link or any suitable combination of such links.

[0049] Detection monitoring client 103 can include presenting the interface relevant to verifying rule based on time point by appropriate form, for any one or more clients of user use and operation.In some embodiments, detection monitoring client 103 can include the equipment of any suitable type.For example, in some embodiments, detection monitoring client 103 can include mobile device, tablet computer, laptop computer, desktop computer and / or any other suitable type of client device.

[0050] Although the detection monitoring server 101 is illustrated as one device, in some embodiments, any appropriate number of devices may be used to perform the functions performed by the detection monitoring server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the detection monitoring server 101. Alternatively, a cloud service may be used to implement the functions of the detection monitoring server 101.

[0051] Based on the above system, an embodiment of the present invention provides a rule detection and monitoring method based on time marking, which is described below through the following embodiments.

[0052] Figure 2 The present invention is a flowchart of a time-based rule detection and monitoring method according to an embodiment of the present invention. Figure 3 A technical principle diagram of a time-based rule detection and monitoring method according to an embodiment of the present invention; Figure 4 FIG. 4 is an example diagram of an execution flow of a time-based rule detection and monitoring method according to an embodiment of the present invention; Figure 2 , Figure 3 and Figure 4As shown, the time-based rule detection and monitoring method of this embodiment can be executed on the detection and monitoring server, and the time-based rule detection and monitoring method includes the following steps:

[0053] Step S201: using the function activation module to start the time marking module, and triggering the traffic construction module to construct HTTP traffic through the time marking module.

[0054] As an optional example, in this embodiment, a startup notification is sent to the time management module through the function activation module. After receiving the startup notification, the time management module sends a traffic construction request to the traffic construction module. After receiving the traffic construction request, the traffic construction module obtains traffic samples from the sample library and constructs HTTP traffic based on the obtained traffic samples.

[0055] As an optional example, in this embodiment, after the traffic construction module receives the traffic construction request sent by the time marking module, it sends a traffic sample acquisition request to the sample library. After receiving the traffic sample acquisition request, the sample library sends the traffic sample to the traffic construction module; when the traffic construction module fails to construct HTTP traffic using the acquired traffic sample, it continues to send traffic sample acquisition requests to the sample library to obtain new traffic samples to construct HTTP traffic; when the traffic construction module fails to construct HTTP traffic using all the traffic samples in the sample library, it sends the result of traffic construction failure to the time processing module. It should be noted that in this embodiment, after receiving the result of traffic construction failure, the time processing module notifies the time marking module to cancel the time marking, and after successfully canceling the time marking, it sends the traffic construction failure result and the reason for the traffic construction failure to the result recording module.

[0056] Step S202: while the traffic construction module constructs the HTTP traffic, the time marking module performs time marking. After the construction of the HTTP traffic is completed, the rule engine module verifies the loaded rules by detecting the HTTP traffic.

[0057] As an optional example, in this embodiment, the time marking module marks the rule verification start time and the rule verification end time before and after detecting the HTTP traffic constructed by the traffic construction module, and marks the verification start time and the verification end time of each rule used to detect HTTP traffic. After completing the construction of HTTP traffic, the rule engine module verifies the currently loaded rule by detecting HTTP traffic. If the currently loaded rule is not the last rule, after completing the verification of the currently loaded rule, continue to load the next rule and verify the next loaded rule by detecting HTTP traffic.

[0058] Step S203: The time processing module collects the detection time parameters of the rule engine module, calculates the detection result according to the collected detection time parameters, and sends the detection result to the result recording module for display.

[0059] As an optional example, in this embodiment, the time processing module collects the rule verification start time and the rule verification end time, collects the verification start time and the verification end time of each rule; calculates the total rule verification time according to the rule verification start time and the rule verification end time, calculates the verification time of each rule according to the verification start time and the verification end time of each rule, and sends the total rule verification time and the verification time of each rule as the detection result to the result recording module. It should be noted that in this embodiment, after the time processing module completes the calculation of the detection result, it informs the time dotting module to remove the time dotting.

[0060] For example, after the time marking and traffic construction are completed, the rule engine module loads the rules to detect the HTTP traffic constructed by the traffic construction module. At this time, the time processing module will collect the rule verification start time time_start1. If the rule currently being verified is not the last rule, the single rule verification end time time_end1 will be recorded, and the next rule will be loaded to continue to detect HTTP traffic, and the rule verification start time time_start2 will continue to be recorded. The time processing module will collect the rule verification start time and the single rule verification end time, and calculate the single rule processing time time=time_end1-time_start1; if the rule currently being verified is the last rule, the rule verification end time will be recorded, and the last rule verification time time=time_endn-time_startn (n=1.2.3.4...represents the last rule) will be calculated, and the total rule verification time time=time_endn-time_start1 will be calculated.

[0061] The result recording module determines the verification result of the rule according to the received calculation test result; when the verification result of the rule is determined to be successful, the verification result and the processing time of each rule and the total processing time of all rules are displayed; when the verification result of the rule is determined to be failed, the verification result and the reason for the verification failure are displayed. In practical applications, the result recording module can generate a data file such as an Excel file with the received calculation test results, the verification results of the rules, and the reason for the verification failure for data export.

[0062] The time-based rule detection and monitoring method and system according to this embodiment have the following beneficial technical effects:

[0063] 1. By timestamping the key time points in processing each rule, the present invention can accurately measure the processing time of each rule and the total processing time, provide precise rule processing time data, help identify performance bottlenecks, and provide detailed performance analysis;

[0064] 2. By recording detailed rule processing time data and timeout information, it provides valuable basis for performance optimization, helps developers to carry out targeted optimization, and improves the overall performance and response speed of the system;

[0065] 3. By integrating the processing flow into the existing rule engine system in a friendly way, the monitoring and optimization of rule processing performance can be realized efficiently and accurately through code embedding and module integration;

[0066] 4. By providing users with detailed processing time and timeout information, users can better understand the system performance status, make timely adjustments and optimizations, and improve the overall user experience of the system;

[0067] 5. Every time the rule base is released, the rules can be verified without the need for manpower investment in detection and verification, which significantly reduces manpower investment.

[0068] like Figure 5 As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a computer program executable by the processor, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned rule detection and monitoring method based on time marking by running the executable computer program.

[0069] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0070] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0071] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0072] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A rule detection and monitoring method based on time marking, characterized in that: The method comprises: Use the function activation module to start the time management module, and use the time management module to trigger the traffic construction module to construct HTTP traffic; While the traffic construction module constructs HTTP traffic, the time marking module performs time marking. After the HTTP traffic is constructed, the rule engine module verifies the loaded rules by detecting the HTTP traffic. The time processing module collects the detection time parameters of the rule engine module, calculates the detection results according to the collected detection time parameters, and sends the detection results to the result recording module for display.

2. The rule detection and monitoring method based on time marking according to claim 1 is characterized in that: The function enabling module is used to start the time management module, and the time management module is used to trigger the traffic construction module to construct HTTP traffic, including: The function enabling module sends a start notification to the time management module, and the time management module sends a flow construction request to the flow construction module after receiving the start notification; After receiving the traffic construction request, the traffic construction module obtains traffic samples from the sample library and constructs HTTP traffic based on the obtained traffic samples.

3. The rule detection and monitoring method based on time marking according to claim 1 is characterized in that: The function enabling module is used to start the time management module, and the time management module is used to trigger the traffic construction module to construct HTTP traffic, which also includes: After receiving the traffic construction request sent by the time management module, the traffic construction module sends a traffic sample acquisition request to the sample library. After receiving the traffic sample acquisition request, the sample library sends the traffic sample to the traffic construction module. When the traffic construction module fails to construct HTTP traffic using the acquired traffic samples, it continues to send traffic sample acquisition requests to the sample library to obtain new traffic samples to construct HTTP traffic; When the traffic construction module fails to construct HTTP traffic using all the traffic samples in the sample library, the result of the traffic construction failure is sent to the time processing module.

4. The rule detection and monitoring method based on time marking according to claim 3 is characterized in that: When the traffic construction module fails to construct HTTP traffic using all the traffic samples in the sample library, the result of the traffic construction failure is sent to the time processing module, including: after the time processing module receives the result of the traffic construction failure, it notifies the time marking module to cancel the time marking, and after the time marking is successfully canceled, sends the traffic construction failure result and the reason for the traffic construction failure to the result recording module.

5. The rule detection and monitoring method based on time marking according to claim 1 is characterized in that: While the traffic construction module constructs HTTP traffic, the time marking module performs time marking, including: the time marking module marks the rule verification start time and the rule verification end time before and after detecting the HTTP traffic constructed by the traffic construction module, and marks the verification start time and the verification end time of each rule used to detect HTTP traffic.

6. The rule detection and monitoring method based on time marking according to claim 1 is characterized in that: After completing the construction of the HTTP traffic, the rule engine module verifies the loaded rules by detecting the HTTP traffic, including: the rule engine module verifies the currently loaded rules by detecting the HTTP traffic. If the currently loaded rule is not the last rule, after completing the verification of the currently loaded rule, continue to load the next rule and verify the next loaded rule by detecting the HTTP traffic.

7. The rule detection and monitoring method based on time marking according to claim 1 is characterized in that: The time processing module collects the detection time parameters of the rule engine module and calculates the detection results according to the collected detection time parameters, including: The time processing module collects the rule verification start time and the rule verification end time, and collects the verification start time and verification end time of each rule; The total rule verification time is calculated according to the rule verification start time and the rule verification end time, and the verification time of each rule is calculated according to the verification start time and the verification end time of each rule. The total rule verification time and the verification time of each rule are taken as the detection result.

8. The rule detection and monitoring method based on time marking according to claim 1 is characterized in that: Send the test results to the result recording module for display, including: The result recording module determines the verification result of the rule according to the received calculation detection result; When the verification result of the judgment rule is successful, the verification result and the processing time of each rule and the total processing time of all rules are displayed; When the verification result of the judgment rule is failed, the verification result and the reason for the verification failure are displayed.

9. A rule detection and monitoring system based on time marking, characterized in that: The system includes a detection and monitoring server, which is used to: use a function activation module to start a time marking module, and trigger a traffic construction module through the time marking module to construct HTTP traffic; while the traffic construction module constructs HTTP traffic, the time marking module is used to perform time marking, and after completing the construction of the HTTP traffic, the rule engine module verifies the loaded rules by detecting the HTTP traffic; the time processing module collects the detection time parameters of the rule engine module, calculates the detection results according to the collected detection time parameters, and sends the calculated detection results to the result recording module for display.

10. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the program.

Images