Flow diagnosis method of cloud service instance, alarm system, equipment and storage medium

Abstract

The embodiment of the invention provides a flow diagnosis method of a cloud service instance, an alarm system, equipment and a storage medium, and the method comprises the steps: obtaining a first abnormal virtual address, and obtaining a second abnormal virtual address which gives an alarm in the same time period as the first abnormal virtual address; combining the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set; and obtaining the service traffic of each cloud service instance, and determining a target abnormal instance of the abnormal virtual address set based on the service traffic. Through determining the target cloud service instance which causes the abnormal traffic of the abnormal virtual address after alarm merging, one-time abnormal instance positioning of a plurality of abnormal virtual addresses with similar abnormal traffic is realized. According to the embodiment of the invention, multiple relocation operations do not need to be carried out on multiple abnormal virtual addresses caused by the same abnormal instance, so that the diagnosis times are reduced, the instance causing the rising of the virtual website flow is quickly determined, and the diagnosis efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a traffic diagnosis method for a cloud service instance, a corresponding alarm system, a corresponding electronic device, and a corresponding computer-readable storage medium. Background Art

[0002] Traffic-based cloud service instances can provide services to the outside world. The use of services is mainly manifested in users accessing through VIP (Virtual IP, i.e. virtual address) or domain names mounted on VIP to achieve data reading and writing. As for cloud service instances, multiple instances are usually reused to provide services to the outside world. However, after VIP reuse, it is easy for VIP traffic to exceed the VIP security threshold, and there is a need to quickly locate the instance that causes the high water level.

[0003] In the related technologies of instance location, it is mainly realized by manually searching for instances with high traffic through the seven-layer log and locating them. However, it is difficult to quickly determine the instances that cause the increase in VIP traffic based on the method of manually locating instances. Summary of the invention

[0004] In view of the above problems, embodiments of the present application are proposed to provide a traffic diagnosis method for a cloud service instance, a corresponding alarm system, a corresponding electronic device, and a corresponding computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] The present application embodiment discloses a traffic diagnosis method for a cloud service instance, the method comprising:

[0006] Acquire a first abnormal virtual address, and acquire a second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address; wherein the abnormal virtual address is used to indicate a virtual address of traffic abnormality;

[0007] Merging the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set;

[0008] The service traffic of each cloud service instance is obtained, and the target abnormal instance of the abnormal virtual address set is determined based on the service traffic; the target abnormal instance is used to indicate the cloud service instance that causes the traffic abnormality of each abnormal virtual address in the abnormal virtual address set.

[0009] Optionally, the merging the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set includes:

[0010] Acquire a first time series of the first abnormal virtual address and a second time series of the second abnormal virtual address;

[0011] The similarity between the first time series and the second time series is calculated, and the first abnormal virtual address and the second abnormal virtual address are merged according to the similarity to obtain an abnormal virtual address set.

[0012] Optionally, the calculating the similarity between the first time series and the second time series, and merging the first abnormal virtual address and the second abnormal virtual address according to the similarity, includes:

[0013] calculating a constrained shape distance between the first time series and the second time series;

[0014] If the constraint shape distance is less than a preset distance threshold, the first abnormal virtual address and the second abnormal virtual address are merged.

[0015] Optionally, calculating the constrained shape distance between the first time series and the second time series includes:

[0016] performing normalization processing on the first time series and the second time series;

[0017] Moving the second time series on the first time series a preset number of times based on a preset shift range;

[0018] Acquire a plurality of shifted time series after the second time series is shifted during a preset number of shifts;

[0019] According to a preset algorithm, the constrained shape distances of the shifted time series and the first time series are calculated respectively.

[0020] Optionally, the service traffic includes multiple service traffic for each cloud service instance; and determining the target abnormal instance of the abnormal virtual address set based on the service traffic includes:

[0021] Arrange the multiple service flows in reverse order according to flow size to obtain a service flow sequence, and obtain the abnormal instance that is at the first position in the service flow sequence;

[0022] If the number of the abnormal instance at the first position in the service traffic sequence is one, determining the abnormal instance at the first position as the target abnormal instance;

[0023] And / or, if there are multiple abnormal instances at the first position in the service traffic sequence, the actual traffic proportions of the multiple abnormal instances at the first position in the service traffic sequence are obtained, and the target abnormal instance is determined according to the traffic proportions.

[0024] Optionally, determining a target abnormal instance of the abnormal virtual address set according to the traffic proportion includes:

[0025] If there is an abnormal instance whose actual traffic ratio exceeds a preset traffic difference ratio among the multiple abnormal instances at the first position of the service traffic sequence, the abnormal instance is determined to be the target abnormal instance;

[0026] And / or, if there is no abnormal instance in which the actual traffic ratio exceeds the preset traffic difference ratio among the multiple abnormal instances at the top of the service traffic sequence, the traffic increase rate of the multiple abnormal instances at the top of the service traffic sequence is obtained, and the target abnormal instance is determined based on the traffic increase rate information.

[0027] Optionally, determining a target abnormal instance of the abnormal virtual address set according to the traffic increase includes:

[0028] If there is an abnormal instance whose traffic increase ratio exceeds a preset traffic range among the multiple abnormal instances located at the first position of the service traffic sequence, the abnormal instance is determined to be the target abnormal instance.

[0029] Optionally, it also includes:

[0030] If there is no abnormal instance whose traffic increase ratio exceeds a preset traffic range among the multiple abnormal instances at the first position of the service traffic sequence, then obtaining the virtual address traffic of the first abnormal virtual address and the service traffic of each cloud service instance using the first abnormal virtual address;

[0031] Calculating similarities between virtual address traffic of the first abnormal virtual address and service traffic of each cloud service instance using the first abnormal virtual address to obtain multiple traffic similarity results;

[0032] An abnormal instance corresponding to a certain traffic similarity result among the multiple traffic similarity results that exceeds other traffic similarity results is determined as the target abnormal instance.

[0033] The embodiment of the present application also discloses an alarm system, which includes: an alarm detection module and an intelligent diagnosis module;

[0034] The alarm detection module is used to detect the abnormal virtual address where the alarm occurs and generate an alarm instruction; wherein the abnormal virtual address is used to indicate the virtual address of the traffic abnormality, and the abnormal virtual address includes a first abnormal virtual address and a second abnormal virtual address where the alarm occurs in the same time period as the first abnormal virtual address;

[0035] The intelligent diagnosis module is used to respond to the alarm instruction, merge the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set; and obtain the service traffic of each cloud service instance, and determine the target abnormal instance of the abnormal virtual address set based on the service traffic, wherein the target abnormal instance is used to indicate the cloud service instance that causes the traffic abnormality of each abnormal virtual address in the abnormal virtual address set.

[0036] An embodiment of the present application also discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, any traffic diagnosis method of the cloud service instance is implemented.

[0037] An embodiment of the present application further discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the traffic diagnosis method of any one of the cloud service instances is implemented.

[0038] The embodiments of the present application include the following advantages:

[0039] In an embodiment of the present application, while obtaining the first abnormal virtual address, the second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address can be obtained, and the first abnormal virtual address and the second abnormal virtual address obtained can be merged to obtain an abnormal virtual address set, and then the target cloud service instance that causes the traffic anomaly of each abnormal virtual address in the abnormal virtual address set can be located based on the service traffic of each cloud service instance. By merging the abnormal virtual addresses that generate alarms in the same time period, and determining the target cloud service instance that causes the traffic anomaly of the abnormal virtual address after the alarm merger, a one-time positioning of abnormal instances of multiple abnormal virtual addresses with similar abnormal traffic is achieved, without the need to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance, so as to quickly determine the instance that causes the increase in virtual website traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of the principle of an example of diagnosing flow anomalies provided in an embodiment of the present application;

[0041] Figure 2It is a schematic diagram of a positioning process of positioning an abnormal instance in the related art;

[0042] Figure 3 It is a flow chart of steps of an embodiment of a traffic diagnosis method of a cloud service instance of the present application;

[0043] Figure 4 is a flow chart of steps of another embodiment of a traffic diagnosis method for a cloud service instance of the present application;

[0044] Figure 5 is a schematic diagram of the time series of each abnormal virtual address in the abnormal virtual address set provided by an embodiment of the present application;

[0045] Figure 6 It is a schematic diagram of a process of merging abnormal virtual addresses provided in an embodiment of the present application;

[0046] Figure 7 It is a schematic diagram of a process of calculating the similarity of a time series of abnormal virtual addresses provided by an embodiment of the present application;

[0047] Figure 8 It is a schematic diagram of the positioning process based on simulated artificial rules provided by the example of this application;

[0048] Fig. 9 It is a schematic diagram of service flow provided by an embodiment of the present application in which the actual flow ratio exceeds the preset flow difference ratio;

[0049] Fig.10 It is a schematic diagram of service flow provided by an embodiment of the present application, in which the flow rate increase ratio exceeds a preset flow rate range;

[0050] Fig.11 This is an example schematic diagram of a diagnosis failure based on simulating manual rules provided in an embodiment of the present application;

[0051] Fig.12 is a schematic diagram of a positioning process based on a similarity algorithm provided in an embodiment of the present application;

[0052] Fig.13 It is a schematic diagram of the framework of the alarm system provided in the embodiment of the present application;

[0053] Fig.14 It is a schematic diagram of an application scenario of traffic diagnosis of a cloud service instance provided in an embodiment of the present application;

[0054] Fig.15 It is a structural block diagram of an embodiment of a traffic diagnostic device of a cloud service instance of the present application. DETAILED DESCRIPTION

[0055] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0056] To facilitate those skilled in the art to understand the present application, the following explains the terms or nouns involved in the following embodiments of the present application:

[0057] VIP: Virtual IP, refers to the IP obtained through the IP load balancing virtualization of LVS (Linux Virtual Server). When a user accesses a cloud product, the request first passes through the VIP to the load scheduler, and then the load scheduler selects a service node from the cloud server list in the backend of the cloud product, such as the Real Server list, to respond to the user's request.

[0058] Instance-based cloud products: refers to cloud service products provided in the form of instances, such as virtual machines in cloud servers and storage space in cloud object storage.

[0059] VIP multiplexing: refers to multiple instances sharing the same or multiple identical VIPs to write and read data.

[0060] VIP traffic: It is the statistical data of the network layer 4 traffic, which can be obtained based on the collection and statistics of LVS logs. It is a near real-time water level data. The data content may include VIP, outbound traffic, and inbound traffic.

[0061] Service traffic: It is the statistical data of layer 7 traffic, which can be obtained based on the collection and statistics of service layer logs. It is a kind of near-real-time water level data. The data content may include instance ID (Identity document, identification code), VIP, outbound traffic and inbound traffic.

[0062] Water level data: used to indicate the amount of flow.

[0063] Abnormal virtual address: also known as abnormal VIP, refers to the VIP whose traffic exceeds the security threshold.

[0064] Abnormal instance / problem instance: refers to the instance that causes VIP traffic abnormality, that is, the Top instance.

[0065] HTTP: HyperText Transfer Protocol.

[0066] TCP: Transmission Control Protocol.

[0067] cSBD algorithm: It is a similarity algorithm based on constrained shape distance, which is used to calculate the time delay relationship between two time series and is one of the methods for measuring distance of time series.

[0068] Pearson algorithm: Pearson algorithm is a method to measure vector similarity.

[0069] Spearman algorithm: Spearman algorithm reflects the correlation between the direction and intensity of the change trend of two random variables.

[0070] DTW algorithm: Dynamic TimeWarping, dynamic time warping algorithm, is a dynamic programming algorithm that calculates the similarity of two time series data (especially two series data with different time lengths).

[0071] Instance-based cloud products based on VIP reuse are characterized by access through multiple instances of VIP reuse to provide external services, such as object cloud storage services. Users can use HTTP, TCP and other protocols to access VIP, or the domain name mounted by VIP to read and write data.

[0072] However, since multiple instances reuse the same VIP, when the water level of one of the instances is too high, the traffic of the reused VIP may be too high and exceed the VIP security threshold, resulting in packet loss. This problem will affect other instances that reuse the VIP, and this situation is not allowed to occur. Therefore, there is a need to quickly locate the instance that causes the high water level, so as to migrate the instance to lower the water level and avoid risks.

[0073] How to quickly diagnose and locate the problem of causing high water level, such as Figure 1 As shown, assuming that there are multiple instances (including instance 1, instance 2, instance i (i can be any positive integer), etc.) to reuse VIP, the water level of the VIP is mainly calculated based on the linear superposition of the aforementioned multiple instances, that is, it is expressed as a linear model: VIP = instance 1 + instance 2 + instance i. When diagnosing, it is mainly manifested in locating the instance that causes VIP traffic abnormality in the aforementioned instances, such as instance 1, instance 2, instance i, etc.

[0074] In the related technologies of instance location, since the network layer 4 data related to VIP traffic or VIP water level does not carry relevant instance information, it is impossible to locate directly based on the network layer 4 data. In this case, it is mainly achieved by manually finding instances with high traffic and locating them through the layer 7 logs that carry instance information. Specifically, Figure 2As shown, the service traffic statistics data is mainly obtained through the collection and statistics based on the service layer logs, and the Top instance analysis is performed to calculate the instances that reuse a certain VIP, such as instance 1, instance 2, and instance i, and then the instances are arranged in reverse order according to the traffic size, and then the instance at the top of the Top1, such as instance 1, is found and treated as an abnormal instance.

[0075] However, it is difficult to quickly determine the instance that caused the increase in VIP traffic by manually searching through the seven-layer logs, and it is difficult to determine the instance that actually caused the increase in VIP traffic because it relies on the single factor of traffic for positioning. In particular, when there are instances with similar traffic, it is difficult to locate the instance of the traffic anomaly that caused it by relying on the single factor of VIP traffic. In addition, there may be multiple abnormal VIPs associated with the same problem instance, that is, the traffic anomalies of multiple VIPs are caused by the same instance. In this case, it is still necessary to repeatedly locate each VIP separately, and it is not possible to directly search for other abnormal VIPs that may be caused by the problem instance located by one of the abnormal VIPs based on the located problem instance.

[0076] The embodiment of the present application merges the abnormal virtual addresses that have alarmed in the same time period, and determines the target cloud service instance that caused the abnormal traffic to occur in the abnormal virtual addresses after the alarm is merged, so as to realize the one-time positioning of abnormal instances of multiple abnormal virtual addresses with similar abnormal traffic, without the need to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance, thereby reducing the number of diagnoses, and quickly determining the instance that caused the increase in virtual website traffic, thereby improving the diagnostic efficiency. Furthermore, based on the fusion analysis of the four-layer data used to indicate the virtual address traffic and the seven-layer data used to indicate the service traffic, and the dual combination of positioning the abnormal instance based on rules and algorithms at the same time, because it relies on the two-layer factors of virtual address traffic and service traffic, it is possible to simulate the artificial rule positioning process that meets the characteristics of cloud services, and introduce intelligent algorithms to solve the situation where the artificial positioning cannot cover the scene, so as to locate the instance that actually causes the traffic abnormality, so as to avoid the problem that it is difficult to locate which of the similar instances caused the traffic abnormality when there are instances with similar traffic. In addition, the diagnostic scheme proposed in the embodiment of the present application can be applied to the alarm system, and the diagnostic process is automatically executed after being triggered by the intelligent diagnostic module in the alarm system based on the alarm data. The entire process does not require human intervention and can automatically locate abnormal instances, thereby achieving the purpose of improving execution efficiency.

[0077] Reference Figure 3 , shows a flow chart of a flow diagnosis method embodiment of a cloud service instance of the present application, which may specifically include the following steps:

[0078] Step 301, obtaining a first abnormal virtual address, and obtaining a second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address;

[0079] A cloud service instance may refer to an instantiation node of a cloud service provided by a cloud product. A cloud service instance may reuse one or more of the same VIPs with other cloud service instances, i.e., a cloud service instance may correspond to multiple virtual address VIPs, and the same virtual address VIP may be used by multiple cloud service instances.

[0080] Since a cloud service instance usually corresponds to multiple VIPs, assuming that the cloud service instance is an abnormal instance, then when the abnormal instance causes a high water level, it is usually manifested as a phenomenon of abnormal traffic at multiple virtual addresses in the same time period. In an embodiment of the present application, in order to achieve a one-time positioning of abnormal instances for multiple abnormal virtual addresses with similar abnormal traffic, there is no need to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance to quickly determine the instance that causes the increase in virtual website traffic. At this time, the abnormal virtual addresses that alarm in the same time period can be obtained, which facilitates the alarm merging processing of the abnormal virtual addresses that alarm in the same time period.

[0081] An abnormal virtual address (which may be called an abnormal VIP) may refer to a virtual address where traffic anomalies occur. Traffic anomalies are mainly manifested as traffic exceeding a security threshold, which can be mainly determined by real-time detection of VIP traffic.

[0082] In one embodiment of the present application, a first abnormal virtual address that generates an alarm can be obtained, and a second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address can be obtained, wherein the number of second abnormal virtual addresses can be one or more, and the embodiment of the present application is not limited to this.

[0083] In practical applications, the acquisition of the first abnormal virtual address and the second abnormal virtual address can be mainly obtained by receiving and parsing the alarm instruction, and the received alarm instruction can be automatically generated based on the upstream alarm data, or based on manual triggering. Specifically, for the alarm instruction for sending the first abnormal virtual address, it can be automatically generated based on the alarm data including the first abnormal virtual address, or it can be generated based on the diagnostic operation triggered manually when the first abnormal virtual address is manually detected; and the instruction generation of the second abnormal virtual address for the alarm is similar to the process of generating the first abnormal virtual address, and the embodiments of the present application will not be repeated here.

[0084] Step 302, merging the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set;

[0085] After obtaining the first abnormal virtual address and at least one second abnormal virtual address that alarm in the same time period, the abnormal virtual addresses that alarm in the same time period can be merged to perform a combined diagnosis; wherein, diagnosis refers to locating the abnormal instances that cause these VIP traffic abnormalities.

[0086] The merge alarm operation performed may be expressed as merging the abnormal virtual addresses into the same abnormal virtual address set, so as to regard the merged abnormal virtual address set as a whole as an abnormal VIP to perform subsequent diagnosis process on the abnormal instance.

[0087] The abnormal virtual addresses that can be merged, that is, the abnormal virtual addresses in the abnormal virtual address set, are usually multiple abnormal virtual addresses with similar abnormal situations.

[0088] The abnormal situation of the abnormal virtual address can be mainly presented through the time series, which presents the change of the traffic value of the abnormal VIP over time, that is, the traffic change trend of the abnormal VIP. Then, for situations with similar abnormal situations, the similarity calculated by the time series can be determined.

[0089] In one embodiment of the present application, the time series of each abnormal VIP in the abnormal virtual address set can be obtained separately, that is, the first time series of the first abnormal virtual address and the second time series of the second abnormal virtual address are obtained. At this time, the similarity of the first time series and the second time series can be calculated so as to merge the first abnormal virtual address and the second abnormal virtual address based on the calculated similarity.

[0090] It should be noted that, since multiple second abnormal virtual addresses are allowed to exist, the second time series obtained at this time can also be multiple. When calculating the similarity, what is involved is the similarity calculation between the two time series. At this time, the first time series can be used as a reference object, and the similarity between each second time series and the first time series can be calculated separately, so as to determine whether to merge the second abnormal virtual addresses corresponding to each second time series into the abnormal virtual address set created for the first abnormal virtual address based on the calculation results.

[0091] Step 303: Obtain service traffic of each cloud service instance, and determine a target abnormal instance of the abnormal virtual address set based on the service traffic.

[0092] After merging the alarms of abnormal virtual addresses that have issued alarms in the same time period, the service traffic of each cloud service instance can be obtained, so as to determine the target abnormal instance based on the obtained service traffic and complete the diagnosis and positioning of the instance that caused the high water level.

[0093] Among them, the merged abnormal virtual address set can be regarded as an abnormal VIP as a whole, so the target abnormal instance determined at this time can refer to the cloud service instance that causes the traffic abnormality of each abnormal virtual address in the abnormal virtual address set.

[0094] In some embodiments of the present application, the method for determining the target abnormal instance can be based on the fusion analysis of the four-layer data used to indicate the virtual address traffic and the seven-layer data used to indicate the service traffic, and the dual combination of the rules and algorithms to locate the abnormal instance at the same time. Since it relies on the dual factors of the virtual address traffic and the service traffic, it is possible to simulate the artificial rule positioning process that meets the characteristics of cloud services, and introduce intelligent algorithms to solve the situation where the artificial positioning cannot cover the scene, and locate the instance that actually causes the traffic anomaly, so as to avoid the problem that it is difficult to locate which of the similar instances is the instance that causes the traffic anomaly when there are instances with similar traffic. It should be noted that the embodiments of the present application do not limit the specific fusion analysis process of the four-layer data and the seven-layer data, and the specific combination of simulating the artificial rule positioning and the algorithm positioning based on the similarity calculation.

[0095] It should be noted that the execution order between the aforementioned step 103 and steps 101 to 102 may not be executed in the order of the aforementioned steps, that is, in response to the alarm instruction carrying the first abnormal virtual address, the service traffic of each cloud service instance may be obtained, and the abnormal instance may be determined based on the service traffic. Then, the second abnormal virtual address that alarmed in the same time period as the first abnormal virtual address may be obtained, and then after determining whether it can be merged, a merged diagnosis process may be performed, and the abnormal instance that causes the traffic abnormality of the first abnormal virtual address may be directly used as the abnormal instance located by the second abnormal virtual address that can be merged. This is not limited in the embodiments of the present application.

[0096] In an embodiment of the present application, while obtaining the first abnormal virtual address, the second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address can be obtained, and the first abnormal virtual address and the second abnormal virtual address obtained can be merged to obtain an abnormal virtual address set, and then the target cloud service instance that causes the traffic anomaly of each abnormal virtual address in the abnormal virtual address set can be located based on the service traffic of each cloud service instance. By merging the abnormal virtual addresses that generate alarms in the same time period, and determining the target cloud service instance that causes the traffic anomaly of the abnormal virtual address after the alarm merger, a one-time positioning of abnormal instances of multiple abnormal virtual addresses with similar abnormal traffic is achieved, without the need to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance, so as to quickly determine the instance that causes the increase in virtual website traffic.

[0097] Reference Figure 4 , shows a flow chart of another flow diagnosis method embodiment of a cloud service instance of the present application, which may specifically include the following steps:

[0098] Step 401, calculating the similarity between a first time series of a first abnormal virtual address and a second time series of a second abnormal virtual address, and merging the first abnormal virtual address and the second abnormal virtual address according to the similarity to obtain an abnormal virtual address set;

[0099] A cloud service instance can reuse one or more of the same VIPs with other cloud service instances, that is, a cloud service instance can correspond to multiple virtual address VIPs. When an abnormal instance causes a high water level, it is usually manifested as abnormal traffic at multiple virtual addresses in the same time period. In an embodiment of the present application, the abnormal virtual addresses that alarm in the same time period can be obtained to merge the alarms of the abnormal virtual addresses in the same time period, so as to achieve a one-time positioning of abnormal instances for multiple abnormal virtual addresses with similar abnormal traffic.

[0100] After obtaining the first abnormal virtual address and at least one second abnormal virtual address that generate alarms in the same time period, the abnormal virtual addresses that generate alarms in the same time period may be combined to generate alarms for combined diagnosis.

[0101] The merge alarm operation performed may be expressed as merging the abnormal virtual addresses into the same abnormal virtual address set, so as to regard the merged abnormal virtual address set as a whole as an abnormal VIP to perform subsequent diagnosis process on the abnormal instance.

[0102] The abnormal virtual addresses that can be merged, that is, the abnormal virtual addresses in the abnormal virtual address set, are usually multiple abnormal virtual addresses with similar abnormal situations.

[0103] The abnormal situation of the abnormal virtual address can be mainly presented through the time series. The time series presents the change of the traffic value of the abnormal VIP with the migration of time, that is, the traffic change trend of the abnormal VIP.

[0104] Specifically, refer to Figure 5 , shows a schematic diagram of the time series of each abnormal virtual address in the abnormal virtual address set provided by the embodiment of the present application. Assuming that the first abnormal virtual address is VIP1, the second abnormal virtual address is VIP2, and VIP1 and VIP2 are used by the same cloud service instance, the time series shows the traffic change trend of VIP1 and VIP2. When the cloud service instance using VIP1 and VIP2 triggers a high water mark, such as Figure 5 As shown in the figure, the water level trends of the time series of VIP 1 and VIP 2 are basically consistent in the same time period. In this case, it is possible to consider merging VIP1 and VIP2 for combined diagnosis after merging the alarms, that is, VIP1 and VIP2 can be merged into the abnormal virtual address set.

[0105] For cases where the anomalies are similar, they can be determined by the similarity calculated for the time series.

[0106] In one embodiment of the present application, the time series of each abnormal VIP in the abnormal virtual address set can be obtained separately, that is, the first time series of the first abnormal virtual address and the second time series of the second abnormal virtual address are obtained. At this time, the similarity of the first time series and the second time series can be calculated so as to merge the first abnormal virtual address and the second abnormal virtual address based on the calculated similarity.

[0107] Among them, a similarity algorithm can be used to calculate the similarity of the two sequences to measure the correlation between the two time series.

[0108] Similarity algorithms may include, for example, the Pearson algorithm suitable for objects with linear relationships, the Spearman algorithm that is insensitive to data distribution and outliers, the DTW algorithm that uses distortion to solve misalignment, and the cSBD algorithm that uses translation to solve delay, and their time complexities can be expressed as 0(m), 0(m), O(m*m), and O(2w*mw*(w+1)), respectively.

[0109] In the embodiment of the present application, during the flow diagnosis process, due to different data sources, the VIP flow used is based on four-layer sampling statistics, the service flow is based on seven-layer sampling statistics, and from the perspective of the service party, even if different VIP flows of the same cloud service instance are counted, the collected VIP flow will have the problem that the trend time cannot be completely aligned, that is, the data has serious time shift characteristics. At this time, a similarity algorithm that is robust to "misalignment" can be used. Among the above-mentioned similarity algorithms, similarity algorithms that are robust to "misalignment" can include DTW and cSBD, which can effectively solve the time shift problem. However, based on considerations of time complexity, the similarity algorithm used in the embodiment of the present application takes the cSBD algorithm as an example.

[0110] The cSBD algorithm is mainly a similarity algorithm based on the constrained shape distance (i.e., cSBD distance). It is an enhanced implementation of SBD and can determine the similarity of sequences by moving a certain sequence multiple times on another fixed sequence. Among them, the size of the constrained shape distance can be used to indicate the degree of similarity. The larger the constrained shape distance, the lower the similarity, and the smaller the constrained shape distance, the higher the similarity.

[0111] In one embodiment of the present application, the merging process of abnormal virtual addresses can be as follows: Figure 6 As shown, the constraint shape distance of the first time series and the second time series is calculated. If the constraint shape distance is less than the preset distance threshold, it means that the abnormal conditions of the first abnormal virtual address and the second abnormal virtual address are similar. At this time, the first abnormal virtual address and the second abnormal virtual address can be merged. In another case, if the constraint shape distance is greater than or equal to the preset distance threshold, it means that the abnormal conditions of the first abnormal virtual address and the second abnormal virtual address are quite different. At this time, the first abnormal virtual address and the second abnormal virtual address are not merged. Among them, the preset distance threshold set can be a cSBD threshold, and the preset distance threshold can be specifically determined based on an empirical value. The empirical value can be a relatively reasonable value obtained through a large number of alarm analyses, and the embodiments of the present application are not limited to this.

[0112] Specifically, in the process of calculating the constrained shape distance, the first time series can be fixed after normalizing the first time series and the second time series, and then the second time series can be moved a preset number of times on the fixed first time series based on a preset shift range. At this time, multiple shifted time series can be obtained after the second time series is shifted during the preset number of movements. The constrained shape distance of each shifted time series and the first time series can be calculated respectively according to a preset algorithm, i.e., the cSBD algorithm, and the preferred value in the calculation result is used as the constrained shape distance for determining the similarity, so as to determine whether they are similar based on the calculated priority distance.

[0113] For example, it can be Figure 7 As shown in FIG. 1 , the corresponding values ​​of the normalized sequence at different times are compressed in the interval [0, 1]. Assume that x(k) is the time series of VIP 1 and h(k) is the time series of VIP 2, where k can refer to the time value. In this case, the time series x(k) of VIP 1 can be fixed, and then the time series h(k) of VIP 2 can be moved a preset number of times on the time series of VIP 1 within a preset shift range, for example, within (-w, w). The preset number of times can be determined mainly based on the moving threshold w. In this case, it can be assumed that w = -11, and the negative sign indicates that the time series h(k) of VIP 2 is moved to the left. Then, Figure 7 As shown, the second time series after the movement can be expressed as h(wk).

[0114] The time series can be mainly expressed as a data series, which presents alarm data that changes over time, that is, the data format of VIP traffic, which can be presented in the time series data format of [time, value], where value can refer to VIP traffic. Based on obtaining the traffic value of each data node in the sequence before and after the shift within the preset shift range, and obtaining the traffic value of each data node in the fixed time series, the similarity is calculated in the cSBD algorithm based on the traffic value. For example, the similarity between VIP 1 and multiple VIP 2 shifted sequences is calculated within [-w, w], that is, the constrained shape distance is calculated, and then the preferred similarity is obtained on the preferred shift.

[0115] Step 402: Determine a target abnormal instance of the abnormal virtual address set based on multiple service flows of each cloud service instance.

[0116] After merging the alarms of abnormal virtual addresses that have issued alarms in the same time period, the service traffic of each cloud service instance can be obtained, so as to determine the target abnormal instance based on the obtained service traffic and complete the diagnosis and positioning of the instance that caused the high water level.

[0117] Among them, the merged abnormal virtual address set can be regarded as an abnormal VIP as a whole, so the target abnormal instance determined at this time can be the cloud service instance that indicates the traffic anomaly that occurs in each abnormal virtual address in the abnormal virtual address set.

[0118] In an embodiment of the present application, a method for determining a target abnormal instance can be implemented based on a fusion analysis of layer-4 data for indicating virtual address traffic and layer-7 data for indicating service traffic, as well as a dual combination of positioning the abnormal instance based on rules and algorithms. This enables the positioning of instances that actually cause traffic anomalies by simulating an artificial rule positioning process that conforms to the characteristics of cloud services and introducing intelligent algorithms to solve scenarios that are not covered by artificial positioning.

[0119] Specifically, refer to Figure 8 As shown, a schematic diagram of the positioning process based on simulated artificial rules provided by an example of the present application is shown. At this time, it can be expressed as obtaining multiple service flows for each cloud service instance. The obtained service flow can be mainly obtained based on seven-layer data, and the data format of its service flow can be expressed as [time, value, instanceid], where time represents time, value represents service flow, and instance id is used to represent the ID of the cloud service instance; at this time, the obtained service flow can be calculated as TopN Instance, and the calculation process is expressed as arranging multiple service flows in reverse order according to the flow size to obtain a service flow sequence, and then obtaining the abnormal instance that is at the first place in the service flow sequence, that is, the Top instance implementation. In one case, if the number of abnormal instances at the first place in the service flow sequence is one, that is, Count=1, then the abnormal instance at the first place can be determined, assuming that the Top1 instance is the target abnormal instance, such as Figure 8 As shown in the figure, the abnormal instance is successfully located. In another case, if there are multiple abnormal instances at the top of the service traffic sequence, it means that there are multiple cloud service instances using the abnormal VIP, such as Top1 and Top2 instances. In this case, the abnormal instance fails to be located. Figure 8 As shown, the actual traffic proportions of multiple abnormal instances at the top of the service traffic sequence can be obtained, so as to determine the target abnormal instance according to the traffic proportions.

[0120] In the process of determining the target abnormal instance of the abnormal virtual address set according to the traffic proportion, if there is an abnormal instance whose actual traffic proportion exceeds the preset traffic difference ratio among the multiple abnormal instances at the top of the service traffic sequence, then the abnormal instance can be determined as the target abnormal instance, such as Figure 8 As shown, the abnormal instance is successfully located. Fig. 9 As shown in the figure, if the actual traffic proportion of the Top1 instance (such as curve A) is much larger than the actual traffic proportion of the Top2 instance (such as curve B), the Top1 instance can be determined to be the target abnormal instance.

[0121] Specifically, the judgment of whether it is much greater than can be calculated and determined based on the following judgment formula:

[0122] traffic1-traffic2>gapRatio*traffic1

[0123] Among them, traffic1 can represent the water level of instance 1, for example, the actual flow of the Top1 instance; traffic2 can be used to represent the water level of instance 2, for example, the actual flow of the Top2 instance; gapRatio can be used to represent the preset flow difference ratio. It should be noted that the water levels of instance 1 and instance 2 occur based on the reuse of the same VIP. The setting of the preset flow difference ratio can be determined based on an empirical value. The empirical value can be a relatively reasonable value obtained through a large number of alarm analyses. The embodiments of the present application do not limit this. It can be seen from the above judgment formula that when the difference between the water level of instance 1 and the water level of instance 2 is greater than the product of the preset flow difference ratio and the preset flow difference ratio, it means that there is an abnormal instance in the multiple abnormal instances at the top of the service flow sequence whose actual flow ratio exceeds the preset flow difference ratio. It can be determined that instance 1 corresponding to traffic1 is an abnormal instance.

[0124] In another case, if Figure 8 As shown, if there is no abnormal instance in the multiple abnormal instances at the top of the service traffic sequence whose actual traffic proportion exceeds the preset traffic difference ratio, that is, the actual traffic proportions of each instance are not significantly different, then it means that the positioning of the abnormal instance has failed. At this time, the traffic increase of the multiple abnormal instances at the top of the service traffic sequence can be obtained, and the target abnormal instance can be determined based on the traffic increase information.

[0125] In the process of determining the target abnormal instance of the abnormal virtual address set according to the traffic proportion, such as Figure 8 As shown, if there is an abnormal instance whose flow rate increase ratio exceeds the preset flow rate range among the multiple abnormal instances at the top of the service flow sequence, the abnormal instance is determined to be the target abnormal instance, where the flow rate increase ratio may refer to the increase in water level. Fig.10 As shown, if the traffic increase ratio of the Top1 instance (such as curve A) is much larger than the actual traffic proportion of the Top2 instance (such as curve B), then the Top1 instance can be determined to be the target abnormal instance, and the judgment that it is much larger can be determined based on the preset traffic range.

[0126] Specifically, considering the factor of anti-burr interference, the embodiment of the present application can be implemented by designing a search algorithm with a smooth window, and the algorithm can be as follows:

[0127]

[0128]

[0129] Among them, instance time series data can refer to the service traffic data generated by the aforementioned instances through multiplexing the current VIP; the definition of the growth interval of each instance can be determined by analyzing the instance traffic curve, for example, the interval from the beginning of the rise to the end of the rise is used as the growth interval. When searching for the first falling interval, since the sequence data is arranged in reverse order, the growth interval of the instance close to the alarm point can be used as the found interval; and for filtering the valid interval, the valid growth interval can be filtered out mainly according to the increase, and the interval with too small increase can be filtered. The purpose of reverse arranging the instance growth interval is mainly to find the first instance according to the reverse order of the traffic increase, so as to further determine whether the instance is a diagnosis result, that is, whether it is an abnormal instance.

[0130] In the embodiment of the present application, the positioning method based on the simulated artificial rules may not cover some scenarios, which may lead to the failure of the diagnosis based on the artificial rules. Fig.11 , shows an example schematic diagram of a diagnosis failure based on a simulated artificial rule provided by an embodiment of the present application. For example, assuming Fig.11 (A) shows the current VIP inflow in the past hour. Fig.11 (B) shows the inflow trend of the top 10 instances that passed through the VIP in the past hour. It can be seen that there are 3 suspicious instances, but since the water levels are close, rule-based diagnosis will fail.

[0131] Based on Figure 8 The diagnosis shown fails, that is, when there is no abnormal instance whose traffic increase ratio exceeds the preset traffic range among the multiple abnormal instances at the top of the service traffic sequence, the diagnosis can be continued using the similarity-based algorithm positioning method. That is, if the above method cannot successfully locate the abnormal instance, the similarity algorithm can be used to calculate the similarity of the service traffic and the abnormal virtual address respectively to determine the abnormal instance.

[0132] Specifically, it can be manifested as obtaining the virtual address traffic of the first abnormal virtual address and the service traffic of each cloud service instance using the first abnormal virtual address, and then calculating the similarity between the virtual address traffic of the first abnormal virtual address and the service traffic of each cloud service instance using the first abnormal virtual address to obtain multiple traffic similarity results; and determining the abnormal instance corresponding to a certain traffic similarity result among the multiple traffic similarity results that exceeds other traffic similarity results as the target abnormal instance.

[0133] VIP traffic can be an approximate superposition of multi-service traffic data, for example, Fig.11 As shown, the similarity of a VIP water level sequence, such as the time series of the first abnormal VIP, and the water level sequences of each instance of the VIP, such as instance 1, instance 2, and instance 3, can be calculated respectively to obtain the instance with the greatest similarity. Specifically, the process may include normalizing the sequence, calculating the cSBD distance between the sequences, and then arranging the calculated cSBD distances in ascending order, taking the instance at the first position in the arranged sequence as the Top1 instance, and then judging whether the cSBD distance of the Top1 instance is less than the cSBD threshold. If its cSBD distance is less than the cSBD threshold, it means that the abnormal instance is successfully located, and the Top1 instance can be determined as the target abnormal instance; if its cSBD distance is not less than the cSBD threshold, the location of the abnormal instance fails. It should be noted that the calculation process of the sequence similarity can refer to the above-mentioned related content, and the embodiments of the present application will not be repeated here.

[0134] In a preferred embodiment of the present application, if the above method cannot successfully locate the abnormal instance, the service traffic sequence that is close to the change trend of the abnormal virtual address timing sequence can be found according to the similarity calculation algorithm to determine the abnormal instance. The embodiment of the present application is not limited to this.

[0135] In an embodiment of the present application, while obtaining the first abnormal virtual address, the second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address can be obtained, and the first abnormal virtual address and the second abnormal virtual address obtained can be merged to obtain an abnormal virtual address set, and then the target cloud service instance that causes the traffic anomaly of each abnormal virtual address in the abnormal virtual address set can be located based on the service traffic of each cloud service instance. By merging the abnormal virtual addresses that generate alarms in the same time period, and determining the target cloud service instance that causes the traffic anomaly of the abnormal virtual address after the alarm merger, a one-time positioning of abnormal instances of multiple abnormal virtual addresses with similar abnormal traffic is achieved, without the need to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance, so as to quickly determine the instance that causes the increase in virtual website traffic.

[0136] Reference Fig.13 , shows a schematic diagram of the framework of the alarm system provided in an embodiment of the present application. The alarm system 1310 may include an alarm detection module 131 and an intelligent diagnosis module 132.

[0137] Among them, the alarm system 1310 can realize the detection of abnormal VIPs and the location process of abnormal instances, which can be specifically manifested as follows:

[0138] Detecting the abnormal virtual address where an alarm occurs based on the alarm detection module 131 and generating an alarm instruction;

[0139] The intelligent diagnosis module 132 responds to the alarm instruction, merges the first abnormal virtual address and the second abnormal virtual address that alarmed in the same time period to obtain an abnormal virtual address set, and determines the target abnormal instance of the abnormal virtual address set based on the service traffic of each cloud service instance obtained. Among them, the target abnormal instance can be used to indicate the cloud service instance that caused the traffic anomaly of each abnormal virtual address in the abnormal virtual address set, that is, at this time, by merging the abnormal virtual addresses that alarmed in the same time period, and determining the target cloud service instance that caused the traffic anomaly of the abnormal virtual address after the alarm merger, it is possible to realize the one-time positioning of the abnormal instances of multiple abnormal virtual addresses with similar abnormal traffic, without the need to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance, so as to quickly determine the instance that caused the increase of virtual website traffic.

[0140] In practical applications, the automatic location of abnormal instances by the intelligent diagnosis module 132 can be mainly realized based on the triggering of the intelligent diagnosis module, which can be automatically triggered by the upstream alarm data or manually triggered. The upstream alarm data can refer to abnormal VIPs, that is, the relevant data of VIPs whose traffic exceeds the safety threshold.

[0141] Reference Fig.14 , shows a schematic diagram of the application scenario of the traffic diagnosis of the cloud service instance provided by the embodiment of the present application, and the application scenario can be expressed as the process of performing intelligent diagnosis after the intelligent diagnosis module is triggered. Specifically, it can be expressed as a dual combination of the four-layer data used to indicate the virtual address traffic and the seven-layer data used to indicate the service traffic, and the positioning of the abnormal instance based on rules and algorithms at the same time. Because it relies on the two-layer factors of virtual address traffic and service traffic, it can simulate the artificial rule positioning process that meets the characteristics of cloud services, and introduce intelligent algorithms to solve the situation where the manual positioning cannot cover the scene.

[0142] The specific automated diagnosis process can be implemented through the following code:

[0143]

[0144] The specific implementation process can refer to the contents of the above method embodiment part, and the embodiments of the present application will not be described in detail here.

[0145] In the embodiment of the present application, by merging the abnormal virtual addresses that have alarmed in the same time period, and determining the target cloud service instance that caused the abnormal traffic to occur in the abnormal virtual addresses after the alarm is merged, it is possible to locate the abnormal instances of multiple abnormal virtual addresses with similar abnormal traffic at one time, without having to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance, thereby reducing the number of diagnoses, and quickly determining the instance that caused the increase in virtual website traffic, thereby improving the diagnostic efficiency. Furthermore, based on the fusion analysis of the four-layer data used to indicate the virtual address traffic and the seven-layer data used to indicate the service traffic, and the dual combination of locating the abnormal instance based on rules and algorithms at the same time, since it relies on the two-layer factors of virtual address traffic and service traffic, it is possible to locate the instance that actually causes the traffic anomaly while simulating the artificial rule positioning process that meets the characteristics of cloud services, and introducing an intelligent algorithm to solve the situation where the artificial positioning cannot cover the scene, so as to avoid the problem of difficulty in locating which of the similar instances caused the traffic anomaly when there are instances with similar traffic. In addition, the diagnostic scheme proposed in the embodiment of the present application can be applied to the alarm system, and the diagnostic process is automatically executed after being triggered by the intelligent diagnostic module in the alarm system based on the alarm data. The entire process does not require human intervention and can automatically locate abnormal instances, thereby achieving the purpose of improving execution efficiency.

[0146] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0147] Reference Fig.15 , shows a structural block diagram of a traffic diagnosis device embodiment of a cloud service instance of the present application, which may specifically include the following modules:

[0148] The abnormal virtual address acquisition module 1501 is used to acquire a first abnormal virtual address, and acquire a second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address; wherein the abnormal virtual address is used to indicate a virtual address of traffic abnormality;

[0149] An abnormal virtual address merging module 1502 is used to merge the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set;

[0150] The target abnormal instance positioning module 1503 is used to obtain the service traffic of each cloud service instance, and determine the target abnormal instance of the abnormal virtual address set based on the service traffic; the target abnormal instance is used to indicate the cloud service instance that causes the traffic abnormality of each abnormal virtual address in the abnormal virtual address set.

[0151] In one embodiment of the present application, the abnormal virtual address merging module 1502 may include the following submodules:

[0152] The abnormal virtual address merging submodule is used to obtain the first time series of the first abnormal virtual address and the second time series of the second abnormal virtual address; calculate the similarity between the first time series and the second time series, and merge the first abnormal virtual address and the second abnormal virtual address according to the similarity to obtain an abnormal virtual address set.

[0153] In one embodiment of the present application, the abnormal virtual address merging submodule may include the following units:

[0154] The abnormal virtual address merging unit is used to calculate the constraint shape distance between the first time series and the second time series; if the constraint shape distance is less than a preset distance threshold, the first abnormal virtual address and the second abnormal virtual address are merged.

[0155] In one embodiment of the present application, the abnormal virtual address merging unit may include the following sub-units:

[0156] The abnormal virtual address merging subunit is used to normalize the first time series and the second time series; move the second time series on the first time series a preset number of times based on a preset shift range; obtain multiple shifted time series after the second time series is shifted a preset number of times; and calculate the constraint shape distance of the shifted time series and the first time series respectively according to a preset algorithm.

[0157] In one embodiment of the present application, the service traffic includes multiple service traffic for each cloud service instance; the target abnormal instance location module 1503 may include the following submodules:

[0158] The target abnormal instance positioning submodule is used to arrange the multiple service flows in reverse order according to the flow size to obtain a service flow sequence, and obtain the abnormal instance that is at the first position in the service flow sequence; if the number of abnormal instances at the first position in the service flow sequence is one, then determine that the abnormal instance at the first position is the target abnormal instance; and / or, if the number of abnormal instances at the first position in the service flow sequence is multiple, then obtain the actual flow proportion of the multiple abnormal instances at the first position in the service flow sequence, and determine the target abnormal instance according to the flow proportion.

[0159] In one embodiment of the present application, determining the target abnormal instance of the abnormal virtual address set according to the traffic proportion includes:

[0160] If, among the multiple abnormal instances at the top of the service traffic sequence, there is an abnormal instance in which the actual traffic ratio exceeds the preset traffic difference ratio, then the abnormal instance is determined to be the target abnormal instance; and / or, if, among the multiple abnormal instances at the top of the service traffic sequence, there is no abnormal instance in which the actual traffic ratio exceeds the preset traffic difference ratio, then the traffic increase rates of the multiple abnormal instances at the top of the service traffic sequence are obtained, and the target abnormal instance is determined based on the traffic increase rate information.

[0161] Among them, if there is an abnormal instance whose traffic increase ratio exceeds a preset traffic range among the multiple abnormal instances located at the first position of the service traffic sequence, then the abnormal instance is determined to be the target abnormal instance; if there is no abnormal instance whose traffic increase ratio exceeds the preset traffic range among the multiple abnormal instances located at the first position of the service traffic sequence, then the virtual address traffic of the first abnormal virtual address and the service traffic of each cloud service instance using the first abnormal virtual address are obtained; the similarity between the virtual address traffic of the first abnormal virtual address and the service traffic of each cloud service instance using the first abnormal virtual address is calculated to obtain multiple traffic similarity results; the abnormal instance corresponding to a certain traffic similarity result among the multiple traffic similarity results that exceeds other traffic similarity results is determined as the target abnormal instance.

[0162] In the embodiment of the present application, the traffic diagnosis device of the cloud service instance provided in the embodiment of the present application can obtain the second abnormal virtual address that alarms in the same time period as the first abnormal virtual address while obtaining the first abnormal virtual address, and merge the obtained first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set, and then locate the target cloud service instance that causes the traffic anomaly of each abnormal virtual address in the abnormal virtual address set based on the service traffic of each cloud service instance. By merging the abnormal virtual addresses that alarm in the same time period, and determining the target cloud service instance that causes the traffic anomaly of the abnormal virtual address after the alarm merger, it is possible to locate the abnormal instance of a one-time abnormal instance for multiple abnormal virtual addresses with similar abnormal traffic, without having to perform multiple relocation operations on multiple abnormal virtual addresses caused by the same abnormal instance, so as to quickly determine the instance that causes the increase in virtual website traffic.

[0163] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0164] The present application also provides an electronic device, including:

[0165] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the traffic diagnosis method embodiment of the above-mentioned cloud service instance are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0166] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the traffic diagnosis method embodiment of the above-mentioned cloud service instance are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0167] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0168] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0172] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0173] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0174] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0175] The above is a detailed introduction to the traffic diagnosis method of a cloud service instance provided by the present application, a corresponding alarm system, a corresponding electronic device and a corresponding computer-readable storage medium. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A traffic diagnosis method for a cloud service instance, characterized in that: The method comprises: Acquire a first abnormal virtual address, and acquire a second abnormal virtual address that generates an alarm in the same time period as the first abnormal virtual address; wherein the abnormal virtual address is used to indicate a virtual address of traffic abnormality; Merging the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set; The service traffic of each cloud service instance is obtained, and the target abnormal instance of the abnormal virtual address set is determined based on the service traffic; the target abnormal instance is used to indicate the cloud service instance that causes the traffic abnormality of each abnormal virtual address in the abnormal virtual address set.

2. The method according to claim 1, characterized in that The step of merging the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set includes: Acquire a first time series of the first abnormal virtual address and a second time series of the second abnormal virtual address; The similarity between the first time series and the second time series is calculated, and the first abnormal virtual address and the second abnormal virtual address are merged according to the similarity to obtain an abnormal virtual address set.

3. The method according to claim 2, characterized in that The calculating the similarity between the first time series and the second time series, and merging the first abnormal virtual address and the second abnormal virtual address according to the similarity, comprises: calculating a constrained shape distance between the first time series and the second time series; If the constraint shape distance is less than a preset distance threshold, the first abnormal virtual address and the second abnormal virtual address are merged.

4. The method according to claim 3, characterized in that The calculating the constrained shape distance between the first time series and the second time series comprises: performing normalization processing on the first time series and the second time series; Moving the second time series on the first time series a preset number of times based on a preset shift range; Acquire a plurality of shifted time series after the second time series is shifted during a preset number of shifts; According to a preset algorithm, the constrained shape distances of the shifted time series and the first time series are calculated respectively.

5. The method according to claim 1, characterized in that The service traffic includes a plurality of service traffics for each cloud service instance; and determining the target abnormal instance of the abnormal virtual address set based on the service traffic includes: Arrange the multiple service flows in reverse order according to flow size to obtain a service flow sequence, and obtain the abnormal instance that is at the first position in the service flow sequence; If the number of the abnormal instance at the first position in the service traffic sequence is one, determining the abnormal instance at the first position as the target abnormal instance; And / or, if there are multiple abnormal instances at the first position in the service traffic sequence, the actual traffic proportions of the multiple abnormal instances at the first position in the service traffic sequence are obtained, and the target abnormal instance is determined according to the traffic proportions.

6. The method according to claim 5, characterized in that The determining, according to the traffic proportion, a target abnormal instance of the abnormal virtual address set includes: If there is an abnormal instance whose actual traffic ratio exceeds a preset traffic difference ratio among the multiple abnormal instances at the first position of the service traffic sequence, the abnormal instance is determined to be the target abnormal instance; And / or, if there is no abnormal instance in which the actual traffic ratio exceeds the preset traffic difference ratio among the multiple abnormal instances at the top of the service traffic sequence, the traffic increase rate of the multiple abnormal instances at the top of the service traffic sequence is obtained, and the target abnormal instance is determined based on the traffic increase rate information.

7. The method according to claim 6, characterized in that The step of determining a target abnormal instance of the abnormal virtual address set according to the traffic increase includes: If there is an abnormal instance whose traffic increase ratio exceeds a preset traffic range among the multiple abnormal instances located at the first position of the service traffic sequence, the abnormal instance is determined to be the target abnormal instance.

8. The method according to claim 7, characterized in that Also includes: If there is no abnormal instance whose traffic increase ratio exceeds a preset traffic range among the multiple abnormal instances at the first position of the service traffic sequence, then obtaining the virtual address traffic of the first abnormal virtual address and the service traffic of each cloud service instance using the first abnormal virtual address; Calculating similarities between virtual address traffic of the first abnormal virtual address and service traffic of each cloud service instance using the first abnormal virtual address to obtain multiple traffic similarity results; An abnormal instance corresponding to a certain traffic similarity result among the multiple traffic similarity results that exceeds other traffic similarity results is determined as the target abnormal instance.

9. An alarm system, characterized in that: The alarm system comprises: an alarm detection module and an intelligent diagnosis module; The alarm detection module is used to detect the abnormal virtual address where the alarm occurs and generate an alarm instruction; wherein the abnormal virtual address is used to indicate the virtual address of the traffic abnormality, and the abnormal virtual address includes a first abnormal virtual address and a second abnormal virtual address where the alarm occurs in the same time period as the first abnormal virtual address; The intelligent diagnosis module is used to respond to the alarm instruction, merge the first abnormal virtual address and the second abnormal virtual address to obtain an abnormal virtual address set; and obtain the service traffic of each cloud service instance, and determine the target abnormal instance of the abnormal virtual address set based on the service traffic, wherein the target abnormal instance is used to indicate the cloud service instance that causes the traffic abnormality of each abnormal virtual address in the abnormal virtual address set.

10. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the traffic diagnosis method of the cloud service instance as described in any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the traffic diagnosis method of the cloud service instance as described in any one of claims 1 to 8 is implemented.

Images