IP recovery method, system and device for regional service interruption and medium

Abstract

The invention discloses an IP recovery method, system and device for regional service interruption and a medium, and the method specifically comprises the steps: carrying out the global IP address detection of a target domain name according to a distributed detector, obtaining a detection result, analyzing all IP addresses in the detection result, and determining a currently available optimal IP address; monitoring the service state of the optimal IP address currently bound with the target domain name in real time, and if the service state is determined to be service interruption, determining a new optimal IP address according to the detection result; carrying out atomization modification on a local Hosts file, and binding the target domain name to a new optimal IP address; after the local Hosts file is modified, availability verification is carried out on the target domain name through a local detector, and whether the new optimal IP address is available or not is determined. By automatically detecting and switching the IP address, the service interruption time is remarkably shortened, and the service availability is improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to an IP recovery method, system, device and medium for regional service interruption. Background Art

[0002] With the rapid development of Internet technology, more and more services and applications rely on global domain name resolution and IP access. However, regional service interruptions have become increasingly prominent and have become a key factor affecting Internet service continuity and user experience. Such interruptions may be caused by a variety of reasons, including but not limited to the unavailability of third-party domain name services, network failures, or server maintenance.

[0003] When regional service outages occur, users often cannot access critical services, which not only leads to a sharp decline in user experience, but can also cause significant business losses. For example, when domain name resolution issues occur for globally renowned services such as Facebook, Google, or Apple, a large number of users will be unable to access these services, which in turn affects various business scenarios that rely on these services.

[0004] Traditional solutions usually rely on the intervention of service providers. When a service outage occurs, users must wait for the service provider to discover and resolve the problem, which may take dozens of minutes or even longer. This passive waiting method not only prolongs the time it takes to restore the service, but also increases the risk of business loss.

[0005] To address this problem, the industry has been exploring more efficient and reliable solutions. However, most existing solutions have limitations and cannot quickly restore services in a short period of time. For example, some solutions rely on backup domain name systems or redundant servers, but these solutions often require complex configuration and deployment before service interruptions occur, and may be subject to various restrictions in actual applications. Summary of the invention

[0006] The purpose of the present invention is to provide an IP recovery method, system, device and medium for regional service interruption, which significantly reduces the service interruption time and improves the service availability by automatically detecting and switching IP addresses, so as to solve at least one of the above-mentioned prior art problems.

[0007] In a first aspect, the present invention provides an IP recovery method for regional service interruption, the method specifically comprising:

[0008] Performing global IP address detection on the target domain name according to the distributed detector to obtain detection results, and determining the currently available optimal IP address by analyzing all IP addresses in the detection results;

[0009] Monitor the service status of the optimal IP address currently bound to the target domain name in real time, and if it is determined that the service status is service interruption, determine a new optimal IP address according to the detection result;

[0010] By atomically modifying the local Hosts file, the target domain name is bound to the new optimal IP address;

[0011] After modifying the local Hosts file, the availability of the target domain name is verified through a local detector to determine whether the new optimal IP address is available.

[0012] In a second aspect, the present invention provides an IP recovery system for regional service interruption, the system specifically comprising:

[0013] The first recovery module is used to perform global IP address detection on the target domain name according to the distributed detector to obtain the detection result, and determine the currently available optimal IP address by analyzing all IP addresses in the detection result;

[0014] A second recovery module is used to monitor the service status of the optimal IP address currently bound to the target domain name in real time, and if it is determined that the service status is service interruption, determine a new optimal IP address according to the detection result;

[0015] A third recovery module is used to bind the target domain name to a new optimal IP address by atomically modifying the local Hosts file;

[0016] The fourth recovery module is used to verify the availability of the target domain name through a local detector after modifying the local Hosts file to determine whether the new optimal IP address is available.

[0017] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor and a computer program stored in the memory, and when the computer program is executed on the processor, an IP recovery method for regional service interruption as described in any one of the above methods is implemented.

[0018] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for IP recovery of regional service interruption as described in any one of the above methods is implemented.

[0019] Compared with the prior art, the present invention has at least one of the following technical effects:

[0020] 1. The present invention significantly reduces service interruption time and improves service availability by automatically detecting and switching IP addresses.

[0021] 2. The present invention can restore business in a short time, reduce business losses, and improve user experience by actively avoiding abnormal nodes and quickly switching to other available area entrances.

[0022] 3. Through active detection and real-time monitoring, the present invention can detect service interruptions in a short time and switch to other available regional entrances, thereby greatly improving response efficiency and reducing downtime.

[0023] 4. The present invention adopts the method of atomically modifying the local Hosts file to ensure that no additional service interruption or data loss will be caused when switching the IP address.

[0024] 5. When determining the optimal IP address, the present invention comprehensively considers multiple dimensions such as reachability, average delay and network stability, and uses weighted average method or K-Means clustering algorithm for evaluation, so as to ensure that the selected optimal IP address has the best service quality.

[0025] 6. The present invention provides an IP address switchback process and a service interruption assessment model, which can automatically switch back after the original optimal IP address is restored, and determine the service recovery method according to the cause of the service interruption, thereby further improving the reliability and continuity of the service. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 It is a flow chart of an IP recovery method for regional service interruption provided by an embodiment of the present invention;

[0028] Figure 2 It is a structural diagram of an IP recovery system for regional service interruption provided by an embodiment of the present invention;

[0029] Figure 3 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0031] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0032] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0033] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0034] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0035] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0036] In the embodiment of the present application, the execution subject of the process includes a terminal device, which includes but is not limited to: a server, a computer, a smart phone, a tablet computer, and other devices capable of executing the method disclosed in the present application. Figure 1 A flow chart of an IP recovery method for regional service interruption disclosed in an embodiment of the present invention is shown, and the details are as follows:

[0037] S101, performing global IP address detection on a target domain name according to a distributed detector to obtain a detection result, and determining a currently available optimal IP address by analyzing all IP addresses in the detection result.

[0038] In this embodiment, multiple distributed detectors are deployed globally, especially in areas with large user traffic. These detectors can be deployed in data centers, cloud service providers, network nodes, etc. When any user visits a domain name, the domain name is set as the target domain name, and the distributed detector is used to perform global IP address detection on the domain name. The detector obtains multiple IP addresses corresponding to the target domain name by sending a DNS query request.

[0039] Collect the detection results of all detectors and summarize all IP addresses of the target domain name. Perform reachability tests on these IP addresses to ensure that they can respond to ICMP echo requests (such as the ping command). Further test the average latency and network stability of each reachable IP address, calculate the latency by sending data packets and measuring the round-trip time, and evaluate the network stability by observing the fluctuation of latency over a period of time.

[0040] Assign an availability score to each IP address based on dimensions such as reachability, average latency, and network stability. Use the weighted average method or other appropriate algorithms to calculate the comprehensive score of each IP address. Sort all IP addresses by score from high to low, and select the IP address with the highest score as the currently available optimal IP address.

[0041] In this embodiment, by detecting the IP address of the target domain name globally and selecting the optimal IP address for access, the availability of the service can be significantly improved.

[0042] In some embodiments, in the above step S101, analyzing all IP addresses in the detection result to determine the currently available optimal IP address specifically includes:

[0043] For each IP address in the detection result, an availability evaluation is performed from multiple dimensions to obtain an evaluation result, wherein the dimensions include reachability, average delay, and network stability;

[0044] Determine a preset weight for each dimension, and based on the evaluation result and the preset weight, calculate the availability score of each IP address using a weighted average method;

[0045] Sort the availability scores of all IP addresses to obtain a list of available IP addresses;

[0046] The IP address with the highest availability score is determined according to the available IP list, and the IP address with the highest availability score is determined as the currently available optimal IP address.

[0047] In this embodiment, each IP address in the detection result is obtained, and for each IP address, the dimensions such as reachability, average delay and network stability are evaluated to obtain the evaluation results of each dimension; the preset weights of each dimension such as reachability, average delay and network stability are determined, and the preset weights are used as the initial weights of the neural network model; the evaluation results of each dimension of the IP address are used as the input of the neural network, and the neural network model is optimized by training to obtain the optimized weights of each dimension; the weighted average method is used to multiply the evaluation results of each IP address in each dimension with the corresponding optimized dimension weights, and the sum is obtained to obtain the availability score of each IP address. The availability score is used as the sorting basis, and the IP addresses are sorted in descending order to obtain a sorted IP address list, and the optimal IP address is determined according to the sorting of the IP address list.

[0048] Exemplarily, the availability of each IP address in the detection result is evaluated from three dimensions: accessibility, average delay, and network stability. Accessibility is obtained through Ping detection. If the ping is successful, the accessibility is 1, otherwise it is 0; the average delay is averaged through multiple Ping detections in milliseconds; the network stability is obtained by calculating the packet loss rate through multiple Ping detections over a period of time. If the packet loss rate is less than 5%, the network stability is high. Determine the preset weight of each dimension, such as accessibility weight 4, average delay weight 35, and network stability weight 25, and calculate the availability score of the IP address based on the evaluation results and preset weights using the weighted average method. For example, if the accessibility of an IP address is 1, the average delay is 20ms, and the network stability corresponds to a packet loss rate of 3%, then its availability score = 1×4+(100-20)×35+(100-3)×25=875 points. Quickly sort the availability scores of all IP addresses to obtain an available IP list. Finally, determine the IP address with the highest availability score based on the available IP list and determine it as the currently available optimal IP address. If there are multiple IP addresses with the highest availability score, one can be randomly selected as the optimal IP address. Through the above process, multiple key performance indicators of the IP address are comprehensively considered, the quantitative availability score is calculated, and the importance of each indicator is balanced through the weighted average model. Finally, the optimal IP address with the highest availability is obtained for subsequent network communication tasks to ensure communication quality and stability.

[0049] In some embodiments, in the above step S101, analyzing all IP addresses in the detection result to determine the currently available optimal IP address specifically includes:

[0050] For each IP address in the detection result, use the ping command to test the reachability and record the response time;

[0051] If the response time is less than a preset response time threshold, the corresponding IP address is added to the available IP address group;

[0052] According to the reachability and response time of each IP address in the available IP address group, a K-Means clustering algorithm is used for analysis, and the similarity between IP addresses is calculated using the Euclidean distance, and IP addresses with similar response times are grouped into one category to obtain a plurality of clusters;

[0053] In each cluster, the IP address corresponding to the center point is selected as the optimal IP address of the cluster to form a candidate IP address group;

[0054] Obtain delay data between the target domain name and each candidate IP address in the optimal IP address group, and determine a currently available optimal IP address according to the delay data.

[0055] In this embodiment, all IP addresses in the detection result are obtained, and for each IP address, the ping command is used to test its reachability, and the response time of the ping command is recorded. It is determined whether the ping command response time of each IP address is less than the preset response time threshold. If it is less than the threshold, the IP address is added to the available IP address group. According to the two attributes of reachability and response time of each IP address in the available IP address group, the K-Means clustering algorithm is used for analysis, and the similarity between IP addresses is measured by calculating the Euclidean distance between them, and IP addresses with similar response times are clustered into one category, and finally several clustering results are obtained. In each clustering result, the IP address corresponding to the cluster center point is selected as the optimal IP address of the class, and all the optimal IP addresses are formed into a candidate IP address group. The network delay data between the target domain name and each IP address in the candidate IP address group is obtained, and the round-trip delay from the target domain name to each candidate IP address is tested by the ping command. According to the network delay data, the candidate IP address group is sorted, and the IP address with the smallest delay time is considered to be the currently available optimal IP address. The currently available optimal IP address is returned as the final business processing result for use in subsequent business processes. This IP address can access the target domain name with the lowest network latency, ensuring the efficiency and availability of the business.

[0056] Exemplarily, for each IP address in the detection result, the ping command is used to test the reachability and record the response time. If the response time is less than the preset 200ms threshold, the corresponding IP address is added to the available IP address group. For example, the IP address list obtained by detecting a target domain name is 19161, 19162, and 19163. After the ping test, the response time is 150ms, 250ms, and 180ms, respectively, then 19161 and 19163 are added to the available IP address group. According to the reachability (1 or 0) and response time of each IP address in the available IP address group, the K-Means clustering algorithm is used for analysis. With the reachability and response time of the IP address as the feature vector, the similarity between the IP addresses is calculated by the Euclidean distance, the number of clusters K=3 is set, and the cluster center is iteratively optimized until the clustering result is stable. Finally, IP addresses with similar response times are clustered into one category to obtain several clusters. In each cluster, the IP address closest to the cluster center is selected as the optimal IP address of the class to form a candidate IP address group. Next, obtain the delay data between the target domain name and each candidate IP address in the optimal IP address group, and calculate the average delay value through multiple tests at different time points. For example, the candidate IP address group is 19161, 19161, and 19161. After 10 delay tests, their average delays with the target domain name are 50ms, 80ms, and 60ms, respectively. According to the delay data, 19161, which currently has the lowest average delay, is determined as the optimal IP address for subsequent network communication tasks to obtain a faster and more stable access experience. Through the above process, the accessibility, response time, cluster analysis, and multiple delay tests of the IP address are comprehensively considered, and the IP address with the best delay is finally selected to ensure communication efficiency and quality.

[0057] S102, monitoring the service status of the optimal IP address currently bound to the target domain name in real time, and if it is determined that the service status is service interruption, determining a new optimal IP address according to the detection result.

[0058] In this embodiment, a professional network monitoring tool is used to monitor the optimal IP address currently bound to the target domain name in real time. The monitoring indicators include but are not limited to HTTP response status code, response time, connection success rate, etc., and reasonable thresholds are set. When the monitoring indicators exceed the threshold, a service interruption alarm is triggered. When a service interruption alarm is received, further diagnosis and analysis are performed immediately. By sending a probe request, it is verified whether the optimal IP address currently bound to the target domain name is indeed inaccessible. If multiple consecutive probes fail and the reason for the failure meets the characteristics of the service interruption (such as the HTTP response status code is 5xx or the connection timed out), the service is determined to be interrupted. Review the detection results previously obtained through distributed detectors. Re-evaluate the availability of the remaining IP addresses based on dimensions such as reachability, average latency, and network stability. Select the IP address with the highest availability score as the new optimal IP address.

[0059] In this embodiment, through real-time monitoring and rapid determination, quick action can be taken when a service interruption occurs, which helps to reduce the impact of the service interruption on users and improve the availability and reliability of the service.

[0060] S103, binding the target domain name to the new optimal IP address by atomically modifying the local Hosts file.

[0061] In this embodiment, through the previous steps, it has been determined that the IP address currently bound to the target domain name has a service interruption, and a new optimal IP address is selected based on the detection results. According to the operating system type (such as Windows, Linux, macOS), the path of the local Hosts file is determined. For example, in a Windows system, the Hosts file is usually located in C:\Windows\System32\drivers\etc\hosts.

[0062] Before making any changes, back up the current Hosts file to prevent unexpected situations during the modification process from causing file corruption. In Linux or macOS systems, you can take advantage of the atomicity of the mv (move / rename) command to first create a temporary file with the new content, and then use the mv command to rename it to the original Hosts file. In Windows systems, although the atomicity of the mv command is not as good as that of Linux systems, atomic operations can be simulated by writing scripts or using third-party tools (such as PowerShell scripts). The specific method is to first read the original Hosts file content, add the new domain name and IP address pair to the content (or replace the original record), and then write the modified content to a temporary file. Finally, use the atomic replacement function of the file system (such as through the MoveFileEx function) to replace the temporary file with the original Hosts file. After the modification is completed, verify whether the target domain name has been successfully bound to the new optimal IP address through command-line tools (such as ping or nslookup).

[0063] If there are other services or applications in the system that rely on Hosts file parsing, they need to be notified to update or restart accordingly, and record the time, reason, new and old IP addresses of the modification, etc. for subsequent auditing and troubleshooting.

[0064] In this embodiment, by timely binding the target domain name to the new optimal IP address, degradation of user experience or business loss due to service interruption is avoided, thereby enhancing the stability of the system.

[0065] In some embodiments, in the above step S103, the target domain name is bound to the new optimal IP address by atomically modifying the local Hosts file, specifically including:

[0066] Generate a Hosts mapping rule according to the target domain name and the new optimal IP address, and send the Hosts mapping rule to the local DNS service;

[0067] The Hosts mapping rule is verified for legitimacy using a preset verification rule. If the legitimacy verification is passed, the local Hosts file is atomically modified through the local DNS service to bind the target domain name to a new optimal IP address.

[0068] In this embodiment, a Hosts mapping rule is generated based on the detected target domain name and the new optimal IP address, and the Hosts mapping rule is sent to the local DNS service through a secure communication protocol, and the Hosts mapping rule is verified for legitimacy using a preset regular expression verification rule to check whether the format of the domain name and IP address meets the standard. If the verification is passed, the local Hosts file is modified through the local DNS service using the atomic file write operation to bind the target domain name to the new optimal IP address. It is ensured that the file will not be interfered with by other processes during the file writing process to ensure data consistency. After the modification is completed, the local DNS service automatically loads the updated Hosts file to make it effective. When the client requests to access the target domain name, the local DNS service will first parse it according to the mapping relationship in the Hosts file, and point the request to the optimal IP address to improve access speed and stability. The entire process is executed through an automated script without manual intervention, ensuring real-time updating and effectiveness of the Hosts mapping rule.

[0069] S104, after modifying the local Hosts file, verify the availability of the target domain name through a local detector to determine whether the new optimal IP address is available.

[0070] In this embodiment, a local detector is configured to perform availability verification. The local detector can be a simple script or tool for sending HTTP requests to the target domain name and checking key indicators such as response status code and response time. Use the configured local detector to verify the availability of the target domain name. This usually includes sending a series of HTTP requests to the target domain name, collecting response data, and recording key information such as response status code, response time, and response content of each request. According to the defined verification rules, the response data is analyzed to determine whether the new optimal IP address is available. According to the results of the availability verification, it is determined whether the new optimal IP address is available. If the verification is successful, that is, the new IP address meets the availability requirements, the current Hosts file configuration remains unchanged. If the verification fails, the IP address detection and selection process needs to be repeated. The results of the availability verification are recorded in the log for subsequent auditing and troubleshooting. If the verification fails, the Hosts file needs to be updated to use other available IP addresses and the availability verification needs to be repeated.

[0071] In this embodiment, by verifying the availability of the target domain name through the local detector, it can be ensured that the new optimal IP address is available in actual use, thereby avoiding service interruption caused by unavailable IP address.

[0072] In some embodiments, the method further comprises:

[0073] Regularly detect the original optimal IP address;

[0074] If the HTTP response status code of the original optimal IP address is detected as a preset value for a consecutive preset number of times, and the average response time is less than the preset average response time threshold, it is determined that the original optimal IP address has been restored;

[0075] Obtain service quality data of the new optimal IP address and the original optimal IP address, and determine whether to perform an IP address switching back process for the target domain name by comparing the service quality data between the new optimal IP address and the original optimal IP address.

[0076] In this embodiment, the HTTP response status code and average response time data of the original optimal IP address are regularly obtained according to a preset time interval. It is determined whether the HTTP response status code of the original optimal IP address is equal to the preset value within a preset number of consecutive times, and whether the average response time is less than the preset threshold. If the above conditions are met, it is determined that the original optimal IP address has been restored, and the service quality data of the new optimal IP address is obtained at the same time. The service quality data of the new and old optimal IP addresses are compared through the support vector machine algorithm, including indicators such as HTTP response success rate and average response time. The decision tree algorithm is used to determine whether to trigger the IP address switching back process of the target domain name based on the service quality comparison result. If it is determined that switching back is required, the DNS resolution record of the target domain name is obtained, and the IP address therein is replaced with the original optimal IP address. After the modification is completed, the DNS resolution record of the target domain name is republished to achieve the switching back of the IP address, thereby ensuring the continuity and service quality of user access.

[0077] In some embodiments, the method further comprises:

[0078] Obtain the number of request failures, request intervals, and historical interruption pattern monitoring data of the IP address bound to the target domain name to form a service interruption detection data set;

[0079] The service interruption detection data set is input as an input feature, a random forest model is trained, and a service interruption detection model is obtained;

[0080] The service interruption probability of the optimal IP address currently bound to the target domain name is determined according to the service interruption detection model, and whether a service interruption occurs between the target domain name and the optimal IP address currently bound to it is determined by comparing the service interruption probability with a preset interruption probability threshold.

[0081] In this embodiment, the number of request failures, request interval time and historical interruption regularity monitoring data of the target domain name bound to the IP address are obtained to construct a service interruption detection data set. The service interruption detection data set is divided into a training set and a test set. The training set is used to train the random forest model, and the test set is used to evaluate the model performance. The grid search and cross-validation methods are used to optimize the hyperparameters of the random forest model to obtain the optimal service interruption detection model. Using the trained service interruption detection model, the relevant data of the current IP address bound to the target domain name is predicted to obtain its service interruption probability. A preset interruption probability threshold is set. If the service interruption probability is greater than the threshold, it is determined that a service interruption occurs between the target domain name and its current bound IP address. If a service interruption occurs, an alarm mechanism is triggered to notify relevant personnel to handle it, and the backup IP address is started to take over the service. The number of request failures and request interval time of the target domain name bound to the IP address are continuously monitored, the service interruption detection data set is updated in real time, and the service interruption detection model is retrained regularly to adapt to business changes.

[0082] Exemplarily, first, the system will obtain the number of request failures, request intervals, and historical interruption law monitoring data of the IP address bound to the target domain name to form a service interruption detection data set. For example, the system can collect the number of request failures and the average request interval of the IP address bound to the target domain name in the past month, as well as the duration of each service interruption in the past year, the change trend of the number of request failures before the interruption, etc., to form a multi-dimensional data set. Next, the data set is used as an input feature, and the random forest algorithm is used for model training to obtain a service interruption detection model. The random forest algorithm can effectively process high-dimensional data and reduce the risk of overfitting by constructing multiple decision trees and integrating their results. During the training process, the system divides the data set, with 80% of the data used for training and 20% for verification, and optimizes the model hyperparameters through grid search and other methods, and finally obtains a service interruption detection model with excellent performance. In the application stage, the system uses the model to predict the service interruption probability of the optimal IP address currently bound to the target domain name. The model will comprehensively consider the recent number of request failures, the change trend of the request interval, and the historical interruption law of the IP address, and give an interruption probability value between 0 and 1. If the probability value exceeds the preset interruption probability threshold (such as 0.8), it is determined that a service interruption may have occurred between the target domain name and the current IP address, and the system will start the corresponding fault handling process; if it is lower than the threshold, the service is considered to be running normally. Through the above process, the system can monitor the service status between the target domain name and the bound IP in real time, promptly identify potential service interruption risks, and take measures to ensure the availability and continuity of the service. This intelligent operation and maintenance method based on machine learning can significantly improve the system's automation level and fault handling efficiency, and reduce the need for manual intervention.

[0083] In some embodiments, the method further comprises:

[0084] Collect the interruption reasons and various abnormal indicator data when the service is interrupted to form a service interruption assessment data set;

[0085] Inputting the service interruption assessment data set into a decision tree model for training to obtain a service interruption assessment model;

[0086] The optimal IP address where the service interruption has occurred is analyzed according to the service interruption assessment model to determine the cause of the service interruption, and a service recovery method is determined according to the cause of the service interruption.

[0087] In this embodiment, the abnormal indicator data during service interruption is obtained, and data cleaning and standardization processing are performed for each indicator to obtain a standardized service interruption evaluation data set. The service interruption evaluation data set is randomly divided into a training set and a test set, the training set is used to train the decision tree model, and the test set is used to evaluate the model performance. The decision tree classification model is constructed using the ID3 algorithm, and parameters such as the information gain threshold and the maximum depth of the tree are set. The model is trained and optimized using the training set data to obtain a service interruption evaluation model. According to the IP address where the service interruption has occurred, the abnormal indicator data corresponding to the address is extracted to form the data to be analyzed. The data to be analyzed is input into the trained service interruption evaluation model for prediction and classification, and the specific cause of the service interruption of the IP address is determined to obtain the interruption cause classification result. For different interruption cause classification results, the pre-set service recovery method knowledge base is matched to obtain the corresponding recovery plan. The obtained service recovery plan is sent to the server node where the faulty IP address is located, and the recovery operation is performed through the automated operation and maintenance tool to achieve rapid recovery of the service.

[0088] Exemplarily, when a service interruption occurs, the system automatically collects interruption causes and abnormal indicator data, such as the number of request failures, response time, CPU occupancy, etc., to form a service interruption assessment data set. The data set contains 1,000 historical interruption cases, each with 20 characteristic indicators. The data set is randomly divided into a training set and a test set, of which the training set accounts for 80% and the test set accounts for 20%. The decision tree model is trained using the CART algorithm, and the optimal parameters are obtained through grid search, including a maximum tree depth of 10 and a minimum number of leaf node samples of 5. When a service interruption occurs at an optimal IP address, its related indicator data is input into the service interruption assessment model for analysis. The model outputs the probability distribution of the interruption cause by weight calculation and path reasoning of each characteristic indicator, such as a server failure probability of 80%, a network failure probability of 15%, and a system bug probability of 5%. According to the highest probability cause, the system automatically determines the corresponding recovery method, such as restarting the server, switching to a backup network, rolling back the version, etc., and executes an automated recovery script to restore the service as quickly as possible. At the same time, the system will also record information such as the duration of the interruption and the number of users affected for subsequent service optimization and prevention.

[0089] Reference Figure 2 An embodiment of the present invention provides an IP recovery system 2 for regional service interruption, and the system 2 specifically includes:

[0090] The first recovery module 201 is used to perform global IP address detection on the target domain name according to the distributed detector to obtain the detection result, and determine the currently available optimal IP address by analyzing all IP addresses in the detection result;

[0091] The second recovery module 202 is used to monitor the service status of the optimal IP address currently bound to the target domain name in real time, and if it is determined that the service status is service interruption, determine a new optimal IP address according to the detection result;

[0092] The third recovery module 203 is used to bind the target domain name to the new optimal IP address by atomically modifying the local Hosts file;

[0093] The fourth recovery module 204 is used to verify the availability of the target domain name through a local detector after modifying the local Hosts file to determine whether the new optimal IP address is available.

[0094] It is understandable that if Figure 1 The contents of the IP recovery method for regional service interruption shown in the embodiment are applicable to the IP recovery system embodiment for regional service interruption. The functions specifically implemented by the IP recovery system embodiment for regional service interruption are similar to those in the embodiment shown in the embodiment. Figure 1The IP recovery method embodiment of the regional service interruption shown in FIG. 1 is the same as that shown in FIG. 1 , and the beneficial effects achieved are the same as those achieved in FIG. Figure 1 The beneficial effects achieved by the illustrated embodiment of the IP recovery method for regional service interruption are also the same.

[0095] It should be noted that the information interaction, execution process and other contents between the above-mentioned systems are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0096] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0097] Reference Figure 3 The embodiment of the present invention further provides a computer device 3, comprising: a memory 302 and a processor 301 and a computer program 303 stored in the memory 302. When the computer program 303 is executed on the processor 301, the IP recovery method for regional service interruption as described in any one of the above methods is implemented.

[0098] The computer device 3 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of computer device 3 and does not constitute a limitation on computer device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, etc.

[0099] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0100] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 3. Further, the memory 302 may also include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, an application program, a boot loader (Boot Loader), data, and other programs, such as the program code of the computer program, etc. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0101] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for IP recovery of regional service interruption as described in any one of the above methods is implemented.

[0102] In this embodiment, if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0103] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0104] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0105] In the embodiments disclosed in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0106] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Claims

1. A method for restoring an IP address during a regional service interruption, characterized in that: The method specifically comprises: Performing global IP address detection on the target domain name according to the distributed detector to obtain detection results, and determining the currently available optimal IP address by analyzing all IP addresses in the detection results; Monitor the service status of the optimal IP address currently bound to the target domain name in real time, and if it is determined that the service status is service interruption, determine a new optimal IP address according to the detection result; By atomically modifying the local Hosts file, the target domain name is bound to the new optimal IP address; After modifying the local Hosts file, the availability of the target domain name is verified through a local detector to determine whether the new optimal IP address is available.

2. The method according to claim 1, characterized in that The step of analyzing all IP addresses in the detection result to determine the currently available optimal IP address specifically includes: For each IP address in the detection result, an availability evaluation is performed from multiple dimensions to obtain an evaluation result, wherein the dimensions include reachability, average delay, and network stability; Determine a preset weight for each dimension, and based on the evaluation result and the preset weight, calculate the availability score of each IP address using a weighted average method; Sort the availability scores of all IP addresses to obtain a list of available IP addresses; The IP address with the highest availability score is determined according to the available IP list, and the IP address with the highest availability score is determined as the currently available optimal IP address.

3. The method according to claim 1, characterized in that The step of analyzing all IP addresses in the detection result to determine the currently available optimal IP address specifically includes: For each IP address in the detection result, use the ping command to test the reachability and record the response time; If the response time is less than a preset response time threshold, the corresponding IP address is added to the available IP address group; According to the reachability and response time of each IP address in the available IP address group, a K-Means clustering algorithm is used for analysis, and the similarity between IP addresses is calculated using the Euclidean distance, and IP addresses with similar response times are grouped into one category to obtain a plurality of clusters; In each cluster, the IP address corresponding to the center point is selected as the optimal IP address of the cluster to form a candidate IP address group; Obtain delay data between the target domain name and each candidate IP address in the optimal IP address group, and determine a currently available optimal IP address according to the delay data.

4. The method according to claim 1, characterized in that: The target domain name is bound to the new optimal IP address by atomically modifying the local Hosts file, specifically including: Generate a Hosts mapping rule according to the target domain name and the new optimal IP address, and send the Hosts mapping rule to the local DNS service; The Hosts mapping rule is verified for legitimacy using a preset verification rule. If the legitimacy verification is passed, the local Hosts file is atomically modified through the local DNS service to bind the target domain name to a new optimal IP address.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Regularly detect the original optimal IP address; If the HTTP response status code of the original optimal IP address is detected as a preset value for a consecutive preset number of times, and the average response time is less than the preset average response time threshold, it is determined that the original optimal IP address has been restored; Obtain service quality data of the new optimal IP address and the original optimal IP address, and determine whether to perform an IP address switching back process for the target domain name by comparing the service quality data between the new optimal IP address and the original optimal IP address.

6. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Obtain the number of request failures, request intervals, and historical interruption pattern monitoring data of the IP address bound to the target domain name to form a service interruption detection data set; The service interruption detection data set is input as an input feature, a random forest model is trained, and a service interruption detection model is obtained; The service interruption probability of the optimal IP address currently bound to the target domain name is determined according to the service interruption detection model, and whether a service interruption occurs between the target domain name and the optimal IP address currently bound to it is determined by comparing the service interruption probability with a preset interruption probability threshold.

7. The method according to claim 6, characterized in that The method further comprises: Collect the interruption reasons and various abnormal indicator data when the service is interrupted to form a service interruption assessment data set; Inputting the service interruption assessment data set into a decision tree model for training to obtain a service interruption assessment model; The optimal IP address where the service interruption has occurred is analyzed according to the service interruption assessment model to determine the cause of the service interruption, and a service recovery method is determined according to the cause of the service interruption.

8. An IP recovery system for regional service interruption, characterized in that: The system specifically comprises: The first recovery module is used to perform global IP address detection on the target domain name according to the distributed detector to obtain the detection result, and determine the currently available optimal IP address by analyzing all IP addresses in the detection result; A second recovery module is used to monitor the service status of the optimal IP address currently bound to the target domain name in real time, and if it is determined that the service status is service interruption, determine a new optimal IP address according to the detection result; A third recovery module is used to bind the target domain name to a new optimal IP address by atomically modifying the local Hosts file; The fourth recovery module is used to verify the availability of the target domain name through a local detector after modifying the local Hosts file to determine whether the new optimal IP address is available.

9. A computer device, characterized in that: include: A memory and a processor and a computer program stored in the memory, when the computer program is executed on the processor, implements the IP recovery method for regional service interruption as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the IP recovery method for regional service interruption as claimed in any one of claims 1 to 7 is implemented.

Images