Abnormality detection method and device, electronic equipment and computer readable medium

Abstract

The invention discloses an anomaly detection method and device, electronic equipment and a computer readable medium, and relates to the technical field of computers.The specific implementation mode comprises the steps that an anomaly detection request is received, and a debugging tool is called to obtain a target function call chain; generating a probe function based on the target function call chain and a preset step length; determining each detection point in the target function call chain, and executing the probe function to obtain the function call time of each detection point; determining a first abnormal range according to the function calling time, and determining a second abnormal range according to the probe function and the first abnormal range; and obtaining a function call chain logic between the detection points corresponding to the second abnormal range, and determining an abnormal type based on the function call chain logic. Therefore, the anomaly detection efficiency and accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an anomaly detection method, device, electronic device and computer-readable medium. Background Art

[0002] At present, performance is a very important factor for most applications, especially for applications directly accessed by users, such as websites and mobile apps, because poor performance will directly affect their user experience. The response time of the database is crucial to the application. As an important part of the application response time, database response time monitoring becomes very important, which will help us find the database performance bottleneck and optimize it. In the current monitoring system, there are application monitoring and database monitoring, but the current monitoring system's level of detail in monitoring the database response time is average, and it is impossible to locate the specific location and line of the database that is slow, making it difficult to locate and troubleshoot complex performance problems. Summary of the invention

[0003] In view of this, the embodiments of the present application provide an anomaly detection method, device, electronic device and computer-readable medium, which can solve the problem that the current monitoring system has a general level of detail in monitoring the database response time, cannot locate the specific location and function line of the database that is slow, and has difficulty in locating and troubleshooting complex performance problems.

[0004] To achieve the above-mentioned purpose, according to one aspect of an embodiment of the present application, there is provided an exception detection method, including: receiving an exception detection request, calling a debugging tool to obtain a target function call chain; generating a probe function based on the target function call chain and a preset step size; determining each detection point in the target function call chain, executing the probe function to obtain the function call time of each detection point; determining a first exception range according to the function call time, and determining a second exception range according to the probe function and the first exception range; obtaining the function call chain logic between the detection points corresponding to the second exception range, and determining the exception type based on the function call chain logic.

[0005] Optionally, generating the probe function includes: taking out a function at every preset step length in the target function call chain, and making the taken out function into the probe function.

[0006] Optionally, determining each detection point in the target function call chain includes: determining each unique function in the target function call chain as each detection point.

[0007] Optionally, determining the first abnormal range includes: determining a range formed by detection points corresponding to a function call time greater than a first preset threshold as the first abnormal range.

[0008] Optionally, determining the second abnormal range includes: calculating the step length between the probe function in the first abnormal range and each detection point in the first abnormal range; and determining the range formed by the detection points corresponding to the step length that is smaller than a second preset threshold as the second abnormal range.

[0009] Optionally, determining the exception type based on the function call chain logic includes: locating the performance exception function call point based on the function call chain logic; and determining the exception type based on the performance exception function call point.

[0010] In addition, the present application also provides an exception detection device, including: a receiving unit, configured to receive an exception detection request, and call a debugging tool to obtain a target function call chain; a generating unit, configured to generate a probe function based on the target function call chain and a preset step size; an executing unit, configured to determine each detection point in the target function call chain, and execute the probe function to obtain the function call time of each detection point; a range determination unit, configured to determine a first exception range according to the function call time, and determine a second exception range according to the probe function and the first exception range; an exception type determination unit, configured to obtain the function call chain logic between the detection points corresponding to the second exception range, and determine the exception type based on the function call chain logic.

[0011] Optionally, the generating unit is further configured to: take out a function at every preset step length in the target function call chain, and make the taken out function into a probe function.

[0012] Optionally, the execution unit is further configured to: determine each unique function in the target function call chain as each detection point.

[0013] Optionally, the range determination unit is further configured to: determine a range formed by detection points corresponding to a function call time greater than a first preset threshold as a first abnormal range.

[0014] Optionally, the range determination unit is further configured to: calculate the step length between the probe function in the first abnormal range and each detection point in the first abnormal range; and determine the range formed by the detection points corresponding to the step length that is smaller than a second preset threshold as the second abnormal range.

[0015] Optionally, the exception type determination unit is further configured to: locate the performance exception function call point based on the function call chain logic; and determine the exception type based on the performance exception function call point.

[0016] In addition, the present application also provides an anomaly detection electronic device, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the one or more processors implement the anomaly detection method as described above.

[0017] In addition, the present application also provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned anomaly detection method is implemented.

[0018] To achieve the above objective, according to another aspect of the embodiments of the present application, a computer program product is provided.

[0019] A computer program product according to an embodiment of the present application includes a computer program, and when the program is executed by a processor, the anomaly detection method provided by the embodiment of the present application is implemented.

[0020] One embodiment of the above invention has the following advantages or beneficial effects: the present application receives an exception detection request, calls a debugging tool to obtain a target function call chain; generates a probe function based on the target function call chain and a preset step size; determines each detection point in the target function call chain, executes the probe function to obtain the function call time of each detection point; determines a first exception range based on the function call time, determines a second exception range based on the probe function and the first exception range; obtains the function call chain logic between the detection points corresponding to the second exception range, and determines the exception type based on the function call chain logic. Thus, the efficiency and accuracy of exception detection can be improved.

[0021] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to better understand the present application and do not constitute an improper limitation on the present application.

[0023] Figure 1 is a schematic diagram of the main process of an abnormality detection method according to an embodiment of the present application;

[0024] Figure 2 is a schematic diagram of the main process of an abnormality detection method according to an embodiment of the present application;

[0025] Figure 3 It is a schematic diagram of the main process of an abnormality detection method according to an embodiment of the present application;

[0026] Figure 4 is a schematic diagram of main units of an abnormality detection device according to an embodiment of the present application;

[0027] Figure 5 is an exemplary system architecture diagram to which the embodiments of the present application can be applied;

[0028] Figure 6 It is a structural diagram of a computer system of a terminal device or server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0029] The following is an explanation of the exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of known functions and structures is omitted in the following description. It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of the present application are in compliance with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of the present application, certain software, components, models, and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or must have used the solution. In the technical solution of the present application, the collection, collection, update, analysis, processing, use, transmission, storage, etc. of the user personal information involved are in compliance with the provisions of relevant laws and regulations, are used for legal and reasonable purposes, and do not violate public order and good customs, are not shared, leaked or sold outside these legal uses, and are subject to supervision and management by regulatory authorities. Take necessary measures to prevent illegal access to such user personal information data, maintain the security of user personal information, network security and national security, ensure that persons who have access to personal information data comply with relevant laws and regulations, and ensure the security of user personal information. Once such user personal information data is no longer needed, the risk should be minimized by limiting or even prohibiting data collection and / or deleting data.

[0030] When used, including in certain related applications, user privacy is protected by de-identifying data, such as by removing specific identifiers when used, controlling the amount or specificity of data stored, controlling how data is stored, and / or other methods of de-identification.

[0031] Figure 1 is a schematic diagram of the main process of the abnormality detection method according to an embodiment of the present application, such as Figure 1 As shown, the anomaly detection method mainly includes the following steps S101 to S105.

[0032] Step S101, receiving an exception detection request, and calling a debugging tool to obtain a target function call chain.

[0033] In this embodiment, the execution subject of the anomaly detection method (for example, it can be a server) can receive the anomaly detection request by wired connection or wireless connection. The anomaly detection request can be a request for detecting the performance anomaly of the program. After receiving the anomaly detection request, the execution subject can call a debugging tool, for example, a gdb debugging tool, wherein gdb, debugger (Debugger) is also called a debugging program, a debugging tool, and refers to a computer program and tool for debugging other programs, used to debug the code and find positioning problems. The target function call chain is obtained by calling the debugging tool. Specifically, the target function call chain can be all function call chains corresponding to the application identifier carried in the anomaly detection request, which is used to detect the anomalies that may be generated by the performance of the application corresponding to the application identifier. There are various functions available for call in the target function call chain.

[0034] Step S102, generating a probe function based on the target function call chain and the preset step size.

[0035] The preset step size may be every n steps, where n may be a positive integer, and the embodiment of the present application does not specifically limit the value of n. In the target function call chain, a function is selected every preset step size, and the selected function is made into a probe function. The probe function is used to count the function call time of the function to be monitored.

[0036] Step S103, determining each detection point in the target function call chain, and executing the probe function to obtain the function call time of each detection point.

[0037] Each detection point in the target function call chain may be a unique function in the target function call chain. The execution subject may allocate detection points in the target function call chain to be monitored for each probe function, and then execute each probe function to obtain the function call time of each monitored detection point, wherein the function call time may be the function call duration from when the function is triggered to when the function is successfully called.

[0038] Step S104, determining a first abnormal range according to the function call time, and determining a second abnormal range according to the probe function and the first abnormal range.

[0039] Specifically, determining the first abnormal range includes: determining a range formed by detection points corresponding to a function call time greater than a first preset threshold as the first abnormal range.

[0040] The first preset threshold may be 5 minutes or 7 minutes. The first preset threshold may be determined according to user configuration. The first preset threshold is not specifically limited in the embodiment of the present application. The execution subject may determine the range of detection points corresponding to the function call time greater than the first preset threshold as the first abnormal range based on the function call time of each detection point obtained. The first abnormal range may be, for example, between the first detection point and the fifth detection point.

[0041] Specifically, determining the second abnormal range includes: calculating the step length between the probe function in the first abnormal range and each detection point in the first abnormal range; and determining the range formed by the detection points corresponding to the step length that is smaller than a second preset threshold as the second abnormal range.

[0042] For example, the execution entity may determine the range formed by the detection points closest to the probe function in the first abnormal range as the second abnormal range, thereby narrowing the abnormality determination range, accelerating the abnormality detection speed and improving the abnormality detection accuracy.

[0043] Step S105, obtaining the function call chain logic between the detection points corresponding to the second exception range, and determining the exception type based on the function call chain logic.

[0044] Specifically, determining the exception type based on the function call chain logic includes: locating the performance exception function call point based on the function call chain logic; and determining the exception type based on the performance exception function call point.

[0045] For example, the execution subject may compare the function call chain logic between the detection points corresponding to the second abnormal range with the function call chain logic corresponding to normal performance to determine the logic difference, and determine the position of the logic difference in the function call chain logic between the detection points corresponding to the second abnormal range as the performance abnormal function call point. And by matching with the preset abnormal type list, the abnormal type corresponding to the performance abnormal function point is determined.

[0046] This embodiment receives an exception detection request, calls a debugging tool to obtain a target function call chain; generates a probe function based on the target function call chain and a preset step size; determines each detection point in the target function call chain, executes the probe function to obtain the function call time of each detection point; determines a first exception range based on the function call time, determines a second exception range based on the probe function and the first exception range; obtains the function call chain logic between the detection points corresponding to the second exception range, and determines the exception type based on the function call chain logic. This can improve the efficiency and accuracy of exception detection.

[0047] Figure 2 FIG. 1 is a schematic diagram of the main process of an abnormality detection method according to an embodiment of the present application. Figure 2As shown, the anomaly detection method mainly includes the following steps S201 to S205.

[0048] Step S201, receiving an exception detection request, and calling a debugging tool to obtain a target function call chain.

[0049] The execution subject can obtain the application type identifier carried in the anomaly detection request, and call the corresponding debugging tool according to the application type identifier to obtain all function call chains corresponding to the application type identifier, that is, the target function call chain.

[0050] Step S202, taking out a function in the target function call chain at every preset step length, and making the taken out function into a probe function.

[0051] The preset step size can be determined based on the target performance and stability. After the execution subject takes out a function in the target function call chain according to the preset step size, the function can be bound to a function with a probe function to generate a probe function. When a function taken out in the target function call chain according to the preset step size is triggered, the function with a probe function bound to the function is inserted into the kernel or user process from here to detect the function call time of the monitored function. Thereby, the function call time can be accurately counted without affecting the target function call chain.

[0052] Step S203: determine each unique function in the target function call chain as each detection point, and execute the probe function to obtain the function call time of each detection point.

[0053] The execution subject can determine each unique function in the target function call chain as each detection point. The unique function refers to the function in the target function call chain that realizes the uniqueness of the function through the function name and parameter list. The execution subject can assign the detection point in the target function call chain that needs to be monitored to each probe function, and then execute each probe function to obtain the function call time of each monitored detection point, wherein the function call time can be the function call duration from the time the function is triggered to the time the function is successfully called.

[0054] Step S204, determining a first abnormal range according to the function call time, and determining a second abnormal range according to the probe function and the first abnormal range.

[0055] The second abnormal range is smaller than the first abnormal range and can more accurately determine the abnormal logic.

[0056] Step S205, obtaining the function call chain logic between the detection points corresponding to the second exception range, and determining the exception type based on the function call chain logic.

[0057] The execution subject may execute the function call chain logic between the detection points corresponding to the second exception range multiple times, compare the multiple execution results, and then accurately determine the exception type according to the comparison results.

[0058] Figure 3 FIG. 1 is a schematic diagram of the main flow of an abnormality detection method according to an embodiment of the present application. Figure 3 As shown, when performing anomaly detection, the function call chain is first summarized, and then a probe function is generated based on the summarized function call chain. After the probe function is generated, the probe function is executed, and statistical data after the execution of the probe function is generated. Then, based on the statistical data, the performance abnormal function call points are summarized and output. If there is a next function call chain, the probe function of the next function call chain is generated, and the probe function is executed to generate statistical data, summarize and output the performance abnormal function call points, and if there is no next function call chain, the anomaly detection is ended.

[0059] In the embodiments of the present application, probe script: an executable script generated based on the function call stack, which can detect and monitor the corresponding function stack after execution. SystemTap: SystemTap is a dynamic tracing tool under Linux (similar to DTrace under Solaris), which can easily monitor and track running programs or Linux kernel operations, output performance data or debugging information that users are concerned about, and help us understand where system performance is consumed, so as to optimize it in a targeted manner. APM: Application Performance Monitoring (APM) is the monitoring and management of application performance and availability. APM strives to detect and diagnose complex application performance problems to maintain expected service levels.

[0060] For example, we first use the automated gdb debugging tool to pre-sort the function call chain, analyze and summarize it, and then automatically generate the systemtap probe function through the script. Then we run the probe function online to detect and count the database, summarize the function call statistics, and output the problem call chain code. Among them, gdb, debugger (Debugger) is also called debugging program, debugging tool, refers to a computer program and tool used to debug other programs, used to debug code, find and locate problems. SystemTap is a dynamic tracking tool that can easily monitor and track running programs or Linux kernel operations, output performance data or debugging information that users are concerned about, and help us understand where system performance is consumed, so as to optimize in a targeted manner.

[0061] The specific method steps are as follows: (1) rely on gdb to output the entire function call chain of the sql to be diagnosed; (2) extract all unique functions in the entire call chain (herein referred to as stubs). The stub in the embodiment of the present application, that is, the detection point, is a certain event point monitored by the program. Once the detected event is triggered, it will be inserted into the kernel or user process from here; (3) extract a stub every n times to make it into a stap probe function (do not have too many stubs, the purpose is to improve performance and stability); (4) load the stap probe script into the memory as a kernel module, monitor the trigger time of each stub and execute the corresponding probe logic (this (5) Execute the corresponding diagnostic SQL to perform function call time statistics and output the function that consumes the most time; (6) Further narrow the pile range. Previously, one was taken every n piles. This step is to lock the problem to the nearest pile. Specifically, the problem is locked to the most accurate code segment. For example, the problem code segment locked for the first time is between the 1st and 5th detection points. After narrowing down, it can be located between the 4th and 5th detection points. Directly checking this code is faster and more accurate; (7) Find the entire function call chain based on the minimum range pile, and check the function call chain logic here to lock the problem.

[0062] After online detection and monitoring, the database function call chain can be tracked and detected in real time, the time statistics can be accurate to microseconds, the function content is detailed, the readability is strong, and the function stack can be flexibly customized to dynamically generate detection scripts. In this application, the automated gdb debugging tool and the collected and summarized function call chain, the detailed function call chain is the basis of monitoring and detection, and is also the result of long-term accumulation. The more detailed the function call chain, the more refined the monitoring, and the more significant the effect. The automatically generated probe function, the probe function is a monitoring program for the function call chain, which can be used directly and includes a function stack.

[0063] By monitoring and tracking the database function stack call link, the real-time statistics of each function call time are summarized and output to generate a function call link diagram, helping database operation and maintenance, R&D personnel, etc. to quickly locate the function call points with performance anomalies and go deep into the source code to view the cause of the problem. This is direct, transparent, and fast. It makes up for the shortcomings of the existing monitoring system in the statistics of database function stack call time. It truly builds full-link monitoring without blind spots.

[0064] Figure 4 Schematic diagram of the main units of the abnormality detection device according to an embodiment of the present application. Figure 4 As shown, the abnormality detection device 400 includes a receiving unit 401, a generating unit 402, an executing unit 403, a range determining unit 404 and an abnormality type determining unit 405.

[0065] The receiving unit 401 is configured to receive an exception detection request and call a debugging tool to obtain a target function call chain.

[0066] The generating unit 402 is configured to generate a probe function based on the target function call chain and a preset step size.

[0067] The execution unit 403 is configured to determine each detection point in the target function call chain and execute the probe function to obtain the function call time of each detection point.

[0068] The range determination unit 404 is configured to determine a first abnormal range according to the function call time, and determine a second abnormal range according to the probe function and the first abnormal range.

[0069] The exception type determination unit 405 is configured to obtain the function call chain logic between the detection points corresponding to the second exception range, and determine the exception type based on the function call chain logic.

[0070] In some embodiments, the generation unit 402 is further configured to: extract a function in the target function call chain at every preset step length, and make the extracted function into a probe function.

[0071] In some embodiments, the execution unit 403 is further configured to: determine each unique function in the target function call chain as each detection point.

[0072] In some embodiments, the range determination unit 404 is further configured to: determine a range formed by detection points corresponding to a function call time greater than a first preset threshold as a first abnormal range.

[0073] In some embodiments, the range determination unit 404 is further configured to: calculate the step length between the probe function in the first abnormal range and each detection point in the first abnormal range; and determine the range formed by the detection points corresponding to the step length that is less than the second preset threshold as the second abnormal range.

[0074] In some embodiments, the exception type determination unit 405 is further configured to: locate the performance exception function call point based on the function call chain logic; and determine the exception type based on the performance exception function call point.

[0075] It should be noted that the anomaly detection method and the anomaly detection device of the present application have a corresponding relationship in terms of specific implementation contents, so the repeated contents will not be described again.

[0076] Figure 5 An exemplary system architecture 500 to which the anomaly detection method or anomaly detection device according to the embodiment of the present application can be applied is shown.

[0077] like Figure 5As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0078] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0079] The terminal devices 501 , 502 , and 503 may be various electronic devices having an abnormality detection processing screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0080] Server 505 can be a server that provides various services, such as a background management server that provides support for the exception detection request submitted by the user using terminal devices 501, 502, and 503 (only as an example). The background management server can receive the exception detection request, call the debugging tool to obtain the target function call chain; generate a probe function based on the target function call chain and the preset step size; determine each detection point in the target function call chain, execute the probe function to obtain the function call time of each detection point; determine the first exception range according to the function call time, and determine the second exception range according to the probe function and the first exception range; obtain the function call chain logic between the detection points corresponding to the second exception range, and determine the exception type based on the function call chain logic. This can improve the efficiency and accuracy of exception detection.

[0081] It should be noted that the anomaly detection method provided in the embodiment of the present application is generally executed by the server 505 , and accordingly, the anomaly detection device is generally arranged in the server 505 .

[0082] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0083] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present application. Figure 6 The terminal device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0084] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0085] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0086] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present application are executed.

[0087] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. Computer-readable storage media may include, for example, but are not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0088] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0089] The units involved in the embodiments described in the present application may be implemented by software or hardware. The units described may also be arranged in a processor, for example, it may be described as follows: a processor includes a receiving unit, a generating unit, an executing unit, a range determining unit, and an exception type determining unit. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0090] As another aspect, the present application also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device receives an exception detection request, calls a debugging tool to obtain a target function call chain; generates a probe function based on the target function call chain and a preset step size; determines each detection point in the target function call chain, executes the probe function to obtain the function call time of each detection point; determines a first exception range according to the function call time, and determines a second exception range according to the probe function and the first exception range; obtains the function call chain logic between the detection points corresponding to the second exception range, and determines the exception type based on the function call chain logic.

[0091] The computer program product of the present application includes a computer program, and when the computer program is executed by a processor, the anomaly detection method in the embodiment of the present application is implemented.

[0092] According to the technical solution of the embodiment of the present application, the efficiency and accuracy of anomaly detection can be improved.

[0093] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. An anomaly detection method, characterized in that: include: Receive anomaly detection requests and call debugging tools to obtain the target function call chain; Generate a probe function based on the target function call chain and a preset step size; Determine each detection point in the target function call chain, and execute the probe function to obtain the function call time of each detection point; Determine a first abnormal range according to the function call time, and determine a second abnormal range according to the probe function and the first abnormal range; Obtain function call chain logic between detection points corresponding to the second exception range, and determine the exception type based on the function call chain logic.

2. The method according to claim 1, characterized in that The generating probe function comprises: In the target function call chain, a function is taken out at every preset step length, and the taken out function is made into a probe function.

3. The method according to claim 1, characterized in that Determining each detection point in the target function call chain includes: Each unique function in the target function call chain is determined as each detection point.

4. The method according to claim 1, characterized in that: Determining the first abnormal range includes: A range formed by detection points corresponding to a function call time greater than a first preset threshold is determined as a first abnormal range.

5. The method according to claim 1, characterized in that Determining the second abnormal range includes: Calculating the step length between the probe function in the first abnormal range and each detection point in the first abnormal range; The range formed by the detection points corresponding to the step lengths smaller than the second preset threshold in the step lengths is determined as the second abnormal range.

6. The method according to claim 1, characterized in that The determining the exception type based on the function call chain logic includes: Based on the function call chain logic, locate the function call point with abnormal performance; Based on the performance exception function call point, the exception type is determined.

7. An abnormality detection device, characterized in that: include: A receiving unit is configured to receive an exception detection request and call a debugging tool to obtain a target function call chain; A generating unit, configured to generate a probe function based on the target function call chain and a preset step size; An execution unit is configured to determine each detection point in the target function call chain, and execute the probe function to obtain the function call time of each detection point; a range determination unit configured to determine a first abnormal range according to the function call time, and determine a second abnormal range according to the probe function and the first abnormal range; The exception type determination unit is configured to obtain the function call chain logic between the detection points corresponding to the second exception range, and determine the exception type based on the function call chain logic.

8. The device according to claim 7, characterized in that The generating unit is further configured to: In the target function call chain, a function is taken out at every preset step length, and the taken out function is made into a probe function.

9. The device according to claim 7, characterized in that The execution unit is further configured to: Each unique function in the target function call chain is determined as each detection point.

10. An abnormality detection electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images