Data anomaly detection method and device for game server

Abstract

The embodiment of the invention provides a data anomaly detection method and device for a game server, and the method comprises the steps: obtaining a plurality of pieces of operation data in a game server group; performing primary anomaly detection on the plurality of operation data to obtain a primary anomaly detection result; under the condition that the primary anomaly detection result indicates that at least one piece of operation data in the multiple pieces of operation data meets the first anomaly condition, secondary anomaly detection is conducted on the at least one piece of operation data, and a secondary anomaly detection result is obtained; and under the condition that the secondary anomaly detection result indicates that the target operation data in the at least one piece of operation data meets the second anomaly condition, determining the target operation data as the abnormal operation data. By means of the method and device, the problem that the data anomaly detection efficiency of the game server is low is solved, and then the effect of improving the data anomaly detection efficiency of the game server is achieved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and more specifically, to a method and device for detecting data anomalies in a game server. Background Art

[0002] In the data anomaly detection scenario of the game server, it is usually not possible to quickly handle the faults that occur during operation. This is because the game server itself has high requirements for timeliness. If too much time and resources are consumed in the data anomaly detection process, although the accuracy of data anomaly detection can be guaranteed, it will lead to the problem of low efficiency of data anomaly detection of the game server. Therefore, there is a problem of low efficiency of data anomaly detection of the game server.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method and device for detecting data anomalies in a game server, so as to at least solve the problem of low efficiency in detecting data anomalies in a game server in the related art.

[0005] According to an embodiment of the present application, a data anomaly detection method for a game server is provided, comprising: acquiring multiple operating data within a game server group; performing a primary anomaly detection on the multiple operating data to obtain a primary anomaly detection result, wherein the primary anomaly detection is a comprehensive scan of the multiple operating data to preliminarily screen out possible abnormal data; when the primary anomaly detection result indicates that at least one operating data among the multiple operating data meets a first abnormal condition, performing a secondary anomaly detection on the at least one operating data to obtain a secondary anomaly detection result; when the secondary anomaly detection result indicates that target operating data among the at least one operating data meets a second abnormal condition, determining the target operating data as abnormal operating data.

[0006] According to another embodiment of the present application, a data anomaly detection device for a game server is provided, comprising: an acquisition unit, configured to acquire multiple operating data within a game server group; a first detection unit, configured to perform a primary anomaly detection on the multiple operating data to obtain a primary anomaly detection result, wherein the primary anomaly detection is a comprehensive scan of the multiple operating data to preliminarily screen out possible abnormal data; a second detection unit, configured to perform a secondary anomaly detection on the at least one operating data when the primary anomaly detection result indicates that at least one operating data among the multiple operating data meets a first abnormal condition to obtain a secondary anomaly detection result; and a determination unit, configured to determine the target operating data as abnormal operating data when the secondary anomaly detection result indicates that the target operating data among the at least one operating data meets a second abnormal condition.

[0007] In an exemplary embodiment, the above-mentioned first detection unit includes: an analysis module, which is used to perform a preliminary analysis of the above-mentioned multiple operating data for the above-mentioned one abnormality detection to obtain a preliminary analysis result; a first comparison module, which is used to use the data in the first database to perform data comparison with the data in the above-mentioned at least one candidate abnormal data to obtain a first comparison result when the above-mentioned preliminary analysis result indicates that the above-mentioned multiple operating data include at least one candidate abnormal data that meets the preliminary abnormal condition; a first determination module, which is used to determine the above-mentioned possible abnormal data as meeting the above-mentioned first abnormal condition when the above-mentioned first comparison result indicates that the above-mentioned at least one candidate abnormal data includes possible abnormal data.

[0008] In an exemplary embodiment, the first comparison module includes: a first comparison submodule, which is used to use the normal data in the first database to compare the data in the at least one candidate abnormal data to obtain the first comparison result; the first determination module includes: a first determination submodule, which is used to determine the possible abnormal data different from the normal data as meeting the first abnormal condition when the first comparison result indicates that the at least one candidate abnormal data includes possible abnormal data different from the normal data.

[0009] In an exemplary embodiment, the second detection unit comprises:

[0010] A second comparison module is used to use the data in the second database to compare the data in the at least one operating data to obtain a second comparison result; a second determination module is used to determine the target abnormal data as meeting the second abnormal condition when the second comparison result is used to indicate that the at least one operating data includes the target abnormal data.

[0011] In an exemplary embodiment, the above-mentioned second comparison module includes: a second comparison sub-module, which is used to use the false alarm data in the second database to perform data comparison with the data in the above-mentioned at least one operating data to obtain the above-mentioned second comparison result; the above-mentioned second determination module includes: a second determination sub-module, which is used to determine the above-mentioned target abnormal data different from the above-mentioned false alarm data as meeting the above-mentioned second abnormal condition when the above-mentioned second comparison result is used to indicate that the above-mentioned at least one operating data includes target abnormal data different from the above-mentioned false alarm data.

[0012] In an exemplary embodiment, the above-mentioned device also includes: a query unit, which is used to query the data in the third database for abnormal repair data that matches the above-mentioned abnormal operation data after the above-mentioned target operation data is determined as abnormal operation data; a first repair unit, which is used to perform abnormal repair on the game server where the above-mentioned abnormal operation data appears according to the above-mentioned abnormal repair data after the above-mentioned target operation data is determined as abnormal operation data, so as to obtain an abnormal repair result.

[0013] In an exemplary embodiment, in the event that the above-mentioned abnormal repair result fails, the above-mentioned device also includes at least one of the following: a second repair unit, used to respond to a remote repair instruction to remotely repair the game server where the above-mentioned abnormal operation data appears; a third repair unit, used to switch the account data in the above-mentioned game server where the above-mentioned abnormal operation data appears to a normally operating backup game server, and shut down the above-mentioned game server where the above-mentioned abnormal operation data appears.

[0014] In an exemplary embodiment, the above-mentioned device also includes: a review unit, which is used to review and analyze the cause of the occurrence, processing process, and processing result of the above-mentioned abnormal operation data after the above-mentioned target operation data is determined as abnormal operation data, and obtain a review analysis result if the above-mentioned abnormal operation data is successfully processed; a potential unit, which is used to determine the potential improvement points of the above-mentioned game server group through the above-mentioned review analysis results after the above-mentioned target operation data is determined as abnormal operation data, wherein the above-mentioned potential improvement points are the parts that exist in the above-mentioned game server group and may cause the above-mentioned abnormal operation data to appear, but have not been improved; an optimization unit, which is used to optimize the above-mentioned game server group according to the above-mentioned potential improvement points after the above-mentioned target operation data is determined as abnormal operation data.

[0015] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when running.

[0016] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0017] Through this application, a phased detection method is adopted to effectively deal with the problem of low efficiency of data anomaly detection of game servers caused by high timeliness requirements. Specifically:

[0018] First, multiple operating data within the game server group are obtained to lay the foundation for comprehensive monitoring. Next, the data is subjected to the first abnormality detection, and this step emphasizes comprehensiveness. By comprehensively scanning the acquired operating data, possible abnormal data is initially screened out, thus avoiding the time-consuming step of in-depth analysis of all data one by one. This preliminary screening mechanism can quickly locate potential problem areas and provide direction for subsequent detailed detection.

[0019] Subsequently, when the first anomaly detection result reveals that at least one running data satisfies the first anomaly condition, a secondary anomaly detection is performed on these possible anomaly data. The characteristic of this step is its targetedness. Unlike a comprehensive scan, the secondary detection focuses on in-depth analysis of the initially screened anomaly data. This targeted detection method can more accurately identify the real anomaly data while avoiding wasting time and resources on irrelevant data.

[0020] Finally, when the secondary anomaly detection results confirm that the target operation data meets the second anomaly condition, these data are determined to be abnormal operation data. The entire detection process adopts a hierarchical processing method, which not only ensures the accuracy of the detection, but also greatly improves the detection efficiency, thereby achieving the technical effect of improving the efficiency of data anomaly detection of game servers. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a schematic diagram of an application environment of a data anomaly detection method for a game server according to an embodiment of the present application;

[0022] Figure 2 is a flow chart of a data anomaly detection method for a game server according to an embodiment of the present application;

[0023] Figure 3 is a schematic diagram of a data anomaly detection method for a game server according to an embodiment of the present application;

[0024] Figure 4 is a schematic diagram of a data anomaly detection method for a game server according to an embodiment of the present application;

[0025] Figure 5is a schematic diagram of a data anomaly detection method for a game server according to an embodiment of the present application;

[0026] Figure 6 is a schematic diagram of a data anomaly detection method for a game server according to an embodiment of the present application;

[0027] Figure 7 is a schematic diagram of a data anomaly detection method for a game server according to an embodiment of the present application;

[0028] Figure 8 is a schematic diagram of a data anomaly detection method for a game server according to an embodiment of the present application;

[0029] Fig. 9 is a schematic diagram of a data anomaly detection method for a game server according to an embodiment of the present application;

[0030] Fig.10 It is a structural block diagram of a data anomaly detection device for a game server according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0033] The method embodiments provided in the embodiments of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 1 is a hardware structure block diagram of a server device of a method for detecting data anomalies in a game server according to an embodiment of the present application. Figure 1 As shown, the server device may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned server device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0034] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the data anomaly detection method of the game server in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the server device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0035] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0036] In this embodiment, a method for detecting data anomalies in a game server is provided. Figure 2 is a flow chart of a method for detecting data anomalies in a game server according to an embodiment of the present application. Figure 2 As shown, the process includes the following steps:

[0037] Step S202, obtaining a plurality of operation data in the game server group;

[0038] Step S204, performing an anomaly detection on the plurality of operating data to obtain an anomaly detection result, wherein the anomaly detection is to perform a comprehensive scan on the plurality of operating data to preliminarily screen out possible abnormal data;

[0039] Step S206, when the primary abnormality detection result indicates that at least one of the multiple operating data meets the first abnormality condition, a secondary abnormality detection is performed on the at least one operating data to obtain a secondary abnormality detection result;

[0040] Step S208: When the secondary abnormality detection result indicates that the target operating data in the at least one operating data meets the second abnormality condition, the target operating data is determined as abnormal operating data.

[0041] The execution subject of the above steps may be a server, a terminal, etc., but is not limited thereto.

[0042] In an exemplary embodiment, the operating data may refer to various data reflecting the operating status of the game server, including but not limited to CPU usage, memory consumption, disk I / O, network traffic, etc.

[0043] In an exemplary embodiment, primary anomaly detection may be a broad and preliminary screening process to identify data that may deviate from normal behavior by comparing it to a preset first anomaly condition (such as a threshold, range, or pattern).

[0044] In an exemplary embodiment, secondary anomaly detection may be a refined check of the initially screened abnormal candidate data, which uses more complex algorithms or models to verify whether the data is truly abnormal, and may consider factors such as the context and historical trends of the data.

[0045] In an exemplary embodiment, the first abnormality condition may be used for primary abnormality detection, which is a loose or basic abnormality determination standard. The second abnormality condition is used for secondary abnormality detection, which is more stringent or specific to ensure high accuracy of abnormality identification.

[0046] In an exemplary embodiment, abnormal operation data may refer to data points that are ultimately determined to be abnormal and may have a negative impact on the stability, performance, or security of the game server.

[0047] It should be noted that the description of this embodiment defines a process for anomaly detection on game server data. The process begins by obtaining multiple operating data within the game server group, which may include but are not limited to key performance indicators such as CPU usage, memory usage, network latency, and number of player connections. Next, these data will undergo two stages of anomaly detection: first, a comprehensive scanning anomaly detection to preliminarily screen out possible abnormal data; second, a secondary anomaly detection to conduct in-depth analysis of these potentially abnormal data.

[0048] To further illustrate, it is optional to assume that the game server group contains 10 servers, and each server monitors three operating data: CPU usage, memory usage, and network latency. In an anomaly detection, the system found that the CPU usage of three of the servers exceeded the preset 80% threshold (the first abnormal condition). Subsequently, the high CPU usage data of these three servers were sent to the secondary anomaly detection, two of which were confirmed to be caused by normal peaks in player activity, while the other showed irregular CPU surges accompanied by error messages in the system log, meeting the second abnormal condition (such as CPU usage continues to exceed 95% and specific errors appear in the system log). In the end, the relevant data of this server was marked as abnormal operating data.

[0049] Through the embodiments of the present application, a phased detection method is adopted to effectively deal with the problem of low efficiency of data anomaly detection of the game server caused by high timeliness requirements. Specifically:

[0050] First, multiple operating data within the game server group are obtained to lay the foundation for comprehensive monitoring. Next, the data is subjected to the first abnormality detection, and this step emphasizes comprehensiveness. By comprehensively scanning the acquired operating data, possible abnormal data is initially screened out, thus avoiding the time-consuming step of in-depth analysis of all data one by one. This preliminary screening mechanism can quickly locate potential problem areas and provide direction for subsequent detailed detection.

[0051] Subsequently, when the first anomaly detection result reveals that at least one running data satisfies the first anomaly condition, a secondary anomaly detection is performed on these possible anomaly data. The characteristic of this step is its targetedness. Unlike a comprehensive scan, the secondary detection focuses on in-depth analysis of the initially screened anomaly data. This targeted detection method can more accurately identify the real anomaly data while avoiding wasting time and resources on irrelevant data.

[0052] Finally, when the secondary anomaly detection results confirm that the target operation data meets the second anomaly condition, these data are determined to be abnormal operation data. The entire detection process adopts a hierarchical processing method, which not only ensures the accuracy of the detection, but also greatly improves the detection efficiency, thereby achieving the technical effect of improving the efficiency of data anomaly detection of game servers.

[0053] As an optional solution, an anomaly detection is performed on multiple operating data to obtain an anomaly detection result, including:

[0054] S1-1, performing a preliminary analysis of anomaly detection on multiple operating data to obtain preliminary analysis results;

[0055] S1-2, when the preliminary analysis result indicates that the plurality of operating data include at least one candidate abnormal data that meets the preliminary abnormal condition, using the data in the first database to perform data comparison with the data in the at least one candidate abnormal data to obtain a first comparison result;

[0056] S1-3: When the first comparison result indicates that at least one candidate abnormal data includes possible abnormal data, the possible abnormal data is determined to meet the first abnormal condition.

[0057] In an optional embodiment, preliminary analysis is the first stage of anomaly detection, and data is screened through preset preliminary abnormal conditions (such as thresholds, ranges, etc.) to find candidate abnormal data points.

[0058] In an optional embodiment, candidate abnormal data refers to data that preliminarily meets the abnormality determination conditions but has not been further verified.

[0059] In an optional embodiment, the first database is used as a comparison benchmark in an anomaly detection to provide a data set for comparison with the current operating data.

[0060] In an optional embodiment, data comparison is a process of comparing the similarities or differences between two sets of data through a specific algorithm or method to obtain a comparison result.

[0061] In an optional embodiment, the first comparison result is a conclusion drawn based on the data comparison process, and is used to determine which data points meet the conditions for further abnormality determination.

[0062] In an optional embodiment, possible abnormal data refers to data that is further confirmed in the data comparison stage to conform to certain abnormal characteristics or patterns.

[0063] In an optional embodiment, the first abnormal condition is a specific criterion for determining data abnormality that is set after comprehensive preliminary analysis and data comparison results.

[0064] It should be noted that this embodiment describes the specific execution steps and key concepts involved in "primary anomaly detection". In a primary anomaly detection, a plurality of operating data are firstly preliminarily analyzed, and then, based on the preliminary analysis results, the data in the first database are used for comparison, and finally possible abnormal data that meets the first abnormal condition is determined.

[0065] Optionally, the first database may contain multiple types of data, such as historical average data, normal behavior pattern data, industry standard data, etc. These data can provide a more comprehensive and accurate reference for anomaly detection. In addition, the data comparison method and algorithm can also be customized and optimized according to actual conditions to improve the accuracy and efficiency of anomaly detection.

[0066] To further illustrate, it is optional to assume that during the operation of a game server group, the system will regularly collect operating data such as the CPU usage and memory occupancy of each server. During the preliminary analysis stage of anomaly detection, the system found that the CPU usage of a server suddenly soared to 90% (the preliminary abnormal condition was that the CPU usage exceeded 85%). Therefore, this data point is marked as a candidate abnormal data. Next, the system uses the historical CPU usage data stored in the first database to compare with the candidate abnormal data. The comparison results show that the historical average CPU usage of the server in the same time period is 60%, and has never exceeded 80%. Based on this comparison result, the system determines that the data point meets the first abnormal condition, that is, it may be a real abnormal data point.

[0067] Through the above detailed anomaly detection process, the system can more accurately identify and locate possible abnormal data points. The preliminary analysis stage can quickly screen out candidate abnormal data, reducing the burden of subsequent analysis; and the data comparison stage can further verify the abnormality of these candidate data and improve the accuracy of detection. Overall, this step-by-step anomaly detection method helps to improve the efficiency and reliability of game server data anomaly detection and provide strong guarantees for the stable operation of the game.

[0068] As an optional solution, using the data in the first database to compare data with data in at least one candidate abnormal data to obtain a first comparison result includes: using normal data in the first database to compare data with data in at least one candidate abnormal data to obtain a first comparison result;

[0069] When the first comparison result indicates that at least one candidate abnormal data includes possible abnormal data, determining the possible abnormal data as meeting the first abnormal condition includes: when the first comparison result indicates that at least one candidate abnormal data includes possible abnormal data different from normal data, determining the possible abnormal data different from normal data as meeting the first abnormal condition.

[0070] In an optional embodiment, the normal data is baseline data used to compare with the candidate abnormal data to identify abnormal behavior.

[0071] In an optional embodiment, data comparison is to identify data points that do not conform to a normal pattern by comparing the similarities or differences between two sets of data.

[0072] In an optional embodiment, the first comparison result is obtained based on a comparison analysis of the normal data and the candidate abnormal data, which reveals the difference between the data.

[0073] In an optional embodiment, possible abnormal data different from normal data is regarded as possible abnormal data because it is obviously different from normal data.

[0074] In an optional embodiment, the data meeting the first abnormal condition are those data that are identified as abnormal by the system and meet preset abnormality determination criteria.

[0075] It should be noted that this embodiment further refines the process of "using the data in the first database to perform data comparison" mentioned above, and clarifies how to determine abnormal data based on the comparison results. Specifically, it involves using the normal data in the first database to compare with the candidate abnormal data, and identifying those possible abnormal data that are different from the normal data based on the comparison results, and then determining these data as meeting the first abnormal condition.

[0076] Optionally, data comparison can use a variety of statistical methods and techniques, such as calculating deviation, standard deviation, correlation analysis, etc., to more accurately identify abnormal data. In addition, the normal data in the first database needs to be updated regularly to reflect the latest changes in system behavior, thereby improving the accuracy of anomaly detection.

[0077] To further illustrate, it is optional to assume that the first database stores the CPU usage data of the server under normal operating conditions, with an average value of 40% and never exceeding 60% in history. In the preliminary analysis phase of anomaly detection, the system discovered a candidate abnormal data point with a CPU usage of 75%. When the system uses the normal data in the first database (average 40%, upper limit 60%) to compare with this candidate abnormal data, it is found that it is significantly higher than the normal range. Therefore, this data point is determined to be a possible abnormal data that is different from the normal data and meets the first abnormal condition.

[0078] Through a detailed data comparison process, the system can more accurately identify abnormal data points that do not conform to normal behavior patterns. This method not only improves the accuracy of anomaly detection, but also helps to promptly discover and deal with potential system problems, thereby ensuring the stable operation of the game server. Overall, this data comparison-based anomaly detection method has important application value in game server monitoring and maintenance.

[0079] As an optional solution, performing secondary anomaly detection on at least one operation data to obtain secondary anomaly detection results includes:

[0080] S2-1, using data in the second database to compare with data in at least one operation data to obtain a second comparison result;

[0081] S2-2: When the second comparison result indicates that at least one operation data includes target abnormal data, the target abnormal data is determined to meet a second abnormal condition.

[0082] In an optional embodiment, after the initial anomaly detection screens out possible abnormal data, the secondary anomaly detection uses more complex analysis methods to confirm whether the data is truly abnormal.

[0083] In an optional embodiment, the second database is a warehouse storing data used for secondary comparison analysis, which may include more detailed historical data, industry standards or other relevant reference data.

[0084] In an optional embodiment, the similarities or differences between two sets of data are compared through a specific algorithm to identify the real abnormal data.

[0085] In an optional embodiment, the second comparison result is obtained based on the comparison between the second database and the abnormal candidate data, and is used to indicate which data are truly abnormal.

[0086] In an optional embodiment, the target abnormal data refers to data that is identified in the secondary comparison and meets the second abnormal condition.

[0087] In an optional embodiment, the second abnormal condition is set in combination with the secondary comparison result, which is a more stringent and specific abnormality determination criterion.

[0088] It should be noted that this embodiment describes the specific steps of performing secondary anomaly detection on at least one operation data initially screened. In this process, data comparison is performed using the data in the second database, and based on the comparison results, it is determined which data meets the second anomaly condition, that is, is considered to be the real anomaly data.

[0089] Optionally, the secondary anomaly detection may involve more complex statistical analysis, pattern recognition or machine learning techniques to improve the accuracy of anomaly identification. In addition, the second database may need to be regularly updated and maintained to ensure the timeliness and accuracy of its data.

[0090] To further illustrate, in an optional abnormal detection of a game server, preliminary detection found abnormal response times of several servers. For further confirmation, the system performed a secondary abnormal detection. In this process, the system used the detailed historical response time data and industry standard data stored in the second database to compare with the abnormal response time data detected initially. The comparison results showed that the response time of two of the servers not only exceeded the historical average, but also far exceeded the industry standard. Therefore, the response time data of these two servers were determined to be target abnormal data that met the second abnormal condition.

[0091] Through secondary anomaly detection, the system can more accurately identify and confirm real abnormal data. This approach reduces the risk of false positives and false negatives and improves the reliability of anomaly detection. In game server monitoring, this means that potential problems can be discovered and resolved more quickly, ensuring the stable operation of the game and a good experience for players.

[0092] As an optional solution, using the data in the second database to compare with the data in at least one operation data to obtain a second comparison result includes: using the false positive data in the second database to compare with the data in at least one operation data to obtain a second comparison result;

[0093] When the second comparison result is used to indicate that at least one operating data includes target abnormal data, determining the target abnormal data as meeting the second abnormal condition includes: when the second comparison result is used to indicate that at least one operating data includes target abnormal data different from the false alarm data, determining the target abnormal data different from the false alarm data as meeting the second abnormal condition.

[0094] In an optional embodiment, false positive data refers to data points that are mistakenly judged as abnormal in a previous abnormality detection process, but in fact these data points are normal.

[0095] In an optional embodiment, data points that may be misjudged as abnormal are identified and excluded by comparing the similarities or differences between the operating data and the false alarm data.

[0096] In an optional embodiment, the second comparison result is a conclusion obtained based on a comparison analysis of the operating data and the false alarm data.

[0097] In an optional embodiment, the target abnormal data different from the false positive data is regarded as potential true abnormal data because it is different from the known false positive data.

[0098] In an optional embodiment, data that meets the second abnormal condition is still considered to be an abnormal data point after the possibility of false alarm is eliminated.

[0099] It should be noted that this embodiment describes the process of comparing the false alarm data in the second database with the operating data in the secondary anomaly detection, and defines how to determine the target anomaly data that meets the second anomaly condition based on the comparison result.

[0100] The method of using false positive data for comparison helps to reduce the false positive rate in anomaly detection and improve the accuracy of detection. In addition, with the accumulation and analysis of false positive data, the system can continuously optimize its anomaly detection algorithm and further improve the efficiency and reliability of detection.

[0101] To further illustrate, it is optional to assume that in the monitoring of a game server, a previous anomaly detection mistakenly marked the data with a CPU usage of 70% as abnormal (in fact, this is normal during certain peak hours). This 70% CPU usage data is stored as false alarm data. In the subsequent secondary anomaly detection, when the system detects a data point with a CPU usage of 70% again, it will compare it with this false alarm data. If the new data point is the same or similar to the false alarm data, the system may regard it as normal; but if the new data point (for example, the CPU usage suddenly jumps to 90%) is significantly different from the false alarm data, then this new data point will be regarded as the target anomaly data that meets the second anomaly condition.

[0102] By comparing with false positive data, secondary anomaly detection can more accurately identify true abnormal data points while excluding false positives caused by system fluctuations or other non-abnormal factors. This approach is particularly important in game server monitoring because it can help the operation and maintenance team locate problems more accurately, reduce unnecessary interventions and alarms, and thus improve overall operational efficiency and service quality.

[0103] As an optional solution, after determining the target operating data as abnormal operating data, the method further includes:

[0104] S3-1, searching the data in the third database for abnormal repair data that matches the abnormal operation data;

[0105] S3-2, according to the abnormal repair data, perform abnormal repair on the game server with abnormal operation data to obtain the abnormal repair result.

[0106] In an optional embodiment, abnormal operating data are data points that deviate from a normal operating range or pattern and may indicate a failure or performance problem with the server.

[0107] In an optional embodiment, the third database is a data warehouse containing exception repair information, which provides guidelines or scripts for solving specific exception problems.

[0108] In an optional embodiment, the abnormality repair data is data containing specific repair steps, commands or scripts for instructing the system on how to automatically repair or alleviate the abnormal situation.

[0109] In an optional embodiment, abnormality repair is an activity of applying a repair solution retrieved from a third database to solve abnormal problems on the game server.

[0110] In an optional embodiment, the abnormal repair result is an indicator or feedback to measure whether the repair operation is successful and whether the server performance has returned to normal.

[0111] It should be noted that this embodiment describes the process of how the system further queries and applies corresponding abnormality repair data to repair the problematic game server after confirming that the operating data of the game server is abnormal.

[0112] Optionally, the third database may contain rich historical repair cases and expert knowledge to support complex anomaly repair processes. In addition, as new anomalies are discovered and resolved, the third database will be continuously updated to improve the efficiency and success rate of future anomaly repairs.

[0113] To further illustrate, optionally assume that a game server has a network delay anomaly, and the system first determines this through anomaly detection. Subsequently, the system queries the third database for repair data that matches the network delay anomaly. The repair data found may include steps such as restarting the network service, optimizing the network configuration, or clearing the network cache. The system automatically repairs the game server according to these repair data, and finally the network delay problem is solved and the server returns to normal. This is the result of the anomaly repair.

[0114] By querying and applying the exception repair data in the third database, the system can quickly and automatically repair game server anomalies. This not only reduces the need for manual intervention, but also greatly improves the efficiency and accuracy of exception handling. In the game industry, this automated exception repair mechanism is crucial to ensuring the stable operation of the server and the game experience of players.

[0115] As an optional solution, in the case where the abnormal repair result fails, the method further includes at least one of the following:

[0116] In response to the remote repair instruction, remotely repair the game server with abnormal operation data;

[0117] Switch the account data in the game server with abnormal operating data to the normal operating backup game server, and shut down the game server with abnormal operating data.

[0118] In an optional embodiment, the remote repair instruction is a command or instruction sent from a remote location to instruct the server to perform a specific repair operation. It can also be understood as a repair command transmitted over the network, allowing technicians or systems to automatically troubleshoot and repair remote game servers.

[0119] In an optional embodiment, the problem can be diagnosed and solved remotely without having to physically contact the server. Network technology is used to remotely diagnose, debug and repair the game server in question.

[0120] In an optional embodiment, the backup game server can replace the backup server that the main server runs when it fails. In order to ensure the continuity of service, it is set up to take over the additional server of its service when the main server is unavailable.

[0121] In an optional embodiment, the physical level repair is to directly inspect, replace or repair the server hardware to solve the physical level failure. The repair process involving the actual replacement or repair of the server hardware equipment usually requires shutting down the server and may involve disassembling, inspecting or replacing hardware components.

[0122] It should be noted that this embodiment describes the further measures that the system will take to ensure the stability of the game server and the player's gaming experience when the abnormal repair fails. Specifically, it mentions two alternative solutions: one is to perform remote repair processing, and the other is to switch the player account to the backup server and shut down the abnormal server for physical repair.

[0123] Optionally, in a large online gaming environment, it is critical to ensure the stable operation of the server. Therefore, in addition to the automatic repair mechanism, efficient remote management and physical repair processes are also required. The setting of backup servers can not only reduce the service interruption time caused by server failure, but also provide additional expansion capabilities to cope with the surge in the number of players.

[0124] As an example, let's assume that a game server fails to recover after attempting to automatically repair a network failure. At this point, the system can receive remote repair instructions from the technical support team and attempt to resolve the problem through network reconfiguration or installation of update patches. If the remote repair still does not work, the system will automatically transfer the affected player accounts to another normal backup game server and shut down the power to the failed server so that the technician can physically inspect and repair it.

[0125] By combining remote repair and physical repair strategies, the game server management system can respond quickly when automatic repair fails, minimize service interruption time, and maximize the player's gaming experience. This multi-level fault recovery mechanism not only improves the reliability of the system, but also enhances the operator's ability to respond to emergencies.

[0126] As an optional solution, after determining the target operating data as abnormal operating data, the method further includes:

[0127] S4-1, when the abnormal operation data is successfully processed, the cause, processing process, and processing result of the abnormal operation data are reviewed and analyzed to obtain a review analysis result;

[0128] S4-2, by reviewing the analysis results, determining potential improvement points of the game server group, wherein the potential improvement points are parts of the game server group that may cause abnormal operation data but have not been improved;

[0129] S4-3, optimize the game server group based on potential improvement points.

[0130] In an optional embodiment, the retrospective analysis is to conduct a detailed inspection and analysis of the cause, processing process and processing result of the abnormal operation data after the abnormal operation data is successfully processed.

[0131] In an optional embodiment, potential improvement points refer to parts or links in the game server group that may cause abnormal operation data but have not been improved. Potential weaknesses or deficiencies in the system, if these points are not improved, may cause similar anomalies to occur again in the future.

[0132] In an optional embodiment, based on the identified potential improvement points, necessary adjustments and improvements are made to the game server group to improve its performance and stability. A series of measures and activities aimed at enhancing the overall effectiveness of the game server group and reducing the possibility of abnormal events.

[0133] It should be noted that this embodiment describes a series of subsequent operations performed by the system after successfully processing abnormal operation data, including reviewing and analyzing, determining potential improvement points, and optimizing the game server group based on these potential improvement points.

[0134] To further illustrate, let's assume that after a DDoS attack, the game server experienced severe delays and disconnections, and these abnormal operation data were successfully identified and processed by the system. After processing, the system conducted a retrospective analysis and found that the server group's network defense mechanism was insufficient and failed to effectively resist the attack. This deficiency was identified as a potential improvement point. Subsequently, based on this discovery, the system optimized the network architecture of the game server group and added more advanced defense measures to prevent similar attacks in the future.

[0135] By reviewing and analyzing abnormal operation data, the system can accurately identify potential improvement points in the game server group and optimize accordingly. This continuous improvement mechanism significantly improves the stability and performance of the game server, reduces the frequency of abnormal events, and provides players with a smoother and more reliable gaming experience. At the same time, this also enhances the game operator's ability to respond to market changes and external threats.

[0136] As an optional solution, for ease of understanding, the data anomaly detection method of the above-mentioned game server is applied to handling operation failure scenarios. Existing game servers have significant deficiencies in handling operation failures, which are mainly reflected in three aspects: fault response speed, accuracy of warning information, and automatic repair capabilities.

[0137] First, in terms of fault response, the current server system lacks a rapid response mechanism. Once a fault occurs, it usually relies on manual feedback and processing, which is not only inefficient, but also greatly increases the risk of fault expansion. During the maintenance process, the discovery of problems often relies on manual inspection, which undoubtedly increases the possibility of major accidents during server operation.

[0138] Secondly, in terms of early warning information, the verification mechanism of existing servers is not mature enough. When encountering an emergency failure, the system cannot effectively verify the early warning information, resulting in a large number of false alarms. This not only wastes valuable maintenance resources, but also unnecessarily increases maintenance costs, placing an unnecessary burden on corporate operations.

[0139] Finally, the existing game servers are particularly lacking in automatic repair capabilities. For common faults, the system lacks the function of automatic repair, which not only affects the overall performance of the server, but also increases the frequency and cost of manual intervention. In an emergency, remote manual repair cannot be achieved, and it is impossible to switch servers and shut down faulty servers in time, thus failing to minimize losses.

[0140] In this regard, this embodiment proposes an efficient and comprehensive game server emergency rapid processing system, such as Figure 3 As shown, the system is composed of multiple core components, including a server unit 100, a standby server unit 200, a monitoring system 300, an early warning system 400, an automatic repair system 500, a monitoring platform 600, a remote control system 700, and a power supply system 800. These components jointly ensure the stable operation of the game server and the rapid handling of accidents through a sophisticated linkage mechanism.

[0141] Optional, e.g. Figure 4 As shown, the monitoring system 300, as the sensing part of the entire system, captures the operating data of the server group in real time through the data acquisition module 301. Subsequently, the data analysis module 302 conducts in-depth analysis of these data, and the data comparison module 303 compares them with the set data in the database, so that the data judgment module 304 accurately identifies abnormal data. Finally, the data transmission module 305 quickly transmits the abnormal data to the early warning system 400 for further processing.

[0142] Optional, e.g. Figure 5As shown, after receiving the abnormal data, the early warning system 400 receives it through the data receiving module 401, and the data re-verification module 402 performs secondary verification to ensure the accuracy of the data. After the re-inspection judgment module 403 evaluates the re-inspection result, the early warning generation module 404 generates corresponding early warning information. This information is then sent to the automatic repair system 500 and the monitoring platform 600 in a timely manner through the early warning transmission module 405, triggering the subsequent automatic repair and manual intervention process.

[0143] Optional, e.g. Figure 6 As shown, the automatic repair system 500 is the core of the whole system, and it has a strong self-repair capability. The early warning information collection module 501 first collects the early warning information, and the early warning information analysis module 502 performs in-depth analysis. Then, the solution retrieval module 503 searches for possible solutions in the database, and the solution matching module 504 is responsible for selecting the best solution. The solution implementation module 505 then performs the repair operation, and the repair process storage module 506 records the entire repair process for subsequent analysis. Finally, the repair result feedback module 507 feeds back the repair results to the relevant system to ensure the transparency and accuracy of the information.

[0144] Optional, e.g. Figure 7 As shown, the monitoring platform 600 provides an intuitive monitoring interface for managers. The display module 601 displays abnormal data and repair feedback in real time, allowing managers to quickly grasp the server status. The control module 602 supports remote repair operations, improving processing efficiency. At the same time, the alarm module 603 will trigger an alarm when necessary to remind managers to intervene in time.

[0145] Optional, e.g. Figure 8 As shown, the remote control system 700 further enhances the flexibility and emergency response capability of the system. The remote repair module 701 allows the administrator to perform repair operations on the server remotely, while the repair feedback module 702 ensures timely feedback of the repair results. In an emergency, the server switching module 703 can quickly transfer the load to the backup server unit 200 to ensure service continuity. At the same time, the power cut-off module 704 can quickly cut off the power supply of the faulty server when necessary to prevent the accident from expanding and protect the safe and stable operation of the entire system.

[0146] It should be noted that the embodiment of the present application realizes a method for quickly repairing emergency accidents of game servers by integrating the above-mentioned multiple efficient and mutually coordinated modules and systems. This method can not only monitor the server status in real time and accurately identify abnormal data, but also automatically perform repair operations and support remote manual intervention when necessary, providing comprehensive technical support for improving the stability and reliability of game servers.

[0147] To further illustrate, the optional Fig. 9 As shown, this application implements a quick repair for emergency incidents on game servers, and ensures stable operation of the server and quick handling of incidents through a series of precise and efficient steps. The specific steps are as follows:

[0148] S1: Start the monitoring system 300 and conduct comprehensive monitoring of multiple server groups 100. First, the data acquisition module 301 captures the operating data in the server group in real time. Then, the data analysis module 302 conducts in-depth analysis of these data to identify potential abnormalities. The data comparison module 303 compares the analysis results with the set data in the database to further confirm the data status. If the data judgment module 304 determines that the data is abnormal, the abnormal data is quickly transmitted to the early warning system 400 through the data transmission module 305; if the data is normal, the cyclic monitoring continues.

[0149] S2: After the early warning system 400 receives the abnormal data, it confirms it through the data receiving module 401. Subsequently, the data recheck module 402 performs a second verification on the abnormal data, and ensures the accuracy of the early warning by comparing the judgment data in the database again. If the recheck judgment module 403 confirms that the data is still abnormal, the early warning generation module 404 will automatically generate early warning information, and send the early warning information to the monitoring platform 600 and the automatic repair system 500 in time through the early warning transmission module 405; if the data returns to normal, the early warning process ends.

[0150] S3: After receiving the warning information, the automatic repair system 500 immediately starts the repair program. The warning information collection module 501 is responsible for collecting warning information, and the warning information analysis module 502 conducts in-depth analysis of the information. The solution retrieval module 503 quickly searches for possible solutions in the database based on the analysis results. The solution matching module 504 is responsible for matching the optimal solution and performing the repair operation through the solution implementation module 505. The entire repair process is recorded in detail by the repair process storage module 506 for subsequent analysis. After the repair is completed, the repair result feedback module 507 will feedback the repair result. If the anomaly has been eliminated, the repair process ends; otherwise, proceed to the next step.

[0151] S4: If the S3 step fails to successfully eliminate the abnormality, the monitoring platform 600 will take over the subsequent processing. The display module 601 displays the abnormal information in real time, and the alarm module 603 simultaneously issues an alarm to remind the management personnel to intervene in time. The control module 602 allows the management personnel to perform remote repair operations on the server through the remote repair module 701 of the remote control system 700. During the repair process, the repair feedback module 702 provides real-time feedback on the repair progress. If the abnormality is still not resolved, the server switching module 703 will quickly transfer the load to the backup server unit 200 to ensure the continuity of service. At the same time, the power supply system 800 cuts off the power supply to the faulty server unit to prevent the accident from expanding. Finally, the faulty server unit is fully overhauled manually to completely solve the problem.

[0152] The game server emergency rapid processing system proposed in the embodiment of the present application can continuously and comprehensively and accurately collect and analyze data on the server unit. Once abnormal data is detected, the system will immediately start the repeated detection mechanism to ensure the accuracy of the early warning information through multiple verifications, thereby effectively avoiding unnecessary processing costs caused by false alarms. This design significantly improves the reliability and accuracy of the early warning system.

[0153] Secondly, the system integrates advanced automatic repair functions. For common server anomalies, the system can quickly match and execute the best solution to achieve instant repair of the fault. This not only greatly saves troubleshooting time, but also effectively improves the overall operating efficiency of the server. The introduction of the automatic repair function marks a new level of intelligence and automation in server maintenance work.

[0154] Furthermore, when automatic repair cannot solve the problem, the system will promptly feedback the abnormal situation to the monitoring platform. At this time, the management personnel can manually intervene through the remote control system and implement the repair operation without going to the site in person. This remote repair mode greatly shortens the fault response time and ensures that the problem can be effectively solved in the first place. At the same time, it also reduces the complexity of personnel scheduling and further improves the operation and maintenance efficiency.

[0155] Finally, in extreme cases, when remote repairs cannot restore the normal operation of the server, the system will start the standby server unit switching mechanism. This design ensures the continuity and stability of the game service and minimizes the impact of the failure on the user experience. At the same time, the system can also remotely shut down the faulty server unit to provide a safe maintenance environment for the staff. Through this multi-level and comprehensive fault handling strategy, this embodiment successfully minimizes potential losses.

[0156] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0157] In the present embodiment, a data anomaly detection device for a game server is also provided, and the device is used to implement the above-mentioned embodiment and the preferred embodiment, and the description thereof will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented with software, the implementation of hardware, or a combination of software and hardware is also possible and conceivable.

[0158] Fig.10 is a structural block diagram of a data anomaly detection device for a game server according to an embodiment of the present application, such as Fig.10 As shown, the device comprises:

[0159] The acquisition unit 1002 is used to acquire a plurality of operation data in the game server group;

[0160] The first detection unit 1004 is used to perform an anomaly detection on the multiple operating data to obtain an anomaly detection result, wherein the anomaly detection is to perform a comprehensive scan on the multiple operating data to preliminarily screen out possible abnormal data;

[0161] The second detection unit 1006 is configured to perform a secondary abnormality detection on at least one operation data to obtain a secondary abnormality detection result when the primary abnormality detection result indicates that at least one operation data among the multiple operation data meets the first abnormality condition;

[0162] The determining unit 1008 is configured to determine the target operating data as abnormal operating data when the secondary abnormality detection result indicates that the target operating data in the at least one operating data meets the second abnormality condition.

[0163] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0164] As an optional solution, the first detection unit 1004 includes:

[0165] An analysis module is used to perform a preliminary analysis of anomaly detection on multiple operation data to obtain preliminary analysis results;

[0166] A first comparison module is used to compare data in the first database with data in the at least one candidate abnormal data to obtain a first comparison result when the preliminary analysis result indicates that the plurality of operation data include at least one candidate abnormal data that meets the preliminary abnormal condition;

[0167] The first determination module is configured to determine the possible abnormal data as meeting a first abnormal condition when the first comparison result indicates that at least one candidate abnormal data includes possible abnormal data.

[0168] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0169] As an optional solution, the first comparison module includes: a first comparison submodule, used to use normal data in the first database to perform data comparison with data in at least one candidate abnormal data to obtain a first comparison result;

[0170] The first determination module includes: a first determination submodule, which is used to determine the possible abnormal data different from the normal data as meeting the first abnormal condition when the first comparison result indicates that at least one candidate abnormal data includes possible abnormal data different from the normal data.

[0171] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0172] As an optional solution, the second detection unit 1006 includes:

[0173] A second comparison module, used to compare the data in the second database with the data in the at least one operation data to obtain a second comparison result;

[0174] The second determination module is configured to determine the target abnormal data as meeting a second abnormal condition when the second comparison result indicates that at least one operation data includes the target abnormal data.

[0175] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0176] As an optional solution, the second comparison module includes: a second comparison submodule, used to use the false alarm data in the second database to perform data comparison with data in at least one operation data to obtain a second comparison result;

[0177] The second determination module includes: a second determination submodule, which is used to determine the target abnormal data different from the false alarm data as meeting the second abnormal condition when the second comparison result is used to indicate that at least one operating data includes target abnormal data different from the false alarm data.

[0178] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0179] As an optional solution, the device also includes:

[0180] a query unit, configured to query the data in the third database for abnormal repair data matching the abnormal operation data after determining the target operation data as abnormal operation data;

[0181] The first repair unit is used to perform abnormal repair on the game server where the abnormal operation data appears according to the abnormal repair data after determining the target operation data as abnormal operation data, so as to obtain an abnormal repair result.

[0182] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0183] As an optional solution, in the case where the abnormal repair result fails, the device further includes at least one of the following:

[0184] A second repair unit is used to perform remote repair processing on the game server with abnormal operation data in response to a remote repair instruction after performing abnormal repair on the game server with abnormal operation data according to the abnormal repair data;

[0185] The third repair unit is used to switch the account data in the game server with abnormal operation data to a normally operating backup game server after performing an abnormal repair on the game server with abnormal operation data according to the abnormal repair data, and shut down the game server with abnormal operation data.

[0186] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0187] As an optional solution, the device also includes:

[0188] A review unit, for, after determining the target operation data as abnormal operation data, and in the case that the abnormal operation data is successfully processed, performing a review analysis on the cause of the abnormal operation data, the processing process, and the processing result, to obtain a review analysis result;

[0189] A potential unit, used to determine potential improvement points of the game server group by reviewing and analyzing the results after determining the target operation data as abnormal operation data, wherein the potential improvement points are parts of the game server group that may cause the abnormal operation data to appear but have not been improved;

[0190] The optimization unit is used to optimize the game server group according to potential improvement points after determining the target operation data as abnormal operation data.

[0191] For specific embodiments, reference may be made to the examples shown in the above-mentioned method for detecting data anomalies in a game server, which will not be described in detail in this example.

[0192] It should be noted that the above-mentioned virtual devices (modules, units, sub-modules, sub-units, components, etc.) can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above-mentioned virtual devices are all located in the same processor; or, the above-mentioned virtual devices are located in different processors in any combination.

[0193] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0194] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0195] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0196] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0197] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0198] Obviously, those skilled in the art should understand that the above-mentioned virtual devices or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0199] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting data anomalies in a game server, characterized in that: include: Get multiple running data in the game server group; Performing an anomaly detection on the plurality of operating data to obtain an anomaly detection result, wherein the anomaly detection is to perform a comprehensive scan on the plurality of operating data to preliminarily screen out possible abnormal data; When the primary abnormality detection result indicates that at least one of the plurality of operating data meets the first abnormality condition, performing a secondary abnormality detection on the at least one operating data to obtain a secondary abnormality detection result; When the secondary abnormality detection result indicates that the target operating data in the at least one operating data meets the second abnormality condition, the target operating data is determined as abnormal operating data.

2. The method according to claim 1, characterized in that The performing an abnormality detection on the plurality of operation data to obtain an abnormality detection result includes: Performing a preliminary analysis of the one abnormality detection on the plurality of operation data to obtain a preliminary analysis result; When the preliminary analysis result indicates that the plurality of operating data include at least one candidate abnormal data meeting the preliminary abnormal condition, using the data in the first database to perform data comparison with the data in the at least one candidate abnormal data to obtain a first comparison result; When the first comparison result indicates that the at least one candidate abnormal data includes possible abnormal data, the possible abnormal data is determined to meet the first abnormal condition.

3. The method according to claim 2, characterized in that The using the data in the first database to compare data with the data in the at least one candidate abnormal data to obtain a first comparison result includes: using normal data in the first database to compare data with the data in the at least one candidate abnormal data to obtain the first comparison result; The determining, when the first comparison result indicates that the at least one candidate abnormal data includes possible abnormal data, the possible abnormal data as meeting the first abnormal condition comprises: when the first comparison result indicates that the at least one candidate abnormal data includes possible abnormal data different from the normal data, determining the possible abnormal data different from the normal data as meeting the first abnormal condition.

4. The method according to claim 1, characterized in that: The performing secondary anomaly detection on the at least one operation data to obtain a secondary anomaly detection result includes: Using the data in the second database, performing data comparison with the data in the at least one operation data, to obtain a second comparison result; In a case where the second comparison result is used to indicate that the at least one operating data includes target abnormal data, the target abnormal data is determined to meet the second abnormal condition.

5. The method according to claim 2, characterized in that: The using the data in the second database to compare data with the data in the at least one operation data to obtain the second comparison result includes: using the false positive data in the second database to compare data with the data in the at least one operation data to obtain the second comparison result; The step of determining, when the second comparison result is used to indicate that the at least one operating data includes target abnormal data, the target abnormal data as meeting the second abnormal condition comprises: when the second comparison result is used to indicate that the at least one operating data includes target abnormal data different from the false alarm data, determining the target abnormal data different from the false alarm data as meeting the second abnormal condition.

6. The method according to claim 1, characterized in that After determining the target operating data as abnormal operating data, the method further includes: Searching the data in the third database for abnormal repair data that matches the abnormal operation data; According to the abnormal repair data, the game server where the abnormal operation data occurs is repaired abnormally to obtain an abnormal repair result.

7. The method according to claim 6, characterized in that In the case where the abnormal repair result fails, the method further includes at least one of the following: In response to the remote repair instruction, remotely repair the game server where the abnormal operation data occurs; The account data in the game server where the abnormal operation data occurs is switched to the normally operating standby game server, and the game server where the abnormal operation data occurs is shut down.

8. The method according to any one of claims 1 to 7, characterized in that After determining the target operating data as abnormal operating data, the method further includes: When the abnormal operation data is successfully processed, a cause, a processing process, and a processing result of the abnormal operation data are reviewed and analyzed to obtain a review analysis result; Determine potential improvement points of the game server group through the review analysis results, wherein the potential improvement points are parts of the game server group that may cause the abnormal operation data to appear but have not been improved; The game server group is optimized based on the potential improvement points.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 8 when executed by a processor.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 8 are implemented.

Images