Application program anomaly detection method and device, equipment and medium

Abstract

The embodiment of the invention relates to an exception detection method and device for an application program, equipment and a medium, and the method comprises the steps that an exception verification rule is obtained, and the exception verification rule is used for detecting exception problems of a non-exception exit class of a target application program; detecting a running log of the target application program in real time by using the exception verification rule, and determining an exception log; and reporting the abnormal aggregation information corresponding to the abnormal log to a monitoring platform, so that a log early warning server obtains the abnormal aggregation information from the monitoring platform, and gives an alarm when the abnormal aggregation information meets an alarm condition. According to the embodiment of the invention, the abnormal problem of the non-abnormal exit class of the application program can be actively detected through real-time log detection, the abnormality can be found in time, an alarm is given, the escape of the abnormal problem is avoided, and the running stability of the application program is effectively improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method, device, equipment and medium for detecting anomalies of an application program. Background Art

[0002] In order to ensure the stable operation of the application, the application can be monitored through the monitoring platform, and when the application has an abnormal exit, it can be detected and resolved. For non-abnormal exit problems that cannot be detected, the relevant technology usually provides feedback channels to users, discovers problems through user feedback and then troubleshoots and solves the problems. However, this method may cause many abnormal problems to escape and cannot be discovered in time because the user cannot identify the abnormality and does not feedback, or does not feedback after identification. Summary of the invention

[0003] In order to solve the above technical problems, the present disclosure provides a method, device, equipment and medium for detecting anomalies of an application.

[0004] The present disclosure provides a method for detecting anomalies in an application program, the method comprising:

[0005] Acquire an exception verification rule, wherein the exception verification rule is used to detect an exception problem of a non-abnormal exit type of the target application program;

[0006] Using the anomaly verification rules to detect the running log of the target application in real time and determine the abnormal log;

[0007] The abnormal aggregate information corresponding to the abnormal log is reported to the monitoring platform, so that the log warning server obtains the abnormal aggregate information from the monitoring platform and issues an alarm when the abnormal aggregate information meets the alarm condition.

[0008] The present disclosure also provides an application anomaly detection device, the device comprising:

[0009] An acquisition module, used for acquiring an exception verification rule, wherein the exception verification rule is used for detecting an abnormal problem of a non-abnormal exit type of the target application program;

[0010] A detection module, used to detect the operation log of the target application in real time using the anomaly verification rule to determine the abnormal log;

[0011] The reporting module is used to report the abnormal aggregation information corresponding to the abnormal log to the monitoring platform, so that the log warning server obtains the abnormal aggregation information from the monitoring platform and issues an alarm when the abnormal aggregation information meets the alarm condition.

[0012] An embodiment of the present disclosure also provides an electronic device, which includes: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement an anomaly detection method for an application as provided in an embodiment of the present disclosure.

[0013] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the abnormality detection method for the application program provided by the embodiment of the present disclosure.

[0014] The technical solution provided by the embodiment of the present disclosure has the following advantages over the prior art: the abnormal detection solution of the application provided by the embodiment of the present disclosure obtains abnormal verification rules, wherein the abnormal verification rules are used to detect abnormal problems of the non-abnormal exit class of the target application; the operation log of the target application is detected in real time using the abnormal verification rules to determine the abnormal log; the abnormal aggregation information corresponding to the abnormal log is reported to the monitoring platform, so that the log warning server obtains the abnormal aggregation information from the monitoring platform and issues an alarm when the abnormal aggregation information meets the alarm condition. With the above technical solution, the operation log can be monitored in real time and the abnormal log can be determined through the abnormal verification rules obtained when the application is started. After the abnormal aggregation information corresponding to the abnormal log is reported to the monitoring platform, the log warning server can issue an alarm when the abnormal aggregation information meets the alarm condition. Through real-time log detection, the abnormal problems of the non-abnormal exit class of the application can be actively detected, the abnormalities can be discovered in time and an alarm can be issued to avoid the escape of the abnormal problems, thereby effectively improving the operation stability of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0016] Figure 1 A flowchart of an abnormality detection method for an application provided by an embodiment of the present disclosure;

[0017] Figure 2 A flowchart of another method for detecting anomalies of an application program provided by an embodiment of the present disclosure;

[0018] Figure 3 A schematic diagram of an abnormality detection process of an application provided in an embodiment of the present disclosure;

[0019] Figure 4 A schematic diagram of the structure of an abnormality detection device for an application provided in an embodiment of the present disclosure;

[0020] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0022] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0023] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0024] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0025] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0026] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0027] In the related art, problems with non-abnormal exits are usually discovered through user feedback, but there are the following defects: 1. Users cannot correctly identify abnormal behavior, so there will be no user feedback. For example: a. Users cannot identify whether the current video is a special video. For abnormal situations where special logos should be displayed but are not displayed, users cannot judge whether they are abnormal. b. If the correct logic expects the appearance of a component of style A, but in fact a component of style B appears, in this case, the user cannot judge whether it is abnormal. 2. Since the user feedback rate is relatively low, even if the user can correctly identify the abnormality, most users will not provide feedback. For some scenarios, some content appears infrequently, and users will not provide feedback even if they find a problem, and it cannot be discovered through user feedback. In summary, relying solely on user feedback to discover problems will cause many problems to escape and cannot be discovered in time.

[0028] In order to solve the above problems, the embodiments of the present disclosure provide a method for detecting anomalies of an application program, which is introduced below in conjunction with specific embodiments.

[0029] Figure 1 The present invention provides a flowchart of an application anomaly detection method provided by an embodiment of the present invention. The method can be performed by an application anomaly detection device, wherein the device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 1 As shown, the method includes:

[0030] Step 101: Obtain an exception verification rule, wherein the exception verification rule is used to detect an exception problem of a non-abnormal exit type of a target application.

[0031] The application anomaly detection method of the embodiment of the present disclosure can be executed by the target application itself. The target application can be any program that needs to perform anomaly detection or problem detection. The type and number of target applications are not limited. For example, the target application can include video applications, reading applications, etc.

[0032] The exception check rule can be a pre-set rule for detecting abnormal problems of the non-abnormal exit type of the target application, and can be a program that can be automatically executed in the target application. The exception check rules for different target applications can be different, and are set according to actual conditions. Abnormal problems of the non-abnormal exit type can include display problems, interaction problems, and other problems of the application that will not cause the abnormal exit of the application. For example, abnormal problems of the non-abnormal exit type can include user interface display errors, interaction anomalies, jump to error pages, etc. The above-mentioned abnormal exit type problems can include application startup crashes, crashes due to serious errors, memory overflows, etc.

[0033] In the disclosed embodiment, the application anomaly detection device can obtain the corresponding anomaly verification rules after the target application is started. The specific acquisition source can be obtained from a server or manually input.

[0034] In some embodiments, obtaining anomaly verification rules may include: obtaining anomaly verification rules from a log warning server after the target application is started, wherein the anomaly verification rules are written into the log warning server by the log management platform.

[0035] Among them, the log warning server can be a server for storing anomaly verification rules and issuing alarms based on the log information related to the anomaly reported by the application. The log management platform can be a client of the log warning server, which is used to provide an interactive interface to interact with technical personnel to input anomaly verification rules and perform other log-related management or configuration. After the target application is started, the anomaly detection device of the application can send a rule acquisition request to the log warning server to obtain the anomaly verification rules returned by the log warning server. For subsequent use.

[0036] Step 102: Use the abnormality check rules to detect the operation log of the target application in real time and determine the abnormal log.

[0037] The target application's operation log may be information recorded during the execution of the target application, which is used to understand the program's operating status, diagnose problems, monitor performance, and perform debugging. The target application's operation log may include debugging information, program operation information, error logs, and performance logs, etc., with no limit on the specific type and quantity. The exception log may be a log related to the target application's real-time monitoring of abnormal problems of non-abnormal exit types, and the number of exception logs may include multiple.

[0038] After obtaining the anomaly verification rule, the anomaly detection device of the application program can execute the anomaly verification rule in real time to detect after the operation log of the target application program is generated, and determine the anomaly log therein.

[0039] In some embodiments, the exception checking rules include at least one of the following: life cycle rules, jump exception rules, component display exception rules, and code logic exception rules.

[0040] For example, Figure 2 A flowchart of another abnormality detection method for an application provided in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the above step 102 may include at least one of step 201, step 202, step 203 and step 204. The figure takes steps 201 to 204 as an example, and the execution order is also an example, specifically including:

[0041] Step 201: extract part of the log that does not conform to the preset life cycle rule of the corresponding scenario from the operation log according to the life cycle rule, and determine the part of the log as an abnormal log.

[0042] Among them, the life cycle rule can be a rule for judging whether the life cycle of multiple scenarios of the target application is judged according to a fixed life cycle experience. The preset life cycle can be a fixed generation cycle set for a certain scenario, and the preset life cycle for different scenarios can be different.

[0043] Specifically, the anomaly detection device of the application can detect the operation log using the life cycle rule, and compare the life cycle of the scene in the operation log with the corresponding preset life cycle. If they are different, the different partial logs are determined as abnormal logs.

[0044] Exemplarily, the target application is a video application. The preset life cycle for the video may include: setting data, about to be displayed, fully displayed, about to slide away, completely slide away, resetting and destroying data, etc. The order of the preset life cycle is strictly fixed. If there is a sequence error such as about to be displayed first and then setting data, or the number of repetitions of a certain life cycle exceeds the number threshold, it means that the preset life cycle is not met, indicating that an abnormal problem has occurred in the target application at this time. The number threshold can be set according to actual conditions.

[0045] Step 202: According to the jump exception rule, part of the logs in the operation logs that have early jumps, jump failures or jump errors are determined as abnormal logs.

[0046] Among them, the jump exception rule can be a rule for judging whether the jump operation of the target application is in accordance with the expected jump. The jump exception rules corresponding to different pages and different function buttons can be different, and are set according to actual conditions.

[0047] Specifically, the application's anomaly detection device can use jump anomaly rules to detect the operation log, extract the jump information of the jump operation in the operation log, and determine whether an early jump, jump failure or jump error occurs based on the jump information. Specifically, the jump information can be compared with the preset jump information. If there is a difference, a jump anomaly occurs in the target application, and the part of the log where the jump anomaly occurs is determined as an abnormal log. The jump information here can be part of the information related to the jump operation in the operation log, and the preset jump information can be the expected jump method and jump target set for the jump operation.

[0048] For example, after displaying an information page, the target application jumps prematurely without being clicked, or after clicking a function button, it is expected to jump to the mini-program but the jump fails, or it is expected to jump to landing page A but jumps to landing page B, which is a jump error. In this case, it can be determined that a jump abnormality has occurred in the target application.

[0049] Step 203: extract component logs that fail to load or display errors from the operation log according to the component display exception rule, and determine the component logs as exception logs.

[0050] The component display exception rule may be a rule for determining whether an abnormal problem occurs in the component display of the target application, and the component display exception rules corresponding to different components may be different.

[0051] Specifically, the application's anomaly detection device can use component display anomaly rules to detect the operation log, extract component display information in the operation log, and determine whether a loading failure or display error occurs based on the component display information. Specifically, the component display information can be compared with the preset component display information. If there is a difference, a component display anomaly occurs in the target application, and the partial log where the component display anomaly occurs is determined as an abnormal log. Here, the component display information can be partial information related to the component display in the operation log, and the preset component display information can be the expected component display style set for the component.

[0052] For example, when a component fails to load, or component A is expected to be displayed but component B is displayed instead, it can be determined that a component display anomaly occurs in the target application.

[0053] Step 204: According to the code logic exception rule, the part of the operation log that does not run according to the code logic is determined as an abnormal log.

[0054] Among them, the code logic exception rule can be a rule for judging whether there are abnormal problems in the operation of the code logic in the target application. This part of the code logic can be the code logic of the non-abnormal exit type, and the code logic exception rules corresponding to different code logics can be different.

[0055] Specifically, the application's exception detection device can use code logic exception rules to detect the operation log, extract the code execution information in the operation log, and determine whether the code logic is not followed according to the code execution log. Specifically, the code execution information can be compared with the preset code logic. If there is a difference, the target application has a code logic exception, and the part of the log where the code logic exception occurs is determined as an exception log. Here, the code execution information can be part of the information related to the code execution in the operation log, and the preset code logic can be the expected execution process when the code is executed.

[0056] For example, when the target application is expected to report tracking information in a recommended video playback scenario, but fails to report the tracking information, it is determined that a code logic anomaly occurs in the target application.

[0057] When the above steps 201, 202, 203 and 204 are all included, the specific execution order is not limited and they can also be executed in parallel. Figure 2 Just an example.

[0058] In the above scheme, by setting various types of anomaly verification rules, different types of non-abnormal exit abnormal problems can be detected, and the anomaly verification rules support dynamic configuration, which is more in line with actual scenario requirements and improves the accuracy of anomaly detection.

[0059] Step 103: Report the abnormal aggregate information corresponding to the abnormal log to the monitoring platform, so that the log warning server obtains the abnormal aggregate information from the monitoring platform and issues an alarm when the abnormal aggregate information meets the alarm condition.

[0060] Among them, the exception aggregation information can be the information obtained by aggregating the relevant information of an exception log. The embodiment of the present disclosure takes the aggregate exception type as an example. The exception aggregation information can be understood as a log issue. The issue can be any problem, defect, error, suggestion or task of the application. The monitoring platform can be used for the performance monitoring, optimization and alarm of the application. It can improve the reliability and quality of the application. It has the ability to collect the exception information of the application and add custom content. The monitoring platform of the embodiment of the present disclosure can adopt the application performance management platform (Application Performance Management, APM). The alarm condition can be a specific condition for judging whether the exception of an application is serious enough to require an alarm. The alarm condition of the embodiment of the present disclosure is used to judge whether an abnormal problem of the non-abnormal exit type of the target application needs to be alarmed. The alarm conditions of different target applications may be different.

[0061] In some embodiments, reporting the exception aggregate information corresponding to the exception log to the monitoring platform may include: combining the exception log and the corresponding exception type to generate the exception aggregate information; and reporting the exception aggregate information to the monitoring platform.

[0062] Among them, the exception type can be the type corresponding to the exception problem corresponding to the exception log. The exception type can be determined according to the detection result of the exception verification rule. The exception type can include life cycle exception type, jump exception type, component display exception type and code logic exception type, etc. Optionally, the exception type can be further fine-grained, which is determined according to the actual situation.

[0063] Specifically, after determining the exception log, the exception detection device of the application can determine the corresponding exception type according to the detection result of the exception log, and aggregate the exception log and the exception type to generate exception aggregation information, and then actively report the exception aggregation information to the monitoring platform through a customized exception reporting method. The customized exception reporting method here can be an active reporting method, which can be distinguished from the reporting method of abnormal problems of the abnormal exit type. The relevant information of the abnormal problems of the abnormal exit type can be actively pulled by the monitoring platform.

[0064] After obtaining the abnormal aggregation information reported by the target application, the monitoring platform can store it. The log warning server can pull the abnormal aggregation information from the monitoring platform through the application interface at preset intervals. The preset time here can be set according to the actual situation. For example, the preset time can be one day; then the number of abnormal aggregation information of different abnormal types is counted, and whether the alarm conditions are met is determined based on the number. If the alarm conditions are met, an alarm is issued. The alarm method can be to send an alarm message to the corresponding personnel.

[0065] The application programming interface may be an open application programming interface (OPI). The monitoring platform may make its application programming interface public so that external programs can use the data or resources of the platform without changing the source code of the monitoring platform.

[0066] In some embodiments, the alarm condition is used to determine that the abnormal aggregate information meets the alarm condition when the amount of abnormal aggregate information is greater than the corresponding amount threshold. Optionally, the amount threshold is determined according to the problem level corresponding to the abnormal type, and the higher the problem level, the lower the amount threshold.

[0067] The quantity threshold may be a threshold set for the quantity of abnormal aggregate information of different abnormal types, and the quantity thresholds corresponding to different abnormal types may be different. The problem level may be a level pre-set for different abnormal types, representing the severity of the problem. The more serious the abnormal problem corresponding to the abnormal type, the higher the problem level. The quantity threshold may be set according to the problem level corresponding to the abnormal type. The higher the problem level, the lower the quantity threshold.

[0068] After the log warning server determines the number of abnormal aggregation information of different abnormal types, it can obtain the number thresholds corresponding to the different abnormal types and determine whether the number of abnormal aggregation information of each abnormal type is greater than the number threshold. If so, it means that the number of abnormal problems of this abnormal type is large, the problem is already serious, and an alarm is required, and the alarm condition is met; otherwise, the alarm condition is not met.

[0069] In the above scheme, after the application's abnormal aggregation information is reported, the log warning server can set different alarm condition quantity thresholds for different abnormal types. The more serious the problem corresponding to the abnormal type, the lower the quantity threshold, the easier it is to meet the alarm condition, the more sensitive the alarm, and the easier it is to receive the alarm. When the problem corresponding to the abnormal type is not serious, the quantity threshold is higher and it is not easy to trigger the alarm, making the alarm setting more accurate, which not only ensures the alarm of serious problems but also avoids the cost problem caused by frequent alarms of minor problems.

[0070] The application exception detection scheme provided by the disclosed embodiment obtains exception verification rules, wherein the exception verification rules are used to detect abnormal problems of the non-abnormal exit type of the target application; the operation log of the target application is detected in real time using the exception verification rules to determine the abnormal log; the abnormal aggregation information corresponding to the abnormal log is reported to the monitoring platform, so that the log warning server obtains the abnormal aggregation information from the monitoring platform and issues an alarm when the abnormal aggregation information meets the alarm condition. With the above technical scheme, the operation log can be monitored in real time and the abnormal log can be determined through the exception verification rules obtained when the application is started. After the abnormal aggregation information corresponding to the abnormal log is reported to the monitoring platform, the log warning server can issue an alarm when the abnormal aggregation information meets the alarm condition. Through real-time log detection, the abnormal problems of the non-abnormal exit type of the application can be actively detected, the abnormalities can be discovered in time and an alarm can be issued to avoid the escape of the abnormal problems, thereby effectively improving the operation stability of the application.

[0071] Next, the abnormality detection scheme of the application program of the embodiment of the present disclosure is further described by a specific example. Figure 3 A schematic diagram of an abnormality detection process of an application provided in an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the anomaly detection process of the application may include: 1. Entering the anomaly verification rules in the log management platform and writing the anomaly verification rules into the log warning server; 2. After startup, the client will pull the anomaly verification rules just entered from the log warning server, and the client is the target application; 3. The client will detect the local operation log in real time, and verify whether the program is running normally at this time and whether there are any abnormal problems other than abnormal exit through the anomaly verification rules just pulled; 4. If an abnormal problem other than abnormal exit is found, it will be determined that the abnormal log generates abnormal aggregation information and report it to the monitoring platform in the form of custom exceptions; 5. The log warning server can regularly pull the corresponding abnormal aggregation information from the monitoring platform through the application program interface, and combine the configuration of the quantity threshold in the alarm condition to decide whether the alarm message needs to be sent to the corresponding person in charge.

[0072] This solution uses the exception verification rules of the application to proactively identify non-abnormal exit problems that may occur during user use of the local operation log, and reports unexpected behaviors as abnormalities. It also establishes alarm capabilities through cloud services, and issues alarms when the alarm conditions are met, quickly resolving non-abnormal exit problems, preventing major accidents, and effectively reducing losses caused by abnormalities.

[0073] Figure 4 This is a schematic diagram of the structure of an abnormality detection device for an application provided by an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 4 As shown, the device comprises:

[0074] The acquisition module 401 is used to acquire an exception verification rule, wherein the exception verification rule is used to detect an abnormal problem of a non-abnormal exit type of the target application;

[0075] The detection module 402 is used to detect the operation log of the target application in real time using the anomaly verification rule to determine the abnormal log;

[0076] The reporting module 403 is used to report the abnormal aggregation information corresponding to the abnormal log to the monitoring platform, so that the log warning server obtains the abnormal aggregation information from the monitoring platform and issues an alarm when the abnormal aggregation information meets the alarm condition.

[0077] Optionally, the acquisition module 401 is used to:

[0078] The abnormality verification rule is obtained from the log warning server after the target application is started, wherein the abnormality verification rule is written into the log warning server by the log management platform.

[0079] Optionally, the exception verification rule includes at least one of the following: life cycle rule, jump exception rule, component display exception rule, and code logic exception rule.

[0080] Optionally, the detection module 402 includes at least one of the following units:

[0081] The first unit is used to extract part of the logs in the operation log that do not conform to the preset life cycle of the corresponding scenario according to the life cycle rule, and determine the part of the logs as abnormal logs;

[0082] The second unit is used to determine part of the logs in the operation log that have early jumps, jump failures or jump errors as abnormal logs according to the jump abnormality rule;

[0083] A third unit is used to extract a component log that fails to load or displays an error in the operation log according to the component display exception rule, and determine the component log as an exception log;

[0084] The fourth unit is used to determine the part of the operation log that does not run according to the code logic as an abnormal log according to the code logic abnormality rule.

[0085] Optionally, the reporting module 403 is used to:

[0086] Combining the exception log and the corresponding exception type to generate the exception aggregation information;

[0087] The abnormal aggregation information is reported to the monitoring platform.

[0088] Optionally, the alarm condition is used to determine that the abnormal aggregate information meets the alarm condition when it is determined that the amount of the abnormal aggregate information is greater than a corresponding amount threshold.

[0089] Optionally, the quantity threshold is determined according to the problem level corresponding to the abnormal type, and the higher the problem level, the lower the quantity threshold.

[0090] The application anomaly detection device provided in the embodiments of the present disclosure can execute the application anomaly detection method provided in any embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method.

[0091] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the anomaly detection method for an application program provided by any embodiment of the present disclosure.

[0092] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure.

[0093] The following specific reference Figure 5 , which shows a schematic diagram of the structure of an electronic device 500 suitable for implementing the embodiment of the present disclosure. The electronic device 500 in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0094] like Figure 5As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0095] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0096] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the abnormality detection method of the application program of the embodiment of the present disclosure are executed.

[0097] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0098] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0099] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0100] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains an exception verification rule, wherein the exception verification rule is used to detect abnormal problems of the non-abnormal exit type of the target application; uses the exception verification rule to detect the operation log of the target application in real time to determine the abnormal log; reports the abnormal aggregation information corresponding to the abnormal log to the monitoring platform, so that the log warning server obtains the abnormal aggregation information from the monitoring platform and issues an alarm when the abnormal aggregation information meets the alarm condition.

[0101] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0102] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0104] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0105] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0107] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0108] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0109] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A method for detecting anomalies in an application, characterized in that: include: Acquire an exception verification rule, wherein the exception verification rule is used to detect an exception problem of a non-abnormal exit type of the target application program; Using the anomaly verification rules to detect the running log of the target application in real time and determine the abnormal log; The abnormal aggregate information corresponding to the abnormal log is reported to the monitoring platform, so that the log warning server obtains the abnormal aggregate information from the monitoring platform and issues an alarm when the abnormal aggregate information meets the alarm condition.

2. The method according to claim 1, characterized in that The obtaining of the abnormality verification rule includes: After the target application is started, the anomaly verification rule is obtained from the log warning server, wherein the anomaly verification rule is written into the log warning server by the log management platform.

3. The method according to claim 1, characterized in that The exception checking rules include at least one of the following: life cycle rules, jump exception rules, component display exception rules, and code logic exception rules.

4. The method according to claim 3, characterized in that The operation log of the target application is detected in real time using the anomaly verification rule to determine the anomaly log, including at least one of the following: Extracting part of the operation log that does not conform to the preset life cycle of the corresponding scenario according to the life cycle rule, and determining the part of the log as an abnormal log; According to the jump exception rule, part of the logs in the operation logs having early jumps, jump failures or jump errors are determined as abnormal logs; Extracting the component log that fails to load or displays an error in the operation log according to the component display exception rule, and determining the component log as an exception log; According to the code logic exception rule, a part of the operation log that does not run according to the code logic is determined as an abnormal log.

5. The method according to claim 1, characterized in that Reporting the abnormal aggregate information corresponding to the abnormal log to the monitoring platform includes: Combining the exception log and the corresponding exception type to generate the exception aggregation information; The abnormal aggregation information is reported to the monitoring platform.

6. The method according to claim 5, characterized in that The alarm condition is used to determine that the abnormal aggregate information meets the alarm condition when it is determined that the amount of the abnormal aggregate information is greater than the corresponding amount threshold.

7. The method according to claim 6, characterized in that The quantity threshold is determined according to the problem level corresponding to the abnormal type. The higher the problem level, the lower the quantity threshold.

8. An abnormality detection device for an application, characterized in that: include: An acquisition module, used for acquiring an exception verification rule, wherein the exception verification rule is used for detecting an abnormal problem of a non-abnormal exit type of the target application program; A detection module, used to detect the operation log of the target application in real time using the anomaly verification rule to determine the abnormal log; The reporting module is used to report the abnormal aggregation information corresponding to the abnormal log to the monitoring platform, so that the log warning server obtains the abnormal aggregation information from the monitoring platform and issues an alarm when the abnormal aggregation information meets the alarm condition.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the anomaly detection method for the application program described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the anomaly detection method for the application program described in any one of claims 1 to 7.

Images