AI application anomaly detection method, electronic equipment, storage medium and program product

Abstract

The invention provides an AI application anomaly detection method, electronic equipment, a storage medium and a program product, and belongs to the technical field of artificial intelligence. The method comprises the steps that the target execution time length of an API calling sequence is obtained, the API calling sequence refers to a periodic sequence formed by APIs in a hijacking library according to a calling sequence when an AI application provides target service, the hijacking library is used for hijacking calling instructions of the AI application for APIs in a dynamic link library, the hijacking library and the dynamic link library have the same API, and the target execution time length of the API calling sequence is obtained; the target execution duration is the execution duration of the API calling sequence when the AI application provides any target service; obtaining a reference execution time length of the API calling sequence, wherein the reference execution time length is an execution time length of the API calling sequence when the AI application provides a target service once in a normal state; and when the target execution duration exceeds the reference execution duration, determining that the AI application is in an abnormal state. According to the method, the AI application exception can be detected based on the API calling sequence.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an AI application anomaly detection method, electronic device, storage medium and program product. Background Art

[0002] AI (Artificial Intelligence) applications refer to applications that use artificial intelligence technology to provide services. AI applications are generally divided into two scenarios: training and reasoning. In the training scenario, a large amount of data is used to perform multiple rounds of iterative training on AI applications; in the reasoning scenario, AI applications are deployed in electronic devices and then provide services through external interfaces.

[0003] AI applications involve many components in actual deployment, and it is difficult to require users to add specified anomaly detection logic code in AI applications. Therefore, it is difficult to detect anomalies during the operation of AI applications, resulting in low availability of AI applications. In order to improve the availability of AI applications, it is urgent to provide an AI application anomaly detection method so that effective processing measures can be taken in a timely manner when AI application anomalies are detected. Summary of the invention

[0004] The embodiment of the present application provides an AI application anomaly detection method, electronic device, storage medium and program product, which can detect AI application anomalies based on the execution time of the API (Application Programming Interface) call sequence when the AI ​​application provides the target service. The technical solution is as follows: In a first aspect, a method for detecting anomalies in an AI application is provided, the method comprising: Obtaining a target execution duration of an API call sequence, wherein the API call sequence refers to a periodic sequence of APIs in a hijacked library in a calling order when the AI ​​application provides a target service, wherein the hijacked library is used to hijack the calling instructions of the AI ​​application to the API in the dynamic link library, and the hijacked library and the dynamic link library have the same API, and the target execution duration is the execution duration of the API call sequence when the AI ​​application provides any target service; Obtaining a reference execution time of the API call sequence, where the reference execution time refers to a time used to measure whether the AI ​​application is in an abnormal state; When the target execution time exceeds the reference execution time, it is determined that the AI ​​application is in an abnormal state.

[0005] In a second aspect, a device for detecting anomalies in AI applications is provided, the device comprising: A first acquisition module is used to acquire a target execution duration of an application programming interface (API) call sequence, wherein the API call sequence refers to a periodic sequence of APIs in a hijacking library formed in a calling order when the AI ​​application provides a target service, wherein the hijacking library is used to hijack the calling instructions of the AI ​​application to the API in the dynamic link library, and the hijacking library and the dynamic link library have the same API, and the target execution duration is the execution duration of the API call sequence when the AI ​​application provides any target service; A second acquisition module is used to obtain a reference execution time of the API call sequence, where the reference execution time refers to a time used to measure whether the AI ​​application is in an abnormal state; A determination module is used to determine that the AI ​​application is in an abnormal state when the target execution time exceeds the reference execution time.

[0006] In a third aspect, an electronic device is provided, comprising a processor and a memory; the memory stores at least one program code; the at least one program code is used to be called and executed by the processor to implement the artificial intelligence AI application anomaly detection method described in the first aspect.

[0007] In a fourth aspect, a computer-readable storage medium is provided, wherein at least one computer program is stored in the computer-readable storage medium, and when the at least one computer program is executed by a processor, the artificial intelligence (AI) application anomaly detection method described in the first aspect can be implemented.

[0008] In a fifth aspect, a computer program product is provided, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the artificial intelligence (AI) application anomaly detection method described in the first aspect can be implemented.

[0009] The beneficial effects of the technical solution provided by the embodiment of the present application are: In the embodiment of the present application, each API in the dynamic link library has certain semantic information. When an exception occurs during the process of the AI ​​application calling the API, the called API can help the user analyze and locate the exception of the AI ​​application. When different AI applications provide different services, the APIs called in the dynamic link library are different, while when the same AI application provides the same service, the APIs called in the dynamic link library are the same, and the API call sequence corresponding to the same AI application is fixed and has obvious periodicity. In order to facilitate the recording of the calls of different AI applications to the API in the dynamic link library, the embodiment of the present application deploys a hijacking library on the basis of the dynamic link library. The hijacking library and the dynamic link library have the same API. When the AI ​​application provides the target service and needs to call the API in the dynamic link library, the hijacking library can hijack the AI ​​application's call instruction to the API in the dynamic link library to intercept the call to the API in the dynamic link library as a call to the same API in the hijacking library, and then determine the API call sequence based on the call sequence of the API in the hijacking library. The API call sequence is a periodic sequence composed of the API in the hijacking library according to the call sequence when the AI ​​application provides the target service. When anomaly detection of an AI application is required, the target execution time of the API call sequence when the AI ​​application provides any target service is obtained, and the reference execution time of the API call sequence is obtained. The reference execution time is the time used to measure whether the AI ​​application is in an abnormal state, and then the target execution time is compared with the reference execution time. If the target execution time exceeds the reference execution time, it can be determined that the AI ​​application is in an abnormal state. The embodiment of the present application realizes anomaly detection of AI applications non-invasively based on the inherent API call sequence of the AI ​​application providing the target service, and the detection result is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1 It is a schematic diagram of the principle and overall structure of an AI application anomaly detection method provided in an embodiment of the present application; Figure 2 is a flow chart of an AI application anomaly detection method provided in an embodiment of the present application; Figure 3 It is a flowchart of a method for determining an API call sequence provided in an embodiment of the present application; Figure 4It is a schematic diagram of the flow between different state machines of an AI application provided in an embodiment of the present application; Figure 5 It is a flowchart of a method for determining a target execution time of an API call sequence provided in an embodiment of the present application; Figure 6 This is a schematic diagram of the structure of an AI application anomaly detection device provided in an embodiment of the present application; Figure 7 A structural block diagram of an electronic device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0012] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0013] It can be understood that the terms "each", "multiple", and "any" used in the embodiments of the present application include two or more, each refers to each of the corresponding multiple, and any refers to any one of the corresponding multiple. For example, the multiple words include 10 words, and each word refers to each of the 10 words, and any word refers to any one of the 10 words.

[0014] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0015] Before executing the embodiments of the present application, the terms involved in the embodiments of the present application are first explained.

[0016] An API is a set of predefined functions that give applications and developers the ability to directly access hardware and software resources without having to understand the details of the internal working mechanisms.

[0017] An online learning algorithm is an algorithm that can adaptively process data that arrives in time sequence and adjust its own behavioral decisions.

[0018] A watchdog is a program used to monitor the running status of other software or systems.

[0019] Dynamic link library is a way to implement shared function library in operating system. Dynamic link library file is a non-executable binary program file that allows programs to share code and other resources necessary to perform special tasks. Dynamic linking provides a way for a process to call functions that are not part of its executable code. Using dynamic link library makes it easier to apply updates to individual modules without affecting other parts of the program.

[0020] RPC (Remote Procedure Call Protocol) server refers to a protocol that requests services from remote computer programs over the network without having to understand the underlying network technology. RPC uses the client / server model. The requesting program is a client, and the service provider is a server. First, the calling process sends a call message with process parameters to the service process, and then waits for a reply message. On the server side, the process remains in a dormant state until the call message arrives. When a call message arrives, the server obtains the process parameters, calculates the results, sends a reply message, and then waits for the next call message. Finally, the client calls the process to receive the reply message, obtains the process result, and then the call execution continues.

[0021] Artificial intelligence is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is also the study of the design principles and implementation methods of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making.

[0022] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0023] With the research and advancement of artificial intelligence technology, artificial intelligence technology has been studied and applied in many fields, such as common smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, unmanned driving, autonomous driving, robots, smart medical care, smart customer service, etc. I believe that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0024] AI applications, or artificial intelligence applications, refer to applications developed using artificial intelligence technology. The scope of AI applications is very broad, covering various fields. The following are some typical AI application scenarios: Natural Language Processing Chatbot: Able to interact with users in natural language, answer questions, provide services, etc.

[0025] Voice Assistant: Complete various tasks through voice commands.

[0026] Computer Vision Image recognition: Identify objects, faces, text, etc. in images Video surveillance: Use AI technology for intelligent monitoring to improve security.

[0027] Machine Learning Data analysis: Processing massive amounts of data, identifying consumption patterns and trends, and providing support for decision making.

[0028] AI applications are generally divided into two scenarios: training and reasoning. In the training scenario, a large amount of data is used to perform multiple rounds of iterative training on AI applications to improve the availability of AI applications; in the reasoning scenario, AI applications are deployed to Web servers / RPC servers, and then services are provided through external interfaces. GPUs (Graphics Processing Units) are used in the training and reasoning processes of AI applications due to their powerful parallel processing capabilities and high throughput.

[0029] However, AI applications have a long life cycle, and heterogeneous computing units, such as GPUs, have a higher probability of hardware and software errors than CPU computing units. However, AI applications involve many components in actual deployment, and it is difficult to locate whether the error is caused by a heterogeneous computing unit when an AI application is abnormal. In addition, it is difficult for cloud service providers to require users to add abnormality detection logic code specified by the cloud service provider to AI applications. Therefore, it is difficult to detect abnormal situations during the operation of AI applications, especially abnormalities of heterogeneous computing units, resulting in low availability of AI applications.

[0030] Considering that when developing AI applications, developers need to control heterogeneous computing units through APIs provided by equipment manufacturers, and these APIs have clear semantic information, which can assist in analyzing and locating problems when anomalies occur. At the same time, in training and reasoning scenarios, AI applications have obvious periodic characteristics in calling APIs in dynamic link libraries, and the API call sequence called when the same AI application provides the same service is fixed. In view of this, an embodiment of the present application provides an AI application anomaly detection method based on an API call sequence, which intercepts calls to APIs in a dynamic link library through a hijacking library, records the called APIs, and uses an adaptive online learning algorithm based on the called APIs to find the periodicity of API calls, and then determine the API call sequence, thereby detecting whether an AI application has an anomaly based on the API call sequence.

[0031] The embodiment of the present application performs anomaly detection on AI applications based on the API call sequence of AI applications in combination with online learning algorithms, which can help users identify abnormal events during the operation of AI applications non-invasively and at low cost, and has the advantages of non-invasiveness, adaptability, low overhead, versatility, and dynamic switching.

[0032] Non-intrusive means that fault detection can be achieved without the user noticing, without the user having to modify the logic code of the AI ​​application.

[0033] Adaptation means that the online learning algorithm can adapt to a variety of AI applications, perform fault detection on a variety of AI applications, and achieve plug-and-play.

[0034] Low overhead means that the overhead of fault detection and analysis can be reduced to avoid affecting the performance of AI applications.

[0035] Universality means that the detection method is universal and does not need to be locked to a hardware manufacturer.

[0036] The dynamic switch means that when anomaly detection of AI applications is required, the corresponding services of AI applications are provided and anomaly detection of AI applications is performed; when anomaly detection of AI applications is not required, the corresponding services of AI applications are provided, and no anomaly detection of AI applications is performed.

[0037] The embodiment of the present application provides an AI application anomaly detection method, the AI ​​application can be deployed in an electronic device, the electronic device can be a terminal, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the electronic device can also be a server, such as an independent physical server, a server cluster or a distributed system composed of multiple physical servers, and a cloud server that provides basic cloud computing services such as cloud services, cloud computing, cloud functions, cloud storage, network services, cloud communications, and artificial intelligence platforms. Figure 1,In order to realize abnormal detection of AI applications, the electronic device may include a dynamic link library, a hijacking library and a dynamic switch.

[0038] The dynamic link library is a shared function library used by various applications in the electronic device. The dynamic link library includes multiple functions, and multiple functions correspond to multiple APIs. By building a dynamic link library, the memory of the electronic device can be saved and the data reuse rate can be improved.

[0039] The hijacking library has the same API interface as the dynamic link library, and can hijack the AI ​​application's call instructions to the API in the dynamic link library during dynamic linking, that is, intercept the call to the API in the dynamic link library as a call to the same API in the hijacking library, and then replace the API in the call instruction. Specifically, when any AI application is started in a training scenario or a reasoning scenario, the electronic device loads the dynamic link library and the hijacking library into the AI ​​application process, and then hijacks the AI ​​application's call instructions to the API in the dynamic link library in the training scenario or the reasoning scenario during dynamic linking, replaces the API in the call instruction with the storage address of the API in the dynamic link library in the AI ​​application process, and then sends the replaced call instruction to the dynamic link library to implement the AI ​​application's call to the API in the dynamic link library in the training scenario or the reasoning scenario.

[0040] The dynamic switch is the interface for switching the anomaly detection function provided by the hijacking library. The dynamic switch can be a file system mount point, and the anomaly detection function of the hijacking library can be turned on and off in real time according to demand, reducing runtime overhead and avoiding affecting the normal operation of AI applications. When the dynamic switch is on, anomaly detection operations can be performed on AI applications; when the dynamic switch is off, anomaly detection operations are not performed on AI applications.

[0041] Taking any AI application as an example, the anomaly detection process of the above-mentioned AI application specifically includes: when any AI application is started in a training scenario or a reasoning scenario, the electronic device loads the dynamic link library and the hijacking library into the AI ​​application process. If the dynamic switch is in the on state, the electronic device executes the AI ​​application process, hijacks the call instruction of the AI ​​application to the API in the dynamic link library in the training scenario or the reasoning scenario through the hijacking library, replaces the API in the call instruction with the storage address of the API in the dynamic link library in the AI ​​application process, obtains the replaced call instruction, sends the replaced call instruction to the dynamic link library, and then records the call of the AI ​​application to the API in the hijacking library in the training scenario or the reasoning scenario, and then uses the online learning algorithm to analyze the recorded API to obtain the periodic API call sequence of the AI ​​application in the training scenario or the reasoning scenario, and then detects the anomaly in the AI ​​application based on the periodic API call sequence. If the dynamic switch is in the off state, the electronic device executes the AI ​​application process, hijacks the AI ​​application's call instruction to the API in the dynamic link library in a training scenario or inference scenario through the hijacking library, replaces the API in the call instruction with the storage address of the API in the dynamic link library in the AI ​​application process, obtains the replaced call instruction, and sends the replaced call instruction to the dynamic link library to implement the call to the API in the dynamic link library.

[0042] Furthermore, when detecting abnormal situations in AI applications based on the periodic API call sequence, an application abnormality timeout alarm mechanism based on the API call sequence can be set based on the watchdog mechanism, such as setting the execution time of the API call sequence. If it is detected that the API call sequence is not executed within the set time when the AI ​​application provides services, it can be determined that the AI ​​application is abnormal. If it is detected that the API call sequence is executed within the set time when the AI ​​application provides services, the maximum execution time of the API call sequence when the AI ​​application is in a normal state can also be obtained. If it is detected that the execution time of the API call sequence when the AI ​​application provides services exceeds the maximum execution time under normal conditions, it can be determined that the AI ​​application is abnormal.

[0043] Furthermore, when an AI application anomaly is detected, prompt information about the AI ​​application anomaly can be reported through an external management and control interface so that users can take timely measures to handle the anomaly.

[0044] The present application embodiment provides an AI application anomaly detection method, taking an electronic device executing the present application embodiment as an example, see Figure 2 , the method flow provided in the embodiment of the present application includes: 201. Obtain a target execution time of an application programming interface (API) call sequence.

[0045] In an embodiment of the present application, each application in the electronic device shares a dynamic link library and a hijacking library. For any AI application, the AI ​​application is generally divided into a training scenario and a reasoning scenario. No matter what scenario the AI ​​application is in, when the AI ​​application is started, the electronic device will load the dynamic link library and the hijacking library into the AI ​​application process corresponding to the AI ​​application. The dynamic link library includes multiple APIs, and each API in the dynamic link library corresponds to a storage address in the AI ​​application process. When the AI ​​application is running in a training scenario or a reasoning scenario, in response to any acquisition request for a target service of the AI ​​application, the electronic device can provide the target service by executing the AI ​​application process. When providing the target service, the electronic device can also perform anomaly detection on the AI ​​application. In order to achieve anomaly detection of the AI ​​application, the electronic device needs to obtain the target execution time of the API call sequence.

[0046] Among them, the API call sequence refers to the periodic sequence formed by the API in the hijacking library in accordance with the calling order when the AI ​​application provides the target service. The hijacking library is used to hijack the calling instructions of the AI ​​application to the API in the dynamic link library, and the hijacking library and the dynamic link library have the same API. Generally speaking, the dynamic link library can be shared by various applications in the electronic device, and cannot be used to record the call of an application to the API in the dynamic link library, and the API called by the AI ​​application in different states is different. For this reason, the embodiment of the present application can record the API called by the AI ​​application based on the hijacking library in the process of the AI ​​application providing the target service, and obtain the state machine of the AI ​​application, and then determine the API call sequence based on the API recorded by the hijacking library and the state machine of the AI ​​application. Among them, the state machine of the AI ​​application includes an initialization state, a running state, and an end state. The initialization state refers to the state of the AI ​​application after the AI ​​application is started and before the API interface related to the target service in the hijacking library is called for the first time. The running state refers to the state of the AI ​​application after the periodic sequence is identified based on the called API. The end state refers to the state when the AI ​​application is closed. The embodiment of the present application uses a hijacking library to record the APIs called by the AI ​​application, and combines the states of the AI ​​application when calling these APIs, thereby providing a method for determining an API call sequence.

[0047] In an embodiment of the present application, based on the state machine of the API and AI application recorded in the hijacking library, an online learning algorithm can be used to determine the API call sequence. Figure 3 A flowchart showing a method for determining an API call sequence is shown in FIG. Figure 3 , the method comprises the following steps: 301. When the AI ​​application is started, determine that the AI ​​application is in an initialization state.

[0048] In the embodiment of the present application, when the AI ​​application is started, it can be assumed that the AI ​​application is in an initialization state.

[0049] 302. When the AI ​​application is in the initialization state, record the API called in the hijacking library when the AI ​​application provides the target service.

[0050] When the AI ​​application is in the initialization state, each API called will be recorded. When the AI ​​application is in the initialization state, the called APIs are all APIs in the initialization phase and will not be used to determine the periodic API call sequence.

[0051] 303. When it is detected that the time duration during which the API in the hijacking library is not called by the AI ​​application reaches a first preset time duration, it is determined that the AI ​​application is in a running state.

[0052] Among them, the first preset duration can be set by the technician. When it is detected that the time for which the API in the hijacking library has not been called by the AI ​​application reaches the first preset duration, it can be considered that the initialization state is completed. In the training scenario, it can be considered that the input of the previous training batch is completed but the next training batch has not been input, and the input gap between the two training batches is greater than the first preset duration. In the input gap between the two training batches, the API in the hijacking library will not be called. At this time, the initialization state is considered to be completed; in the reasoning scenario, it can be considered that the current reasoning request is received but the next reasoning request is not received, and the receiving gap between the two reasoning requests is greater than the first preset duration. In the receiving gap between the two reasoning requests, the API in the hijacking library will not be called. At this time, the initialization state is considered to be completed.

[0053] In another embodiment of the present application, when the AI ​​application is in the running state, if any API is called for the first time, it can be considered that the initialization state is not completed. At this time, the AI ​​application will be rolled back from the running state to the initialization state.

[0054] 304. When the AI ​​application is in operation, determine the API call sequence based on the API called in the hijack library when the AI ​​application provides the target service.

[0055] After the AI ​​application is started, the embodiment of the present application determines the running state of the AI ​​application, and then, when the AI ​​application is in the running state, determines the API call sequence based on the API called in the hijack library when the AI ​​application provides the target service, thereby providing a method for determining the API call sequence.

[0056] Specifically, when the AI ​​application is in operation, a large language model can be called to identify the API called in the hijacking library when the AI ​​application provides the target service to determine the API call sequence. The API call sequence can also be determined based on the API called in the hijacking library when the AI ​​application provides the target service and the length of time that the API in the hijacking library is not called. Of course, other methods can also be used to determine the API call sequence, which will not be described one by one in the embodiments of the present application. Taking the determination of the API call sequence based on the API called in the hijacking library when the AI ​​application provides the target service and the length of time that the API in the hijacking library is not called as an example, if the length of time that the API in the hijacking library is not called reaches the second preset length, and the API called in the hijacking library when the AI ​​application provides the target service is periodic, the periodic API call sequence is used as the API call sequence. Among them, the second preset length can be set by a technician, and the API call sequence can be marked as T. Generally speaking, the AI ​​applications in the embodiments of the present application include training scenarios and reasoning scenarios. In the training scenario, a start mark can be added to the API to be hijacked by the hijacking library before any training batch is input, or an end mark can be added to the API hijacked by the hijacking library after any training batch is input. When the time during which the API in the hijacking library has not been called reaches a second preset time, the periodic API call sequence can be added as an API call sequence based on the start mark or end mark recorded in the hijacking library; in the reasoning scenario, a start mark can be added to the API to be hijacked by the hijacking library after the last reasoning request is executed and before the next reasoning request is received, or an end mark can be added to the API to be hijacked by the hijacking library after the next reasoning request is executed, and the periodic API call sequence can be added as an API call sequence. The periodic start sequence. Assuming that the second preset time is 10 seconds, when the AI ​​application is in operation, if it is detected that the time for which the API in the hijacking library has not been called reaches 10 seconds, and the API sequence A1A2A3 called by the AI ​​application is obtained to be periodic, then A1A2A3 is used as the API call sequence. Furthermore, when the AI ​​application is in operation, after the API call sequence is determined, the API call sequence each time the AI ​​application provides the target service can be recorded based on the period start mark or period end mark of the learned API call sequence.

[0057] In another embodiment of the present application, taking the reasoning scenario as an example, if the electronic device receives multiple consecutive reasoning requests, in response to the multiple consecutive reasoning requests, the hijacking library will record the API sequence called by the multiple reasonings, and mistakenly identify the API sequence called by the multiple reasonings as a cycle, resulting in an inaccurate recorded API call sequence. To improve the accuracy of the API call sequence, when the AI ​​application is in a running state, based on the API called in the hijacking library when the AI ​​application provides the target service, after using the periodic API call sequence as the API call sequence, the hijacking library continues to hijack the AI ​​application to provide the target service. The call instructions for the API in the dynamic link library, if a new API call sequence is obtained, and the first sequence length of the new API call sequence is less than the second sequence length of the API call sequence, the API call sequence is updated to the new API call sequence. Among them, the new API call sequence can be marked as S, the ,in, , , …, The API included in the new API call sequence. The sequence length of the API call sequence can be determined according to the number of APIs included in the call sequence. If one API call sequence is A1A2A3A1A2A3, the sequence length of the API call sequence can be determined to be 6; if another API call sequence is A1A2A3, the sequence length of the API call sequence can be determined to be 3. Assuming that the new API call sequence S is A1A2A3, the determined API call sequence T is A1A2A3A1A2A3, the first sequence length of the new API call sequence S is 3, and the second sequence length of the determined API call sequence T is 6. If the first sequence length is less than the second sequence length, the API call sequence T can be updated to the new API call sequence S, that is, the new API call sequence A1A2A3 is determined as the API call sequence corresponding to the AI ​​application.

[0058] In another embodiment of the present application, when the AI ​​application is in the initialization state or the running state, when the specified API in the hijacking library is called, it can be considered that the AI ​​application process is terminated, and then the AI ​​application is switched to the end state, thereby stopping the abnormal detection of the AI ​​application. Among them, the specified API refers to the API used to shut down the AI ​​application. Furthermore, after the AI ​​application is switched to the end state, a prompt message will be sent to the upper-level management and control component to prompt that the AI ​​application has stopped running.

[0059] Figure 4 The process of online learning / detection based on the state machine of AI application is shown, through which the API call sequence of AI application can be identified. Figure 4When the AI ​​application is started, the AI ​​application is in the initialization state. At this time, the APIs called by the AI ​​application when providing the target service belong to the APIs in the initialization phase. If the API in the hijacking library has not been called for a period of time, it can be considered that the initialization phase of the AI ​​application is completed, and then the state machine of the AI ​​application is converted to the running state. When the AI ​​application is in the running state, if it is detected that an API in the hijacking library is called for the first time, it means that the initialization phase has not been completed. At this time, the running state is rolled back to the initialization state. In the running state, if the API in the hijacking library has not been called for a period of time, and the API called in the hijacking library when the AI ​​application provides the target service is periodic, the periodic API call sequence T is used as the API call sequence. If a new API call sequence is obtained in a certain cycle of the running state If the new API call sequence If the number of APIs in the API call sequence T is less than the number of APIs in the API call sequence T, the API call sequence T is updated to the new API call sequence If the specified API in the hijacking library is called, the AI ​​application process is considered to be ended, and the AI ​​application is switched to the end state, and then a prompt message is sent to the upper-level control component to prompt the upper-level control component that the AI ​​application has stopped running.

[0060] Among them, the target execution time is the execution time of the API call sequence when the AI ​​application provides any target service. Figure 5 The method for determining the target execution time of an API call sequence is shown in Figure 5 , the method comprises the following steps: 501. When the AI ​​application provides any target service, at least one API call instruction is generated, and the at least one API call instruction includes an API in the API call sequence.

[0061] Based on the determined API call sequence, when the AI ​​application provides any target service, an API call instruction can be generated for each API in the API call sequence to obtain at least one API call instruction, and the at least one API call instruction respectively includes an API in the API call sequence.

[0062] 502. Hijack at least one API call instruction based on the hijacking library, and replace the API in the at least one API call instruction hijacked by the hijacking library with the storage address of the corresponding API in the dynamic link library in the AI ​​application process, to obtain at least one replaced API call instruction.

[0063] After generating at least one API call instruction, the hijacking library hijacks at least one API call instruction in the execution order of the at least one API call instruction, and replaces the API in each API call instruction hijacked by the hijacking library with the storage address of the corresponding API in the dynamic link library in the AI ​​application process, to obtain at least one replaced API call instruction.

[0064] 503. Call the resource stored at the storage address in at least one replaced API call instruction by executing the AI ​​application process.

[0065] 504. Obtain a sum of execution durations of at least one replaced API call instruction as a target execution duration.

[0066] The electronic device records the start execution time and end execution time of at least one replaced API call instruction, and then subtracts the start execution time from the end execution time of each replaced API call sequence to obtain the execution duration of each replaced API call sequence, and then adds the execution duration of at least one replaced API call instruction to obtain the total execution duration, and then determines the total execution duration as the target execution duration.

[0067] In an embodiment of the present application, when an AI application provides any target service, at least one API call instruction is generated based on each API included in the API call sequence, and the at least one API call instruction is hijacked and replaced through a hijacking library to record the API called in the process of the AI ​​application providing the target service and its execution time, thereby obtaining the execution duration of each replaced API call instruction, and obtaining the target execution duration of the AI ​​application providing the target service by adding the execution durations of each replaced API call instruction, thereby providing a method for determining the target execution duration.

[0068] In another embodiment of the present application, considering that abnormality detection of AI applications will bring certain resource consumption, and AI applications do not need to perform abnormality detection in real time, it is only necessary to turn on the dynamic switch when the AI ​​application runs slowly and the user requests detection. When the AI ​​application runs normally and the user does not request detection, there is no need to perform detection to reduce resource consumption. To this end, in response to any acquisition request for the target service of the AI ​​application before providing the target service, the electronic device can obtain the parameter value of the target parameter in the hijacking library. When the parameter value of the target parameter is a preset value, the target execution time of the API call sequence is obtained to perform abnormality detection on the AI ​​application. The target parameter is used to indicate whether to perform abnormality detection on the AI ​​application. The target parameter can be a state parameter of the dynamic switch. The preset value is used to indicate abnormality detection on the AI ​​application, and the preset value corresponds to the on state of the dynamic switch.

[0069] Furthermore, when the parameter value of the target parameter corresponds to the off state of the dynamic switch, the electronic device only needs to execute the AI ​​application process and call the resources stored at the storage address in at least one replaced API call instruction, without the need to perform abnormality detection on the AI ​​application.

[0070] 202. Get the reference execution time of the API call sequence.

[0071] Among them, the reference execution time refers to the time used to measure whether the AI ​​application is in an abnormal state. The reference execution time can be the maximum execution time of the API call sequence when the AI ​​application provides a target service once under normal conditions. The reference execution time can be set by the technician based on experience. It can also obtain multiple execution times of the API call sequence when the AI ​​application provides multiple target services under normal conditions, calculate the average of multiple execution times, and use the obtained average execution time as the reference execution time, or add a preset interference time to the average execution time to obtain the reference execution time.

[0072] 203. When the target execution time exceeds the reference execution time, it is determined that the AI ​​application is in an abnormal state.

[0073] When the target execution time exceeds the reference execution time, it can be determined that the AI ​​application is in an abnormal state. Further, when it is determined that the AI ​​application is in an abnormal state, a prompt message can be sent to the upper-level management and control component to prompt the AI ​​application to be abnormal.

[0074] In another embodiment of the present application, a third preset execution duration of the API call sequence can also be set based on the watchdog mechanism. The third execution duration is the maximum execution duration for the API call sequence to be executed, which can be set by a technician. Optionally, in the embodiment of the present application, during the process of the AI ​​application providing any target service, the execution duration of the API call sequence is recorded. If the API call sequence is completed within the third preset duration, the reference execution duration of the API call sequence can be obtained, and further judgment can be made based on the reference duration. If the API call sequence is not executed within the third preset duration when the AI ​​application provides any target service, it can be determined that the AI ​​application is in an abnormal state. Furthermore, when it is determined that the AI ​​application is in an abnormal state, a prompt message can be sent to the upper-level management and control component to prompt the AI ​​application to be abnormal.

[0075] The embodiment of the present application directly interacts with heterogeneous computing units by hijacking the underlying dynamic link library, without relying on the upper-level application framework, so that users can be unaware. In addition, by providing an interface in the file system, the embodiment of the present application detects the anomaly detection function according to demand, and the detection method is more flexible, saving the cost of electronic equipment. In addition, since only the API call sequence is analyzed, the detection overhead is low. In addition, the embodiment of the present application does not require the AI ​​application to be locked with the hardware manufacturer. It only needs to adjust the symbols in the hijacked library, and other parts do not need to be changed, so it is more compatible.

[0076] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0077] Please refer to Figure 6 , which shows a schematic diagram of the structure of an AI application anomaly detection device provided in an embodiment of the present application. The device can be implemented by software, hardware, or a combination of both, and becomes all or part of an electronic device. The device includes: The first acquisition module 601 is used to acquire the target execution duration of an application programming interface API call sequence, wherein the API call sequence refers to a periodic sequence formed by the API in the hijacking library according to the calling order when the AI ​​application provides a target service, wherein the hijacking library is used to hijack the calling instructions of the AI ​​application to the API in the dynamic link library, and the hijacking library and the dynamic link library have the same API, and the target execution duration is the execution duration of the API call sequence when the AI ​​application provides any target service; A second acquisition module 602 is used to acquire a reference execution time of the API call sequence, where the reference execution time refers to a time used to measure whether the AI ​​application is in an abnormal state; The first determination module 603 is used to determine that the AI ​​application is in an abnormal state when the target execution time exceeds the reference execution time.

[0078] In another embodiment of the present application, the first acquisition module 601 is used to generate at least one API call instruction when the AI ​​application provides the target service at any time, and the at least one API call instruction respectively includes an API in the API call sequence; based on the hijacking library hijacking the at least one API call instruction, and replacing the API in the at least one API call instruction hijacked by the hijacking library with the storage address of the corresponding API in the dynamic link library in the AI ​​application process, to obtain at least one replaced API call instruction; by executing the AI ​​application process, calling the API stored at the storage address in the at least one replaced API call instruction; obtaining the sum of the execution times corresponding to the at least one replaced API call instruction as the target execution time.

[0079] In another embodiment of the present application, the device further comprises: A loading module is used to load the dynamic link library and the hijacking library into the AI ​​application process after the AI ​​application is started, and each API in the dynamic link library corresponds to a storage address in the AI ​​application process.

[0080] In another embodiment of the present application, the device further comprises: The second determination module is used to determine the API call sequence based on the API recorded by the hijacking library and the state machine of the AI ​​application during the process of the AI ​​application providing the target service.

[0081] In another embodiment of the present application, a second determination module is used to determine that the AI ​​application is in an initialization state when the AI ​​application is started; when the AI ​​application is in the initialization state, record the API called in the hijacking library when the AI ​​application provides the target service; when it is detected that the time period during which the API in the hijacking library has not been called by the AI ​​application reaches a first preset time period, determine that the AI ​​application is in a running state; when the AI ​​application is in the running state, determine the API call sequence based on the API called in the hijacking library when the AI ​​application provides the target service.

[0082] In another embodiment of the present application, a second determination module is used to, when the AI ​​application is in a running state, determine a periodic API call sequence as the API call sequence if the time period during which the API in the hijacking library has not been called reaches a second preset time period, and the API in the hijacking library is called periodically when the AI ​​application provides a target service.

[0083] In another embodiment of the present application, the device further comprises: The rollback module is used to roll back the AI ​​application from the running state to the initialization state if any API is called for the first time when the AI ​​application is in the running state.

[0084] In another embodiment of the present application, the device further comprises: An updating module is used to update the API call sequence to the new API call sequence when the AI ​​application is in operation if a new API call sequence is acquired and a first sequence length of the new API call sequence is less than a second sequence length of the API call sequence.

[0085] In another embodiment of the present application, the device further comprises: A switching module is used to switch the AI ​​application to an end state when a specified API in the hijacking library is called when the AI ​​application is in an initialization state or a running state, wherein the specified API refers to an API used to close the AI ​​application.

[0086] In another embodiment of the present application, the device further comprises: A third acquisition module is used to obtain a parameter value of a target parameter in the hijacking library, where the target parameter is used to indicate whether to perform anomaly detection on the AI ​​application; The first acquisition module 601 is further configured to execute an operation of acquiring a target execution duration of an application programming interface API call sequence when the parameter value of the target parameter is a preset value.

[0087] In another embodiment of the present application, the device further comprises: The first acquisition module 601 is further configured to, during the process of the AI ​​application providing the target service at any time, if the API call sequence is executed and completed within a third preset time, execute an operation of acquiring a reference execution time of the API call sequence, and the third execution time is greater than the reference execution time; The third determination module is used to determine that the AI ​​application is in an abnormal state if the API call sequence is not executed within a third preset time period when the AI ​​application provides any target service.

[0088] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0089] Figure 7 The structure block diagram of an electronic device 700 provided by an exemplary embodiment of the present application is shown. Generally, the electronic device 700 includes: a processor 701 and a memory 702 .

[0090] The processor 701 can be implemented in at least one of the following hardware forms: DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 701 may also include a main processor and a coprocessor, wherein the main processor is a processor for processing data in an awake state; and the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 701 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 701 may also include an artificial intelligence processor, which is used to process computing operations related to machine learning.

[0091] The memory 702 may include one or more computer-readable storage media, which may be non-temporary computer-readable storage media, for example, the non-temporary computer-readable storage media may be CD-ROM (Compact Disc Read-Only Memory), ROM, RAM (Random Access Memory), magnetic tape, floppy disk and optical data storage device, etc. The computer-readable storage medium stores at least one computer program, which can implement the above-mentioned artificial intelligence AI application anomaly detection method when executed.

[0092] Of course, the above electronic device may also include other components, such as input / output interface, communication component, etc. The input / output interface provides an interface between the processor and the peripheral interface module, and the above peripheral interface module may be an output device, an input device, etc. The communication component is configured to facilitate wired or wireless communication between the electronic device and other devices.

[0093] Those skilled in the art will understand that Figure 7 The structure shown in the figure does not constitute a limitation on the electronic device 700, and may include more or less components than those shown in the figure, or combine some components, or adopt a different component arrangement.

[0094] An embodiment of the present application provides a computer-readable storage medium, in which at least one computer program is stored. When the at least one computer program is executed by a processor, the above-mentioned artificial intelligence (AI) application anomaly detection method can be implemented.

[0095] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it can implement the above-mentioned artificial intelligence (AI) application anomaly detection method.

[0096] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0097] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting anomalies in artificial intelligence (AI) applications, characterized in that: The method comprises: Obtaining a target execution duration of an application programming interface (API) call sequence, wherein the API call sequence refers to a periodic sequence of APIs in a hijacking library in accordance with a calling order when the AI ​​application provides a target service, wherein the hijacking library is used to hijack the calling instructions of the AI ​​application to the API in a dynamic link library, and the hijacking library and the dynamic link library have the same API, and the target execution duration is the execution duration of the API call sequence when the AI ​​application provides any target service; Obtaining a reference execution time of the API call sequence, where the reference execution time refers to a time used to measure whether the AI ​​application is in an abnormal state; When the target execution time exceeds the reference execution time, it is determined that the AI ​​application is in an abnormal state.

2. The method according to claim 1, characterized in that The step of obtaining the target execution time of the application programming interface (API) call sequence includes: When the AI ​​application provides the target service at any one time, generating at least one API call instruction, wherein the at least one API call instruction respectively includes an API in the API call sequence; Based on the hijacking library hijacking the at least one API call instruction, the API in the at least one API call instruction hijacked by the hijacking library is replaced with the storage address of the corresponding API in the dynamic link library in the AI ​​application process, thereby obtaining at least one replaced API call instruction; Calling the resource stored at the storage address in the at least one replaced API call instruction by executing the AI ​​application process; The sum of the execution times corresponding to the at least one replaced API call instruction is obtained as the target execution time.

3. The method according to claim 2, characterized in that Before replacing the API in at least one API call instruction hijacked by the hijacking library with the storage address of the corresponding API in the dynamic link library in the AI ​​application process to obtain at least one replaced API call instruction, the method further includes: When the AI ​​application is started, the dynamic link library and the hijacking library are loaded into the AI ​​application process, and each API in the dynamic link library corresponds to a storage address in the AI ​​application process.

4. The method according to claim 1, characterized in that: Before obtaining the target execution time of the API call sequence, the method further includes: In the process of the AI ​​application providing the target service, the API calling sequence is determined based on the API recorded by the hijacking library and the state machine of the AI ​​application.

5. The method according to claim 4, characterized in that In the process of the AI ​​application providing the target service, determining the API call sequence based on the API recorded by the hijacking library and the state machine of the AI ​​application includes: When the AI ​​application is started, determining that the AI ​​application is in an initialization state; When the AI ​​application is in an initialization state, recording the API called in the hijacking library when the AI ​​application provides the target service; When it is detected that the time duration for which the API in the hijacking library has not been called by the AI ​​application reaches a first preset time duration, determining that the AI ​​application is in a running state; When the AI ​​application is in a running state, the API calling sequence is determined based on the API called in the hijacking library when the AI ​​application provides a target service.

6. The method according to claim 5, characterized in that The step of determining the API call sequence based on the API called in the hijacking library when the AI ​​application provides a target service while the AI ​​application is in the running state includes: When the AI ​​application is in operation, if the time duration during which the API in the hijacking library has not been called reaches a second preset time duration, and the API in the hijacking library is called periodically when the AI ​​application provides the target service, the periodic API call sequence is determined as the API call sequence.

7. The method according to claim 6, characterized in that The method further comprises: When the AI ​​application is in the running state, if any API is called for the first time, the AI ​​application is rolled back from the running state to the initialization state.

8. The method according to claim 5, characterized in that The step of hijacking the API in the library when the AI ​​application is in the running state and taking the periodic API call sequence as the API call sequence based on the API called in the library when the AI ​​application provides the target service also includes: When the AI ​​application is in a running state, if a new API call sequence is acquired and a first sequence length of the new API call sequence is less than a second sequence length of the API call sequence, the API call sequence is updated to the new API call sequence.

9. The method according to claim 5, characterized in that The method further comprises: When the AI ​​application is in an initialization state or a running state, when a specified API in the hijacking library is called, the AI ​​application is switched to an end state, and the specified API refers to an API used to close the AI ​​application.

10. The method according to any one of claims 1 to 9, characterized in that Before obtaining the target execution time of the API call sequence, the method further includes: Obtaining a parameter value of a target parameter in the hijacking library, where the target parameter is used to indicate whether to perform anomaly detection on the AI ​​application; When the parameter value of the target parameter is a preset value, an operation of obtaining the target execution time of the application programming interface API call sequence is performed.

11. The method according to any one of claims 1 to 9, characterized in that The method further comprises: In the process of the AI ​​application providing any target service, if the API call sequence is executed and completed within a third preset duration, an operation of obtaining a reference execution duration of the API call sequence is performed, and the third execution duration is greater than the reference execution duration; If the API call sequence is not executed to completion within the third preset time length, it is determined that the AI ​​application is in an abnormal state.

12. An electronic device, characterized in that: It includes a processor and a memory; the memory stores at least one program code; the at least one program code is used to be called and executed by the processor to implement the artificial intelligence AI application anomaly detection method as described in any one of claims 1 to 11.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one computer program, and when the at least one computer program is executed by the processor, it can implement the artificial intelligence AI application anomaly detection method according to any one of claims 1 to 11.

14. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, it can implement the artificial intelligence AI application anomaly detection method according to any one of claims 1 to 11.

Images