Application performance detection method and device of service system, equipment and storage medium
By classifying and pairing request and response packets of the service system, determining processing performance parameters, clustering and abnormal detection, the limitations of traditional methods that are difficult to discover application performance problems, and accurate identification and optimization support for application performance problems of the service system are achieved.
Patent Information
- Application Number
- CN202411535419.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-30
- Publication Date
- 2025-03-11
AI Technical Summary
Traditional application performance detection methods are based on server log analysis, and have limitations in data dimensions and process dimensions, making it difficult to effectively discover application performance problems of business systems.
By classifying and pairing the request packets and response packets for the target application of the business system, processing performance parameters are determined, clustering and abnormality detection are performed to identify performance abnormalities.
It realizes accurate identification of business system application performance problems, provides data support for subsequent optimization, and improves the accuracy and effectiveness of detection.
Smart Images
Figure CN119597602A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to an application performance detection method, electronic device and storage medium of a business system. Background Art
[0002] Application performance testing of business systems is the key to optimizing business systems. Traditional application performance testing methods are based on the analysis of server logs of business systems. Log analysis methods have limitations in both the data and process dimensions of business systems, so traditional application performance testing methods often cannot effectively identify application performance problems in business systems. Summary of the invention
[0003] The purpose of this application is to provide an application performance detection method, electronic device and storage medium for a business system, which can accurately identify application performance problems of the business system and provide data support for subsequent related optimization.
[0004] In order to achieve the above purpose, the embodiment of the present application is implemented as follows: In a first aspect, a method for detecting application performance of a business system is provided, comprising: Classify and match request packets and response packets for multiple data packets of target applications of the business system; Determine, based on information of each paired request packet and response packet, a processing performance parameter of the target application for each request packet; Clustering all the request packets based on the processing performance parameter as a dimension, and determining suspicious request packets that are outliers under the processing performance dimension; Anomaly detection is performed on the suspicious request packet to determine whether performance anomalies occur in the target application according to the anomaly detection result.
[0005] In a second aspect, an application performance detection device for a business system is provided, comprising: A classification and matching unit, used for classifying and matching request packets and response packets of multiple data packets of a target application of a business system; a parameter determination unit, configured to determine a processing performance parameter of the target application for each of the request packets based on information of each paired request packet and response packet; A clustering execution unit, clustering all the request packets based on the processing performance parameter as a dimension, and determining suspicious request packets that are outliers under the processing performance dimension; The detection execution unit performs anomaly detection on the suspicious request packet to determine whether the target application has a performance anomaly according to the anomaly detection result.
[0006] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor; and a memory configured to store computer-executable instructions, wherein the computer-executable instructions, when executed, cause the processor to execute the method described in the first aspect.
[0007] According to a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store computer-executable instructions, and the computer-executable instructions implement the method described in the first aspect when executed by a processor.
[0008] The embodiment of the present application can classify and pair the request packets and response packets of the target application of the business system, and determine the processing performance parameters of the complete processing process from request to response of the target application based on the key information in the paired request packets and response packets; then, cluster the request packets based on the processing performance parameters, and perform more accurate anomaly detection on the outlier request packets, so as to finally identify whether the target application has performance anomalies. BRIEF DESCRIPTION OF THE DRAWINGS
[0009] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0010] Figure 1 This is a first flow chart of the application performance detection method of the business system according to an embodiment of the present application.
[0011] Figure 2 This is a second flow chart of the application performance detection method of the business system according to an embodiment of the present application.
[0012] Figure 3 This is a third flow chart of the application performance detection method of the business system according to an embodiment of the present application.
[0013] Figure 4 This is a schematic diagram of the structure of an application performance detection device for a business system according to an embodiment of the present application.
[0014] Figure 5 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION
[0015] As mentioned above, the traditional application performance testing method is based on the analysis of the server logs of the business system. The log analysis method has limitations in both the data dimension and the process dimension of the business system, so the traditional application performance testing method often cannot effectively identify the application performance problems of the business system.
[0016] In view of this, the present application aims to propose a new application performance detection scheme for a business system, which can classify and pair the request packets and response packets of the target application of the business system, and determine the processing performance parameters of the complete processing process from request to response of the target application based on the key information in the paired request packets and response packets; then, cluster the request packets according to the processing performance parameters, and perform more accurate anomaly detection on outlier request packets, so as to finally identify whether the target application has performance anomalies.
[0017] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.
[0018] An embodiment of the present application provides a method for detecting application performance of a business system. Figure 1 The figure is a flowchart of the application performance detection method, which includes the following steps: S102, classifying and pairing request packets and response packets for multiple data packets of a target application of the business system.
[0019] The multiple data packets described in this embodiment may include data packets entering and leaving the server of the target application.
[0020] In network communication, HTTP requests and responses are transmitted through TCP connections. Each HTTP request and response packet contains some key identification information, such as source IP, target IP, source port, target port, and session ID. This embodiment can use this identification information to pair request and response packets.
[0021] Correspondingly, the specific pairing process refers to Figure 2 The following steps are shown: (1) Traverse the processed data packet to determine whether it is a request packet or a response packet; (2) Create index keys: Generate a unique index key for each request and response packet for easy matching. The index key for the request packet includes the source IP, destination IP, source port, destination port, URL, and next sequence number; the index key for the response packet includes the destination IP, source IP, destination port, source port, URL, and confirmation number.
[0022] (3) Pairing requests and responses: Use the generated index key to pair the matching request and response data packets and record the corresponding timestamp, packet length and other information.
[0023] (4) Extract key information and give pairing results: For request response data packets with successful pairing, extract the capture timestamp of each data packet, calculate the time difference between the timestamps, and obtain the server's processing delay for the request; for data packets with failed pairing, give relevant information prompts.
[0024] S104: Determine a processing performance parameter of the target application for each request packet based on information of each paired request packet and response packet.
[0025] It should be understood that the paired request and response packets reflect the complete process of request-response processing. Therefore, after pairing, key data including request path, request time, response time, processing delay (response time minus request time), response data packet length, etc. can be extracted and stored in the database for management. This step ensures that meaningful application layer data is extracted from a large amount of network data, laying the foundation for subsequent analysis. Among them, processing delay is the processing performance parameter described in this step.
[0026] S106, clustering all request packets based on the processing performance parameter as a dimension, and determining suspicious request packets that are outliers under the processing performance dimension.
[0027] In the clustering process, this embodiment can select request packets with a specified number of clusters as initial cluster centers of the clusters; After that, multiple rounds of iterations are performed: the mathematical distance between each non-cluster center request packet and each cluster center is determined based on the processing performance parameter (such as processing delay); each non-cluster center request packet is classified into the cluster with the closest mathematical distance, and the cluster center of each cluster is updated. At this time, the updated cluster center is no longer the initially selected request; Through multiple rounds of iterations in this way, the request packet members and cluster center of each cluster can be continuously adjusted until convergence after multiple rounds of iterations. At this time, the target cluster with the least number of request packets can be selected as the outlier to identify the request packets in the target cluster as suspicious request packets.
[0028] In addition, in actual applications, different types of request packets correspond to different degrees of processing performance standards. All request packets can be classified according to the request type first, and then, for each request type, all request packets are clustered with the processing performance parameter as the dimension to determine the suspicious request packets that are outliers under the processing performance dimension. The request type may include, but is not limited to, at least one of: GET request, POST request, static resource request, and dynamic resource request.
[0029] Correspondingly, the following steps can be performed before clustering is performed: 1) Feature extraction and standardization: Feature extraction extracts key information (such as request path, processing delay, response data packet length, etc.) from successfully matched data packets as input for subsequent analysis. Standardization then eliminates the dimensional differences in feature values, making different features equally important in clustering and outlier detection.
[0030] 2) Request type classification: Different types of requests (such as GET, POST, static resources, etc.) have different properties and behavior patterns, involving different processing flows and resource consumption, and the difference in processing delay is more significant. This step classifies different types of requests, making application requests more comparable, and performing targeted cluster analysis and outlier detection to improve the accuracy and effectiveness of the analysis.
[0031] After that, cluster analysis is performed on different requests of the same type: for each type of application request (GET, POST, static resources, etc.) divided in the previous step, a clustering algorithm is used to cluster the standardized features to identify the common request patterns and the performance of the server when processing this type of request. Specific features include application request path, server processing delay, data packet capture time, and data packet length. The goal of clustering is to find small-category requests (such as getAllUserTodoData, getUserDoneData, etc. in the GET category) with discrete distribution of processing delay performance in requests belonging to the same large category (such as GET) as input data for subsequent anomaly detection.
[0032] Specifically, this embodiment can use the k-means algorithm clustering example to perform the following clustering process: 1) Input the same type of traffic request data: Use the same type of traffic request data (such as the GET category) as the input for cluster analysis to prepare for the subsequent identification of small categories with discrete performance distribution in the large category.
[0033] 2) Select clustering features: Extract features from the input data, such as request path level, request processing delay, packet length, etc. Through feature selection, key data related to application performance can be extracted to ensure the accuracy of clustering analysis.
[0034] 3) Determine the number of clusters and random seeds: Select an appropriate number of clusters (such as K value) and random seeds to ensure the repeatability of the algorithm. When analyzing application requests in an environment, experiment with different K values to find the K value that can best segment different application requests and performance patterns of the same type.
[0035] 4) Randomly initialize cluster centers: Initialize cluster centers, usually by randomly selecting data points as initial centers. Ensure that the KMeans algorithm can start from different initial conditions and eventually converge to the global optimal solution. In network traffic analysis, this means that the initial cluster center will affect the final request classification results, and multiple experiments are required to ensure the stability of the clustering effect.
[0036] 5) Calculate the distance to the center point and determine the cluster label of each sample point: Calculate the distance from each sample point to all cluster centers and assign the sample point to the corresponding cluster based on the shortest distance. Through iterative optimization, each request can be accurately classified into the corresponding behavior pattern. A server may assign a request with a large processing delay to an abnormal cluster, while a request with a normal processing delay will be assigned to a regular cluster.
[0037] 6) Update cluster centers: Calculate new cluster centers based on the assigned sample points. By continuously updating the cluster centers, the KMeans algorithm gradually optimizes the clustering results to ensure that the processing performance of different application requests can be accurately identified. Through multiple iterations, the cluster centers will gradually converge, representing different request types and their corresponding processing performance modes.
[0038] 7) Output traffic clustering results: The final output clustering results include the cluster label of each sample point and the coordinates of the cluster center. For example, the final latency distribution is divided into three categories: low latency (0.001 seconds), normal latency (0.01 seconds), and high latency (0.1 seconds). For each sample point that belongs to the GET category but has a different specific GET request type, a cluster label is added. These results help identify the behavior patterns of different types of requests in the same category, thereby gaining a deeper understanding of the performance of the target application. For example, for the request of the subcategory getAllUserTodoData in the GET category, all its latency is concentrated in the normal latency (0.01 seconds), indicating that the performance of this subcategory application is normal; in contrast, for the latency distribution of the subcategory getUserDoneData request, there are both low latency and high latency categories, and the overall distribution is relatively discrete, indicating that the performance of this subcategory is abnormal. The subcategory data with a discrete overall distribution will be used as input data for the next step of anomaly detection.
[0039] S108, performing anomaly detection on the suspicious request packet to determine whether the target application has performance anomalies according to the anomaly detection result.
[0040] Specifically, this embodiment constructs a decision tree, and the root node of the decision tree includes all suspicious request packets; Afterwards, multiple rounds of iterations are performed: for the latest layer of nodes in the decision tree, an abnormal dimension (such as processing delay, data packet length, etc.) and a split point of the abnormal dimension are randomly selected; all suspicious request packets of the latest layer of nodes are divided into left child nodes and right child nodes according to the selected abnormal dimension and the split point of the abnormal dimension.
[0041] It should be understood that the split point can be regarded as a preliminary criterion for determining abnormality and non-abnormality. For example, a request packet whose processing delay is greater than the split point is divided into a left child node, and a request packet whose processing delay is less than the split point is divided into a left child node; Obviously, after multiple rounds of iterations, the request packets with shorter paths in the decision tree are divided out earlier, and their abnormal probability is approximated. Therefore, the abnormal confidence of each suspicious request packet can be determined according to the path length of each suspicious request packet in the decision tree. The abnormal confidence is negatively correlated with the path length.
[0042] Finally, this implementation uses the anomaly confidence as the anomaly detection result to determine whether the target application has performance anomalies based on suspicious request packets that meet the preset requirements for anomaly confidence. It should be noted that after determining the abnormal request packet, it is possible to analyze whether the target application has performance anomalies based on some information related to the request packet, such as processing delay, port, data packet length, etc. Since the criteria for judging performance anomalies are not unique, this article does not make specific restrictions here.
[0043] In practical applications, this embodiment uses the decision tree use case of the Isolation Forest algorithm for anomaly detection. The corresponding process is referenced Figure 3 The steps include: 1) Input data: After the cluster analysis in the previous step, the small category application request data with relatively discrete latency distribution in the same large category is used as the input for anomaly detection (for example, a small category request has low latency, normal latency, and high latency).
[0044] 2) Initialization parameters: Select anomaly detection feature values: Select features for anomaly detection from the input data, such as request processing delay, packet length, etc.
[0045] 3) Determine the contamination level and random seed: Set the contamination level (i.e., the proportion of abnormal points) and random seed to ensure the repeatability of the algorithm. Select the appropriate contamination level through experiments and experience to ensure that the algorithm can accurately identify abnormal requests. For a high-load server, a higher contamination level can be set to detect more potential performance issues.
[0046] 4) Randomly select a feature and a split point: When constructing a decision tree, randomly select a feature and determine a split point to split the data into left and right child nodes. In traffic analysis, the features that can be selected and split include request processing delay and packet length.
[0047] 5) Divide the samples into left and right child nodes of the decision tree according to the cutting point: the greater the deviation of request processing delay, data packet length and other characteristics from the normal state, the earlier they will be divided into the child nodes of the decision tree.
[0048] 6) Calculate path length and anomaly score: Calculate the path length of each sample point in the tree, and calculate the anomaly score based on the path length. The shorter the path, the higher the score, indicating that the sample point is more likely to be an anomaly. If the processing delay of an application request is significantly higher than the average level of similar requests, then the request will be segmented earlier and marked as a shorter path length in the decision tree, and thus marked as an abnormal request.
[0049] 7) Output anomaly points: Determine the abnormality of the sample point based on the anomaly score, and output detailed information of the anomaly point (such as request path, request time, data packet length, etc.) to identify possible performance issues or potential security threats.
[0050] This embodiment can report the relevant information of the exception handling request to achieve the purpose of alarm. For example, the clustering and exception identification are visualized: when performing statistical analysis on the extracted key data, by calculating the average, median, variance and other statistical indicators of different request types, the performance of the server in processing different types of requests can be fully understood. These statistical indicators provide a quantitative basis for subsequent performance optimization.
[0051] By drawing a clustering result graph, you can intuitively display the distribution of different request types in the cluster space, helping to identify the normal and abnormal patterns of different requests. In addition, through the abnormal point distribution graph, you can highlight the requests that deviate from normal behavior, making it easier to quickly locate and analyze the characteristics of abnormal requests. The latency distribution graph provides the latency distribution of the server when processing requests, helping to discover and analyze potential performance bottlenecks.
[0052] It should be understood that for detected performance anomalies, the system will generate a detailed anomaly report, including a detailed description of the abnormal behavior, such as all detected abnormal requests, including request path, request time, packet length and other information, and provide anomaly scores and cluster labels for each anomaly point. In addition, the report also includes performance statistical analysis of various requests, summarizing indicators such as average response time, packet size distribution, and request frequency, to help identify the causes of performance anomalies and support system performance optimization.
[0053] In addition, reference Figure 4 As shown, another embodiment of this embodiment further provides an application performance detection device for a business system, including: The classification and matching unit 410 is used to classify and match request packets and response packets for multiple data packets of a target application of the business system.
[0054] The parameter determination unit 420 is used to determine the processing performance parameter of the target application for each request packet based on the information of each paired request packet and response packet.
[0055] The clustering execution unit 430 clusters all the request packets based on the processing performance parameter as a dimension, and determines suspicious request packets that are outliers under the processing performance dimension.
[0056] The detection execution unit 440 performs anomaly detection on the suspicious request packet to determine whether the target application has a performance anomaly according to the anomaly detection result.
[0057] The device of this embodiment is capable of classifying and pairing request packets and response packets of the data packets of the target application of the business system, and determining the processing performance parameters of the complete processing process from request to response of the target application based on the key information in the paired request packets and response packets; thereafter, the request packets are clustered according to the processing performance parameters, and more accurate anomaly detection is performed on outlier request packets to ultimately identify whether performance anomalies occur in the target application.
[0058] It should be noted that the application performance detection device of the business system of this embodiment can be used as Figure 1 The execution subject of the method shown can thus realize Figure 1 The steps and functions in the method shown.
[0059] Optionally, the classification pairing unit 410 classifies and pairs the request packets and response packets for the multiple data packets, including: classifying and pairing the request packets and response packets for the multiple data packets based on at least one of the source IP, target IP, source port, target port and session ID.
[0060] Optionally, the processing performance parameters include processing delay; the parameter determination unit 420 determines the processing performance parameters of the target application for each request packet based on the information of each paired request packet and the response packet, including: determining the processing delay of the target application for each request packet based on the timestamp information of each paired request packet and response packet.
[0061] Optionally, the clustering execution unit 430 clusters all the request packets based on the processing performance parameter as a dimension, and determines suspicious request packets that are outliers under the processing performance dimension, including: classifying all the request packets according to request type; for the request packets of each request type, clustering all the request packets based on the processing performance parameter as a dimension, and determining suspicious request packets that are outliers under the processing performance dimension.
[0062] Optionally, the request type includes: at least one of: a GET request, a POST request, a static resource request, and a dynamic resource request.
[0063] Optionally, the clustering execution unit 430 clusters all the request packets based on the processing performance parameter as a dimension, and determines suspicious request packets that are outliers under the processing performance dimension, including: selecting the request packets with a specified number of cluster clusters as cluster centers of cluster clusters; performing multiple rounds of iterations: based on the processing performance parameter as a dimension, determining the mathematical distance between each request packet that is not a cluster center and each cluster center; classifying each request packet that is not a cluster center into a cluster with the closest mathematical distance, and updating the cluster center of each cluster; after multiple rounds of iterations, determining a target cluster with the least number of request packets, and determining the request packets in the target cluster as suspicious request packets.
[0064] Optionally, the detection execution unit 440 performs anomaly detection on the suspicious request packet to determine whether the target application has a performance anomaly based on the anomaly detection result, including: constructing a decision tree, the root node of the decision tree containing all suspicious request packets; performing multiple rounds of iterative execution: for the latest layer of nodes in the decision tree, randomly selecting an anomaly dimension and a split point of the anomaly dimension; dividing all suspicious request packets of the latest layer of nodes into left child nodes and right child nodes according to the selected anomaly dimension and the split point of the anomaly dimension; the anomaly dimension includes processing delay and / or data packet length; after multiple rounds of iterations, determining the anomaly confidence of each suspicious request packet based on the path length of each suspicious request packet in the decision tree; the anomaly confidence is negatively correlated with the path length; using the anomaly confidence as the anomaly detection result to determine whether the target application has a performance anomaly based on the suspicious request packets whose anomaly confidence meets preset requirements.
[0065] It should be noted that the application performance detection device of the business system of this embodiment can be used as Figure 1 The execution subject of the method shown can thus realize Figure 1 The steps and functions of the method are not repeated here.
[0066] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.
[0067] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0068] The memory is used to store the computer program. Specifically, the computer program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides the computer program to the processor.
[0069] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming the above-mentioned Figure 4 The application performance detection device of the business system shown in the figure. Correspondingly, the processor executes the program stored in the memory and is specifically used to perform the following operations: Classify and pair request packets and response packets for multiple data packets of the target application of the business system.
[0070] Based on the information of each paired request packet and response packet, a processing performance parameter of the target application for each request packet is determined.
[0071] All the request packets are clustered based on the processing performance parameter as a dimension, and suspicious request packets that are outliers under the processing performance dimension are determined.
[0072] Anomaly detection is performed on the suspicious request packet to determine whether performance anomalies occur in the target application according to the anomaly detection result.
[0073] The electronic device of this embodiment is able to classify and pair request packets and response packets of the target application data packets of the business system, and determine the processing performance parameters of the complete processing process from request to response of the target application based on the key information in the paired request packets and response packets; thereafter, the request packets are clustered according to the processing performance parameters, and more accurate anomaly detection is performed on outlier request packets to ultimately identify whether performance anomalies occur in the target application.
[0074] The above is as in this manual Figure 1The application performance detection method of the business system disclosed in the illustrated embodiment can be applied to a processor and implemented by the processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in a decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
[0075] Of course, in addition to software implementation, the electronic device of this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.
[0076] In addition, an embodiment of the present application also proposes a computer-readable storage medium, which stores one or more computer programs, and the one or more computer programs include instructions.
[0077] When the above instructions are executed by a portable electronic device including multiple application programs, the portable electronic device can execute Figure 1 The steps in the method shown include: Classify and pair request packets and response packets for multiple data packets of the target application of the business system.
[0078] Based on the information of each paired request packet and response packet, a processing performance parameter of the target application for each request packet is determined.
[0079] All the request packets are clustered based on the processing performance parameter as a dimension, and suspicious request packets that are outliers under the processing performance dimension are determined.
[0080] Anomaly detection is performed on the suspicious request packet to determine whether performance anomalies occur in the target application according to the anomaly detection result.
[0081] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0082] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0083] The above are only embodiments of this specification and are not intended to limit this specification. For those skilled in the art, this specification may be subject to various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims of this specification. In addition, all other embodiments obtained by ordinary technicians in this field without creative work shall fall within the scope of protection of this document.
Claims
1. A method for detecting application performance of a business system, characterized in that: include: Classify and match request packets and response packets for multiple data packets of target applications of the business system; Determine, based on information of each paired request packet and response packet, a processing performance parameter of the target application for each request packet; Clustering all the request packets based on the processing performance parameter as a dimension, and determining suspicious request packets that are outliers under the processing performance dimension; Anomaly detection is performed on the suspicious request packet to determine whether performance anomalies occur in the target application according to the anomaly detection result.
2. The method according to claim 1, characterized in that Classify and match request packets and response packets for multiple data packets of the target application of the business system, including: Based on at least one of the source IP, the target IP, the source port, the target port and the session ID, multiple data packets of the target application of the business system are classified and paired into request packets and response packets.
3. The method according to claim 1, characterized in that: The processing performance parameters include processing delay; Determining, based on information of each paired request packet and response packet, a processing performance parameter of the target application for each request packet, including: Based on the timestamp information of each paired request packet and response packet, a processing delay of the target application for each of the request packets is determined.
4. The method according to claim 1, characterized in that: Clustering all the request packets based on the processing performance parameter as a dimension to determine suspicious request packets that are outliers under the processing performance dimension includes: Classifying all the request packets according to request types; For the request packets of each request type, all the request packets are clustered based on the processing performance parameter as a dimension, and outlier suspicious request packets under the processing performance dimension are determined.
5. The method according to claim 4, characterized in that The request type includes: at least one of a GET request, a POST request, a static resource request, and a dynamic resource request.
6. The method according to claim 1, characterized in that Clustering all the request packets based on the processing performance parameter as a dimension to determine suspicious request packets that are outliers under the processing performance dimension includes: Selecting the request packets with a specified number of clusters as cluster centers of the clusters; Multiple rounds of iterative execution: taking the processing performance parameter as a dimension, determining the mathematical distance between each non-cluster center request packet and each cluster center; classifying each non-cluster center request packet into the cluster with the closest mathematical distance, and updating the cluster center of each cluster; After multiple rounds of iterations are completed, a target cluster with the least number of request packets is determined, and the request packets in the target cluster are determined as suspicious request packets.
7. The method according to claim 1, characterized in that Performing anomaly detection on the suspicious request packet to determine whether the target application has performance anomalies according to the anomaly detection result includes: Constructing a decision tree, wherein the root node of the decision tree includes all suspicious request packets; Multiple rounds of iterative execution: for the latest layer of nodes of the decision tree, randomly select an abnormal dimension and a split point of the abnormal dimension; divide all suspicious request packets of the latest layer of nodes into left child nodes and right child nodes according to the selected abnormal dimension and the split point of the abnormal dimension; the abnormal dimension includes processing delay and / or data packet length; After multiple rounds of iterations, the abnormality confidence of each suspicious request packet is determined according to the path length of each suspicious request packet in the decision tree; the abnormality confidence is negatively correlated with the path length; The anomaly confidence level is used as an anomaly detection result to determine whether the target application has a performance anomaly based on suspicious request packets whose anomaly confidence levels meet preset requirements.
8. An application performance detection device for a business system, characterized in that: include: A classification and matching unit, used for classifying and matching request packets and response packets of multiple data packets of a target application of a business system; a parameter determination unit, configured to determine a processing performance parameter of the target application for each of the request packets based on information of each paired request packet and response packet; A clustering execution unit, clustering all the request packets based on the processing performance parameter as a dimension, and determining suspicious request packets that are outliers under the processing performance dimension; The detection execution unit performs anomaly detection on the suspicious request packet to determine whether the target application has a performance anomaly according to the anomaly detection result.
9. An electronic device, comprising a processor; and a memory configured to store computer executable instructions, wherein when the computer executable instructions are executed, the processor executes the method according to any one of claims 1 to 8.
10. A computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, wherein the computer-executable instructions implement the method according to any one of claims 1 to 8 when executed by a processor.