Application detection method, device, equipment, medium and product

Abstract

The invention discloses an application detection method, device and equipment, a medium and a product, relates to the technical field of software engineering, and can be applied to the field of financial science and technology. In response to a detection configuration operation of the application detector on the to-be-detected application, obtaining a detection configuration file, wherein the detection configuration file comprises a target detection item and a target detection parameter; determining a target detection mirror image from a standard detection mirror image library according to the detection configuration file; and in response to an application detection triggering condition, performing anomaly detection on the to-be-detected application by adopting the target detection mirror image to obtain a detection result. By the adoption of the technical scheme, the detection method is packaged into the mirror image for application anomaly detection, the stability and safety of a detection system architecture are improved, and the development, operation and maintenance efficiency is further improved.

Description

Technical Field

[0001] The present invention relates to the field of software engineering technology, can be applied to the field of financial technology, and in particular to an application detection method, device, equipment, medium and product. Background Art

[0002] When an application is in production and running, it is usually necessary to conduct technical inspections on key application nodes to ensure that the application is running normally. Different applications have different architectures, so the technical inspection methods also vary. The technical inspection methods need to be customized according to the application architecture to meet the inspection needs of different applications. For example, for applications using the traditional front-end + back-end + database, it is necessary to inspect the front-end, back-end, and database nodes; for applications using a service-oriented architecture, it is necessary to inspect the availability of each service node; for applications using containerized deployment, it is necessary to inspect the number and availability of its containers.

[0003] Therefore, traditional application inspection systems usually define each technical inspection as a code method or function, and call these methods or functions when needed to obtain the inspection results.

[0004] However, since the technical inspection methods in traditional application inspection systems are built into the system code, the execution of technical inspections is tightly coupled with the system. If there are many inspection tasks at the same time, it may lead to system resource constraints and affect other inspection tasks. In addition, when adding or deleting methods, the code needs to be modified and redeployed to take effect. Summary of the invention

[0005] The present invention provides an application detection method, device, equipment, medium and product to solve the problem of how to improve the efficiency of application anomaly detection.

[0006] According to one aspect of the present invention, there is provided an application detection method, comprising:

[0007] In response to the detection configuration operation of the application to be detected by the application detection party, a detection configuration file is obtained; the detection configuration file includes target detection items and target detection parameters;

[0008] According to the detection configuration file, determine the target detection image from the standard detection image library;

[0009] In response to an application detection trigger condition, the target detection image is used to perform an abnormality detection on the application to be detected to obtain a detection result.

[0010] According to another aspect of the present invention, there is provided an application detection device, comprising:

[0011] A detection configuration file determination module, configured to obtain a detection configuration file in response to a detection configuration operation of the application to be detected by the application detection party; the detection configuration file includes target detection items and target detection parameters;

[0012] A target detection image determination module, used to determine a target detection image from a standard detection image library according to the detection configuration file;

[0013] The detection module is used to respond to the application detection trigger condition and use the target detection image to perform anomaly detection on the application to be detected to obtain a detection result.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application detection method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application detection method described in any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the application detection method according to any embodiment of the present invention is implemented.

[0020] The technical solution of the embodiment of the present invention solves the problem of improving the efficiency of application anomaly detection by encapsulating the detection method into an image and selecting the target detection image based on the configuration operation to complete the anomaly detection of the application. It not only improves the stability and security of the detection system architecture, but also further improves the efficiency of development and operation and maintenance.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of an application detection method provided according to an embodiment of the present invention;

[0024] Figure 2 is a configuration flow chart of a detection configuration file provided according to an embodiment of the present invention;

[0025] Figure 3 is a flow chart of an application detection method provided according to an embodiment of the present invention;

[0026] Figure 4 is an example diagram of application anomaly detection used in an embodiment of the present invention;

[0027] Figure 5 is a structural schematic diagram of an application detection device provided according to an embodiment of the present invention;

[0028] Figure 6 It is a structural schematic diagram of an electronic device for implementing the application detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] In addition, it should be noted that the collection, storage, use, processing, transmission, provision and disclosure of data involved in the technical solution of the present invention are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0031] Figure 1 is a flow chart of an application detection method provided according to an embodiment of the present invention. The present invention is applicable to the case of application detection. The method can be executed by the application detection device provided by the embodiment of the present invention. The application detection device can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the application detection function, such as a server. Figure 1 As shown, the method includes:

[0032] S110 . In response to the detection configuration operation of the application detection party on the application to be detected, a detection configuration file is obtained; the detection configuration file includes target detection items and target detection parameters.

[0033] Among them, the application to be detected is an application program that needs to be detected for abnormal behavior or condition; the detection configuration operation is the operation in which the user configures the objects required for this detection and the parameters corresponding to the detection objects, which can be imported through electronic files or directly entered; the detection configuration file is the detection object and indicator information required to perform application detection.

[0034] Specifically, in response to the detection configuration operation of the application to be detected by the application detection party, including each detection item and the corresponding detection parameter, the detection item can be at least one, and the detection configuration file is determined according to the determined target detection item and the corresponding target detection parameter. It should be noted that the present invention does not specifically limit the application to be detected, and it can be an application that processes any business type; for example, an ICBC application in a financial scenario.

[0035] Optional, Figure 2 It is a configuration flow chart of a detection configuration file provided according to an embodiment of the present invention; the configuration file in the application anomaly detection in the embodiment of the present invention may preferably be a configuration file in yaml format, and the file needs to be filled in by the user, mainly including filling in the detection items and the detection item parameters corresponding to each detection item; accordingly, in response to the detection configuration operation of the application detection party on the application to be detected, the detection configuration file is obtained, including:

[0036] S111 . In response to a detection item configuration operation performed by the detection application party on the detection item, determine a target detection item.

[0037] The detection item is the function that the detection application can detect; the target detection item is the detection object for the detection application to be detected to perform anomaly detection, which is a specific detection image; the target detection item can be determined according to the detection item configuration operation of the detection item by the application detection party; the detection item configuration operation can determine the target detection item through user input operation or selection operation. For example: the application detection party can fill in specific detection items according to actual needs, and arrange the detection order of the target detection item by defining compilation dependencies.

[0038] It can be understood that by determining the detection items and customizing the compilation dependencies of each detection item, the arrangement of technical detection plans can be achieved through the arrangement of the execution order, and the customization of the detection plans can be further achieved.

[0039] S112: In response to the parameter configuration operation of the target detection item by the application detection party, a target detection parameter is obtained.

[0040] Among them, the target detection parameters include target image parameters and public parameters; the target image parameters are the parameters used to build the target image; the public parameters include the pre-dependency steps, initiation conditions and disposal opinions of the detection items.

[0041] After determining the target detection item, obtain the target image parameters of the target detection item by the application detection party, and further define the pre-dependency steps, initiation conditions and disposal opinions of the detection item; the pre-dependency step is the pre-dependency relationship between each detection item and the previous detection item; the initiation condition is that the operation of the current detection item requires the execution of the pre-condition item detection by passing or failing; the disposal opinion is the disposal opinion after the abnormal detection.

[0042] It should be noted that the pre-dependency relationship in the public parameters can be set by the user according to the actual scenario, which is generally the opposite of the dependency relationship of the actual architecture; for example, if the background service depends on the database, the check is to check the database first and then the background; if the database check fails, the background function must be unavailable, so if the background pre-dependency fails, there is no need to check; the embodiment of the present invention does not specifically limit the setting of the specific pre-dependency relationship, and relevant technical personnel can set it according to the actual scenario.

[0043] It can be understood that by configuring the common detection parameters of the target detection items, the tight coupling between technical detection and the detection system is avoided, making it easier to bring detection points online and offline.

[0044] S113: Determine a detection configuration file according to the target detection items and target detection parameters.

[0045] The detection configuration file is determined based on the target detection items and target detection parameters, and the detection configuration file includes the detection items, the arrangement order between the detection items, the detection parameters of each detection item, and the pre-dependencies of each detection item. For example, in a certain application detection process, 7 detection items are included. The detection configuration file is determined based on its detection items and the target detection parameters corresponding to each detection item, which is a component process. Table 1 shows a partial example of the detection configuration file in the yaml format of the application to be detected.

[0046] Table 1

[0047]

[0048] S120: Determine a target detection image from a standard detection image library according to the detection configuration file.

[0049] Among them, the standard detection image library is a pre-created image library, which is a docker image warehouse, which stores multiple standard detection images. The standard detection image is a detection container.

[0050] Specifically, at least one required target detection image can be selected from the standard detection image library according to the detection items in the detection configuration file, and the arrangement order and execution conditions of each target detection image can be completed according to the detection configuration parameters; for example, when the current detection image fails, whether to proceed to the next step of detection is determined according to the parameter settings.

[0051] It can be understood that by determining the target detection image from the standard detection image library through the detection configuration file, the tight coupling of technical detection and detection system is avoided, and the container images are run independently of each other. By arranging the execution order of different technical containers, the orchestration of technical detection schemes is realized, which facilitates the implementation of customized detection schemes.

[0052] Optionally, based on the above-mentioned embodiment of the present invention, the method further includes: encapsulating the application detection method based on container encapsulation technology to obtain a detection image in a standard detection image library.

[0053] Among them, the detection images in the standard detection image library are classified and set, and each major category is encapsulated through container encapsulation technology; each container provides parameter configuration to specify the detection method.

[0054] Based on container technology encapsulation, the detection methods of different technology stacks are encapsulated into images, and standardized detection methods can be provided for application detection parties; the detection methods include but are not limited to "log detection", "service detection", "interface detection", "file detection", "configuration detection", "server indicator detection", "application indicator detection", "container detection", "cluster detection", "database detection", "message queue detection", etc.; each detection container may include at least one detection subcategory, for example, different subcategories are set in the "server indicator detection" container, which are specified through container startup parameters, such as CPU usage, memory usage, file system usage and other detection subcategories.

[0055] In one embodiment of the present invention, each standardized container includes a technical detection module and a detection result feedback module, and provides a unified scheduling method. For example, the detection image of the "technical detection module" inside the container can be implemented by different technologies, such as shell scripts, python scripts, java codes built into jar packages for execution, go language compiled into binary files for execution, etc.

[0056] It can be understood that each detection method is encapsulated into a single image through container encapsulation technology. Each image can set its personalized assembly and orchestration detection process according to the execution conditions, so that the detection container can be quickly launched without shutting down the detection management system, which facilitates the orchestration between various technical detection points. It only needs to define the container startup order, avoiding the complexity of using code to implement orchestration.

[0057] S130 . In response to the application detection trigger condition, use the target detection image to perform anomaly detection on the application to be detected to obtain a detection result.

[0058] The application detection trigger condition includes an automatic timing execution rule, which can be set by the application detection party according to the detection requirements. It should be noted that the specific timing trigger rule can be set by the relevant technicians according to the detection requirements, and the embodiment of the present invention does not specifically limit this.

[0059] At least one target detection image is determined based on the detection configuration file, and when the automatic timing execution rule preset by the application detection party is reached, the application detection condition is triggered, an abnormality detection is performed on the detection application based on the at least one target detection image, and a detection result is obtained.

[0060] In an optional embodiment of the present invention, after a single target detection image completes anomaly detection, anomaly detection is further completed based on the arrangement order and execution conditions of each target detection image; for example: based on the execution result of the current target detection image, determine whether the initiation conditions for the next step are met. If the conditions are met, call up the next step detection container; if the conditions are not met, skip the next step detection step and set the next step detection result to "empty"; then initiate the next step until the process ends.

[0061] In an optional embodiment of the present invention, after obtaining the detection results, the detection results are sent to the application detection party. If there is at least one failure in the detection results of the collected target detection image, the corresponding disposal opinions and information related to the target detection image are sent to the application detection party, so that the application detection party can execute subsequent processing procedures according to the disposal opinions and initiate application repair. It should be noted that the embodiment of the present invention can use a pop-up prompt to show the application detection party the detection results and corresponding disposal opinions, and can also send message notifications, etc. The embodiment of the present invention does not specifically limit the sending of specific detection result messages.

[0062] It is understandable that setting automatic scheduled execution rules triggers application anomaly detection and notifies the application detection party when the detection fails, so as to complete the application repair in time, ensure the effectiveness of application anomaly detection, and improve the efficiency of subsequent repairs.

[0063] Optionally, after obtaining the detection result, the method further includes: after the detection is completed, destroying the target detection container.

[0064] After the detection of the entire target detection image component is completed and the execution result is obtained, the target detection container is destroyed. It can be understood that by destroying the target detection container after the detection is completed, it is avoided that if the detection image executes too many abnormal detection tasks at the same time, it may cause system resource shortage and affect other detection tasks, thereby effectively avoiding the long-term occupation of system resources.

[0065] The embodiment of the present invention obtains a detection configuration file in response to the detection configuration operation of the application to be detected by the application detection party; the detection configuration file includes target detection items and target detection parameters; according to the detection configuration file, a target detection image is determined from a standard detection image library; in response to the application detection trigger condition, an anomaly detection is performed on the application to be detected using the target detection image to obtain a detection result; the above technical scheme solves the problem of improving the efficiency of application anomaly detection, and by encapsulating the detection method into an image for application anomaly detection, not only the stability and security of the detection system architecture are improved, but also the efficiency of development and operation and maintenance is further improved.

[0066] Figure 3 is a flow chart of an application detection method provided according to an embodiment of the present invention. Based on the above embodiment, the embodiment of the present invention specifically defines the determination of the target detection image based on the detection configuration file. It should be noted that for the part not described in detail in the embodiment of the present invention, please refer to the relevant description of other embodiments. Figure 3 As shown, the method includes:

[0067] S210 . In response to the detection configuration operation of the application detection party on the application to be detected, a detection configuration file is obtained; the detection configuration file includes target detection items and target detection parameters.

[0068] S220: Parse the detection configuration file to obtain target detection items and target detection parameters.

[0069] The required target detection items and target detection parameters are extracted according to the structure of the configuration file; it should be noted that when the configuration file is a YAML format file, relevant technical personnel can set appropriate technical means to perform file parsing, and the embodiment of the present invention does not specifically limit the specific parsing means.

[0070] S230: Determine a target detection image from a standard detection image library according to the target detection item.

[0071] Among them, various detection images are stored in the standard detection image library. The target detection image is determined from the standard detection image library based on the target detection item, and the detection subcategory in the target detection image is determined according to the corresponding parameter settings in the configuration file. For example, if the target detection image is determined to be "service node resource detection", the detection subcategory corresponding to the target detection image is determined to be "memory usage in server indicator detection" based on the target image parameters.

[0072] It can be understood that the target detection image is determined from the standard detection image library based on the target detection item in the configuration file, and the detection object of the application is decoupled from the detection management system. During actual detection, only the image container needs to be scheduled to initiate a complete detection without implementing a specific detection method.

[0073] S240: Determine a detection order of at least one target detection image according to the common parameters in the target detection parameters.

[0074] The execution conditions of the target detection image are set according to the common parameters in the target detection parameters, and the detection order of at least one target detection image is determined based on the preceding dependent steps.

[0075] It can be understood that determining at least one target detection image and a corresponding detection order based on the configuration file effectively improves the detection efficiency.

[0076] S250 . In response to the application detection trigger condition, at least one target detection image is used in sequence to perform abnormality detection on the application to be detected according to the detection order to obtain a detection result.

[0077] When the automatic timing execution rule is reached, at least one target detection mirror is used in turn to detect the application to be detected according to the detection order, and a corresponding detection result is obtained.

[0078] Optionally, according to the detection order, at least one target detection image is used in turn to detect the application to be detected, including: according to the detection order, calling up the target detection container corresponding to the target detection image from the detection cluster; passing the target image parameters in the target detection parameters into the target detection image; and using the target detection container to execute the target detection image to detect the application to be detected.

[0079] The detection cluster is the target detection image required for the anomaly detection of this application. Based on the detection order, the target detection container corresponding to the target detection image is called from the detection cluster, and the target image parameters in the target detection parameters are passed into the target detection image. The target detection image is executed by the target detection container to detect the application to be detected.

[0080] It is understandable that the target detection container is executed in an independent cluster or host machine, which realizes the decoupling of operation. The abnormality of individual detection tasks does not affect the whole. At the same time, it is easy to expand and shrink resources, optimize resource usage, and reduce unnecessary costs.

[0081] In an optional embodiment of the present invention, Figure 4Example diagram of the anomaly detection method applied in. Based on the configuration file, the target detection image of the application to be detected is determined, including service node resource detection, database connectivity detection, access layer service quantity detection, access layer service health detection, transaction log detection, service A service health detection and service B service health detection; based on the detection configuration parameters in the configuration file, the detection subcategory in each detection image container is determined, for example, in "service node resource detection", the detection subcategory is "memory usage in server indicator detection"; the container detection sequence is arranged according to each detection configuration parameter; the trigger dependency condition is determined according to each detection configuration parameter, including the trigger dependency condition is empty, the trigger dependency condition is pre-passed or the trigger dependency condition is pre-failed; the expected value and disposal opinion of each detection image are determined according to each detection configuration parameter. For example, in the service node resource detection image, the expected value of the memory usage is <80%. If the expected value is not reached, the disposal opinion is to restart the node.

[0082] And the triggering dependency conditions of each target detection image in the application detection method are as follows Figure 4 As shown in the figure, if the trigger dependency condition in the "Database Connectivity Detection" is empty, it will be executed regardless of whether the "Service Node Resource Detection" in the previous step passes or not; if the trigger dependency condition of the "Transaction Log Detection" is a pre-pass, if the previous step "Access Layer Service Health Detection" passes, it will be executed, if not, it will not be executed; if this step is not executed, the corresponding execution result is "empty", resulting in the subsequent "Service A Service Health Detection" and "Service B Service Health Detection" conditions not being met and not being executed, until the end; for example, if the "Transaction Log Detection" passes, the subsequent "Service A Service Health Detection" and "Service B Service Health Detection" conditions are not met and are not executed; if the "Transaction Log Detection" fails, the subsequent "Service A Service Health Detection" and "Service B Service Health Detection" conditions are met and the detection is executed.

[0083] It can be understood that the target detection image is determined from the standard detection image library based on the configuration file, and the standardized container workflow of the current application to be detected is determined based on the configuration parameters corresponding to each target detection image, so that the application detection process is decoupled from the detection management system. The detection management system only needs to schedule the target container to initiate detection without compiling specific detection methods. At the same time, based on the orchestration of the container, the difficulty of orchestrating and implementing complex application detection processes is reduced.

[0084] Figure 5 is a schematic diagram of the structure of an application detection device provided according to an embodiment of the present invention. The present invention is applicable to the case of application detection. The application detection device can be implemented in the form of hardware and / or software and can be integrated into an electronic device carrying the application detection function, such as a server. Figure 5 As shown, the application detection device 300 includes:

[0085] The detection configuration file determination module 310 is used to obtain a detection configuration file in response to the detection configuration operation of the application detection party on the application to be detected; the detection configuration file includes target detection items and target detection parameters;

[0086] The target detection image determination module 320 is used to determine the target detection image from the standard detection image library according to the detection configuration file;

[0087] The detection module 330 is used to respond to the application detection trigger condition and use the target detection image to perform anomaly detection on the application to be detected to obtain a detection result.

[0088] The embodiment of the present invention obtains a detection configuration file in response to the detection configuration operation of the application to be detected by the application detection party; the detection configuration file includes target detection items and target detection parameters; according to the detection configuration file, the target detection image is determined from the standard detection image library; in response to the application detection trigger condition, the target detection image is used to perform anomaly detection on the application to be detected to obtain a detection result; the above technical scheme solves the problem of how to improve the efficiency of application anomaly detection, and by encapsulating the detection method into an image for application anomaly detection, not only the stability and security of the detection system architecture are improved, but also the efficiency of development and operation and maintenance is further improved.

[0089] Optionally, the detection profile determination module 310 is specifically used to determine the target detection item in response to the detection item configuration operation of the detection application party on the detection item; obtain the target detection parameter in response to the parameter configuration operation of the target detection item by the detection application party; and determine the detection profile based on the target detection item and the target detection parameter.

[0090] Optionally, the target detection image determination module 320 includes a parsing unit, a target detection image determination unit and a detection order determination unit.

[0091] A parsing unit, used to parse the detection configuration file to obtain target detection items and target detection parameters;

[0092] A target detection image determination unit, used to determine a target detection image from a standard detection image library according to a target detection item;

[0093] A detection order determination unit, used to determine the detection order of at least one target detection image according to the common parameters in the target detection parameters;

[0094] Correspondingly, the detection module 330 is specifically configured to sequentially use at least one target detection image to perform anomaly detection on the application to be detected according to the detection order.

[0095] Optionally, the detection module 330 includes a detection container determination unit, an image parameter input unit, and an anomaly detection unit;

[0096] A detection container determination unit, specifically used to call up a target detection container corresponding to the target detection image from a detection cluster according to a detection order;

[0097] An image parameter input unit, used to input the target image parameter in the target detection parameter into the target detection image;

[0098] The anomaly detection unit is used to use the target detection container to execute the target detection image and perform anomaly detection on the application to be detected.

[0099] Optionally, the application detection device 300 further includes a destruction module, which is used to destroy the target detection container after the detection is completed.

[0100] Optionally, the application detection device 300 further includes a packaging module, which is used to package the application detection method based on the container packaging technology to obtain the detection image in the standard detection image library.

[0101] The application detection device provided in the embodiment of the present invention can execute the application detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0102] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0103] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0104] like Figure 6As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0105] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0106] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 performs the various methods and processes described above, such as the application detection method.

[0107] In some embodiments, application detection may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the application detection described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the application detection method in any other appropriate manner (e.g., by means of firmware).

[0108] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0109] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0110] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0111] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0112] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0113] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0114] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0115] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An application detection method, characterized in that: include: In response to the detection configuration operation of the application to be detected by the application detection party, a detection configuration file is obtained; The detection configuration file includes target detection items and target detection parameters; According to the detection configuration file, determine the target detection image from the standard detection image library; In response to an application detection trigger condition, the target detection image is used to perform an abnormality detection on the application to be detected to obtain a detection result.

2. The method according to claim 1, characterized in that In response to the detection configuration operation of the application to be detected by the application detection party, a detection configuration file is obtained, including: In response to a detection item configuration operation of the detection application party on the detection item, determining a target detection item; In response to the parameter configuration operation of the target detection item by the application detection party, obtaining a target detection parameter; A detection configuration file is determined according to the target detection item and the target detection parameter.

3. The method according to claim 1, characterized in that According to the detection configuration file, a target detection image is determined from a standard detection image library, including: Parsing the detection configuration file to obtain target detection items and target detection parameters; Determine a target detection image from a standard detection image library according to the target detection item; Determining a detection order of at least one target detection image according to the common parameters in the target detection parameters; Correspondingly, using the target detection image to perform anomaly detection on the application to be detected includes: according to the detection order, sequentially using at least one target detection image to perform anomaly detection on the application to be detected.

4. The method according to claim 3, characterized in that According to the detection sequence, at least one target detection image is used in turn to perform abnormality detection on the application to be detected, including: According to the detection order, calling the target detection container corresponding to the target detection image from the detection cluster; The target image parameter in the target detection parameter is transferred into the target detection image; The target detection container is used to execute the target detection image to perform anomaly detection on the application to be detected.

5. The method according to claim 4, characterized in that Also includes: After the detection is completed, the target detection container is destroyed.

6. The method according to any one of claims 1 to 5, characterized in that include: Based on container encapsulation technology, the application detection method is encapsulated to obtain the detection image in the standard detection image library.

7. An application detection device, characterized in that: include: A detection configuration file determination module, configured to obtain a detection configuration file in response to a detection configuration operation of an application to be detected by an application detection party; The detection configuration file includes target detection items and target detection parameters; A target detection image determination module, used to determine a target detection image from a standard detection image library according to the detection configuration file; The detection module is used to respond to the application detection trigger condition and use the target detection image to perform anomaly detection on the application to be detected to obtain a detection result.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application detection method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the application detection method according to any one of claims 1 to 6.

Images