System risk analysis method and device, computing equipment and readable storage medium

Abstract

The embodiment of the invention provides a system risk analysis method and device, computing equipment and a readable storage medium, and the method comprises the steps: in the operation process of a target service in a target system, obtaining information of various data indexes for the target service; according to the analysis sequence of the multiple data indexes, sequentially analyzing the information of the multiple data indexes to obtain operation risk information for the target service; and determining a to-be-adjusted service in the target system based on the operation risk information of the target service. According to the method, the maintenance effect on the target system can be improved, and the operation effect of the target system is improved.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and in particular to a system risk analysis method; they also relate to a system risk analysis apparatus, a computing device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the development of computer technology, many tasks can be performed using computers, such as using computers to record, process and transmit data.

[0003] Car companies use vehicle management systems to carry out a series of business processes such as vehicle in-warehouse management, transportation management, handover, and after-sales service. The system needs to provide services to users uninterruptedly for a long time, so there are high requirements for the stability and performance of the system. Usually, when a problem occurs in the vehicle management system, the operation and maintenance personnel will analyze the relevant information of the vehicle management system to find out the cause of the problem and repair it.

[0004] However, this system maintenance method is relatively passive, and can only be used to deal with problems after they occur, and is more dependent on the operation and maintenance experience of the operation and maintenance personnel. Therefore, the maintenance effect on the vehicle management system is poor, resulting in poor operation of the vehicle management system. Summary of the invention

[0005] The embodiments of this specification provide a system risk analysis method, which can improve the maintenance effect of the target system and improve the operation effect of the target system. One or more embodiments of this specification also relate to a system risk analysis device, a system risk analysis system, a computing device, a computer-readable storage medium, and a computer program product.

[0006] According to one aspect of an embodiment of this specification, a system risk analysis method is provided, including:

[0007] During the operation of the target service in the target system, obtaining information of multiple data indicators for the target service;

[0008] According to the analysis order of the multiple data indicators, the information of the multiple data indicators is analyzed in sequence to obtain the operation risk information of the target service;

[0009] Based on the operation risk information of the target service, a service to be adjusted in the target system is determined.

[0010] According to another aspect of an embodiment of this specification, there is provided a system risk analysis device, comprising:

[0011] An acquisition module, used to acquire information of various data indicators for a target service during the operation of the target service in the target system;

[0012] An analysis module, configured to analyze information of the multiple data indicators in sequence according to the analysis order of the multiple data indicators, and obtain operation risk information of the target service;

[0013] The first determining module is used to determine the service to be adjusted in the target system based on the operation risk information of the target service.

[0014] According to another aspect of the embodiments of this specification, there is provided a computing device, including: a memory and a processor;

[0015] The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the programs / instructions are executed by the processor, the steps of the above method are implemented.

[0016] According to another aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores a computer program / instruction, and the steps of the above method are implemented when the computer program / instruction is executed by a processor.

[0017] According to another aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instruction, and when the computer program / instruction in the computer program product is executed by a processor, the steps of the above method are implemented.

[0018] In one embodiment of the present specification, during the operation of the target service in the target system, information on multiple data indicators of the target service can be obtained, and the information on each data indicator can be analyzed in a corresponding analysis order to obtain the operation risk information of the target service, thereby determining the services to be adjusted in the target system, and adjusting the resources of these services. By monitoring each service in the system and determining the operation risk, it can be ensured that the service is adjusted in time before a problem occurs, and active maintenance of the target system can be achieved to avoid the impact of system operation problems on users, and there is no need to rely on manual experience, which can improve the maintenance effect of the target system and ensure the system operation stability and performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a flow chart of a system risk analysis method provided in an embodiment of this specification;

[0020] Figure 2 is a waveform diagram of a CPU usage rate provided in an embodiment of this specification;

[0021] Figure 3It is a schematic diagram of a decision tree constructed by multiple data indicators provided in an embodiment of this specification;

[0022] Figure 4 is an architecture diagram of a target system provided by an embodiment of this specification;

[0023] Figure 5 It is a graph showing changes in the amount of warning information output by a core API of a target system provided in an embodiment of this specification;

[0024] Figure 6 It is a structural schematic diagram of a system risk analysis device provided in an embodiment of this specification;

[0025] Figure 7 It is a structural block diagram of a computing device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0026] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0027] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms of "one", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items. The term "at least one" in one or more embodiments of this specification refers to "one or more", and "multiple" refers to "two or more". The term "including" is an open description and should be understood as "including but not limited to", and may include other content on the basis of the content already described.

[0028] It should be understood that although the terms "first", "second", etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, "first" may also be referred to as "second", and similarly, "second" may also be referred to as "first". Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0029] In addition, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] Various enterprises usually develop their own application systems to provide support for the production operations of the enterprise and manage various data in the business process. For example, car companies can use the vehicle dynamics management (VDM) system to manage the entire business process of vehicles from production, sales, transportation to after-sales. The process can include the in-warehouse management nodes of the vehicle, such as operations such as entering and exiting the warehouse, setting parking spaces, and locking the vehicle; it can also include vehicle transportation nodes, such as setting transportation routes, changing routes, and issuing transportation instructions; it can also include vehicle after-sales service and terminal vehicle handover nodes. The system probably undertakes the management tasks of more than 2,400 commercial vehicles per day, drives the logistics transportation, service and management of hundreds of transport vehicles (such as flatbed trucks), and requires the system to provide functional services and interface services that work uninterruptedly for a long time. Therefore, there are extremely high requirements for the stability and performance of the system. The system may have high task concurrency and resource constraints, and it is necessary to ensure that the system can run stably and reliably under these conditions.

[0031] Currently, in the system maintenance method, the system operation and maintenance department performs manual operation and maintenance, manually analyzes the information provided by the network and upstream and downstream systems related to the system service, manually investigates the causes of the problems, and manually handles and repairs the problems found. Operation and maintenance personnel also need to summarize the experience of historical operation and maintenance problems, that is, analyze the types and scenarios of system problems that have occurred, predict the problems that may arise again in the future, and formulate corresponding operation and maintenance processing methods. The system will also set the corresponding alarm threshold. When the information in the system reaches the alarm threshold, an alarm message will be issued to remind the operation and maintenance personnel to deal with the problem in time, and usually continue to monitor after the problem is solved to ensure the problem is solved effectively.

[0032] This method of relying on manual operation and maintenance of the system requires a relatively detailed operation and maintenance manual for guidance, and is a relatively passive process of generating and then handling operation and maintenance problems. This method is difficult to adapt to system changes and is more dependent on operation and maintenance personnel and individual operation and maintenance experience. The operation and maintenance effects and running effects of the system are poor. If the subjective judgment of the operation and maintenance personnel is inaccurate or the experience is insufficient, it is difficult to discover problems in advance or faster, and manual analysis of various dimensions requires a lot of time and communication costs, which will make the system's problem-solving efficiency poor. In addition, it is difficult to identify the precursors and risks of system problems manually.

[0033] The embodiments of this specification provide a system risk analysis method, which can identify potential risks of the system, improve the maintenance effect of the target system, improve the operation effect of the target system, and ensure the stability and availability of the system. The embodiments of this specification also involve a system risk analysis device, a computing device, a computer-readable storage medium, and a computer program product, which will be introduced one by one in the following embodiments.

[0034] The system risk analysis method provided in the embodiment of this specification can be applied to the system risk analysis device and the computing device. The system risk analysis device and the computing device can be a server, such as a server that carries the target system, for supporting the operation of the target system. The target system can be a vehicle management system (such as the above-mentioned VDM system), or it can also be a management system that implements other functions or other scenarios, such as an office system, a financial system, etc. The target system can correspond to an application, which can be installed on a terminal, and the background server can be a background server of the application, and the terminal can be connected to the background server based on the application. For example, a user can send instructions or data to the background server through a terminal, so that the background server can execute the instructions or process the corresponding data, and return the processing results to the terminal to implement the corresponding functions of the target system. The server can be a single server, or it can be a server cluster composed of multiple servers. In some embodiments, the system risk analysis device and the computing device in the embodiment of this specification can also be terminal devices such as smart phones, computers, and smart wearable devices, and the target system is directly installed on the terminal device, and the terminal device directly performs risk analysis on the target system.

[0035] Figure 1 1 is a flow chart of a system risk analysis method provided in an embodiment of the present specification. The method can be applied to a system risk analysis device. The system risk analysis device is referred to as an analysis device below, and the analysis device is described as a server. Figure 1 As shown, the method may include the following steps:

[0036] Step 102: During the operation of the target service in the target system, information of various data indicators is obtained for the target service.

[0037] The target system may be located in the analysis device, the target system may have multiple functions, the target system may include multiple services, and each function may be realized by the operation of the service. Different services may be used to realize different functions, or multiple services may cooperate to realize one function. During the operation of the target system, multiple services may be running simultaneously. In the embodiment of this specification, the analysis device may analyze each service running in the target system, and the target service may be any service running in the target system. The method provided in the embodiment of this specification is described below using the target service as an example.

[0038] In the embodiment of this specification, all services running in the target system may be analyzed, or only some services specified in the target system may be analyzed. The analysis process for each service is the same, such as including steps 102 and 104, and specific reference is made to the introduction of the target service.

[0039] The analysis device can automatically analyze the target service periodically. The analysis cycle can be short, which is equivalent to performing real-time analysis on the target service to continuously determine the current operating risk of the target service. Determining the operating risk of the target service means determining the risk that problems may occur during the operation of the target service, resulting in failure to operate normally or the operating status not meeting the requirements. Optionally, the analysis device can also analyze the target service again upon receiving a risk analysis instruction. The risk analysis instruction can be triggered manually. For example, when the operation and maintenance personnel of the target system need to confirm the current operating status of the target system, they can trigger a risk analysis instruction on the analysis device.

[0040] When the analysis device needs to analyze the target service, it can first obtain information of multiple data indicators for the target service to determine the operation risk of the target service by analyzing the information. In some embodiments, the multiple data indicators can be pre-set, and the analysis device can directly obtain information of each data indicator of each service. In some embodiments, different target services can correspond to different data indicators.

[0041] Data indicators may include various factors that may bring risks to the running system, and the data indicators may also be called Features. Different data indicators may have different weights, which may be determined based on the degree of influence of the data indicators on the system. In some embodiments, the multiple data indicators may also be adjusted according to different analysis scenarios, such as adaptively adjusting according to the current state of the system, and the current state of the system may include the operating state of the system and the functions it has. Accordingly, the system risk analysis method provided in the embodiment of this specification may also include, before step 102: based on the operating state and functions of the target system, determining multiple data indicators that affect the operating state and functions. For example, new data indicators may be added dynamically in combination with the operating state of the system and the newly added services or functions, especially when the services on which the system operation depends change, the data indicators may change.

[0042] For example, if the target system is currently executing different tasks, currently running different services, the functions that the target system can achieve are different, or the services included are different, the data indicators required for risk analysis may change accordingly. The operating state of the system may include the tasks currently executed by the system, or the services currently running by the system. The functions possessed by the system may be reflected by all the services included in the system. The relationship between the current state of the system and the required data indicators may be preset, or may be obtained by the analysis device itself.

[0043] After determining the data indicators required for analyzing the operational risks of the target service, the information of each data indicator can be directly obtained. The target system in the embodiment of this specification can be orchestrated based on the Kubernetes platform, and the services therein can be deployed in a containerized manner. The target service runs in a container, and one or more containers are encapsulated in a pod, with the pod as the minimum scheduling unit. In this case, step 102 can correspondingly include: obtaining information on multiple data indicators of the container for the container running the target service. The analysis device can obtain information on multiple data indicators of the target service by obtaining relevant information of the container running the target service, such as by obtaining information at the pod granularity. In the embodiment of this specification, the information of the smallest granularity Pod of the system is analyzed to ensure that the services and risk points that affect the operation of the system are directly located.

[0044] In the embodiment of the present specification, the multiple data indicators based on which the analysis device performs analysis may include: the utilization rate of the central processing unit (CPU), the duration of the CPU utilization rate, the memory occupancy rate, the number of calls (Calls) within the target duration, the call duration, the error rate (Calls Error), the business impact information, and at least two of the connected external interface information. The following is an example of the multiple data indicators including all the listed indicators.

[0045] Each service can be allocated a certain amount of CPU resources and memory. The service will use a certain amount of CPU resources and memory when it is running, and the amount of CPU resources and memory used will be different depending on the number or type of requests processed, which will cause the corresponding CPU usage and memory occupancy. When the CPU usage and memory occupancy reach a certain level, it will affect the operation effect of the service. If the CPU usage and memory occupancy are too high, it may also cause the service to fail to run. In the embodiment of the embodiment of this specification, the operation risk of the service is analyzed based on the CPU usage and memory occupancy. Optionally, the analysis device can also obtain the CPU usage and memory usage, and calculate the CPU usage and memory occupancy based on the information. Table 1 below shows the CPU usage information of the pod granularity obtained, which may include the pod name, CPU usage and the corresponding CPU usage. Table 2 below shows the memory occupancy information of the pod granularity, which may include the pod name, memory usage and the corresponding memory occupancy.

[0046] Table 1

[0047] Pod CPU usage CPU usage (%) Serves 1 0.006 0.59％ Serves 2 0.006 0.62％ Serves 3 0.01 1.00％

[0048] Table 2

[0049] Pod Memory usage Memory usage (%) Serves 1 1.17 GiB 58.48％ Serves 2 795.6MiB 38.85％ Serves 3 850.3MiB 41.52％

[0050] If the CPU usage of a service only rises briefly, it usually does not have much impact on the operation of the service. Therefore, when using the CPU usage to analyze the operation risk of a service, the duration of the CPU usage can also be considered. If the high CPU usage lasts for a long time, it can be considered that the service has an operation risk. The analysis device can also generate a waveform chart showing the change of the CPU usage of each pod over time. Figure 2 It is a CPU usage waveform provided in an embodiment of the present specification. The analysis device can also determine the peak value of the CPU usage of the target service within a certain time interval, such as determining the peak value of the CPU usage based on the waveform, and can determine the duration of the CPU usage based on the waveform, such as the duration of the peak value.

[0051] The analysis device can also obtain the call volume of the target service within the target duration, which is the number of times the target service is called, which is equivalent to the number of requests received by the target service. The target duration can be a set unit duration, such as one second. For example, the analysis device can determine the call volume within a specified period, and then convert it into the call volume per second. If the call volume within the target duration is high, it means that the target service has a high concurrency processing requirement, and the request processing of the target service will also cause a certain amount of pressure, resulting in a decrease in request processing efficiency. Therefore, the call volume will affect the operation of the target service, and the call volume can be considered when performing operational risk analysis. In some embodiments, the analysis device can also count services with higher call volumes to perform subsequent analysis based on the statistical information.

[0052] The call duration can refer to the average duration of each call, such as the average processing time of each request within the target duration. If the target service has a poor operating effect, the processing time for each request will increase, so this duration can reflect the operating effect of the target service and can be considered when analyzing operating risks. The call duration can belong to the service performance information of the service.

[0053] The error rate of the target service refers to the probability of an error in the result returned when the target service processes a request. The error rate can characterize the operation effect of the target service, so it can be considered when performing operation risk analysis. The error rate can be used to identify the potential high concurrency risk of the service.

[0054] Business impact information may refer to whether the processing of the business required by the user has been adversely affected. For example, the business impact information may be determined based on user feedback. If the target system does not effectively provide the user with corresponding feedback or meet the user's needs when the user uses the function corresponding to a certain service, the user may provide feedback to the target system regarding the function. If the target system determines, based on the user's feedback, that the opinion is related to the function corresponding to the target service, business impact information indicating that the target service has caused a business impact may be generated. If all opinions received are not related to the function corresponding to the target service, business impact information indicating that the target service has not caused a business impact may be generated.

[0055] Some services in the target system can be connected to an external interface outside the target system to exchange information with external devices through the external interface and process requests input by external devices. If a service is connected to an external interface, the operation of the service is more easily affected by the external device, which will increase the risk of reduced performance of the service. Therefore, in the embodiments of this specification, the operation risk of the service can be assisted in analyzing based on whether the external interface is connected. The external interface information of the target service connection can indicate whether the target service is connected to an external interface.

[0056] Step 104: Analyze the information of the multiple data indicators in sequence according to the analysis order of the multiple data indicators to obtain the operation risk information of the target service.

[0057] In the embodiments of the present specification, the multiple data indicators determined have an analysis order, and the analysis order can be set when the data indicators are pre-specified. The analysis order can be determined based on the degree of influence of the data indicators on the service operation effect, and can also be determined based on historical experience. For example, the influence of CPU utilization, the duration of CPU utilization, memory occupancy, the number of calls within the target duration, the call duration, the error rate, the business impact information, and the external interface information of the connection on the service operation effect can be reduced in sequence, and the analysis order of these data indicators can be arranged in sequence, and the front data indicators are analyzed first. Since CPU usage usually involves multiple service interfaces and affects the operation of multiple services, the analysis priority of CPU utilization can be set higher.

[0058] Each data indicator may correspond to a corresponding analysis method, and the analysis device may analyze the information of each data indicator according to its corresponding analysis method. The analysis method may be to analyze whether the information of the data indicator meets a certain set condition, such as by comparing the value of the data indicator with the corresponding threshold value. For example, for the CPU usage rate, analyze whether it is greater than the usage rate threshold, for the duration of the CPU usage rate, analyze whether it is greater than the duration threshold, for the memory occupancy rate, analyze whether it is greater than the occupancy threshold, for the call volume within the target duration, analyze whether it is greater than the quantity threshold, for the call time consumption, analyze whether it is greater than the time consumption threshold, for the error rate, analyze whether it is greater than the probability threshold, for the business impact information, analyze whether it indicates that there is a business impact, and for the connected external interface information, analyze whether it indicates that an external interface is connected.

[0059] In the embodiments of the present specification, among the multiple data indicators, the analysis results corresponding to the front data indicators will affect the analysis of the back data indicators. For example, when the analysis results corresponding to the front data indicators meet a certain condition, the back data indicators will continue to be analyzed, and this condition can be considered as the analysis premise of the back data indicators. For example, when the CPU usage rate is not higher than 90%, the memory occupancy rate is analyzed; when the CPU usage rate is higher than 90%, the duration of the CPU usage rate is analyzed. In this case, it can be considered that the analysis premise of the memory usage rate is that the CPU usage rate is not higher than 90%, and the analysis premise of the duration of the CPU usage rate is that the CPU usage rate is higher than 90%.

[0060] In some embodiments, a decision tree can be constructed based on each data indicator, and the decision tree can indicate the analysis order of each data indicator, and can also indicate the analysis method and analysis premise of each data indicator. Accordingly, in step 104, the analysis device can analyze the information of multiple data indicators in turn according to the analysis order indicated by the decision tree constructed by multiple data indicators. A decision tree is an inductive learning algorithm that uses a tree data structure to display decision rules and classification results. It is used to transform seemingly disordered and messy known data into a tree model that can predict unknown data. Each path from the root node (the attribute that contributes the most to the final classification result) to the leaf node (the final classification result) represents a decision rule. In the embodiment of this specification, each path in the decision tree corresponds to a rule for determining the operation risk. The decision tree is equivalent to specifying multiple situations corresponding to different operation risks. The analysis device analyzes each data indicator in turn based on the decision tree, so that it can determine the corresponding path in the decision tree according to the specific situation of the currently running target service, and then obtain the corresponding operation risk.

[0061] Before executing step 104, the analysis device may first determine a corresponding decision tree. In some implementations, for target systems in different states, or for different target services, the multiple data indicators analyzed may be different, and the decision trees accordingly may also be different. The decision trees for various situations may be pre-set, or may be obtained by the analysis device itself by analyzing the target service.

[0062] The specific manner in which the analysis device analyzes the information of the multiple data indicators in the analysis order may be: in accordance with the analysis order of the multiple data indicators, when the information of any data indicator meets the analysis premise of the next data indicator, the information of the next data indicator is analyzed; when the information of any data indicator does not meet the analysis premise of the next data indicator or any data indicator is the last data indicator, based on the analysis result of any data indicator, the operation risk information for the target service is determined. For each data indicator, the analysis device may analyze the information of the data indicator according to its corresponding analysis method. When the information of any data indicator does not meet the analysis premise of the next data indicator or any data indicator is the last data indicator, the analysis result of the data indicator directly corresponds to the operation risk information.

[0063] In the embodiments of this specification, the information of each data indicator is analyzed, and different subsequent processing methods may correspond to different analysis results. For example, each data indicator may correspond to at least two branches. When the information of the data indicator meets the analysis premise of the next data indicator, it moves to the node for analyzing the information of the next data indicator; when the information of the data indicator does not meet the analysis premise of the next data indicator, it moves to the node for determining the final analysis result (that is, the operation risk information). For the last data indicator, it no longer corresponds to the next data indicator. The data indicator may also correspond to two branches, both of which are for obtaining operation risk information, but the obtained operation risk information may be different, such as one branch for low operation risk and one branch for high operation risk.

[0064] For any data indicator, it is also possible to analyze whether the information of the data indicator meets the corresponding conditions of a certain operational risk. If it does, its operational risk information can be directly determined. If it does not, the operational risk cannot be directly determined. It can then be combined with other data indicators for further analysis. At this time, it can be considered that the information of the data indicator meets the analysis premise of the next data indicator.

[0065] In some implementations, the operational risk of the service may be graded, and the obtained operational risk information may indicate the corresponding risk level. For example, in the embodiment of this specification, the operational risk is divided into low risk, medium risk and high risk. The level of the operational risk may also include no risk. Optionally, the operational risk information may also be represented by a certain risk value.

[0066] Figure 3 is a schematic diagram of a decision tree constructed by multiple data indicators provided in an embodiment of this specification. Figure 3 Taking the multiple data indicators including: CPU usage, duration of CPU usage, memory occupancy, call volume within target duration, call duration, error rate, business impact information and connected external interface information as an example, the analysis device can analyze the information of these data indicators in turn. Figure 3As shown, the analysis device first determines whether the CPU usage of the target service is greater than the usage threshold, such as the usage threshold can be 90%. When the CPU usage is greater than the usage threshold, it is determined whether the duration of the CPU usage is greater than the first duration threshold, such as the first duration threshold is 5 seconds. In the case where the duration is greater than the first duration threshold, it can be determined that the operating risk of the target service is high risk. In the case where the duration is less than or equal to the first duration threshold, it is determined whether the memory occupancy is greater than the occupancy threshold, such as the memory occupancy is 80%. In the case where the memory occupancy is greater than the occupancy threshold, it is determined that the operating risk of the target service is high risk. In the case where the memory occupancy is less than or equal to the occupancy threshold, the information of the next data indicator is continued to be analyzed.

[0067] The next data indicator is the call volume within the target duration, such as determining whether the call volume within the target duration is greater than the quantity threshold, such as the target duration is 1 second and the quantity threshold is 100. When the call volume within the target duration is less than or equal to the quantity threshold, the operation risk of the target service can be determined to be low risk. When the call volume within the target duration is greater than the quantity threshold, it can be analyzed whether the call time is greater than the second duration threshold, such as the second duration threshold is 0.5 seconds. When the call time is greater than the second duration threshold, the operation risk of the target service is determined to be medium risk. When the call time is less than or equal to the second duration threshold, it can be determined whether the error rate is greater than the error rate threshold, such as the error rate threshold is 0.01%. When the error rate is greater than the error rate threshold, the operation risk of the target service is determined to be medium risk. When the error rate is less than or equal to the error rate threshold, continue to determine whether the business impact information indicates that there is a business impact. When there is a business impact, the operation risk of the target service is determined to be medium risk. When there is no business impact, determine whether the target service is connected to an external interface. In the case where the target service is connected to an external interface, the operation risk of the target service is determined to be medium risk, otherwise it is determined to be low risk.

[0068] In the embodiment of this specification, each service running in the target system can be Figure 3 The decision tree shown is used to determine the corresponding operational risks. Figure 3 The analysis order, analysis methods corresponding to each data indicator, and corresponding judgment thresholds in the decision tree shown are only examples. The decision tree used for different services can be changed accordingly. If there is a specific setting for the risk analysis method for a certain service, the analysis can be performed according to the setting.

[0069] Step 106: Determine the service to be adjusted in the target system based on the operational risk information of the target service.

[0070] For example, the analyzing device may determine the target service as a service to be adjusted in the target system when the operational risk information of the target service is higher than a risk threshold.

[0071] The analysis device can output corresponding warning information for the service to be adjusted, and the operation and maintenance personnel can choose an appropriate method to adjust the service based on the warning information to reduce the operation risk of the service. Or the analysis device can also directly adjust the service based on the set adjustment method. In the embodiments of this specification, a corresponding risk solution method can be set for each risk level, and the service can be adjusted based on the risk solution method to reduce the operation risk of the service.

[0072] In some embodiments, different risk levels may correspond to different analysis methods, and the risk resolution method to be adopted may be determined based on the analysis method. For example, for high and medium risks, analysis may be performed from the system architecture (such as Archi analysis) to determine the risk resolution method. For low risks, the risk resolution method may be determined by manual analysis by developers or operation and maintenance personnel.

[0073] If the risk resolution method includes a resource adjustment method, the resource adjustment method may include adding CPU cores, adding memory, etc. After step 106, the system risk analysis method may also include: determining the resource adjustment method corresponding to the risk level indicated by the operation risk information; outputting the information of the resource adjustment method, or adjusting the resources of the service to be adjusted according to the resource adjustment method. The operation and maintenance personnel can manually adjust the resources of the service based on the output information of the resource adjustment method. The resource adjustment for the service can be recorded, such as recording the resource information before the adjustment and the resource information after the adjustment.

[0074] In some implementations, if a service does not have an operational risk, the service may also be adjusted, such as allocating its resources to other services with an operational risk, to ensure reasonable allocation of resources and improve resource utilization.

[0075] Table 3 below is an information record table of a service provided by the embodiment of this specification. Figure 3As shown, for various services in the target system, the service name, the pod to which they belong, the CPU core information, the memory information, and the deployed virtual machine (JVM, JavaVirtual Machine Java) information can be recorded. For example, the CPU core information and the memory information both include the demand (request) information and the limit (limit) information. Resource change information can also be recorded, such as the restriction information before the CPU core change, the restriction information after the change, and the change date. Table 3 shows that service 1 changed the number of cores from 3 to 2 on June 1, 2024, so that Pod resources can be dynamically allocated to identify resource risks in advance and avoid them.

[0076] Table 3

[0077]

[0078] Figure 4 This is an architecture diagram of a target system provided by an embodiment of this specification. Figure 4 As shown, the target system may include a shared service layer, a middleware layer, a storage layer, and an infrastructure layer. The shared service layer may include some security services and public services. The middleware layer may include a data transmission module, a data cluster module, an automated work module, and a monitoring module. The storage layer may include storage modules such as cache, distributed storage, relational databases, and data assets. The infrastructure layer may include a container module, a service module, a network module, a security module, and a monitoring module. The system risk analysis method provided in the embodiments of this specification can be applied to perform risk analysis on each module in the architecture and perform corresponding resource allocation to avoid the occurrence of risks in advance.

[0079] Figure 5 1 is a diagram showing the change in the amount of warning information output by the core API of a target system provided in an embodiment of this specification. Figure 5 As shown, before time t1, the method provided in the embodiment of this specification is not used to perform system maintenance, and there are still certain warning messages to remind the system of problems. After time t1, the method provided in the embodiment of this specification is used to perform system maintenance. Since risk identification and avoidance are performed in advance, the system may no longer issue warning messages. By reducing the number of alarms, the subsequent manual analysis and processing processes of operation and maintenance can be reduced.

[0080] The embodiment of this specification provides a method for actively identifying risks of a target system based on a decision tree algorithm. Among them, the analysis device can automatically judge and analyze the service according to the analysis method and order of the multi-dimensional data indicators specified by the decision tree, and the multi-dimensional data indicators can be adjusted based on different scenarios, and can adapt to risk identification in different scenarios. The dynamic adaptability of this method is high. By constructing a decision tree, the key factors affecting the stability of the system and their mutual influence can be identified, and the correlation analysis of multiple factors can be realized. The analysis device can analyze based on the real-time data of each service in the target system, identify and predict potential stability risks in advance, reduce the occurrence of system failures, and ensure efficient analysis and early warning of system risks. In addition, the risk analysis and resource allocation can be realized based on the automation of the system, reducing the resource dependence and time investment of manual analysis. In this way, the stability and reliability of the system in complex scenarios can be improved, which is of great significance for ensuring the continuity of transportation and logistics services and improving user experience.

[0081] In summary, in the system risk analysis method provided in the embodiments of this specification, during the operation of the target service in the target system, information on multiple data indicators of the target service can be obtained, and the information on each data indicator can be analyzed in accordance with the corresponding analysis order to obtain the operation risk information of the target service, and then the services to be adjusted in the target system can be determined, and resources can be adjusted for these services. By monitoring each service in the system and determining the operation risk, it can be ensured that the service is adjusted in time before a problem occurs, and active maintenance of the target system can be achieved to avoid problems in system operation affecting users, and there is no need to rely on manual experience, which can improve the maintenance effect of the target system and ensure the stability and performance of the system operation.

[0082] Corresponding to the above method embodiment, this specification also provides a system risk analysis device embodiment. Figure 6 is a schematic diagram of a system risk analysis device provided in an embodiment of the present specification, wherein the system risk analysis device is applied to Figure 1 The terminal in. Figure 6 As shown, the system risk analysis device includes:

[0083] The acquisition module 602 is used to acquire information of various data indicators for the target service during the operation of the target service in the target system;

[0084] An analysis module 604 is used to analyze information of multiple data indicators in sequence according to the analysis order of multiple data indicators to obtain operation risk information of the target service;

[0085] The first determining module 606 is used to determine the service to be adjusted in the target system based on the operation risk information of the target service.

[0086] Optionally, the analysis module 604 is used to:

[0087] According to the analysis order indicated by the decision tree constructed by multiple data indicators, the information of multiple data indicators is analyzed in turn.

[0088] Optionally, the analysis module 604 is used to:

[0089] According to the analysis order of multiple data indicators, when the information of any data indicator meets the analysis premise of the next data indicator, the information of the next data indicator is analyzed;

[0090] When the information of any data indicator does not meet the analysis premise of the next data indicator or any data indicator is the last data indicator, the operation risk information for the target service is determined based on the analysis result for any data indicator.

[0091] Optionally, the acquisition module 602 is used to acquire information of various data indicators of the container running the target service.

[0092] Optionally, the system risk analysis device further includes:

[0093] The second determination module is used to determine multiple data indicators that affect the running state and functions based on the running state and functions of the target system before obtaining information on multiple data indicators for the target service during the running process of the target service in the target system.

[0094] Optionally, the system risk analysis device further includes:

[0095] A third determination module is used to determine a resource adjustment method corresponding to a risk level indicated by the operation risk information;

[0096] The adjustment module is used to output information about the resource adjustment method, or to adjust resources for the service to be adjusted according to the resource adjustment method.

[0097] Optionally, the multiple data indicators include: central processing unit CPU utilization, duration of CPU utilization, memory occupancy, call volume within a target duration, call duration, error rate, business impact information, and at least two of connected external interface information.

[0098] In summary, the system risk analysis device in the embodiment of this specification can obtain information on multiple data indicators of the target service during the operation of the target service in the target system, and analyze the information of each data indicator in accordance with the corresponding analysis order to obtain the operation risk information of the target service, and then determine the services to be adjusted in the target system, and adjust the resources of these services. By monitoring each service in the system and determining the operation risk, it can be ensured that the service is adjusted in time before the problem occurs, and the target system can be actively maintained to avoid the impact of system operation problems on users, and there is no need to rely on manual experience, which can improve the maintenance effect of the target system and ensure the stability and performance of the system operation.

[0099] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system risk analysis device, since it is basically similar to the system risk analysis method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system risk analysis method embodiment.

[0100] Figure 7 7 is a block diagram of a computing device provided in an embodiment of the present specification. The components of the computing device 700 include but are not limited to a memory 710 and a processor 720. The processor 720 is connected to the memory 710 via a bus 730, and the database 750 is used to store data.

[0101] The computing device 700 also includes an access device 740, which enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 740 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0102] In one embodiment of the present specification, the above components of the computing device 700 and Figure 7 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 7 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0103] The computing device 700 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 700 may also be a mobile or stationary server.

[0104] The processor 720 is used to execute computer programs / instructions. When the computer programs / instructions are executed by the processor, the steps in the above method are implemented, such as Figure 1 The method shown.

[0105] As for the computing device embodiment, since it is basically similar to the system risk analysis method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system risk analysis method embodiment.

[0106] One embodiment of the present specification also provides a computer-readable storage medium, which stores computer instructions, and when the computer instructions are executed by the processor, the steps of the above-mentioned system risk analysis method are implemented. The computer instructions include computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable storage medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable storage media do not include electric carrier signals and telecommunication signals.

[0107] An embodiment of the present specification also provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned system risk analysis method when the computer program / instruction is executed in a processor.

[0108] As for the computer-readable storage medium embodiment and the computer program product embodiment, since they are basically similar to the system risk analysis method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system risk analysis method embodiment.

[0109] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0110] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present specification.

[0111] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0112] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can understand and use this specification well.

Claims

1. A system risk analysis method, characterized in that: The method comprises: During the operation of the target service in the target system, obtaining information of multiple data indicators for the target service; According to the analysis order of the multiple data indicators, the information of the multiple data indicators is analyzed in sequence to obtain the operation risk information of the target service; Based on the operation risk information of the target service, a service to be adjusted in the target system is determined.

2. The method according to claim 1, characterized in that The analyzing the information of the multiple data indicators in sequence according to the analysis order of the multiple data indicators includes: According to the analysis order indicated by the decision tree constructed by the multiple data indicators, the information of the multiple data indicators is analyzed in sequence.

3. The method according to claim 1 or 2, characterized in that: The analyzing the information of the multiple data indicators in sequence according to the analysis order of the multiple data indicators to obtain the operation risk information of the target service includes: According to the analysis order of the multiple data indicators, if the information of any data indicator meets the analysis premise of the next data indicator, the information of the next data indicator is analyzed; When information of any data indicator does not satisfy the analysis premise of the next data indicator or the any data indicator is the last data indicator, operation risk information for the target service is determined based on the analysis result for the any data indicator.

4. The method according to claim 1 or 2, characterized in that: The information of obtaining multiple data indicators for the target service includes: For the container running the target service, information on multiple data indicators of the container is obtained.

5. The method according to claim 1 or 2, characterized in that: In the process of running the target service in the target system, before obtaining information of multiple data indicators for the target service, the method further includes: Based on the operating status and functions of the target system, multiple data indicators that have an impact on the operating status and functions are determined.

6. The method according to claim 1 or 2, characterized in that: The method further comprises: Determining a resource adjustment method corresponding to the risk level indicated by the operation risk information; Output the information of the resource adjustment method, or perform resource adjustment on the service to be adjusted according to the resource adjustment method.

7. The method according to claim 1 or 2, characterized in that: The multiple data indicators include: central processing unit CPU utilization, duration of CPU utilization, memory occupancy, call volume within a target duration, call duration, error rate, business impact information, and at least two of the connected external interface information.

8. A system risk analysis device, characterized in that: The system risk analysis device comprises: An acquisition module, used to acquire information of various data indicators for a target service during the operation of the target service in the target system; An analysis module, configured to analyze information of the multiple data indicators in sequence according to the analysis order of the multiple data indicators, and obtain operation risk information of the target service; The first determining module is used to determine the service to be adjusted in the target system based on the operation risk information of the target service.

9. A computing device, characterized in that include: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the programs / instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: A computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that The computer program product comprises a computer program / instruction, and when the computer program / instruction in the computer program product is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images