Method for detecting abnormal call-in chain in OpenStack cloud environment

Abstract

The invention relates to the technical field of cloud computing, and discloses a method for detecting chain calling abnormity in an OpenStack cloud environment, which comprises the following steps: acquiring a service request in the OpenStack cloud environment, and generating a corresponding global tracking identifier according to the service request; constructing an actual calling chain of all the components in the service request based on the global tracking identifier, and storing calling time consumption among the components in a two-dimensional adjacency matrix based on the actual calling chain; after calculating a two-dimensional adjacency matrix distance between the actual call chain and a preset normal call chain based on the two-dimensional adjacency matrix, comparing the calculated two-dimensional adjacency matrix distance with a threshold distance; and if the calculated two-dimensional adjacent matrix distance is greater than a threshold distance, determining that the actual call chain is abnormal. According to the method provided by the invention, manual intervention is not needed, faults can be quickly positioned, abnormity can be quickly detected, the cost and risk caused by manual intervention are reduced, and the availability and reliability of a cloud computing environment are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and in particular to a method for detecting call chain anomalies in an OpenStack cloud environment. Background Art

[0002] OpenStack is an open source cloud computing management platform that is widely used in public, private or hybrid cloud environments. It aims to provide Infrastructure as a Service (IaaS) solutions. OpenStack allows users to build and manage basic hardware and software facilities in data centers, thereby realizing the virtualization of computing, storage and network resources. With the rapid development of cloud computing, more and more companies are deploying core business systems in the cloud. The cloud platform is the core infrastructure of many businesses. Once a failure occurs, it may cause service interruption and reduce availability. In recent years, more and more intelligent operation and maintenance technologies have been applied to the operation and maintenance of cloud platforms, aiming to improve the availability and reliability of cloud computing environments and reduce the costs and risks caused by failures and manual intervention. Summary of the invention

[0003] In view of this, the present invention provides a method for detecting call chain anomalies in an OpenStack cloud environment to solve the problem of large structural differences between call chains of different business requests.

[0004] In a first aspect, the present invention provides a method for detecting call chain anomalies in an OpenStack cloud environment, comprising: obtaining a business request in the OpenStack cloud environment, and generating a corresponding global tracking identifier according to the business request; constructing an actual call chain of all components in the business request based on the global tracking identifier, and storing the call time consumption between each component in a two-dimensional adjacency matrix based on the actual call chain; after calculating the two-dimensional adjacency matrix distance between the actual call chain and a preset normal call chain based on the two-dimensional adjacency matrix, the calculated two-dimensional adjacency matrix distance is compared with a threshold distance; if the calculated two-dimensional adjacency matrix distance is greater than the threshold distance, the actual call chain is determined to be abnormal.

[0005] The method provided by the present invention introduces a global tracking identifier into each component corresponding to each specific business request, and constructs the call chain between all components according to the tracking identifier, thereby shielding the problem of large structural differences between call chains of different business requests. When there are multiple different task requests in the OpenStack cloud environment, each task request corresponds to a unique call chain. Therefore, when the call chain is abnormal, the corresponding business request can be quickly located. The method has strong pertinence, high accuracy, and fast detection speed, and is suitable for real-time anomaly detection in large-scale cloud environments.

[0006] In an optional implementation, the process of obtaining a service request in an OpenStack cloud environment includes: obtaining the service request and all components that need to be called by the service request; and creating a calling relationship between the components according to a code structure of the OpenStack cloud environment.

[0007] In an optional implementation, the process of generating a corresponding global tracking identifier according to the service request includes: generating a global tracking identifier inside and outside each component based on a function call scenario of each component.

[0008] In an optional embodiment, the process of storing the call time between each component in a two-dimensional adjacency matrix based on the actual call chain includes: using a directed graph data structure to describe the actual call chain, and storing the directed graph data in a two-dimensional adjacency matrix; the numerical values ​​in the two-dimensional adjacency matrix represent the call time between each component.

[0009] The method provided by the present invention can more accurately obtain the commonalities of abnormal call chains by acquiring and analyzing multiple historical abnormal call chains, thereby improving the accuracy of the threshold distance and reducing random errors.

[0010] In an optional implementation, after determining that the actual call chain is abnormal, the process further includes: after marking the actual call chain as an abnormal call chain, storing the abnormal call chain and its corresponding two-dimensional adjacency matrix.

[0011] In an optional implementation, the process of obtaining the threshold distance includes: obtaining all abnormal call chains stored in history; and setting the threshold distance according to the two-dimensional adjacency matrix distance distribution between each abnormal call chain and the normal call chain.

[0012] In a second aspect, the present invention provides a detection device for call chain anomalies in an OpenStack cloud environment, comprising: an acquisition module, used to acquire a business request in an OpenStack cloud environment, and generate a corresponding global tracking identifier according to the business request; a storage module, used to construct an actual call chain of all components in the business request based on the global tracking identifier, and store the call time consumption between each component in a two-dimensional adjacency matrix based on the actual call chain; a calculation module, used to calculate the two-dimensional adjacency matrix distance between the actual call chain and a preset normal call chain based on the two-dimensional adjacency matrix, and then compare the calculated two-dimensional adjacency matrix distance with a threshold distance; a judgment module, used to determine that the call chain is abnormal if the calculated two-dimensional adjacency matrix distance is greater than the threshold distance.

[0013] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute the method for detecting call chain anomalies in an OpenStack cloud environment of the first aspect or any corresponding embodiment thereof.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for detecting call chain anomalies in an OpenStack cloud environment of the first aspect or any corresponding embodiment thereof.

[0015] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute the method for detecting call chain anomalies in an OpenStack cloud environment of the above-mentioned first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a call request diagram of the nova component in the related art;

[0018] Figure 2 It is a flow chart of a method for detecting call chain anomalies in an OpenStack cloud environment according to an embodiment of the present invention;

[0019] Figure 3 It is a flowchart of another method for detecting call chain anomalies in an OpenStack cloud environment according to an embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of a call request of a nova component according to an embodiment of the present invention;

[0021] Figure 5 is a schematic diagram of an actual call chain of a virtual machine according to an embodiment of the present invention;

[0022] Figure 6 It is a flowchart of another method for detecting call chain anomalies in an OpenStack cloud environment according to an embodiment of the present invention;

[0023] Figure 7is a schematic diagram of an adjacency matrix for recording the time consumption of call chains between components according to an embodiment of the present invention;

[0024] Figure 8 It is a flowchart of another method for detecting call chain anomalies in an OpenStack cloud environment according to an embodiment of the present invention;

[0025] Fig. 9 is a structural block diagram of a device for detecting call chain anomalies in an OpenStack cloud environment according to an embodiment of the present invention;

[0026] Fig.10 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0028] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0029] The OpenStack cloud environment contains many modules. The components provide REST API interfaces for the business management platform to call. The components use remote procedure calls (RPC) internally. Take the nova component as an example. Figure 1 As shown in the figure, the nova-api component receives external API requests, and internally calls nova-scheduler, nova-conductor, and nova-compute components. The nova component also calls the API interfaces of cinder and neutron to create the volumes and network cards required by the virtual machine. A request-id is generated for each business request. This request-id request identifier is passed to other internal components of nova, such as nova-conductor, nova-scheduler, and nova-compute, along with the RPC call, but will not be passed to other external components, such as cinder, neutron, etc., so it is impossible to generate a full-link call chain that includes the entire call cycle.

[0030] According to an embodiment of the present invention, an embodiment of a method for detecting call chain anomalies in an OpenStack cloud environment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] In this embodiment, a method for detecting call chain anomalies in an OpenStack cloud environment is provided. Figure 2 is a flow chart of a method for detecting call chain anomalies in an OpenStack cloud environment according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0032] Step S1: Obtain a service request in an OpenStack cloud environment, and generate a corresponding global tracking identifier according to the service request.

[0033] Specifically, the OpenStack cloud environment includes a variety of business requests. The call chain structures of each business request are quite different. In order to improve the speed and accuracy of the call chain anomaly detection process, it is necessary to construct an accurate call chain for each business request, such as Figure 3 As shown, the process of obtaining a service request in the OpenStack cloud environment and generating a corresponding global tracking identifier according to the service request also includes:

[0034] Step S11: Obtain the service request and all components that need to be called by the service request.

[0035] Step S12: creating a calling relationship between components according to the code structure of the OpenStack cloud environment.

[0036] Step S13: Based on the function call scenario of each component, a global tracking identifier is generated inside and outside each component.

[0037] Specifically, Figure 4 As shown, Figure 4 exist Figure 1 On this basis, in the context of each component function call, support is added to generate a global tracking identifier trace_id inside and outside each component, so that all calling processes of the business request can be tracked according to this trace_id, and all calling links in the entire business request life cycle can be constructed to achieve rapid fault location and anomaly detection.

[0038] Step S2: constructing the actual call chain of all components in the service request based on the global tracking identifier, and storing the call time consumption between each component in a two-dimensional adjacency matrix based on the actual call chain.

[0039] For example, since there are many types of cloud platform services, different service types have different underlying call chains. Different types of call chains are constructed according to specific service types. For example, common cloud platform service types include: virtual machine creation, restart, migration, expansion, deletion, etc. Taking the creation of a virtual machine as an example, the call relationship of each component of the virtual machine creation can be obtained according to the OpenStack code structure, such as Figure 5 As shown in the figure, the creation process of the virtual machine requires calling components A-1, A-2, A-3, A-4, B, C and D. The calling sequence between the components is shown by the arrows in the figure. Figure 5 The component types and calling relationships in the compose the actual calling chain of the virtual machine creation process.

[0040] Alternatively, if Figure 6 As shown in FIG. 1 , the process of storing the call time between components in a two-dimensional adjacency matrix based on the actual call chain includes:

[0041] Step S21: Use a directed graph data structure to describe the actual call chain, and store the directed graph data in a two-dimensional adjacency matrix.

[0042] Step S22: The numerical values ​​in the two-dimensional adjacency matrix represent the call time consumption between components.

[0043] Specifically, according to Figure 6 The calling time between each component is marked: the calling time between component A-1 and component B is D1, the calling time between component A-1 and component A-2 is D2, the calling time between component A-2 and component A-3 is D3, the calling time between component A-2 and component A-4 is D4, the calling time between component A-4 and component C is D5, and the calling time between component A-4 and component D is D6. The marked calling time D1-D6 is used as the matrix elements, and the following matrix is ​​generated according to the calling relationship of each component: Figure 7 The two-dimensional adjacency matrix shown in FIG. 1 , element 0 in the two-dimensional adjacency matrix indicates that there is no calling relationship between two components.

[0044] Step S3: After calculating the two-dimensional adjacency matrix distance between the actual call chain and the preset normal call chain based on the two-dimensional adjacency matrix, the calculated two-dimensional adjacency matrix distance is compared with the threshold distance.

[0045] Specifically, the calculation formula of the matrix distance Distance is as follows:

[0046]

[0047] Among them, the two-dimensional adjacency matrix X stores the call time consumption between the components of the actual call chain, and the two-dimensional adjacency matrix Y stores the call time consumption between the components of the preset normal call chain. X[i, j] is the element of the i-th row and j-th column of the two-dimensional adjacency matrix X, and Y[i, j] is the element of the i-th row and j-th column of the two-dimensional adjacency matrix Y. After the two-dimensional adjacency matrix distance Distance is obtained by measuring the difference between the actual call chain and the normal call chain through the matrix distance, the matrix distance Distance is compared with the threshold distance.

[0048] Step S4: If the calculated two-dimensional adjacency matrix distance is greater than the threshold distance, the actual call chain is determined to be abnormal.

[0049] Specifically, if the calculated matrix distance Distance is less than the threshold distance, it means that the actual call chain is normal, otherwise it is determined that the actual call chain is abnormal.

[0050] Optionally, after determining that the actual call chain is abnormal, the process further includes: after marking the actual call chain as an abnormal call chain, storing the abnormal call chain and its corresponding two-dimensional adjacency matrix.

[0051] Alternatively, if Figure 8 As shown, the process of obtaining the threshold distance includes:

[0052] Step S31: Obtain all the exception call chains stored in history.

[0053] Step S32: setting a threshold distance according to the two-dimensional adjacency matrix distance distribution between each abnormal call chain and the normal call chain.

[0054] Specifically, the threshold is obtained by statistically analyzing the historical call chain data, and by calculating and analyzing the matrix distance value distribution of the historical abnormal call chain and the normal call chain, an appropriate threshold is set for anomaly detection.

[0055] The method provided in this embodiment introduces a global tracking identifier into each component corresponding to each specific business request, and constructs the call chain between all components according to the tracking identifier, thereby shielding the problem of large structural differences between call chains of different business requests. When there are multiple different task requests in the OpenStack cloud environment, each task request corresponds to a unique call chain. Therefore, when the call chain is abnormal, the corresponding business request can be quickly located. The method has strong pertinence, high accuracy, and fast detection speed, and is suitable for real-time anomaly detection in large-scale cloud environments.

[0056] In this embodiment, a device for detecting call chain anomalies in an OpenStack cloud environment is also provided, and the device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0057] This embodiment provides a detection device for call chain anomalies in an OpenStack cloud environment. Fig. 9 As shown, including:

[0058] The acquisition module 901 is used to acquire a service request in the OpenStack cloud environment and generate a corresponding global tracking identifier according to the service request.

[0059] The storage module 902 is used to construct the actual call chain of all components in the business request based on the global tracking identifier, and store the call time consumption between each component in a two-dimensional adjacency matrix based on the actual call chain.

[0060] The calculation module 903 is used to calculate the two-dimensional adjacency matrix distance between the actual call chain and the preset normal call chain based on the two-dimensional adjacency matrix, and then compare the calculated two-dimensional adjacency matrix distance with the threshold distance.

[0061] The judgment module 904 is used to judge that the call chain is abnormal if the calculated two-dimensional adjacency matrix distance is greater than a threshold distance.

[0062] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0063] The device for detecting call chain anomalies in the OpenStack cloud environment in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0064] The embodiment of the present invention also provides a computer device having the above Fig. 9 The device for detecting call chain anomalies in the OpenStack cloud environment is shown.

[0065] See also Fig.10 , Fig.10 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Fig.10As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.10 A processor 10 is taken as an example.

[0066] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0067] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0068] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0069] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0070] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0071] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0072] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0073] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting call chain anomalies in an OpenStack cloud environment, characterized in that: include: Obtain a service request in the OpenStack cloud environment, and generate a corresponding global tracking identifier according to the service request; Constructing an actual call chain of all components in the service request based on the global tracking identifier, and storing the call time consumption between each component in a two-dimensional adjacency matrix based on the actual call chain; After calculating the two-dimensional adjacency matrix distance between the actual call chain and the preset normal call chain based on the two-dimensional adjacency matrix, the calculated two-dimensional adjacency matrix distance is compared with the threshold distance; If the two-dimensional adjacency matrix distance obtained by the calculation is greater than the threshold distance, the actual call chain is determined to be abnormal.

2. The method according to claim 1, characterized in that: The process of obtaining a service request in the OpenStack cloud environment includes: Get the business request and all components that need to be called for the business request; The calling relationships between components are created based on the code structure of the OpenStack cloud environment.

3. The method according to claim 2, characterized in that The process of generating a corresponding global tracking identifier according to the service request includes: Based on the function call scenarios of each component, a global tracking identifier is generated inside and outside each component.

4. The method according to claim 1, characterized in that: The process of storing the call time consumption between components in a two-dimensional adjacency matrix based on the actual call chain includes: Using a directed graph data structure to describe the actual call chain, and storing the directed graph data in the two-dimensional adjacency matrix; The numerical values ​​in the two-dimensional adjacency matrix represent the call time consumption between components.

5. The method according to claim 1, characterized in that After the process of determining that the actual call chain is abnormal, the following steps are also included: After marking the actual call chain as an abnormal call chain, the abnormal call chain and its corresponding two-dimensional adjacency matrix are stored.

6. The method according to claim 5, characterized in that The process of obtaining the threshold distance includes: Get all the exception call chains stored in history; The threshold distance is set according to the two-dimensional adjacency matrix distance distribution between each abnormal call chain and the normal call chain.

7. A device for detecting call chain anomalies in an OpenStack cloud environment, characterized in that: include: The acquisition module is used to acquire the service request in the OpenStack cloud environment and generate a corresponding global tracking identifier according to the service request; A storage module, used to construct an actual call chain of all components in the service request based on the global tracking identifier, and store the call time consumption between each component in a two-dimensional adjacency matrix based on the actual call chain; A calculation module, configured to calculate a two-dimensional adjacency matrix distance between an actual call chain and a preset normal call chain based on the two-dimensional adjacency matrix, and then compare the calculated two-dimensional adjacency matrix distance with a threshold distance; The judgment module is used to judge that the call chain is abnormal if the two-dimensional adjacency matrix distance obtained by the calculation is greater than the threshold distance.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for detecting call chain anomalies in an OpenStack cloud environment according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for detecting call chain anomalies in an OpenStack cloud environment according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the method for detecting call chain anomalies in an OpenStack cloud environment according to any one of claims 1 to 6.

Images