Computer information abnormity identification and early warning method and system

Abstract

The invention discloses a computer information exception identification and early warning method and system, and particularly relates to the field of exception identification and early warning. Through monitoring cross-layer event timestamp data generated by a host machine and a container side, the time record consistency of the two sides is evaluated; meanwhile, process-level behavior metadata captured by the virtual machine management program layer and the container kernel namespace layer are analyzed, and the visibility consistency degree of the multi-layer resource occupancy state is evaluated. And determining a cross-layer visibility dislocation risk degree, and when the risk reaches a high risk level, evaluating a multilayer lock competition abnormity risk by analyzing a kernel event tracking sequence. And finally, the time record consistency of the host machine and the container side, the visibility consistency degree of the multi-layer resource occupancy state and the multilayer lock competition abnormity risk are comprehensively analyzed, and the cross-layer visibility dislocation alarm level is evaluated, so that accurate identification and early warning of computer information abnormity are realized, and the operation safety and stability of a computer system are effectively guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of abnormality identification and early warning technology, and more specifically, to a computer information abnormality identification and early warning method and system. Background Art

[0002] With the rapid popularization of cloud computing and virtualization technology, enterprise computer systems adopt multi-layer architectures such as nested virtualization and mixed deployment of containers and virtual machines. However, in this complex environment, there are obvious differences in data and event collection at different levels (including operating systems, hypervisors, and container kernels), resulting in some abnormal phenomena only appearing in specific views, while appearing normal in other levels. This multi-layer data visibility misalignment problem makes traditional single-layer anomaly detection methods prone to misjudgment or missed detection, seriously affecting the stability and security of computer systems.

[0003] In order to solve the above problems, a technical solution is now provided. Summary of the invention

[0004] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a computer information anomaly identification and early warning method and system to solve the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions: A computer information anomaly identification and early warning method comprises the following steps: By monitoring the cross-layer event timestamp data generated by the host and container in a multi-layer virtualization environment, the consistency of the timestamp data of the host and the timestamp data of the container can be evaluated. Analyze the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer in a multi-layer virtualization environment to evaluate the visibility consistency of resource occupancy status in multiple layers; Capture process behavior metadata at the hypervisor layer and extract process resource usage characteristics; Capture process behavior metadata at the container kernel namespace layer and extract container resource usage characteristics; Establish a unified feature space based on virtual machine and container data to perform feature vector mapping; Use the vector space similarity analysis algorithm to calculate the difference between cross-layer resource states; According to the difference of resource status across layers, the consistency of visibility of resource occupancy status across multiple layers is evaluated; Based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the consistency of the visibility of the multi-layer resource occupancy status, the risk level of cross-layer visibility misalignment is determined; When the risk level of cross-layer visibility misalignment is high, the risk of multi-layer lock contention anomalies is evaluated by analyzing the kernel event trace sequence; Comprehensively analyze the consistency of the timestamp data of the host machine and the timestamp data on the container side, the consistency of the visibility of multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies to evaluate the cross-layer visibility misalignment alarm level.

[0006] In a preferred embodiment, by monitoring the cross-layer event timestamp data generated by the host and the container in a multi-layer virtualization environment, the consistency of the timestamp data of the host and the timestamp data of the container is evaluated, specifically: Collect host machine key event log timestamp data in real time in a multi-layer virtualization environment; Synchronously collect the corresponding timestamp data in the key event log on the container side; Standardize and synchronize timestamp data on the host and container sides; The cross-correlation algorithm is used to compare the time series on both sides and quantify the time series differences; Calculate and output the cross-layer timing consistency deviation index.

[0007] In a preferred embodiment, the cross-layer visibility misalignment risk level is determined based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the visibility consistency of the multi-layer resource occupancy status, specifically: When the cross-layer timing consistency deviation index is greater than or equal to the cross-layer timing consistency deviation index threshold, and the visibility consistency index is less than the visibility consistency index threshold, the cross-layer visibility misalignment risk level is judged to be high risk; otherwise, the cross-layer visibility misalignment risk level is judged to be low risk.

[0008] In a preferred embodiment, the risk of multi-layer lock contention anomaly is evaluated by analyzing the kernel event tracing sequence, specifically: Synchronously capture kernel event trace data at the hypervisor layer and the container kernel namespace layer; Parse lock contention logs and extract feature vectors; Statistics on mutex lock queue status and waiting time based on multi-level queue model; Use the improved machine learning algorithm to train and output the lock contention anomaly index; Evaluate the multi-layer lock abnormal contention risk based on the lock contention abnormality index.

[0009] In a preferred embodiment, the multi-layer lock abnormal competition risk is evaluated according to the lock competition abnormality index, specifically: Compare the lock contention anomaly index with the lock contention anomaly threshold: When the lock contention anomaly index is greater than or equal to the lock contention anomaly threshold, it indicates that the lock contention between the hypervisor layer and the container kernel namespace layer has reached a risk critical point; When the lock contention anomaly index is less than the lock contention anomaly threshold, it indicates that the lock contention between the hypervisor layer and the container kernel namespace layer has not reached the risk critical point.

[0010] In a preferred implementation, the consistency of the timestamp data of the host machine and the timestamp data of the container side, the consistency of the visibility of the multi-layer resource occupancy status, and the risk of multi-layer lock competition anomaly are comprehensively analyzed to evaluate the cross-layer visibility misalignment alarm level, specifically: Compare the comprehensive score with the preset first alarm threshold and second alarm threshold to determine the risk level of cross-layer visibility misalignment: When the comprehensive score is less than the first alarm threshold, the risk level of cross-layer visibility misalignment is normal; When the comprehensive score is greater than or equal to the first warning threshold and less than the second warning threshold, the risk level of cross-layer visibility misalignment is warning; When the comprehensive score is greater than or equal to the second alarm threshold, the risk level of cross-layer visibility misalignment is urgent.

[0011] On the other hand, the present invention provides a computer information anomaly identification and early warning system, including a consistency assessment module, a metadata analysis module, a risk level determination module, an anomaly risk assessment module, and an alarm level assessment module; The consistency assessment module monitors the cross-layer event timestamp data generated by the host and container sides in a multi-layer virtualization environment to assess the consistency of the timestamp data of the host and the timestamp data of the container side. The metadata analysis module analyzes the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer in a multi-layer virtualization environment to evaluate the visibility consistency of the resource occupancy status of the multiple layers; The risk level determination module determines the risk level of cross-layer visibility misalignment based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the visibility consistency of the multi-layer resource occupancy status; The abnormal risk assessment module evaluates the abnormal risk of multi-layer lock contention by analyzing the kernel event tracing sequence when the risk level of cross-layer visibility misalignment is high; The alarm level assessment module conducts a comprehensive analysis of the consistency between the timestamp data of the host machine and the timestamp data of the container side, the consistency of the visibility of multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies, and assesses the cross-layer visibility misalignment alarm level.

[0012] The technical effects and advantages of a computer information anomaly identification and early warning method and system of the present invention are as follows: By collecting key event timestamps, process behavior metadata, and kernel event tracking data on the host and container sides, the consistency of time records, the consistency of resource usage visibility, and the risk of lock contention anomalies are evaluated respectively, and then the cross-layer visibility misalignment risk and alarm level are comprehensively determined, overcoming the limitations of traditional single-layer monitoring technology in complex scenarios such as nested virtualization and mixed deployment of containers and virtual machines. It can accurately capture abnormal phenomena that are only exposed at a specific level, avoid misjudgment and missed detection, and improve the accuracy and real-time response capabilities of anomaly detection. Through data normalization, fuzzy synthesis, and nonlinear aggregation algorithms, efficient integration and intelligent judgment of multi-dimensional indicators are achieved, providing strong support for rapid fault location and dynamic resource scheduling, effectively reducing security risks and operation and maintenance costs, and enhancing overall information security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A schematic diagram of a computer information anomaly identification and early warning method of the present invention; Figure 2 The present invention is a schematic diagram of the structure of a computer information anomaly identification and early warning system. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0015] Example 1 Figure 1 The present invention provides a computer information anomaly identification and early warning method, which includes the following steps: By monitoring the cross-layer event timestamp data generated by the host and container in a multi-layer virtualization environment, the consistency of the timestamp data of the host and the timestamp data of the container can be evaluated. Analyze the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer in a multi-layer virtualization environment to evaluate the visibility consistency of resource occupancy status in multiple layers; Based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the consistency of the visibility of the multi-layer resource occupancy status, the risk level of cross-layer visibility misalignment is determined; When the risk level of cross-layer visibility misalignment is high, the risk of multi-layer lock contention anomalies is evaluated by analyzing the kernel event trace sequence; Comprehensively analyze the consistency of the timestamp data of the host machine and the timestamp data on the container side, the consistency of the visibility of multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies to evaluate the cross-layer visibility misalignment alarm level.

[0016] Specifically, by monitoring the cross-layer event timestamp data generated by the host and the container in a multi-layer virtualization environment, the consistency of the timestamp data of the host and the timestamp data of the container is evaluated, including: Collecting host machine key event log timestamp data in a multi-layer virtualization environment: In a multi-layer virtualization environment, the host machine is responsible for overall resource scheduling and virtual machine management. The time information of its key events (such as process startup, file operation, network connection establishment, etc.) is very important to the computer system status. Real-time capture and record the exact time when all key events occur. The collected data is recorded in milliseconds to form a host machine key event timestamp data sequence, which is expressed as ;in, Represents a collection of all key event timestamp data of the host machine, which includes the time point when each key event recorded by the host machine occurred within the predetermined collection period; Indicates the host machine records the Timestamps of key events; Indicates the total number of key events recorded by the host during the scheduled collection period.

[0017] Synchronously collect the corresponding timestamp data in the key event log on the container side: In a virtualized environment, the container, as an independent running instance inside the host machine, also generates key event logs. To ensure the consistency of cross-layer data, a lightweight log collection agent is deployed inside each container to capture the timestamp data of key events occurring in the container in real time. The collection process uses the same time base as the host machine to ensure that the data on both sides are directly comparable. The expression of the timestamp data sequence on the container side is: ;in, Represents the collection of all key event timestamp data on the container side. The collection includes the key event time points recorded by each container instance in the same collection cycle as the host. Indicates the first Timestamps of key events; Indicates the total number of key events recorded on the container side in the same collection period as the host.

[0018] Standardize and synchronize the timestamp data on the host and container sides: Due to hardware differences, clock drift, and collection delays between the host and container side devices, the collected timestamp data is standardized to eliminate the inherent deviations between the data sources. First, convert the format of the data on each side and use Greenwich Mean Time or Coordinated Universal Time as the time reference; second, compensate and correct the timestamps on each side based on the correction data obtained from the Network Time Protocol service. The correction formula is: ;in, It means that after calibration, the host machine The timestamp recorded when the critical event occurred; Indicates that the host is in The timestamp recorded when the critical event occurred. ; Indicates the offset value of the host clock, calculated by the Network Time Protocol correction on the host.

[0019] ;in, It means that after calibration, the container side is The timestamp recorded when the critical event occurred; Indicates that the container side is The timestamp recorded when the critical event occurred. ; Indicates the offset value of the container-side clock, which is calculated by the container's built-in or external Network Time Protocol agent and is used to correct the timestamp collected inside the container.

[0020] Through compensation and correction processing, it is ensured that all acquisition timestamps on the host and container sides are based on the same time reference, eliminating errors caused by device differences and providing accurate data for cross-comparison.

[0021] Use the cross-correlation algorithm to compare the time series on both sides and quantify the timing difference: In order to accurately quantify the timing difference between the timestamp data on the host and container sides, a cross-correlation analysis method is used. By comparing the standardized time series on both sides, the correlation and delay deviation between the host and container sides are obtained, thereby reflecting the cross-layer timing consistency. The expression for defining the cross-correlation function is: ;in, Indicates that at a given delay Under the condition, the cross-correlation value between the corrected timestamp data sequences on the host and container sides is used to measure the time delay between the data sequences on both sides. The similarity between the two conditions is high, and a higher cross-correlation value indicates that the data on both sides are delayed. The following is more consistent; Indicates the time delay parameter, which is used to offset the container side data sequence in the cross-correlation calculation. value, and find the delay that best matches the time series of the host and container sides; Represents the index variable in the data sequence, which is used to traverse the corrected timestamp data on the host and container sides. Each Corresponding to a data point in the host sequence, the corresponding container-side data point is the index The value at Indicates the time after the host side has been standardized and synchronized. A timestamp, after compensation and correction, can reflect the actual time when the event occurred on the host machine; It represents the arithmetic mean of all timestamps after standardization and time synchronization on the host side. Sum the data and divide by Get, used to eliminate the mean shift; Indicates that after correction on the container side, the index The timestamp data at the container side is delayed by the original data in the data sequence After the offset, the corresponding value; Indicates the arithmetic mean of all timestamp data after container-side correction.

[0022] By traversing different delay values , a series of cross-correlation values ​​can be obtained. Finally, we select The delay when reaching the maximum value is recorded as ,satisfy: ;in, Represents the cross-correlation function Get the optimal delay parameter with the maximum value by solving , select the optimal time offset to reflect the best alignment between the data sequences on both sides.

[0023] The time delay deviation, which represents the best match between the time series on both sides, can be accurately quantified by cross-correlation analysis to reveal the systematic differences in time records across layers.

[0024] Calculate and output the quantitative index of cross-layer timing consistency deviation: to obtain the optimal delay Finally, a cross-layer timing consistency deviation index is constructed to reflect the overall consistency of event records on the host and container sides in time. The cross-layer timing consistency deviation index is defined as: ;in, Represents the cross-layer timing consistency deviation indicator, which is used to quantify the consistency of time records between the host and container sides; Represents the standard deviation of all corrected timestamp data.

[0025] The larger the cross-layer timing consistency deviation index is, the greater the systematic difference between the corrected time records on the host and container sides is. That is, the alignment of the event records on both sides is poor, which means: Obvious timing deviation: The absolute value of the best match delay accounts for a large proportion of the overall data fluctuation, reflecting that there is a significant delay or offset in the comparison of log time between the host and container sides.

[0026] Low data consistency: A higher cross-layer time series consistency deviation index value indicates that the cross-layer data is not consistent in time series, which may lead to information lag or misjudgment risk during anomaly detection or early warning.

[0027] Specifically, the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer in a multi-layer virtualization environment is analyzed to evaluate the visibility consistency of the multi-layer resource occupancy status, including: Capture process behavior metadata at the hypervisor layer and extract process resource usage features: In the hypervisor layer, all process-level behavior metadata are captured through the built-in monitoring module, including process startup, running, exit, CPU utilization, memory consumption, disk and network I / O, etc. The raw monitoring data is converted into a structured resource usage feature vector through the preprocessing module. The feature vector set obtained is defined as: ;in, represents the set of all process resource occupancy feature vectors collected at the hypervisor layer; Indicates The resource usage feature vector corresponding to each process in the hypervisor layer, including various indicators (such as CPU usage, memory consumption, I / O operation rate, etc.); Indicates the number of process behavior metadata successfully captured by the hypervisor layer during the collection period.

[0028] Capture process behavior metadata at the container kernel namespace layer and extract container resource usage features: In the container kernel namespace layer, a lightweight monitoring agent is also deployed to monitor the behavior of all running processes in the container. The collected content includes process startup, running status, resource usage and other data. After passing through the data parsing module, it is converted into a standardized resource usage feature vector. The feature vector set obtained is defined as: ;in, Represents the set of all process resource usage feature vectors collected at the container kernel namespace layer; Indicates The resource usage feature vector corresponding to each process in the container layer contains similar resource consumption information; Indicates the total number of process behavior data captured by the container layer during the collection period.

[0029] A unified feature space is established based on virtual machine and container data, and feature vector mapping is performed: To achieve consistent comparison of cross-layer data, the feature vectors collected from the virtual machine hypervisor layer and the container kernel namespace layer are mapped to the same unified feature space. A pre-designed feature mapping function is used to perform nonlinear or linear mapping on each layer of data, so that feature vectors from different sources are comparable in a unified dimensional space. The mapping functions are defined as and , then the hypervisor layer data after mapping is: ;in, represents a function for mapping hypervisor layer data; Indicates that after the mapping function The obtained hypervisor layer feature vectors; Indicates The resource usage feature vector corresponding to each process in the container kernel namespace layer, .

[0030] After mapping, the container kernel namespace layer data is: ;in, Represents a function that maps container layer data. The mapping result is the same as the mapping function. The output features are in the same feature space; Indicates that after the mapping function The obtained A container kernel namespace layer feature vector; Indicates The resource occupancy feature vector corresponding to each process in the container layer, .

[0031] The construction of a unified feature space eliminates the differences in dimensions and scales of the original data, while enabling similarity analysis to be performed under the same metric.

[0032] The vector space similarity analysis algorithm is used to calculate the difference in cross-layer resource status: the two sets of mapped feature vectors reflect their respective resource occupancy status in the unified feature space. In order to evaluate the consistency of the data on both sides in the overall resource usage, the vector space similarity analysis method is used.

[0033] Calculate the centroid (mean vector) of the two sets of vectors separately: The hypervisor layer centroid is ;in, It represents the mean of all mapped feature vectors of the hypervisor layer, reflecting the central trend of the overall resource usage status.

[0034] The centroid of the container kernel namespace layer is ;in, Represents the mean of all mapped feature vectors at the container kernel namespace layer.

[0035] The Euclidean distance is used to calculate the distance between the two groups of centroids as a preliminary measure of the difference in cross-layer resource status. The difference is defined as: ;in, Represents the Euclidean distance between the centroids of the feature vectors after mapping between the hypervisor layer and the container kernel namespace layer.

[0036] In order to reflect the degree of dispersion within each layer of data, the average dispersion of all mapping vectors in the unified feature space is calculated, that is, the dispersion is defined as: ;in, It represents the average Euclidean distance between all mapped vectors and their corresponding centroids in the unified feature space, reflecting the discreteness of the data.

[0037] By comparing the distances of the centroid pieces The overall dispersion , which can reflect the differences in resource occupancy status of cross-layer data.

[0038] According to the difference of cross-layer resource status, the visibility consistency of multi-layer resource occupancy status is evaluated: the visibility consistency index is defined to evaluate the visibility consistency of multi-layer resource occupancy status. The calculation formula is: ;in, Represents the visibility consistency index, ranging from 0 to 1.

[0039] The larger the visibility consistency index is, the more consistent the resource usage data captured in the hypervisor layer and the container kernel namespace layer are, indicating that the cross-layer resource status is well aligned, the computer system operation status is stable, and there is no obvious deviation in the monitoring data.

[0040] Specifically, based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the consistency of the visibility of the multi-layer resource occupancy status, the risk level of cross-layer visibility misalignment is determined, including: A cross-layer timing consistency deviation indicator threshold is preset, and the cross-layer timing consistency deviation indicator is compared with the cross-layer timing consistency deviation indicator threshold: When the cross-layer timing consistency deviation index is greater than or equal to the cross-layer timing consistency deviation index threshold, it indicates that the consistency of the time records on the host and container sides is high, which means that the degree of asynchrony between the time records on the host and container sides exceeds the critical range; at this time, the computer system may have problems such as log sequence misalignment and event playback difficulties, which may lead to inaccurate abnormal diagnosis and even communication disorder of distributed components; When the cross-layer timing consistency deviation index is less than the cross-layer timing consistency deviation index threshold, it indicates that the consistency of the time records on the host and container sides is low, which means that the time record difference between the host and container sides is within the normal range; at this time, the computer system as a whole maintains a high timing accuracy, abnormal diagnosis and distributed collaboration can proceed normally, and slight timing drift will not cause serious consequences; The setting of the cross-layer timing consistency deviation index threshold is usually based on the statistical analysis results of a series of empirical measurements obtained from the timestamp data of the host and container sides under historical normal operation. Under normal working conditions, by collecting the timestamp data of the corresponding events on the host and container sides for a long time, a statistical analysis method (such as quantile analysis or robust statistics) is used to obtain a stable historical deviation distribution, ensuring that the threshold has statistical significance and practical applicability.

[0041] A visibility consistency index is preset and compared with a visibility consistency index threshold: When the visibility consistency index is greater than or equal to the visibility consistency index threshold, it indicates that the visibility consistency of the multi-layer resource occupancy status is high, that is, the visibility of resource occupancy information of the hypervisor layer and the container kernel namespace layer in the multi-layer virtualization environment is highly consistent; at this time, the monitoring results of the process-level behavior metadata on the host and container sides can confirm each other, and the overall computer system operation status tends to be stable; When the visibility consistency index is less than the visibility consistency index threshold, it indicates that the visibility consistency of the multi-layer resource occupancy status is low, which means that there is a significant difference in the resource occupancy view between the hypervisor layer and the container kernel namespace layer. At this time, there may be alignment imbalance, confusion of indicators, or hidden abnormal process occupancy between cross-layer data, which may easily lead to deviations in computer system operation and maintenance and problem diagnosis. The setting of the visibility consistency index threshold is determined based on the actual operation of the computer system, resource scheduling strategy and historical monitoring data statistics. Through long-term tracking and experimental analysis of resource occupancy status data of each layer in a multi-layer virtualization environment, a reasonable threshold interval is obtained using statistical methods.

[0042] When the cross-layer timing consistency deviation index is greater than or equal to the cross-layer timing consistency deviation index threshold, and the visibility consistency index is less than the visibility consistency index threshold, the cross-layer visibility misalignment risk level is judged to be high risk; otherwise, the cross-layer visibility misalignment risk level is judged to be low risk.

[0043] Specifically, we analyze kernel event tracing sequences to assess the risk of multi-layer lock contention anomalies, including: Synchronously capture kernel event tracing data at the hypervisor layer and the container kernel namespace layer: Deploy the kernel event tracing module at both the hypervisor layer and the container kernel namespace layer to achieve real-time capture of kernel event data at both the hypervisor layer and the container kernel namespace layer. Settings: ; ;in, Represents a collection of kernel event trace sequences captured in the hypervisor layer. Each element in the collection represents a record, which contains information such as event type and lock operation status. Represents the hypervisor layer Kernel event records; Indicates the total number of kernel event records captured by the hypervisor layer during the scheduled collection period; Represents a collection of kernel event trace sequences captured in the container kernel namespace layer; Indicates the first Kernel event records; Indicates the total number of kernel event records captured at the container kernel namespace layer during the same scheduled collection period.

[0044] Parse lock contention logs and extract feature vectors: After obtaining kernel event tracing data, process the log information related to lock contention in the records. Extract key features: lock request frequency and lock holding time. Define feature vector set ;in, Represents the set of all lock contention feature vectors parsed from kernel event records, covering both hypervisor layer and container kernel namespace layer data; Indicates feature vectors, of the form: , ;in, Indicates feature vectors; Indicates that the corresponding The lock request frequency of each lock event; Indicates that the corresponding The lock holding time of each lock event, which reflects the time from lock application to lock release; Indicates the total number of feature vectors obtained after parsing, reflecting the number of events involving lock contention within the predetermined collection period.

[0045] By parsing kernel event tracing data, accurate lock contention indicators are extracted from logs, providing high-dimensional feature data.

[0046] Statistics of mutex lock queues and waiting time based on a multi-level queue model: A multi-level queue model is used to count lock requests in queues of different priorities. Each queue level records the mutex lock queue status and the corresponding waiting time. ( ),have: Indicates the queue level The total waiting time of all lock requests in; Indicates the queue level The total number of lock requests.

[0047] Based on the total number of queue-level lock requests and the total waiting time of all lock requests, the average waiting time for each queue level is calculated as: ;in, Indicates the queue level The average waiting time.

[0048] Set weight factors based on the importance of each queue level ;in, Indicates the level assigned to the queue The weight of meets the normalization condition and reflects the contribution of this level to the overall lock contention risk.

[0049] Based on the statistical results of each queue level, the overall lock competition queue waiting index is defined as: ;in, It indicates the overall average waiting time indicator obtained by statistics under the multi-level queue model; Indicates the total number of queue levels.

[0050] Use the improved machine learning algorithm to train and output the lock contention anomaly index: combine the lock contention feature vector set with the overall lock contention queue waiting index to form a comprehensive feature vector for machine learning training. Define the combined feature vector as: ;in, Represents the comprehensive feature vector after combined processing; Represents the dimension of the comprehensive feature vector.

[0051] Introducing an improved machine learning algorithm, defined as ;in, It represents a specially designed and optimized machine learning model, which can be a supervised learning or unsupervised anomaly detection model, and its training goal is to capture the abnormal patterns hidden in the data.

[0052] The machine learning model is used to process the input comprehensive feature vector to obtain the multi-layer lock competition anomaly coefficient, which is expressed as: ;in, Indicates the lock contention exception index output.

[0053] Machine Learning Models By training on a large amount of historical data, the input comprehensive feature vector can be mapped into an indicator reflecting the degree of abnormal risk.

[0054] Evaluate the risk of multi-layer lock contention abnormality based on the lock contention abnormality index: Set the lock contention abnormality threshold, and determine and calibrate it based on historical data and actual business needs.

[0055] Compare the lock contention anomaly index with the lock contention anomaly threshold to assess the risk of multi-layer lock contention anomaly: When the lock contention anomaly index is greater than or equal to the lock contention anomaly threshold, it indicates that the lock contention between the hypervisor layer and the container kernel namespace layer has reached the risk critical point. At this time, the queue waiting situation of each process when competing for the same resource or mutex is serious, which may cause the thread to be blocked for a long time. When the lock contention anomaly index is less than the lock contention anomaly threshold, it indicates that the lock contention between the hypervisor layer and the container kernel namespace layer has not reached the risk critical point, the overall operation of the computer system is relatively stable, and the shared resources and mutex locks required by each process can be allocated and released within a reasonable time.

[0056] Specifically, the consistency of the timestamp data of the host machine and the timestamp data of the container side, the consistency of the visibility of the multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies are comprehensively analyzed to evaluate the cross-layer visibility misalignment alarm level, including: Defining cross-layer timing consistency deviation indicators for , visibility consistency index for , lock contention abnormality index for .

[0057] The cross-layer timing consistency deviation index corresponding to the consistency of time records on the host and container sides, the visibility consistency index corresponding to the visibility consistency of multi-layer resource occupancy status, and the lock contention anomaly index corresponding to the multi-layer lock contention anomaly risk are normalized respectively. The normalized cross-layer timing consistency deviation index, visibility consistency index and lock contention anomaly index represent the performance of cross-layer timing consistency, resource occupancy visibility and multi-layer lock contention anomaly risk on the same numerical scale.

[0058] In order to comprehensively reflect the cross-layer visibility misalignment, fuzzy membership functions are designed for the normalized cross-layer timing consistency deviation index, visibility consistency index and lock contention anomaly index, specifically: , ;in, Indicates The fuzzy membership of an indicator or index; Indicates The slope parameter of an indicator or index; Indicates The raw value of an indicator or index; Indicates The central parameter or critical value of an indicator or index.

[0059] The normalized value is converted into fuzzy membership through fuzzy membership function. The geometric mean method is used to perform nonlinear aggregation on each fuzzy membership to obtain a comprehensive score. ;in, Indicates the comprehensive rating. Represents the fuzzy membership of the cross-layer temporal consistency deviation indicator; represents the fuzzy membership of the visibility consistency index; Indicates the fuzzy membership of lock contention exception lock contention.

[0060] Compare the comprehensive score with the preset first alarm threshold and second alarm threshold to determine the risk level of cross-layer visibility misalignment: When the comprehensive score is less than the first alarm threshold, the risk level of cross-layer visibility misalignment is normal; When the comprehensive score is greater than or equal to the first warning threshold and less than the second warning threshold, the risk level of cross-layer visibility misalignment is warning; When the comprehensive score is greater than or equal to the second alarm threshold, the risk level of cross-layer visibility misalignment is urgent.

[0061] Example 2 The difference between Example 2 of the present invention and Example 1 is that this example introduces a computer information anomaly identification and early warning system.

[0062] Figure 2 A structural schematic diagram of a computer information anomaly identification and early warning system of the present invention is given, a computer information anomaly identification and early warning system, including a consistency assessment module, a metadata analysis module, a risk level determination module, an abnormal risk assessment module and an alarm level assessment module; The consistency assessment module monitors the cross-layer event timestamp data generated by the host and container sides in a multi-layer virtualization environment to assess the consistency of the timestamp data of the host and the timestamp data of the container side. The metadata analysis module analyzes the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer in a multi-layer virtualization environment to evaluate the visibility consistency of the resource occupancy status of the multiple layers; The risk level determination module determines the risk level of cross-layer visibility misalignment based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the visibility consistency of the multi-layer resource occupancy status; The abnormal risk assessment module evaluates the abnormal risk of multi-layer lock contention by analyzing the kernel event tracing sequence when the risk level of cross-layer visibility misalignment is high; The alarm level assessment module conducts a comprehensive analysis of the consistency between the timestamp data of the host machine and the timestamp data of the container side, the consistency of the visibility of multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies, and assesses the cross-layer visibility misalignment alarm level.

[0063] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0064] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or may be transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium may be a solid-state hard disk.

[0065] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0066] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0067] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0068] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, and may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0069] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0070] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0071] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0072] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A computer information anomaly identification and early warning method, characterized in that: The steps include: By monitoring the cross-layer event timestamp data generated by the host and container in a multi-layer virtualization environment, the consistency of the timestamp data of the host and the timestamp data of the container can be evaluated. Analyze the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer in a multi-layer virtualization environment to evaluate the visibility consistency of resource occupancy status in multiple layers; Capture process behavior metadata at the hypervisor layer and extract process resource usage characteristics; Capture process behavior metadata at the container kernel namespace layer and extract container resource usage characteristics; Establish a unified feature space based on virtual machine and container data to perform feature vector mapping; Use the vector space similarity analysis algorithm to calculate the difference between cross-layer resource states; According to the difference of resource status across layers, the consistency of visibility of resource occupancy status across multiple layers is evaluated; Based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the consistency of the visibility of the multi-layer resource occupancy status, the risk level of cross-layer visibility misalignment is determined; When the risk level of cross-layer visibility misalignment is high, the risk of multi-layer lock contention anomalies is evaluated by analyzing the kernel event trace sequence; Comprehensively analyze the consistency of the timestamp data of the host machine and the timestamp data on the container side, the consistency of the visibility of multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies to evaluate the cross-layer visibility misalignment alarm level.

2. A computer information anomaly identification and early warning method according to claim 1, characterized in that: By monitoring the cross-layer event timestamp data generated by the host and container in a multi-layer virtualization environment, the consistency of the timestamp data of the host and the timestamp data of the container is evaluated. Specifically: Collect host machine key event log timestamp data in real time in a multi-layer virtualization environment; Synchronously collect the corresponding timestamp data in the key event log on the container side; Standardize and synchronize timestamp data on the host and container sides; The cross-correlation algorithm is used to compare the time series on both sides and quantify the time series differences; Calculate and output the cross-layer timing consistency deviation index.

3. A computer information anomaly identification and early warning method according to claim 2, characterized in that: Based on the consistency between the timestamp data of the host and the timestamp data of the container side and the consistency of the visibility of the multi-layer resource occupancy status, the risk level of cross-layer visibility misalignment is determined, specifically: When the cross-layer timing consistency deviation index is greater than or equal to the cross-layer timing consistency deviation index threshold, and the visibility consistency index is less than the visibility consistency index threshold, the cross-layer visibility misalignment risk level is judged to be high risk; otherwise, the cross-layer visibility misalignment risk level is judged to be low risk.

4. A computer information anomaly identification and early warning method according to claim 3, characterized in that: By analyzing the kernel event trace sequence, the risk of multi-layer lock contention anomalies is assessed, specifically: Synchronously capture kernel event trace data at the hypervisor layer and the container kernel namespace layer; Parse lock contention logs and extract feature vectors; Statistics on mutex lock queue status and waiting time based on multi-level queue model; Use the improved machine learning algorithm to train and output the lock contention anomaly index; Evaluate the multi-layer lock abnormal contention risk based on the lock contention abnormality index.

5. A computer information anomaly identification and early warning method according to claim 4, characterized in that: The multi-layer lock abnormal competition risk is evaluated based on the lock competition abnormality index, specifically: Compare the lock contention anomaly index with the lock contention anomaly threshold: When the lock contention anomaly index is greater than or equal to the lock contention anomaly threshold, it indicates that the lock contention between the hypervisor layer and the container kernel namespace layer has reached a risk critical point; When the lock contention anomaly index is less than the lock contention anomaly threshold, it indicates that the lock contention between the hypervisor layer and the container kernel namespace layer has not reached the risk critical point.

6. A computer information anomaly identification and early warning method according to claim 5, characterized in that: Comprehensively analyze the consistency of the timestamp data of the host machine and the timestamp data of the container side, the consistency of the visibility of the multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies, and evaluate the cross-layer visibility misalignment alarm level, specifically: Compare the comprehensive score with the preset first alarm threshold and second alarm threshold to determine the risk level of cross-layer visibility misalignment: When the comprehensive score is less than the first alarm threshold, the risk level of cross-layer visibility misalignment is normal; When the comprehensive score is greater than or equal to the first warning threshold and less than the second warning threshold, the risk level of cross-layer visibility misalignment is warning; When the comprehensive score is greater than or equal to the second alarm threshold, the risk level of cross-layer visibility misalignment is urgent.

7. A computer information anomaly identification and early warning system, used to implement a computer information anomaly identification and early warning method according to any one of claims 1 to 6, characterized in that: It includes consistency assessment module, metadata analysis module, risk level determination module, abnormal risk assessment module and alarm level assessment module; The consistency assessment module monitors the cross-layer event timestamp data generated by the host and container sides in a multi-layer virtualization environment to assess the consistency of the timestamp data of the host and the timestamp data of the container side. The metadata analysis module analyzes the process-level behavior metadata captured by the hypervisor layer and the container kernel namespace layer in a multi-layer virtualization environment to evaluate the visibility consistency of the resource occupancy status of the multiple layers; The risk level determination module determines the risk level of cross-layer visibility misalignment based on the consistency between the timestamp data of the host machine and the timestamp data of the container side and the visibility consistency of the multi-layer resource occupancy status; The abnormal risk assessment module evaluates the abnormal risk of multi-layer lock contention by analyzing the kernel event tracing sequence when the risk level of cross-layer visibility misalignment is high; The alarm level assessment module conducts a comprehensive analysis of the consistency between the timestamp data of the host machine and the timestamp data of the container side, the consistency of the visibility of multi-layer resource occupancy status, and the risk of multi-layer lock competition anomalies, and assesses the cross-layer visibility misalignment alarm level.

Images