Application program anomaly detection method and device

Abstract

The embodiment of the invention provides an application program exception detection method and device.The method is applied to an exception detection module of an exception detection system and comprises the steps that firstly, operation parameters of an application program are obtained, and operation index data of the application program are calculated according to the operation parameters; then inputting the unit time flow and the operation index data of the application program into an exception score calculation model for exception score calculation, outputting an exception score, finally detecting whether the exception score exceeds a preset score threshold, if yes, sending the operation parameters to a control module of an exception detection system for exception response processing of the operation parameters, and if not, sending the operation parameters to the control module of the exception detection system. Therefore, the accuracy of evaluating the running state of the application program is improved, and the response speed of the running parameters in the running process of the application program and the processing efficiency of the running parameters are improved.

Description

Technical Field

[0001] This document relates to the field of application technology, and more particularly to a method and device for detecting anomalies in an application. Background Art

[0002] With the continuous development of information technology, various applications have become an indispensable part of people's daily work and life. In order to ensure the security and stability of applications during operation and prevent potential security threats and performance issues, effective monitoring and anomaly detection mechanisms for applications are particularly important.

[0003] At present, the security protection of applications can be achieved through access control, encryption protection, security auditing, log monitoring and other methods to identify potential security threats during the operation of applications. However, with the continuous changes in the complexity of applications, the existing anomaly detection methods for applications may have some limitations. For example, there is a lack of comprehensive detection of the running status of applications, resulting in some hidden threats not being discovered in time. For example, the existing anomaly detection methods rely more on preset rules, which may easily lead to delayed responses or false alarms. Therefore, how to improve the efficiency and accuracy of anomaly detection during the operation of applications and achieve security protection for applications has become a problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of one embodiment of the present specification is to provide a method and device for detecting anomalies in an application program, so as to improve the accuracy of evaluating the running status of the application program, and to increase the response speed to the running parameters during the running of the application program and the processing efficiency of the running parameters.

[0005] To solve the above technical problems, an embodiment of this specification is implemented as follows: In a first aspect, an embodiment of the present specification provides an application anomaly detection method, the method being applied to an anomaly detection module of an anomaly detection system; the method comprising: Obtaining operating parameters of an application program, and calculating operating indicator data of the application program according to the operating parameters; Inputting the unit time flow of the application and the operation index data into an anomaly score calculation model to calculate the anomaly score, and outputting the anomaly score; Detect whether the abnormal score exceeds a preset score threshold, and if so, send the operating parameter to the control module of the abnormal detection system to perform abnormal response processing on the operating parameter.

[0006] In a second aspect, an embodiment of the present specification provides an abnormality detection device for an application program, the device being applied to an abnormality detection module of an abnormality detection system; the device comprising: An indicator calculation module, used to obtain the operating parameters of the application program and calculate the operating indicator data of the application program according to the operating parameters; A scoring calculation module, used for inputting the unit time flow of the application and the operation index data into an abnormal scoring calculation model to perform abnormal scoring calculation and output an abnormal scoring; The detection module is used to detect whether the abnormal score exceeds a preset score threshold. If so, the operating parameters are sent to the control module of the abnormal detection system for abnormal response processing of the operating parameters.

[0007] In a third aspect, another embodiment of the present specification provides an application anomaly detection device, comprising: a memory, a processor, and computer executable instructions stored on the memory and executable on the processor, wherein the computer executable instructions, when executed by the processor, implement the steps of the application anomaly detection method as described in the first aspect above.

[0008] In a fourth aspect, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the method for detecting anomalies in an application as described in the first aspect above are implemented.

[0009] In a fifth aspect, another embodiment of the present specification provides a computer program product, wherein the computer program product includes an application anomaly detection program, and the application anomaly detection program is executed by a processor to implement the steps of the application anomaly detection method as described in the first aspect above.

[0010] The present embodiment provides an anomaly detection method for an application. The method is applied to an anomaly detection module of an anomaly detection system. First, the operating parameters of the application are obtained, and the operating index data of the application is calculated according to the operating parameters to provide a data basis for subsequent anomaly score calculation. Then, the unit time flow and operating index data of the application are input into an anomaly score calculation model for anomaly score calculation, and an anomaly score is output. The anomaly score calculation model can be used to quickly obtain the anomaly score, and the data processing efficiency and accuracy are also improved. Finally, it is detected whether the anomaly score exceeds a preset score threshold. If so, the operating parameters are sent to a control module of the anomaly detection system for abnormal response processing of the operating parameters. By presetting the score threshold, false alarms of the operating parameters are avoided, and the stability and reliability of the anomaly detection system are improved. At the same time, the response speed to the operating parameters during the operation of the application and the processing efficiency of the operating parameters are improved, and the accuracy of the evaluation of the application operation status is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in one or more embodiments of the present specification, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0012] Figure 1 A processing flow chart of an abnormality detection method for an application provided in one or more embodiments of this specification; Figure 2 A schematic diagram of an anomaly detection system provided for one or more embodiments of this specification; Figure 3 A processing flow chart of an application anomaly detection method for detecting an application running parameter scenario provided by one or more embodiments of this specification; Figure 4 A schematic diagram of an abnormality detection device for an application provided in one or more embodiments of this specification; Figure 5 A schematic diagram of the structure of an abnormality detection device for an application provided in one or more embodiments of this specification. DETAILED DESCRIPTION

[0013] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0014] This specification provides an example of an abnormality detection method for an application: Reference Figure 1 , which shows a processing flow chart of an abnormality detection method for an application provided in this embodiment. The abnormality detection method for an application provided in this embodiment specifically includes the following steps S102 to S106.

[0015] Step S102, obtaining the operating parameters of the application, and calculating the operating index data of the application according to the operating parameters.

[0016] The application anomaly detection method provided in this embodiment is applied to the anomaly detection module of the anomaly detection system; wherein the anomaly detection system refers to a system for real-time detection and evaluation of the running status of the application, and performing anomaly response processing on abnormal data of the application during the running process; the anomaly detection module refers to a module that detects whether the running status of the application is abnormal by acquiring the running parameters of the application in real time.

[0017] The operating parameters in this embodiment refer to the parameters generated by the application during operation; the operating parameters include the access frequency, abnormal fluctuation number, delay time, number of active connections and / or number of waiting connections of the application. In addition, the operating parameters may also include other parameters generated by the application during operation, for example, the operating parameters may also include the CPU (Central Processing Unit) usage rate and / or disk I / O (Input / Output) operation frequency of the application. Optionally, the operating parameters include the access frequency, abnormal fluctuation number, delay time, number of active connections and / or number of waiting connections.

[0018] Among them, the number of abnormal fluctuations refers to the number of times certain indicators of the application exceed the preset threshold within the preset time; the number of active connections refers to the number of connections currently being processed; the number of waiting connections refers to the number of connections that have arrived but have not yet been processed and are in the waiting queue.

[0019] The operation index data refers to data used to evaluate the operation status of an application program after processing the operation parameters based on an algorithm or formula; the operation index data includes the access frequency obtained by processing the access frequency, the abnormal fluctuation rate obtained by processing the abnormal fluctuation number, the delay impact factor obtained by processing the delay time, and / or the connection ratio obtained by processing the number of active connections and the number of waiting connections. In addition, the operation index data may also include corresponding data obtained by processing other operation parameters, for example, the operation index data may also include the CPU peak utilization rate and / or the disk I / O rate of the application program. Optionally, the operation index data includes the access frequency, the abnormal fluctuation rate, the delay impact factor and / or the connection ratio.

[0020] In the specific implementation, the operating parameters of the application can be obtained in real time first to provide a data basis for the subsequent execution process, and then the operating indicator data of the application can be calculated based on the obtained operating parameters to obtain the operating indicator data to preliminarily evaluate the operating status of the application.

[0021] During the specific execution process, in the process of calculating the operating indicator data of the application based on the operating parameters, in order to evaluate the operating status of the application during the operation process, the corresponding operating indicator data can be calculated respectively according to the obtained operating parameters; the following provides four methods for calculating the operating indicator data, and specifically explains the calculation methods of the four operating indicator data respectively.

[0022] (1) Calculate access frequency Specifically, in order to evaluate the number of requests processed by the application within a preset time, the access frequency may be calculated according to the preset time and the access frequency of the application within the preset time. In an optional implementation provided by this embodiment, the operation index data of the application is calculated according to the operation parameters, including: The access frequency is calculated based on the preset duration and the access frequency corresponding to the preset duration.

[0023] For example, if the preset duration is 1 hour, and the access frequency initiated to the application within 1 hour is 18,000 times, then the access frequency T of the application is: 18,000 times 1 hour = 18000 60 minutes = 300 times / minute; the higher the access frequency, the more requests are made to the application per unit time.

[0024] (2) Calculation of abnormal volatility Specifically, in order to evaluate the stability and reliability of an application program when facing a high access frequency, the abnormal fluctuation rate may be calculated based on a preset duration, the access frequency of the application program within the preset duration, and the number of abnormal fluctuations; in an optional implementation manner provided by this embodiment, the operation index data of the application program is calculated based on the operation parameters, including: The abnormal fluctuation rate is calculated according to the preset duration, the access frequency corresponding to the preset duration, and the number of abnormal fluctuations corresponding to the preset duration.

[0025] For example, the preset duration is 1 minute, the access frequency initiated to the application within 1 minute is obtained to be 300 times, and the number of abnormal fluctuations detected is 15 times, then the access frequency T of the application is: 300 1=300 times / minute, the abnormal fluctuation rate E of the application is: 15 300=5%.

[0026] In practical applications, in order to reduce the impact of abnormal volatility on the calculation of anomaly scores in the subsequent process of calculating anomaly scores through anomaly score calculation models, the abnormal volatility can be normalized in the process of calculating anomaly scores based on abnormal volatility. For example, the abnormal volatility is expressed as E, and 1-E can be used to calculate the anomaly score.

[0027] Calculating the Delay Impact Factor Specifically, in order to evaluate the change in the response speed of the application and identify the reasons that may cause the increase in the delay of the application, the delay impact factor may be calculated according to the delay time of the application. In an optional implementation manner provided by this embodiment, the operation index data of the application is calculated according to the operation parameters, including: The delay impact factor is calculated based on the delay time and the delay impact coefficient.

[0028] The delay time in this embodiment refers to the maximum delay time of the application program, and refers to the maximum value of the delay times of various requests for the application program recorded within a preset time period.

[0029] For example, the maximum delay time S is determined from the delay times obtained within the preset time length. max In order to make the influence of delay time on the calculation of abnormal score linear, the delay influence coefficient c can be introduced. Then the delay influence factor S can be calculated by the following formula: S=

[0030] Among them, S max represents the maximum delay time, c represents the delay influence coefficient, and c can be a preset delay time; S max The larger the value, the greater the impact of the delay factor on the calculation of the abnormal score. max The smaller it is, the smaller the impact of the delay impact factor on the calculation of the anomaly score.

[0031] (4) Calculate the connection ratio Specifically, in order to evaluate the processing capability of the application program for new connection requests, the connection ratio may be calculated based on the number of active connections and the number of waiting connections of the application program. In an optional implementation manner provided by this embodiment, the operation index data of the application program is calculated based on the operation parameters, including: Calculates the connection ratio based on the number of active connections and the number of waiting connections.

[0032] For example, the number of active connections of the application is recorded as W, and the number of waiting connections is recorded as H. Then the connection ratio R can be calculated by the following formula: R=

[0033] Among them, W represents the number of active connections, and H represents the number of waiting connections. The larger the number of waiting connections H, the more connections are waiting to be processed. Correspondingly, the greater the pressure on the application server to process connections. For example, the number of active connections W obtained is 80, and the number of waiting connections H is 20, then the connection ratio R=80 / (20+80)=80%, indicating that 80% of the connections are being processed and 20% of the connections are waiting to be processed, which indicates that the server is relatively stable and most connections are being effectively processed. For another example, the number of active connections W obtained is 20, and the number of waiting connections H is 80, then the connection ratio R=20 / (80+20)=20%, indicating that only 20% of the connections are being processed and 80% of the connections are waiting to be processed, which may indicate that the application server is overloaded.

[0034] It should be noted that the above four processes of calculating the corresponding operating index data according to the obtained operating parameters have no obvious order of precedence in the actual calculation process, and can be executed in sequence in a certain order. For example, the connection ratio can be calculated first, then the delay impact factor can be calculated, then the abnormal volatility can be calculated, and finally the access frequency can be calculated; for example, the delay impact factor can be calculated first, then the access frequency can be calculated, then the abnormal volatility can be calculated, and finally the connection ratio can be calculated; in addition, in order to improve the response speed, the calculation processes of the four operating index data can also be processed in parallel, which will not be elaborated in this embodiment.

[0035] In addition, all four operation indicator data calculation processes can be executed, or at least one of the processes can be selected for execution. For example, when resources are limited, at least one of the operation indicator data can be selected for calculation: calculating the access frequency and abnormal fluctuation rate to evaluate whether the server is overloaded and whether the server has abnormalities, while the delay impact factor and / or connection ratio are temporarily not calculated.

[0036] In actual applications, in order to more comprehensively evaluate the running status of the application, in addition to calculating the above four running indicator data, other related running indicator data can also be introduced according to actual needs. For example, in order to evaluate the resource utilization of the application, the CPU usage of the application can be calculated. For example, in order to evaluate the disk I / O performance of the application, the disk I / O rate of the application can be calculated. This embodiment will not be elaborated here.

[0037] In addition, before the step of obtaining the operating parameters of the application and calculating the operating indicator data of the application according to the operating parameters is executed, the unit time flow of the application can be obtained; or, after the step of obtaining the operating parameters of the application and calculating the operating indicator data of the application according to the operating parameters is executed, and before the step of inputting the unit time flow of the application and the operating indicator data into the anomaly score calculation model for executing the anomaly score calculation step, the unit time flow of the application can also be obtained; in addition, the acquisition of the unit time flow and the operation indicator data obtained by calculating the operating parameters can be processed in parallel.

[0038] Step S104: input the unit time flow of the application and the operation index data into an abnormality score calculation model to calculate the abnormality score and output the abnormality score.

[0039] The anomaly score calculation model refers to a model that performs anomaly score calculation based on the unit time flow and operation index data of the application to evaluate the operation status of the application. The input of the anomaly score calculation model is the obtained unit time flow of the application and the calculated operation index data of the application. The output of the anomaly score calculation model is the anomaly score; wherein the anomaly score can be used to quantify the degree of anomaly of the application.

[0040] In specific implementation, after obtaining the unit time flow and operation index data of the application, the unit time flow and operation index data of the application can be input into the anomaly score calculation model to calculate the anomaly score and output the anomaly score.

[0041] During the specific implementation process, in order to improve the efficiency of obtaining anomaly scores and improve the accuracy of evaluating the operating status of the application, the unit time flow and operating indicator data of the application can be input into the anomaly score calculation model to calculate the anomaly score and output the anomaly score; the following provides two methods for calculating anomaly scores and explains the two methods for calculating anomaly scores respectively.

[0042] Method 1: Specifically, in order to improve the comprehensiveness and accuracy of evaluating the running status of the application, the abnormality score of the application may be calculated based on multiple running indicator data; in an optional implementation manner provided in this embodiment, the abnormality score calculation includes: The access frequency, the delay impact factor and the normalized abnormal fluctuation rate are multiplied to obtain the adjusted access frequency; Divide the adjusted access frequency by the unit time flow to obtain the unit access frequency; The anomaly score is obtained by multiplying the unit access frequency and the connection ratio.

[0043] For example, after normalizing the abnormal volatility E, 1-E can be obtained. First, the access frequency T, the delay impact factor S and the normalized abnormal volatility are multiplied to obtain the adjusted access frequency , then divide the adjusted access frequency by the unit time flow L to obtain the unit access frequency Finally, the unit access frequency and the connection ratio R are multiplied to obtain the anomaly score. Based on this, the anomaly score P of the application can be calculated by the following formula: P= =

[0044] Among them, P represents the anomaly score of the application, T represents the access frequency, E represents the anomaly fluctuation rate, S represents the delay impact factor, L represents the traffic per unit time, and R represents the connection ratio.

[0045] Method 2: Specifically, in order to reduce the impact of the server performance of the application on the anomaly score calculation, and at the same time improve the flexibility and sensitivity of the anomaly score calculation model, so that the anomaly score calculation model can also improve the accuracy of calculating the anomaly score when the connection state of the application is unstable and / or there are too many connection requests, the weight of the connection ratio in the anomaly score calculation process can be adjusted; in another optional implementation manner provided by this embodiment, the anomaly score calculation also includes: The access frequency, the delay impact factor and the normalized abnormal fluctuation rate are multiplied to obtain the adjusted access frequency; Divide the adjusted access frequency by the unit time flow to obtain the unit access frequency; Performing an exponential operation on the connection ratio based on a preset constant to obtain an adjusted connection ratio; The anomaly score is obtained by multiplying the unit access frequency and the adjusted connection ratio.

[0046] For example, after normalizing the abnormal volatility E, we can get 1-E, and the access frequency , Delay Impact Factor Multiply the normalized abnormal volatility to get the adjusted access frequency , divide the adjusted access frequency by the unit time flow L to obtain the unit access frequency , based on the preset constant k, the connection ratio R is exponentially calculated to obtain the adjusted connection ratio , multiply the unit access frequency and the adjusted connection ratio to obtain the anomaly score P. Based on this, the anomaly score P of the application can be calculated using the following formula: P= =

[0047] Among them, P represents the abnormality score of the application, T represents the access frequency, E represents the abnormal volatility, S represents the delay impact factor, L represents the flow per unit time, R represents the connection ratio, and k represents a preset constant; the value of the preset constant k can be determined according to the performance of the application server. The higher the application server performance, the larger the value of k can be, and the lower the application server performance, the smaller the value of k can be.

[0048] It should be noted that the unit time flow and operation index data of the application are input into the abnormal score calculation model for abnormal score calculation, and the abnormal score is output. The abnormal score calculation model here can also be an abnormal score algorithm or an abnormal score calculation module. Correspondingly, the abnormal score calculation can be performed by the abnormal score algorithm or the abnormal score calculation module, that is, the unit time flow and operation index data of the application are input into the abnormal score calculation model for abnormal score calculation, and the abnormal score is output. It can be replaced by: the unit time flow and operation index data of the application are input into the abnormal score calculation algorithm for abnormal score calculation, and the abnormal score is output; or, it can also be replaced by: the unit time flow and operation index data of the application are input into the abnormal score calculation module for abnormal score calculation, and the abnormal score is output. This embodiment will not be described in detail here.

[0049] Step S106, detecting whether the abnormality score exceeds a preset score threshold, and if so, sending the operating parameter to the control module of the abnormality detection system to perform abnormal response processing on the operating parameter.

[0050] In specific implementation, after obtaining the abnormal score through the abnormal score calculation model, the abnormal score is compared with the preset score threshold to detect whether the abnormal score exceeds the preset score threshold. If the abnormal score is greater than or equal to the preset score threshold, it indicates that the abnormal score exceeds the preset score threshold. Based on this, the operating parameters are sent to the control module of the abnormal detection system for abnormal response processing of the operating parameters; if the abnormal score is less than the preset score threshold, it indicates that the abnormal score does not exceed the preset score threshold and no processing is required.

[0051] During the specific execution process, in order to ensure that the abnormal operating status of the application can be identified and processed in a timely manner, and to improve the security and stability of the application operation, after detecting that the abnormal score exceeds the preset score threshold, the operating parameters are sent to the control module of the abnormal detection system for abnormal response processing of the operating parameters; the abnormal response processing of the operating parameters may include multiple execution processes. The following provides two processes for abnormal response processing of the operating parameters, and describes the two processes in detail respectively.

[0052] (1) Encrypt and / or store operating parameters Specifically, in the process of performing abnormal response processing on the operating parameters, in order to improve the security of the operating parameters during transmission and storage, and to provide persistent storage for the operating parameters, the operating parameters may be encrypted, and the encrypted abnormal data may be stored; in an optional implementation manner provided in this embodiment, the abnormal response processing includes: Encrypting the operating parameters to obtain encrypted data; Local and / or cloud storage of encrypted data.

[0053] Specifically, the operating parameters may be encrypted to obtain encrypted data, and the obtained encrypted data may be stored locally, stored in the cloud, or stored locally and in the cloud.

[0054] For example, Figure 2 As shown, the anomaly detection system may include an anomaly detection module 201, a control module 202, an anomaly warning module 203, an update display module 204, an encryption module 205, a local storage module 206, a cloud storage module 207 and / or an interaction module 208; wherein the anomaly detection module may obtain the operating parameters of the application to detect whether the operating state of the application is abnormal, the control module may coordinate various modules to forward and process data, the anomaly warning module may further evaluate and analyze the operating parameters to determine the specific abnormal type of the operating parameters, the update display module may display the operating state of the application in real time, the encryption module may encrypt the operating parameters of the application, the local storage module and the cloud storage module may store the operating parameters, and the interaction module may receive an abnormality processing instruction for the operating parameters input by the detection personnel; In the process of sending the operating parameters to the control module of the abnormal detection system for abnormal response processing of the operating parameters, the control module 202 can send the operating parameters to the encryption module 205 after receiving the operating parameters. The encryption module can randomly generate a key to encrypt the operating parameters to obtain encrypted data, and return the encrypted data and the key to the control module. After receiving the encrypted data and the key, the control module can send the encrypted data to the local storage module 206 and / or the cloud storage module 207. Accordingly, the local storage module and / or the cloud storage module can store the encrypted data locally and / or in the cloud; in addition, the encryption module can also randomly generate two pairs of keys to encrypt the application and the operating parameters respectively, and return the encrypted data and the key to the control module.

[0055] (2) Data processing of operating parameters Specifically, in the process of performing abnormal response processing on the operating parameters, in order to improve the processing efficiency of the operating parameters and improve the accuracy and effectiveness of data processing on the operating parameters, the operating parameters may be processed according to the abnormal processing instruction; in an optional implementation manner provided in this embodiment, the abnormal response processing further includes: An exception handling instruction is generated according to the operation parameters, and data processing is performed on the operation parameters based on the exception handling instruction.

[0056] For example, Figure 2 As shown, the exception detection module 201 can send the operating parameters to the control module 202. After receiving the operating parameters, the control module can send the operating parameters to the update display module 204. Accordingly, the detection personnel can obtain the operating status and operating parameters of the application based on the update display module of the user terminal. For the operating parameters, the detection personnel can input corresponding exception handling instructions through the interaction module 208. The interaction module can return the acquired and generated exception handling instructions to the control module, so that the control module parses the exception handling instructions and performs data processing on the operating parameters based on the exception handling instructions.

[0057] In addition, in addition to the above two processes of abnormal response processing for operating parameters, other abnormal response processing can be performed on operating parameters through the abnormal detection system. For example, abnormal response processing can be performed on operating parameters through the abnormal warning module: after the control module sends the operating parameters to the abnormal warning module, the abnormal evaluation program deployed in the abnormal warning module can call the evaluation algorithm to further analyze the operating parameters to determine the specific abnormal type of the operating parameters, and send the analysis results to the control module; for example, abnormal response processing can also be performed on operating parameters through the cloud storage module: first, a cloud storage platform is created on the local server, and a storage protocol is implemented through a third-party gateway. This storage protocol can realize the conversion from NFS (Network File System) to SMB (Server Message Block), and the operating parameters are written into the cloud storage gateway. The cloud storage gateway transmits the operating parameters to the border router, and the border router transmits the operating parameters to the cloud platform through the dedicated public network. A storage request is initiated in the cloud platform, and the operating parameters are transmitted to the cloud storage gateway in the cloud platform. The cloud storage gateway sends the operating parameters to the cloud storage availability zone through the vSwitch (Virtual Switch) to complete the cloud storage of the operating parameters.

[0058] In summary, the present embodiment provides an anomaly detection method for an application. The method is applied to an anomaly detection module of an anomaly detection system. First, the operating parameters of the application are obtained, and the operating index data of the application is calculated according to the operating parameters to provide a data basis for subsequent anomaly score calculation. Then, the unit time flow and operating index data of the application are input into the anomaly score calculation model for anomaly score calculation, and the anomaly score is output. The anomaly score calculation model can be used to quickly obtain the anomaly score, and the data processing efficiency and accuracy of data processing are also improved. Finally, it is detected whether the anomaly score exceeds a preset score threshold. If so, the operating parameters are sent to the control module of the anomaly detection system for abnormal response processing of the operating parameters. By presetting the scoring threshold, false alarms of the operating parameters are avoided, and the stability and reliability of the anomaly detection system are improved. At the same time, the response speed to the operating parameters during the operation of the application and the processing efficiency of the operating parameters are improved, and the accuracy of the evaluation of the application operation status is improved.

[0059] The following combination Figure 3 , taking the application of the abnormality detection method of the application provided by this embodiment in the scenario of detecting the running parameters of the application as an example, the abnormality detection method of the application provided by this embodiment is further described. Figure 3 The anomaly detection method for an application program applied to detecting an operating parameter scenario of the application program specifically includes steps S302 to S316.

[0060] Step S302, obtaining the access frequency, abnormal fluctuation number, delay time, number of active connections and number of waiting connections of the application.

[0061] Step S304: Calculate the access frequency according to the preset duration and the access frequency corresponding to the preset duration.

[0062] Step S306, calculating the abnormal fluctuation rate according to the preset duration, the access frequency corresponding to the preset duration, and the number of abnormal fluctuations corresponding to the preset duration.

[0063] Step S308: Calculate the delay impact factor according to the delay time and the delay impact coefficient.

[0064] Step S310, calculating the connection ratio according to the number of active connections and the number of waiting connections.

[0065] Step S312: Input the application's unit time flow, access frequency, abnormal fluctuation rate, delay impact factor, and connection ratio into an abnormality scoring model to calculate the abnormality score and output the abnormality score.

[0066] Step S314, detect whether the abnormal score exceeds the preset score threshold; if so, execute step S316; if not, no processing is performed.

[0067] Step S316: Send the operating parameters to the control module of the abnormality detection system to perform abnormal response processing on the operating parameters.

[0068] It should be noted that steps S304 to S310 are processes for calculating corresponding operating indicator data according to the operating parameters of the application. There is no obvious order of sequence for steps S304, S306, S308, and S310. In actual applications, after executing step S302 and obtaining the access frequency, abnormal fluctuation number, delay time, number of active connections, and number of waiting connections of the application, at least one of steps S304, S306, S308, and S310 may be executed according to actual needs. This embodiment will not be elaborated here.

[0069] In addition, it should be noted that a combination of one step from step S302 to step S316 or any combination of multiple steps can select any one step from step S102 to step S106 or any combination of multiple steps to form a new implementation method according to the needs of implementation deployment; and any one or multiple technical features in the technical scheme composed of steps S302 to step S316 can also select any one or multiple technical features in the technical scheme composed of steps S102 to step S106 to form a new implementation method according to the needs of actual deployment, or select one or more technical features in one or more optional implementation methods provided by steps S102 to step S106 to combine into a new implementation method, which will not be repeated here one by one.

[0070] Figure 4 A schematic diagram of an abnormality detection device for an application provided by an embodiment of the present invention, wherein the device is applied to an abnormality detection module of an abnormality detection system, such as Figure 4 As shown, the device comprises: The indicator calculation module 402 is used to obtain the operating parameters of the application program and calculate the operating indicator data of the application program according to the operating parameters; The scoring calculation module 404 is used to input the unit time flow of the application and the operation index data into the abnormal scoring calculation model to perform abnormal scoring calculation and output the abnormal scoring; The detection module 406 is used to detect whether the abnormal score exceeds a preset score threshold. If so, the operating parameter is sent to the control module of the abnormal detection system for abnormal response processing of the operating parameter.

[0071] The present embodiment provides an abnormality detection device for an application. The device is applied to an abnormality detection module of an abnormality detection system. First, an index calculation module 402 is run to obtain the operation parameters of the application. The operation index data of the application is calculated according to the operation parameters to provide a data basis for subsequent abnormality score calculation. Then, a score calculation module 404 is run to input the unit time flow and the operation index data of the application into an abnormality score calculation model to perform abnormality score calculation and output an abnormality score. The abnormality score can be quickly obtained through the abnormality score calculation model, and the data processing efficiency and the accuracy of data processing are also improved. Finally, a detection module 406 is run to detect whether the abnormality score exceeds a preset score threshold. If so, the operation parameter is sent to the control module of the abnormality detection system for abnormal response processing of the operation parameter. By presetting the score threshold, false alarms of the operation parameter are avoided, and the stability and reliability of the abnormality detection system are improved. At the same time, the response speed to the operation parameter during the operation of the application and the processing efficiency of the operation parameter are improved, and the accuracy of the evaluation of the operation status of the application is improved.

[0072] An abnormality detection device for an application provided in one embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0073] Furthermore, an embodiment of the present specification also provides an abnormality detection device for an application program. Figure 5 A schematic diagram of a structure of an abnormality detection device for an application provided in one embodiment of this specification, such as Figure 5 As shown, the device includes: a memory 501, a processor 502, a bus 503 and a communication interface 504. The memory 501, the processor 502 and the communication interface 504 communicate through the bus 503, and the communication interface 504 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0074] Figure 5 In the embodiment, the memory 501 stores computer executable instructions that can be run on the processor 502. When the computer executable instructions are executed by the processor 502, the following process is implemented: Obtaining operating parameters of an application program, and calculating operating indicator data of the application program according to the operating parameters; Inputting the unit time flow of the application and the operation index data into an anomaly score calculation model to calculate the anomaly score, and outputting the anomaly score; Detect whether the abnormal score exceeds a preset score threshold, and if so, send the operating parameter to the control module of the abnormal detection system to perform abnormal response processing on the operating parameter.

[0075] An anomaly detection device provided in this embodiment first obtains the operating parameters of an application program through the cooperation of a memory 501, a processor 502, a bus 503 and a communication interface 504, calculates the operating index data of the application program according to the operating parameters, and provides a data basis for subsequent anomaly score calculation, then inputs the unit time flow and operating index data of the application program into an anomaly score calculation model for anomaly score calculation, and outputs an anomaly score. The anomaly score calculation model can be used to quickly obtain an anomaly score, and the data processing efficiency and the accuracy of data processing are also improved. Finally, it is detected whether the anomaly score exceeds a preset score threshold. If so, the operating parameters are sent to the control module of the anomaly detection system for abnormal response processing of the operating parameters. By presetting the score threshold, false alarms of the operating parameters are avoided, and the stability and reliability of the anomaly detection system are improved. At the same time, the response speed to the operating parameters during the operation of the application program and the processing efficiency of the operating parameters are improved, and the accuracy of the evaluation of the application program operation status is improved.

[0076] The application anomaly detection device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0077] Furthermore, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Obtaining operating parameters of an application program, and calculating operating indicator data of the application program according to the operating parameters; Inputting the unit time flow of the application and the operation index data into an anomaly score calculation model to calculate the anomaly score, and outputting the anomaly score; Detect whether the abnormal score exceeds a preset score threshold, and if so, send the operating parameter to the control module of the abnormal detection system to perform abnormal response processing on the operating parameter.

[0078] The computer-readable storage medium provided in this embodiment first obtains the operating parameters of the application, calculates the operating index data of the application according to the operating parameters, so as to provide a data basis for the subsequent abnormal score calculation, and then inputs the unit time flow and operating index data of the application into the abnormal score calculation model to perform abnormal score calculation, and outputs the abnormal score. The abnormal score can be quickly obtained through the abnormal score calculation model, and the data processing efficiency and accuracy of data processing are also improved. Finally, it is detected whether the abnormal score exceeds the preset score threshold. If so, the operating parameters are sent to the control module of the abnormal detection system for abnormal response processing of the operating parameters. By presetting the scoring threshold, false alarms of the operating parameters are avoided, and the stability and reliability of the abnormal detection system are improved. At the same time, the response speed and processing efficiency of the operating parameters during the operation of the application are improved, and the accuracy of the evaluation of the application operation status is improved.

[0079] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0080] The computer-readable storage medium provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0081] Furthermore, another embodiment of the present specification also provides a computer program product, which implements the following process when executed by a processor: Obtaining operating parameters of an application program, and calculating operating indicator data of the application program according to the operating parameters; Inputting the unit time flow of the application and the operation index data into an anomaly score calculation model to calculate the anomaly score, and outputting the anomaly score; Detect whether the abnormal score exceeds a preset score threshold, and if so, send the operating parameter to the control module of the abnormal detection system to perform abnormal response processing on the operating parameter.

[0082] The computer program product provided in this embodiment first obtains the operating parameters of the application program, calculates the operating index data of the application program according to the operating parameters, so as to provide a data basis for the subsequent abnormal score calculation, and then inputs the unit time flow and operating index data of the application program into the abnormal score calculation model to perform abnormal score calculation, and outputs the abnormal score. The abnormal score can be quickly obtained through the abnormal score calculation model, and the data processing efficiency and accuracy of data processing are also improved. Finally, it is detected whether the abnormal score exceeds the preset score threshold. If so, the operating parameters are sent to the control module of the abnormal detection system for abnormal response processing of the operating parameters. By presetting the scoring threshold, false alarms of the operating parameters are avoided, and the stability and reliability of the abnormal detection system are improved. At the same time, the response speed and processing efficiency of the operating parameters during the operation of the application program are improved, and the accuracy of the evaluation of the application program operation status is improved.

[0083] The computer program product provided in one embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0084] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0086] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0087] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0088] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0089] Memory may include non-permanent storage in a computer-readable storage medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable storage medium.

[0090] Computer-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable storage media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0091] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0092] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0093] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for detecting anomalies in an application, characterized in that: The method is applied to an anomaly detection module of an anomaly detection system; the method comprises: Obtaining operating parameters of an application program, and calculating operating indicator data of the application program according to the operating parameters; Inputting the unit time flow of the application and the operation index data into an anomaly score calculation model to calculate the anomaly score, and outputting the anomaly score; Detect whether the abnormal score exceeds a preset score threshold, and if so, send the operating parameter to the control module of the abnormal detection system to perform abnormal response processing on the operating parameter.

2. According to the method for detecting anomalies of an application program in claim 1, the operation indicator data of the application program is calculated according to the operation parameters by at least one of the following methods: Calculate the access frequency according to the preset duration and the access frequency corresponding to the preset duration; Calculate the abnormal fluctuation rate according to the preset duration, the access frequency corresponding to the preset duration, and the number of abnormal fluctuations corresponding to the preset duration; Calculate the delay impact factor according to the delay time and the delay impact coefficient; Calculates the connection ratio based on the number of active connections and the number of waiting connections.

3. The anomaly detection method for an application according to claim 2, wherein the anomaly score calculation comprises: Multiplying the access frequency, the delay impact factor and the normalized abnormal fluctuation rate to obtain an adjusted access frequency; Dividing the adjusted access frequency by the unit time flow rate to obtain a unit access frequency; The abnormality score is obtained by multiplying the unit access frequency and the connection ratio.

4. The method for detecting anomalies of an application according to claim 2, wherein the anomaly score calculation further comprises: Multiplying the access frequency, the delay impact factor and the normalized abnormal fluctuation rate to obtain an adjusted access frequency; Dividing the adjusted access frequency by the unit time flow rate to obtain a unit access frequency; Performing an exponential operation on the connection ratio based on a preset constant to obtain an adjusted connection ratio; The abnormality score is obtained by multiplying the unit access frequency and the adjusted connection ratio.

5. The method for detecting anomalies in an application according to claim 1, wherein the abnormal response processing comprises: Encrypting the operating parameters to obtain encrypted data; The encrypted data is stored locally and / or in the cloud.

6. The method for detecting anomalies in an application according to claim 1, wherein the abnormal response processing further comprises: An exception handling instruction is generated according to the operation parameter, and data processing is performed on the operation parameter based on the exception handling instruction.

7. An abnormality detection device for an application, characterized in that: The device is applied to an anomaly detection module of an anomaly detection system; the device comprises: An indicator calculation module, used to obtain the operating parameters of the application program and calculate the operating indicator data of the application program according to the operating parameters; A scoring calculation module, used for inputting the unit time flow of the application and the operation index data into an abnormal scoring calculation model to perform abnormal scoring calculation and output an abnormal scoring; The detection module is used to detect whether the abnormal score exceeds a preset score threshold. If so, the operating parameters are sent to the control module of the abnormal detection system for abnormal response processing of the operating parameters.

8. An abnormality detection device for an application, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer executable instructions, and when the computer executable instructions are executed on the processor, the steps of the method described in any one of claims 1 to 6 can be implemented.

9. A computer-readable storage medium having computer-executable instructions stored therein, characterized in that: When the computer executable instructions are executed by a processor, the steps of the method described in any one of claims 1 to 6 can be implemented.

10. A computer program product, characterized in that The computer program product includes an application anomaly detection program, and when the application anomaly detection program is executed by a processor, the steps of the method described in any one of claims 1 to 6 can be implemented.

Images