Data link analysis method, apparatus, device, and computer program product

Abstract

The application discloses a data link analysis method, device, equipment and computer program product. The method comprises the following steps: obtaining a data stream received by a server and processing the data stream to obtain a data stream processing result; performing call link analysis by using a preset call link analysis strategy according to the data stream processing result to obtain a call link analysis result; performing associated call analysis by using a preset associated call analysis strategy according to the data stream processing result to obtain an initial associated call analysis result; and determining a final associated call analysis result according to the call link analysis result and the initial associated call analysis result. The application comprehensively displays the call relationship between interfaces through the call link analysis and the associated analysis. The call link analysis can find the link call relationship, which is convenient for the alarm of the deep call link and the circular call. The associated call analysis can find the business association degree between the interface calls, which provides a reference for the interface and business optimization of the developer.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data link analysis, and in particular to a data link analysis method, device, equipment and computer program product. BACKGROUND

[0002] In a complex distributed system, the calling relationship between interfaces (APIs) is complex and forms a huge calling network. In order to effectively manage and optimize these systems, it is particularly important to accurately map and analyze the application program interface link.

[0003] At present, some schemes for API link analysis and monitoring are provided in the prior art, but these schemes have certain limitations in actual application and cannot meet the comprehensive, accurate and efficient analysis requirements of API calling relationship in complex distributed systems. SUMMARY

[0004] The embodiments of the present application provide a data link analysis method, device, equipment and computer program product to improve the comprehensiveness and accuracy of data link analysis.

[0005] The embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, the embodiments of the present application provide a data link analysis method, which comprises:

[0007] Obtaining a data stream received by a server and processing the data stream to obtain a data stream processing result;

[0008] According to the data stream processing result, performing calling link analysis by using a preset calling link analysis strategy to obtain a calling link analysis result;

[0009] According to the data stream processing result, performing associated calling analysis by using a preset associated calling analysis strategy to obtain an initial associated calling analysis result;

[0010] Determining a final associated calling analysis result according to the calling link analysis result and the initial associated calling analysis result.

[0011] Optionally, the obtaining of the data stream received by the server and the processing of the data stream to obtain the data stream processing result comprises:

[0012] Obtaining the data stream received by the server and performing parsing on the data stream to obtain a data stream parsing result, the data stream parsing result comprising a source address, a destination address, a request time and a response time of a request;

[0013] Generating a unique identification of the request according to a request type and a request path of the data stream;

[0014] The source address, the destination address, the request time, the response time and the request unique identifier of the request are used to form the data flow processing result.

[0015] Optionally, the calling link analysis is performed according to the data flow processing result and a preset calling link analysis strategy to obtain a calling link analysis result.

[0016] Whether any two requests satisfy a request calling chain condition is determined according to data flow processing results of the any two requests.

[0017] In a case where the two requests satisfy the request calling chain condition, suspected calling link data is generated according to the data flow processing results of the two requests and a calling relationship.

[0018] The suspected calling link data in a preset time period is statistically analyzed, and the calling link analysis result is determined according to a statistical analysis result.

[0019] Optionally, the data flow processing result includes a source address, a destination address, a request time, a response time and a request unique identifier of a request, and any two requests include a first request and a second request. Whether the any two requests satisfy the request calling chain condition is determined according to data flow processing results of the any two requests.

[0020] It is determined whether the destination address of the first request is the source address of the second request.

[0021] It is determined whether the request time of the first request is earlier than the request time of the second request and whether an end time of the first request is later than an end time of the second request, the end time being calculated based on the request time and the response time.

[0022] If yes, it is determined that the first request and the second request satisfy the request calling chain condition, and the calling relationship is that the first request is a calling request of the second request and the second request is a called request of the first request.

[0023] Otherwise, it is determined that the first request and the second request do not satisfy the request calling chain condition.

[0024] Optionally, the statistical analysis of the suspected calling link data in the preset time period and the determination of the calling link analysis result according to the statistical analysis result include:

[0025] The suspected calling times between calling requests and called requests in the preset time period and the total calling times of the calling requests in the preset time period are counted according to the suspected calling link data in the preset time period.

[0026] The calling link analysis result is determined according to the suspected calling times and the total calling times.

[0027] Optionally, the obtaining the initial correlation calling analysis result according to the data stream processing result and the preset correlation calling analysis strategy comprises:

[0028] dividing the data stream processing result into a plurality of time zone request data sets;

[0029] performing correlation degree calculation according to the plurality of time zone request data sets and a correlation rule mining algorithm to obtain correlation degrees between requests;

[0030] determining the initial correlation calling analysis result according to the correlation degrees between requests.

[0031] Optionally, the calling link analysis result comprises a correlation request set corresponding to a request, and the determining the final correlation calling analysis result according to the calling link analysis result and the initial correlation calling analysis result comprises:

[0032] determining whether the correlation request set corresponding to the request contains a called request corresponding to the request according to the calling link analysis result and the initial correlation calling analysis result;

[0033] in the case of containing, removing the called request corresponding to the request from the correlation request set to obtain a final correlation request set corresponding to the request.

[0034] Optionally, the data link analysis method further comprises:

[0035] generating a calling link directed graph according to the calling link analysis result;

[0036] performing calling alarm analysis according to the calling link directed graph to obtain a calling alarm analysis result, the calling alarm analysis result comprising at least one of a calling depth analysis result and a circular calling analysis result;

[0037] determining whether to perform calling alarm according to the calling alarm analysis result.

[0038] In a second aspect, the embodiments of the present application further provide a data link analysis apparatus, which comprises:

[0039] an acquisition unit configured to acquire and process a data stream received by a server to obtain a data stream processing result;

[0040] a calling link analysis unit configured to perform calling link analysis according to the data stream processing result and a preset calling link analysis strategy to obtain a calling link analysis result;

[0041] The association call analysis unit is configured to perform association call analysis according to the data stream processing result and a preset association call analysis strategy, to obtain an initial association call analysis result.

[0042] The determination unit is configured to determine a final association call analysis result according to the call link analysis result and the initial association call analysis result.

[0043] In a third aspect, an apparatus is provided, comprising:

[0044] a processor; and a memory arranged to store computer executable instructions that, when executed, cause the processor to perform any of the data link analysis methods described above.

[0045] In a fourth aspect, a computer program product is provided, comprising computer program / instructions that, when executed by a processor, implement any of the data link analysis methods described above.

[0046] The above at least one technical solution adopted by the embodiments of the present application can achieve the following beneficial effects: The data link analysis method of the embodiments of the present application first acquires a data stream received by a server and processes the data stream to obtain a data stream processing result; then performs call link analysis according to the data stream processing result and a preset call link analysis strategy, to obtain a call link analysis result; then performs association call analysis according to the data stream processing result and a preset association call analysis strategy, to obtain an initial association call analysis result; and finally determines a final association call analysis result according to the call link analysis result and the initial association call analysis result. The data link analysis method of the embodiments of the present application more comprehensively displays the call relationship between interfaces through call link analysis and association analysis, can discover the call link relationship through call link analysis, is helpful to the occurrence of situations such as excessively deep call chain and circular call, and can discover the business association degree between interface calls through association call analysis, thereby providing a reference for developers to optimize interfaces and businesses. BRIEF DESCRIPTION OF DRAWINGS

[0047] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate embodiments of the present application and a description thereof, and do not constitute an improper limitation to the present application. In the drawings:

[0048] Figure 1 FIG. 1 is a flowchart of a data link analysis method according to an embodiment of the present application;

[0049] Figure 2 FIG. 2 is a structural diagram of a data link analysis apparatus according to an embodiment of the present application;

[0050] Figure 3 FIG. 1 is a structural schematic diagram of an apparatus in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the objectives, technical solutions, and advantages of the present application clearer, the technical solutions of the present application will be described below in conjunction with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0052] The technical solutions provided by the embodiments of the present application will be described in detail below in conjunction with the drawings.

[0053] At present, there are various technologies for API link mapping and monitoring. For example, patent document CN202410027783.6 proposes an API application program interface link mapping method based on data features. This method obtains traffic access logs through a traffic probe and restores the upstream and downstream relationships of application program interfaces in a single request using a graph depth traversal algorithm. However, this method cannot effectively discover and handle looped calls when facing complex call relationships that may form loops, and the analysis scope is limited to upstream and downstream call relationships, lacking more comprehensive link analysis.

[0054] Patent document CN202110911652.0 proposes a cross-interface link monitoring method. This method converts business interface process relationships into a complete visual link model by sorting out key business interfaces, achieving cross-interface request relationship establishment and business attribute assignment. Although this method can analyze the link of an actual request, it relies on a large amount of manual sorting work, which is not only inefficient but also difficult to discover some hidden or complex call relationships.

[0055] In addition, patent document CN201710962192.8 provides a link call relationship construction method. This method focuses on the visual display of call links and generates a link call relationship graph through icons and call times. Although this method has certain advantages in displaying call links, it is not competent in link call analysis and cannot provide developers with in-depth interface and business optimization suggestions.

[0056] In summary, the existing API link mapping and monitoring methods have certain limitations in actual application and cannot meet the comprehensive, accurate, and efficient analysis needs of API call relationships in complex distributed systems.

[0057] Based on this, the embodiment of the present application provides a data link analysis method, as shown in the figure, a flowchart of a data link analysis method in the embodiment of the present application is provided, and the data link analysis method at least includes the following steps S110 to S140: Figure 1

[0058] Step S110, obtaining the data stream received by the server and processing to obtain the data stream processing result.

[0059] When performing data link analysis, the data stream received by each server needs to be obtained first, for example, the port of each service that needs to be analyzed can be monitored, including HTTP service and other RPC services, etc., the network data stream of each service port is captured by using a network traffic packet capture program, or the program package can be directly punched into the agent proxy mode in the service online to capture the data stream. Of course, how to collect the data stream of the server can be flexibly set by the person skilled in the art according to the actual needs, which is not limited here.

[0060] Step S120, according to the data stream processing result, using a preset call link analysis strategy to perform call link analysis to obtain a call link analysis result.

[0061] After obtaining the data stream processing result, the data stream processing result needs to be analyzed by using a defined call link analysis strategy, for example, the call link relationship between requests can be analyzed according to the request parameter information contained in the data stream processing result, thereby providing a reliable basis for avoiding interface response timeout, interface exception and other problems in the subsequent. For example, if it is analyzed by the call link that request A calls request B, it is indicated that the processing of request B is included in the process of processing request A.

[0062] Step S130, according to the data stream processing result, using a preset association call analysis strategy to perform association call analysis to obtain an initial association call analysis result.

[0063] Based on the data stream processing result obtained in the foregoing steps, the data stream processing result also needs to be analyzed by using a defined association call analysis strategy, and the association call analysis can be realized based on an association rule mining algorithm, thereby obtaining an initial association call analysis result. The association call analysis result reflects the association degree between requests at the business level, which can be used as a reference for subsequent developers to optimize the interface and business.

[0064] Step S140, according to the call link analysis result and the initial association call analysis result, determining a final association call analysis result.

[0065] ​The final purpose of the correlation call analysis is to realize the optimal design of the interface and the business level. For example, if the correlation degree of two requests is high, it indicates that the design of the interface or the business level corresponding to the two requests is highly repeated, and therefore the repeated part can be uniformly optimized. In the analysis result of the correlation call in the foregoing step, the correlation degree of the two requests corresponding to the call relationship may be high, and therefore the call relationship between the two requests needs to be further removed from the initial correlation call analysis result, so as to obtain the final correlation call analysis result.

[0066] The data link analysis method of the embodiment of the application can more comprehensively show the call relationship between interfaces by the call link analysis and the correlation analysis. The call link analysis can find the link call relationship, which is helpful to the alarm of the excessively deep call chain and the occurrence of the circular call. The correlation analysis can find the business correlation degree between the interface calls, which provides a reference for the interface and business optimization of the developer.

[0067] In some embodiments of the application, the data stream received by the server is acquired and processed to obtain a data stream processing result, including: acquiring and parsing the data stream received by the server to obtain a data stream parsing result, the data stream parsing result including the source address, destination address, request time and response time of the request; generating a request unique identifier according to the request type and request path of the data stream; and constructing the data stream processing result from the source address, destination address, request time, response time and request unique identifier of the request.

[0068] The processing of the original data stream received by the server in the embodiment of the application mainly includes two aspects: on the one hand, the data stream received by each server is parsed using a stream processing framework such as Flink or Spark to parse the source address, destination address, request time, response time and other information of the request end. On the other hand, a unique identifier is generated for each data stream request. For example, for an HTTP request, the request type (indicating GET, POST, etc.) and the path in the URL can be concatenated as the request unique identifier, and the source address and destination address and other information can be parsed through the HTTP protocol.

[0069] In addition, in order to be compatible with more types of service requests, the corresponding stream processing method can also be expanded according to the accessed service protocol. For example, for some custom RPC requests, the request parsing and identifier generation processing can also be performed by expanding the stream processing method, and the information in the request that can be used to distinguish the same request can be selected as the unique identifier.

[0070] Finally, the source address, destination address, request time, response time and request unique identifier of the request obtained after the above processing constitute the data flow processing result of the request.

[0071] In some embodiments of the present application, the data flow processing result is shunted, on the one hand, the data flow processing result is stored persistently, the requirement of the storage database is to store hundreds of millions of data, the performance requirement of adding and querying is high, for example, ElasticSearch or other databases with these characteristics can be selected, this part of data is used as the data flow processing result of the original request, which is used for subsequent correlation analysis. On the other hand, the data flow processing result directly enters the link analysis link.

[0072] In some embodiments of the present application, the data flow processing result is shunted, on the one hand, the data flow processing result is stored persistently, the requirement of the storage database is to store hundreds of millions of data, the performance requirement of adding and querying is high, for example, ElasticSearch or other databases with these characteristics can be selected, this part of data is used as the data flow processing result of the original request, which is used for subsequent correlation analysis. On the other hand, the data flow processing result directly enters the link analysis link.

[0073] The embodiments of the present application set the request call chain judgment condition based on the source address, destination address, request time and response time and other parameter information contained in the data flow processing result. The request call chain judgment condition is used to determine whether there is a call relationship between two requests according to the above parameter information corresponding to each two requests. If there is a call relationship, it means that the request call chain condition is met, and the suspected call link data can be generated according to the parameter information corresponding to the two requests, such as the unique identifier of the request.

[0074] It should be noted that considering the actual scene, there may be a case that two requests accidentally meet the set request call chain condition, but there is actually no call relationship between the two requests. Therefore, the number of times that the above two requests meet the request call chain condition can be statistically analyzed within a period of time to exclude the influence of small probability events, so as to obtain the final call link data and improve the accuracy of the call link analysis.

[0075] In some embodiments of the present application, the data flow processing result includes a source address, a destination address, a request time, a response time, and a request unique identifier, any two requests include a first request and a second request, and determining whether the data flow processing result of any two requests satisfies a request call chain condition includes: determining whether the destination address of the first request is the source address of the second request; determining whether the request time of the first request is earlier than the request time of the second request and the end time of the first request is later than the end time of the second request, the end time being calculated based on the request time and the response time; if yes, determining that the first request and the second request satisfy the request call chain condition, and the call relationship is that the first request is a calling request of the second request, and the second request is a called request of the first request; otherwise, determining that the first request and the second request do not satisfy the request call chain condition.

[0076] When determining whether there is a call relationship between two requests A and B, the following two conditions can be used for judgment:

[0077] 1) The destination address of the request A is the source address of the request B;

[0078] 2) The request time of the request A is earlier than the request time of the request B, and the end time of the request A is later than the end time of the request B.

[0079] If the request A and the request B satisfy the above two conditions at the same time, it is considered that there is a suspected call relationship between the request A and the request B, and the call relationship is that the request A calls the request B, or the request B is called by the request A. If any condition is not satisfied, it is considered that there is no call relationship between the request A and the request B.

[0080] After determining that there is a call relationship between the request A and the request B based on the above judgment conditions, the request unique identifiers of the request A and the request B can be stored as a calling interface field and a called interface field of a data respectively, and this part is suspected call link data. Of course, whether other dimensions of data are included or not can be flexibly set by a person skilled in the art according to actual needs, and is not limited here.

[0081] In some embodiments of the present application, the statistical analysis of the suspected call link data in the preset time period and the determination of the call link analysis result based on the statistical analysis result include: according to the suspected call link data in the preset time period, the number of suspected calls between the calling requests and the called requests in the preset time period and the total number of calling requests are counted; and the call link analysis result is determined according to the number of suspected calls and the total number of calling requests.

[0082] In the confirmation of whether the suspected calling link data in the above embodiment is accurate, a judgment threshold can be set first, and then the total amount of data of the request unique identifier A in a period of time is extracted from the stored original data stream processing result as the total calling times of the request A, and the amount of data of the suspected calling link data in the same period of time is extracted as the suspected calling times between the request A and the request B, where the calling interface field is the request unique identifier of the request A and the called interface field is the request unique identifier of the request B.

[0083] The ratio of the suspected calling times between the request A and the request B to the total calling times of the request A is calculated, and the ratio is compared with the judgment threshold. If the ratio is greater than the threshold, it is indicated that the suspected calling relationship between the request A and the request B does not belong to a casual event, and it can be determined that the request B is in the calling chain of the request A, and the request B is the downstream calling of the request A. The result is stored as the final calling link data.

[0084] Through the above statistical analysis process, the calling relationship between the requests can be further confirmed, and the accuracy of the calling link analysis is improved.

[0085] In some embodiments of the present application, the initial correlation calling analysis result is obtained by performing correlation calling analysis on the data stream processing result according to a preset correlation calling analysis strategy, which includes: dividing the data stream processing result into a plurality of time zone request data sets; performing correlation degree calculation on the plurality of time zone request data sets by using a correlation rule mining algorithm to obtain the correlation degree between the requests; and determining the initial correlation calling analysis result according to the correlation degree between the requests.

[0086] In the correlation calling analysis, the correlation rule mining algorithm can be used to mine the correlation degree between the requests based on the data stream processing result stored in the foregoing embodiments.

[0087] Based on the implementation principle of the correlation rule mining algorithm, the embodiments of the present application can first set a sampling interval time t to sample the original data stream processing result, for example, to take data in 0-t, 0.5t-1.5t, t-2t, 1.5t-2.5t and the like in a plurality of time zones in a sliding time window manner. For all data in each time zone, each request unique identifier corresponds to a request to form a request data set, and each time zone corresponds to a request data set to obtain I1={A, B, C, D…}, I2={B, D, E…} and the like. Then the correlation rule mining algorithm is used to process the above request data to calculate the request with a high correlation degree, to form the correlation request set of each request as the initial correlation calling analysis result.

[0088] The association rule mining algorithm can be implemented by using an Apriori algorithm, for example. Of course, the specific association rule mining algorithm can be selected by a person skilled in the art according to actual needs, and is not limited herein.

[0089] In some embodiments of the present application, the call link analysis result includes a set of associated requests corresponding to the request, and the determining of the final associated call analysis result according to the call link analysis result and the initial associated call analysis result includes: determining whether the set of associated requests corresponding to the request contains the called request corresponding to the request according to the call link analysis result and the initial associated call analysis result; and in the case of containing, removing the called request corresponding to the request from the set of associated requests to obtain a final set of associated requests corresponding to the request.

[0090] Since the association degree of two requests A and B having a calling relationship can also be high when performing the associated call analysis, the called request B can be contained in the set of associated requests corresponding to the request A, that is, the downstream calling request of the request A, and therefore, the called request B can be removed from the set of associated requests corresponding to the request A, and the remaining requests are the associated calling requests of the request A.

[0091] Through the above associated call analysis process, the problem that the associated calls cannot be analyzed manually in the multi-node high-availability architecture is solved, the business requests with a high correlation degree can be quickly found, and the interference of the downstream calling interface on the associated calls is excluded through the removal of the call link, which facilitates the developers to perform corresponding optimization and adjustment on the interfaces and the business pages.

[0092] In some embodiments of the present application, the data link analysis method further includes: generating a call link directed graph according to the call link analysis result; performing call alarm analysis according to the call link directed graph to obtain a call alarm analysis result, the call alarm analysis result including at least one of a call depth analysis result and a circular call analysis result; and determining whether to perform call alarm according to the call alarm analysis result.

[0093] The call alarm analysis of the embodiments of the present application can be divided into two aspects: alarm analysis of the call chain depth and alarm analysis of the circular call. In the call alarm analysis stage, a directed graph can be drawn according to the call link data in the foregoing embodiments, taking each request as a node of the directed graph. For example, if the request B is a downstream calling request of the request A in the call link data, a directed edge from the request A to the request B is drawn. All edges are drawn by traversing all call link data, and a call relationship graph of the requests is obtained.

[0094] In one aspect, in the interface call, the layer-by-layer call of the interface can cause interface timeout risk, and also increase the occurrence of interface exceptions, so special attention should be paid to the case of too deep call chain. The call depth threshold can be set according to the business scenario, and the value of the edge between nodes represents the depth of the node, for example, request A calls request B, and request B calls request C, so the value of the edge between request A and request B is 1, the value of the edge between request B and request C is 2, and so on. When the value of the edge between nodes in the directed graph is greater than the set depth threshold, an alarm of too deep call chain is issued.

[0095] On the other hand, in the interface call, if there is a circular call request, it can cause interface timeout risk, and also can cause the situation that the interface thread cannot be released and is always increasing, leading to program crash, so the situation of interface circular call should be found and handled in time. The algorithm for finding loops in directed graphs such as DFS (depth first search algorithm) and Tarjan algorithm can be used to find loops in the call relationship graph, so as to issue a circular call alarm in time.

[0096] The embodiment of the application also provides a data link analysis device 200, as shown in Figure 2 The structure diagram of the data link analysis device in the embodiment of the application is provided, and the data link analysis device 200 comprises an acquisition unit 210, a call link analysis unit 220, an associated call analysis unit 230 and a determination unit 240, wherein:

[0097] The acquisition unit 210 is used for acquiring and processing the data stream received by the server to obtain a data stream processing result.

[0098] The call link analysis unit 220 is used for performing call link analysis by using a preset call link analysis strategy according to the data stream processing result to obtain a call link analysis result.

[0099] The associated call analysis unit 230 is used for performing associated call analysis by using a preset associated call analysis strategy according to the data stream processing result to obtain an initial associated call analysis result.

[0100] The determination unit 240 is used for determining a final associated call analysis result according to the call link analysis result and the initial associated call analysis result.

[0101] In some embodiments of the present application, the obtaining unit 210 is specifically configured to: obtain a data stream received by a server and parse the data stream to obtain a data stream parsing result, the data stream parsing result including a source address, a destination address, a request time and a response time of a request; generate a request unique identifier according to a request type and a request path of the data stream; and construct the data stream processing result from the source address, the destination address, the request time, the response time and the request unique identifier of the request.

[0102] In some embodiments of the present application, the call link analysis unit 220 is specifically configured to: determine whether any two requests satisfy a request call chain condition according to data stream processing results of the any two requests; in a case where the two requests satisfy the request call chain condition, generate suspicious call link data according to the data stream processing results and a call relationship of the two requests; and perform statistical analysis on the suspicious call link data in a preset time period, and determine the call link analysis result according to a statistical analysis result.

[0103] In some embodiments of the present application, the data stream processing result includes a source address, a destination address, a request time, a response time and a request unique identifier of a request, any two requests include a first request and a second request, and the call link analysis unit 220 is specifically configured to: determine whether the destination address of the first request is the source address of the second request; determine whether the request time of the first request is earlier than the request time of the second request and whether an end time of the first request is later than an end time of the second request, the end time being calculated based on the request time and the response time; if yes, determine that the first request and the second request satisfy the request call chain condition, and the call relationship is that the first request is a calling request of the second request and the second request is a called request of the first request; otherwise, determine that the first request and the second request do not satisfy the request call chain condition.

[0104] In some embodiments of the present application, the call link analysis unit 220 is specifically configured to: according to the suspicious call link data in the preset time period, count suspicious call times between calling requests and called requests in the preset time period and a total call time of the calling requests; and determine the call link analysis result according to the suspicious call times and the total call time.

[0105] In some embodiments of the present application, the associated call analysis unit 230 is specifically configured to: divide the data stream processing result into request data sets of multiple time zones; perform association degree calculation by using an association rule mining algorithm according to the request data sets of the multiple time zones to obtain association degrees between requests; and determine an initial associated call analysis result according to the association degrees between the requests.

[0106] In some embodiments of the present application, the call link analysis result includes a set of associated requests corresponding to the request, and the determination unit 240 is specifically configured to: determine whether the called request corresponding to the request is included in the set of associated requests corresponding to the request according to the call link analysis result and the initial associated call analysis result; and in the case of inclusion, remove the called request corresponding to the request from the set of associated requests to obtain a final set of associated requests corresponding to the request.

[0107] In some embodiments of the present application, the data link analysis apparatus 200 further includes: a generation unit configured to generate a call link directed graph according to the call link analysis result; a call alarm analysis unit configured to perform call alarm analysis according to the call link directed graph to obtain a call alarm analysis result, the call alarm analysis result including at least one of a call depth analysis result and a circular call analysis result; and a call alarm unit configured to determine whether to perform call alarm according to the call alarm analysis result.

[0108] It can be understood that the above data link analysis apparatus can implement each step of the data link analysis method provided in the foregoing embodiments, and the related explanations about the data link analysis method are all applicable to the data link analysis apparatus, which will not be repeated here.

[0109] Figure 3 is a structural schematic diagram of an apparatus in an embodiment of the present application. As shown in Figure 3 The apparatus includes one or more processors (or processing units), and can also include one or more memories coupled to the processors, and can also include a communication module coupled to the processors.

[0110] The communication module can be used for communication with other devices or apparatuses, such as transmission or reception of data and / or signals. The communication module can have at least one communication module for communication. The communication module can include any interface necessary for communication with other devices. Illustratively, the communication module can be a transceiver, a circuit, a bus, a module, or other types of communication modules.

[0111] The processor can include, but is not limited to, at least one of the following: a general-purpose computer, a special-purpose computer, a microcontroller, a digital signal controller (Digital Signal Processor, DSP), or one or more of a controller-based multi-core controller architecture. The apparatus can have multiple processors, such as application-specific integrated circuit chips, which are time-dependent on a clock synchronized with the main processor.

[0112] The memory can include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, at least one of the following: Read-Only-Memory (ROM), Electrically Programmable Read-Only-Memory (EPROM), flash memory, hard disk, Compact Disc (CD), Digital Video Disk (DVD), or other magnetic and / or optical storage. Examples of volatile memories include, but are not limited to, at least one of the following: Random Access Memory (RAM), or other volatile memory that does not persist in the duration of a power failure.

[0113] The computer program includes computer-executable instructions executed by an associated processor. The program can be stored in the ROM. The processor can perform any suitable action and processing by loading the program into the RAM.

[0114] Possible implementations of the present application can be realized by means of a program and therefore the communication device can perform any process as discussed in the preceding embodiments. Possible implementations of the present application can also be realized in hardware or in a combination of software and hardware.

[0115] In some embodiments, the program can be tangibly embodied in a computer readable storage medium which can include other storage devices in the device, such as in the memory, or other storage devices accessible by the device. The program can be loaded from the computer readable storage medium to the RAM for execution. The computer readable storage medium can include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc.

[0116] The embodiments of the present application further provide a computer readable storage medium having computer instructions or program codes stored thereon, which, when executed by a processor, cause the processor to perform the methods and functions involved in any of the above embodiments. The computer readable medium can be any tangible medium containing or storing a program for or about an instruction execution system, apparatus or device. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, apparatus or device, or any suitable combination thereof. The computer readable storage medium can be any available medium accessible by a computer or data storage device such as a server, data center, etc. integrated with one or more available media sets. More detailed examples of the computer readable storage medium include electrical connections with one or more wires, magnetic media (such as a magnetic disk, floppy diskette, hard disk, magnetic tape, magnetic storage device), optical media (such as optical storage device, DVD), semiconductor media (such as solid state hard drive), random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), or any suitable combination thereof, etc.

[0117] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The embodiments of the present application also provide at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes one or more computer executable instructions, such as instructions included in program modules, which are executed in a device on a target real or virtual processor to perform the processes, methods and functions involved in any of the above embodiments. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode.

[0118] The embodiments of the present application also provide a computer program product, including computer programs or instructions, which, when running on a computer, enable the computer to perform the processes, methods and functions described in the above embodiments. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform particular tasks or implement particular abstract data types. In various embodiments, the functions of program modules can be combined or divided among program modules according to the needs of the application. Machine-executable instructions for program modules can be executed within a local or distributed device. In a distributed device, program modules can be located in local and remote storage media.

[0119] Generally, various embodiments of the present application can be implemented in hardware or special-purpose circuits, software, logic or any combination thereof. Some aspects can be implemented in hardware, while other aspects can be implemented in firmware or software which can be executed by a controller, microprocessor or other computing device. While various aspects of an embodiment of the present disclosure are illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein can be implemented in, as non-limiting examples, hardware, software, firmware, special-purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.

[0120] It should be noted that although the embodiments of the present application are described above in conjunction with the accompanying drawings, the embodiments above are not independent of each other, and they can also be combined to obtain other embodiments. The manners, cases, categories and division of embodiments in the embodiments of the present application are only for the convenience of description, and should not constitute special limitation. The features in various manners, categories, cases and embodiments can be combined with each other as long as they are logically consistent. The various embodiments of the present application can be combined to achieve different technical effects. The embodiments of the present application do not list various combinations.

[0121] In addition, although the operations of the methods of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in that particular order, or that all of the illustrated operations must be performed to achieve the desired results. On the contrary, the steps depicted in the flowcharts can change the order of execution. Additionally or alternatively, some steps can be omitted, combined into one step, and / or decomposed into multiple steps. It should also be noted that the features and functions of two or more devices according to the present disclosure can be embodied in one device. Conversely, the features and functions of one device described above can be further divided into multiple devices.

[0122] It should also be noted that the terms "comprising," "including," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0123] The above description is merely illustrative of the application, and not restrictive. Various modifications and changes can become apparent to those skilled in the art. Incorporating any modification, equivalent substitution, improvement, etc. within the spirit and principle of the application, shall be included in the scope of the claims of the application.

Claims

1. A data link analysis method, characterized in that: The data link analysis method comprises: Obtain the data stream received by the server and process it to obtain the data stream processing result; According to the data stream processing result, a call link analysis is performed using a preset call link analysis strategy to obtain a call link analysis result; Performing correlation call analysis based on the data stream processing result using a preset correlation call analysis strategy to obtain an initial correlation call analysis result; Determining a final associated call analysis result based on the call link analysis result and the initial associated call analysis result; The method of performing call link analysis based on the data stream processing result using a preset call link analysis strategy to obtain a call link analysis result includes: Determine whether any two requests meet the request call chain conditions based on the data flow processing results of any two requests; When two requests meet the request call chain condition, generating suspected call chain data according to the data flow processing results and call relationship of the two requests; Performing statistical analysis on suspected call link data within a preset time period, and determining the call link analysis result based on the statistical analysis result; The method of performing correlation call analysis based on the data stream processing result using a preset correlation call analysis strategy to obtain an initial correlation call analysis result includes: Dividing the data stream processing result into request data sets in multiple time zones; Based on the request data sets of multiple time zones, the association degree is calculated using the association rule mining algorithm to obtain the association degree between the requests; An initial correlation call analysis result is determined based on the correlation between the requests.

2. The data link analysis method according to claim 1, characterized in that: The acquiring and processing of the data stream received by the server to obtain the data stream processing result includes: Obtaining and parsing the data stream received by the server to obtain a data stream parsing result, wherein the data stream parsing result includes the source address of the request, the destination address, the request time, and the response time; Generate a unique request identifier according to the request type and request path of the data flow; The source address, destination address, request time, response time and unique identifier of the request constitute the data flow processing result.

3. The data link analysis method according to claim 1, characterized in that: The data stream processing result includes the source address, destination address, request time, response time, and unique identifier of the request, and any two requests include a first request and a second request. Determining whether any two requests meet the request call chain condition based on the data stream processing results of the any two requests includes: determining whether the destination address of the first request is the source address of the second request; determining whether a request time of the first request is earlier than a request time of the second request, and whether an end time of the first request is later than an end time of the second request, the end time being calculated based on the request time and the response time; If so, it is determined that the first request and the second request meet the request call chain condition, and the call relationship is that the first request is the calling request of the second request, and the second request is the called request of the first request; Otherwise, it is determined that the first request and the second request do not meet the request call chain condition.

4. The data link analysis method according to claim 3, characterized in that: The performing statistical analysis on the suspected call link data within a preset time period and determining the call link analysis result according to the statistical analysis result includes: According to the suspected call link data within the preset time period, the number of suspected calls between the calling request and the called request within the preset time period and the total number of calls of the calling request are counted; The call link analysis result is determined according to the suspected call count and the total call count.

5. The data link analysis method according to claim 1, characterized in that: The call link analysis result includes a set of associated requests corresponding to the request, and determining a final associated call analysis result based on the call link analysis result and the initial associated call analysis result includes: Determining, based on the call link analysis result and the initial associated call analysis result, whether the associated request set corresponding to the request includes the called request corresponding to the request; In the case of inclusion, the called request corresponding to the request is removed from the associated request set to obtain a final associated request set corresponding to the request.

6. The data link analysis method according to any one of claims 1 to 5, characterized in that: The data link analysis method further includes: Generate a call link directed graph according to the call link analysis result; Performing call alarm analysis according to the call link directed graph to obtain a call alarm analysis result, wherein the call alarm analysis result includes at least one of a call depth analysis result and a loop call analysis result; Determine whether to issue a call alarm based on the call alarm analysis result.

7. A data link analysis device, characterized in that: The data link analysis device comprises: An acquisition unit is used to acquire and process the data stream received by the server to obtain a data stream processing result; A call link analysis unit, configured to perform call link analysis based on the data stream processing result and using a preset call link analysis strategy to obtain a call link analysis result; An associated call analysis unit, configured to perform associated call analysis based on the data stream processing result and a preset associated call analysis strategy to obtain an initial associated call analysis result; a determining unit, configured to determine a final associated call analysis result based on the call link analysis result and the initial associated call analysis result; The call link analysis unit is specifically used to: Determine whether any two requests meet the request call chain conditions based on the data flow processing results of any two requests; When two requests meet the request call chain condition, generating suspected call chain data according to the data flow processing results and call relationship of the two requests; Performing statistical analysis on suspected call link data within a preset time period, and determining the call link analysis result based on the statistical analysis result; The associated call analysis unit is specifically used for: Dividing the data stream processing result into request data sets in multiple time zones; Based on the request data sets of multiple time zones, the association degree is calculated using the association rule mining algorithm to obtain the association degree between the requests; An initial correlation call analysis result is determined based on the correlation between the requests.

8. A device comprising: processor; and a memory arranged to store computer-executable instructions, which, when executed, cause the processor to perform the data link analysis method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the data link analysis method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the data link analysis method according to any one of claims 1 to 6 is implemented.

Images