Watchdog circuit monitoring device and system

Abstract

The present invention discloses a watchdog circuit monitoring device and system, which relate to the field of circuit monitoring technology and are used to solve the problem of lack of dynamic handling capability under high resource competition situation, resulting in processing delay. By calling historical data to obtain application running time, statistical results and application running time are obtained, and each application in the monitoring device is judged. According to the judgment result, high-risk applications in the monitoring device are screened out and marked, the real-time access number and the accumulated usage load of each application are monitored and obtained, the real-time competitiveness of each application are analyzed, and the number of high resource competition applications is counted. According to the number of high resource competition applications, a processing signal is selected and sent to the watchdog or a tuning prompt is given to the monitoring device. The monitoring time is set in combination with the tuning response and the statistical update result of the number of high resource competition applications to trigger an alarm mechanism, thereby improving the dynamic monitoring capability of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of circuit monitoring, and more particularly to a watchdog circuit monitoring device and system. Background Art

[0002] With the widespread adoption of cloud computing, microservices, and multi-process architectures, the number of applications and concurrent threads running in embedded systems and networked monitoring devices continues to increase. Because different applications utilize varying degrees of system resources (such as CPU, memory, and network connections) during operation, some highly concurrent or resource-intensive applications can, in certain scenarios, cause unexpected issues such as surges in system load, thread blocking, connection interruptions, and even system downtime.

[0003] The existing technology has the following deficiencies:

[0004] Currently, watchdog circuits typically rely on time thresholds or heartbeat mechanisms, lacking the ability to dynamically handle high resource contention. This leads to processing delays, high false alarm rates, or untimely responses, making them difficult to adapt to the current complex operating environment. Therefore, a watchdog circuit monitoring device and system are proposed.

[0005] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0006] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a watchdog circuit monitoring device and system, which solve the problems raised in the above-mentioned background technology by utilizing multi-dimensional resource behavior monitoring modeling and dynamic competition analysis mechanism.

[0007] To achieve the above object, the present invention provides the following technical solution: a watchdog circuit monitoring system, comprising a data acquisition module, a high-risk screening module, a competition analysis module, and an alarm control module, wherein the modules are signal-connected;

[0008] The data collection module is used to count the number of connection threads of each application in the monitoring device, call historical data to obtain the application running time, and obtain statistical results and application running time;

[0009] The high-risk screening module receives the statistical results of the number of connection threads of each application and the application running time to judge each application in the monitoring device, and screens out high-risk applications in the monitoring device based on the judgment results;

[0010] The competition analysis module marks the received high-risk applications, monitors the marked applications when they are enabled, obtains the real-time access count and accumulated usage load of each application, analyzes the real-time competitiveness of each application, and obtains the competitiveness statistics of each application and the number of applications with high resource contention;

[0011] The alarm control module selects and formulates processing signals based on the number of high resource contention applications and sends them to the watchdog or prompts the monitoring equipment for tuning, monitors the tuning response, sets the monitoring time, and combines the tuning response and the statistical update results of the number of high resource contention applications to determine whether to formulate a secondary processing signal and send it to the watchdog. After receiving the processing signal, the watchdog triggers the alarm mechanism.

[0012] In a preferred embodiment, a low-pass filter is applied to the received network traffic monitoring sensor waveform data to remove high-frequency noise;

[0013] When the application starts and establishes a connection, the network traffic monitoring sensor listens to the connection request and marks it as a connection establishment event;

[0014] By traversing all connection establishment events captured by the network traffic monitoring sensor within a set statistical period, the number of threads that successfully established connections within the period is counted according to the source process ID and the target port belonging to the application, and the number of connection threads of each application is obtained;

[0015] When the application process starts, its startup timestamp is captured by the operating system event recording component. Combined with the current sampling time, the application running time is obtained by subtracting the startup timestamp from the current sampling time.

[0016] In a preferred embodiment, the data collection module database is called to extract the statistical results of the number of threads connected to each application and the application running time;

[0017] Create an application list containing each application's ID, number of threads, and runtime. Initialize a list of high-risk applications and obtain the number of threads and runtime for each application. If the number of threads exceeds the thread count threshold or the runtime exceeds the runtime threshold, add the application ID to the initialized high-risk application list.

[0018] The statistical results of the number of threads of each application and the application running time are compared with the threshold to filter out a list of high-risk applications.

[0019] In a preferred embodiment, a tag field is added to the high-risk application list database to identify the status of the application. When a high-risk application is identified, the number of accesses and the accumulated load of the application are recorded in real time.

[0020] In a preferred embodiment, when the monitoring module captures a connection request, the number of accesses to the high-risk application is accumulated, and the statistical data is stored in a high-risk application list database to obtain the number of accesses to each high-risk application;

[0021] Monitor the cumulative usage load of high-risk applications and divide the resident memory set size by the total system memory to obtain the memory usage.

[0022] Divide the current number of threads by the maximum number of threads to get the thread ratio;

[0023] The sum of the process's user-mode time and kernel-mode time is divided by the total CPU time during the sampling interval to obtain the CPU usage value.

[0024] In a preferred embodiment, a preset weight coefficient is used to obtain a CPU weight value, a memory usage weight value, and a thread number weight value, and all weight values are added together to obtain a comprehensive load value;

[0025] Collect all application comprehensive load values for standardization;

[0026] A weighted algorithm is used to combine the normalized number of visits and the normalized load value to obtain a comprehensive competitiveness indicator.

[0027] In a preferred embodiment, the real-time competitiveness of all high-risk applications is traversed to check whether the real-time competitiveness of each application is greater than or equal to a set competitiveness threshold; if the real-time competitiveness is greater than or equal to the competitiveness threshold, it is marked as a high resource contention application;

[0028] The real-time competitiveness of applications that is greater than or equal to the competitiveness threshold is recorded, and the final count value is used as the number of applications with high resource contention.

[0029] In a preferred embodiment, when the system calls the number of high resource contention applications and the number of high resource contention applications, when the number of high resource contention applications is greater than or equal to a preset threshold, a processing signal is constructed and sent to the monitoring device to trigger a response mechanism;

[0030] The monitoring device extracts the target application from the processed signal, multiplies the preset monitoring frequency adjustment coefficient by the existing monitoring time to obtain a new monitoring time, and monitors the number of threads connected to each application in the new monitoring cycle to obtain an updated number of applications with high resource contention.

[0031] In a preferred embodiment, if the number of applications with high resource contention is still greater than or equal to the preset threshold, the device constructs a secondary processing signal including the target application ID and current resource status data and sends it to the watchdog circuit monitoring system;

[0032] After receiving the secondary processing signal, the watchdog analyzes the signal content and extracts the target application ID and current resource status data;

[0033] Compare the current resource status data with the preset resource usage threshold. If the current resource status data is greater than or equal to the resource usage threshold, the alarm mechanism is triggered and a specific alarm message is generated based on the parsed secondary processing signal information.

[0034] The alarm message includes the application ID and current resource status data.

[0035] Technical effects and advantages of the present invention:

[0036] 1. The present invention obtains the application running time by calling historical data, obtains statistical results and application running time, judges each application in the monitoring device, screens out high-risk applications in the monitoring device according to the judgment results and marks them, monitors and obtains the real-time access number and cumulative usage load of each application, analyzes the real-time competitiveness of each application, and counts the number of applications with high resource competition. According to the number of applications with high resource competition, a processing signal is selected and sent to the watchdog or a tuning prompt is given to the monitoring device. The monitoring time is set in combination with the tuning response and the statistical update result of the number of applications with high resource competition to trigger the alarm mechanism, thereby improving the dynamic monitoring capability of the system, optimizing resource scheduling, and ensuring the accuracy of the alarm mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flowchart of the watchdog circuit monitoring system of the present invention.

[0038] Figure 2 Schematic diagram of the module of the watchdog circuit monitoring system of the present invention.

[0039] Figure 3 Schematic diagram of the watchdog circuit monitoring device of the present invention. DETAILED DESCRIPTION

[0040] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention. Example 1

[0041] Watchdog circuit monitoring system, such as Figures 1 to 2 As shown, it includes a data acquisition module, a high-risk screening module, a competition analysis module and an alarm control module, and the signals between the modules are connected;

[0042] The data collection module is used to count the number of connection threads of each application in the monitoring device, call historical data to obtain the application running time, and pass the statistical results and application running time to the high-risk screening module;

[0043] The high-risk screening module receives the statistical results of the number of connection threads of each application and the application running time to judge each application in the monitoring device, and screens out high-risk applications in the monitoring device based on the judgment results and sends them to the competition analysis module;

[0044] The competition analysis module marks the high-risk applications it receives, monitors them when they are enabled, obtains the real-time access count and accumulated usage load of each application, analyzes the real-time competitiveness of each application, calculates the number of applications with high resource contention, and transmits this number to the alarm control module.

[0045] The alarm control module selects and formulates processing signals based on the number of high resource contention applications and sends them to the watchdog or prompts the monitoring equipment for tuning, monitors the tuning response, sets the monitoring time, and combines the tuning response and the statistical update results of the number of high resource contention applications to determine whether to formulate a secondary processing signal and send it to the watchdog. After receiving the processing signal, the watchdog triggers the alarm mechanism.

[0046] The specific implementation is as follows:

[0047] S1: The network traffic monitoring sensor collects application performance data in real time, including the connection status and thread information of each application. When the application establishes a connection, the network traffic monitoring sensor records the start time of the connection and the end time when the connection is closed. By calculating the difference between the start time and end time of the same tag recorded by the network traffic monitoring sensor, the running time of the application can be obtained.

[0048] It should be noted that a network traffic monitoring sensor is a device used to capture and analyze data packets in the network; it can monitor network traffic in real time and record information such as the source, destination, protocol type, and data volume of the data.

[0049] The received waveform data of the network traffic monitoring sensor is subjected to a low-pass filter to remove high-frequency noise to ensure data accuracy; a thread counter is initialized for each application, and the initial value is set to zero; when the application starts and establishes a connection, the network traffic monitoring sensor listens to the connection request and records the timestamp, source IP address, and destination port of the connection request, marking it as a connection establishment event.

[0050] By traversing all connection establishment events captured by the network traffic monitoring sensor within a set statistical period, the number of threads that successfully established connections within the period is counted according to the source process ID and the target port belonging to the application, and the number of connection threads of each application is obtained;

[0051] The statistical period is obtained by our experimenters based on the analysis of application connection behavior characteristics and experimental data on the dynamic changes in resource usage, and will not be detailed here.

[0052] When the network traffic monitoring sensor captures a connection establishment event, the system will add 1 to the thread counter of the application; when the application closes the connection, the network traffic monitoring sensor listens to the connection termination signal, records the timestamp, source IP address, and destination port of the event, and marks it as a connection closing event; when the network traffic monitoring sensor captures a connection closing event, the system will subtract 1 from the thread counter of the application.

[0053] It should be noted that the Transmission Control Protocol is a connection-oriented communication protocol, which is mainly used to transmit data reliably in computer networks. It ensures that data packets arrive at the receiver in order and in full through mechanisms such as connection establishment, data segmentation, flow control and error detection; the network traffic monitoring sensor listens for connection termination signals by monitoring network traffic, specifically capturing the end packet in the Transmission Control Protocol, which indicates the signal when the application closes the connection. The network traffic monitoring sensor captures connection establishment events by detecting the synchronization packet of the Transmission Control Protocol. When an application initiates a connection request, the synchronization packet will be sent and recorded by the network traffic monitoring sensor, thereby realizing dynamic management of the thread counter.

[0054] When the application process starts, the startup timestamp is captured by the operating system event recording component. Combined with the current sampling time, the application running time is obtained by subtracting the startup timestamp from the current sampling time.

[0055] By monitoring the synchronization packets and end packets in the transmission control protocol, accurate identification of application connection events can be achieved. This not only improves the accuracy of performance data, but also effectively manages the dynamic changes of thread counters. This is of great significance for timely discovery and resolution of potential network service problems and ensuring system stability and efficiency. All application running time, thread count information and connection events will be stored in the database of the data acquisition module in a structured format for subsequent query and analysis.

[0056] S2: Call the data collection module database to extract the statistical results of the number of threads connected to each application and the application running time, create an application list A, which contains the ID, number of threads and running time of each application ap, initialize the high-risk application list H, obtain the number of threads and running time of each application ap, and if the number of threads is greater than the thread number threshold or the running time is greater than the running time threshold, add the application ap id to list H.

[0057] Traverse the application list A, through the formula:

[0058] ;

[0059] Judgment condition: The number of threads t is greater than the thread number threshold or the running time td is greater than the running time threshold.

[0060] It should be noted that the thread count threshold and run time threshold are set based on the application's performance requirements and the availability of system resources. The thread count threshold is determined based on the application's design specifications and historical performance data to ensure that the system does not cause resource competition and performance degradation due to too many threads. The run time threshold takes into account the application's normal operating cycle and response time requirements.

[0061] The statistical results of the number of threads of each application and the application running time are filtered through the above process to obtain a list H of high-risk applications.

[0062] By calling the data collection module database to extract the number of threads and running time of each application and creating an application list, high-risk applications can be effectively monitored and identified. By setting thresholds, applications with excessive thread counts or excessive running time are automatically screened out and added to the high-risk application list. This method improves monitoring efficiency and accuracy, and can promptly identify potential performance issues and security risks, providing strong support for system management, helping to optimize resource allocation and improve system stability.

[0063] S3: In the high-risk application list database, a tag field is added to identify the application status. When a high-risk application is identified, its status is updated to marked. When the application is started, the system records the number of application visits and the accumulated load in real time.

[0064] It should be noted that the mark field is used to indicate the current status of each application. This field can have multiple values. When a high-risk application is identified, the system will update the status of its mark field. In this case, it is marked, indicating that the application has been marked as high-risk.

[0065] The system integrates a traffic monitoring module into the network interface of the application server, which can capture and analyze network data packets entering and leaving the server in real time; when a high-risk application makes a connection request, the monitoring module extracts the destination address, source address, and timestamp of the connection request, and classifies the connection request according to the Uniform Resource Locator path.

[0066] When the monitoring module captures a connection request, it adds 1 to the number of accesses to the high-risk application and stores the statistical data in the high-risk application list database to obtain the number of accesses to each high-risk application. The minimum and maximum values of the current number of accesses are selected as the maximum access data and the minimum number of accesses; the difference between the current number of accesses and the minimum number of accesses is divided by the difference between the maximum number of accesses and the minimum number of accesses to obtain the standardized number of accesses.

[0067] Monitor the cumulative usage load of high-risk applications and use process monitoring tools to obtain information about each high-risk application's process identifier, CPU usage value, resident memory set size, and total system memory.

[0068] It should be noted that the process monitoring tool is a library for building and managing presentation layer state transfer application programming interfaces. It provides a simple and flexible way to define application interface routing, handle connection requests and responses. In this example, the process monitoring tool is used to calculate comprehensive load indicators.

[0069] The sum of the user state time and kernel state time of the process is divided by the total CPU time in the sampling interval to obtain the CPU usage value;

[0070] Divide the value of the resident memory set size by the value of the total system memory to get the memory usage;

[0071] Monitor the current number of threads in the process. This value directly reflects the concurrent execution of the application. Normalize the number of threads by dividing the current number of threads by the maximum number of threads to obtain the thread ratio.

[0072] The entire process is executed in a timed loop to achieve regular monitoring and ensure that the resource usage of each high-risk application is obtained in real time; the preset weight coefficients are used to obtain the CPU weighted value, memory usage weighted value, and thread number weighted value, and all weighted values are added together to obtain the comprehensive load value.

[0073] It should be noted that the timed loop is implemented by setting a timer to periodically execute monitoring tasks. The time setting is based on the characteristics of the application, the frequency of changes in resource usage, and system performance requirements. The preset weight coefficient is not a fixed value, but can be adjusted according to specific application scenarios and needs. In different environments or load conditions, the importance of the number of accesses and the comprehensive load value to the competitiveness indicator may vary. For example: CPU utilization accounts for 50%, memory usage accounts for 30%, and the number of threads accounts for 20%.

[0074] Collect the comprehensive load values of all applications, obtain the minimum and maximum comprehensive load values, and substitute the comprehensive load value of each application into the following formula for normalization:

[0075]

[0076] Where a is the current integrated load value; b is the minimum integrated load value; c is the maximum integrated load value; and d is the standardized load value.

[0077] The normalized number of visits and normalized load values are combined using a weighted algorithm to obtain real-time competitiveness:

[0078]

[0079] Where m is the normalized number of visits, n is the normalized load value, and k is the competitiveness index.

[0080] It should be noted that is the visit quantity weight, is the load value weight, and ; In this example, you can set , and can also be adjusted according to actual conditions.

[0081] Traverse the real-time competitiveness of all high-risk applications and check whether the real-time competitiveness of each application is greater than or equal to the preset competitiveness threshold. If the real-time competitiveness is greater than or equal to the competitiveness threshold, mark it as a high resource contention application.

[0082] In the above process, a counter is set and initialized to zero. Whenever it is found that the real-time competitiveness of an application is greater than or equal to the competitiveness threshold, the count value of the corresponding counter is increased by one. The final value of the counter is stored in the high-risk application list database as the number of high resource contention applications.

[0083] It should be noted that the setting of competitiveness thresholds is usually based on historical data analysis. The position is determined by analyzing past competitiveness indicator data. For example, the percentile is set to 75% to identify poorly performing applications.

[0084] The use of a timed loop mechanism to regularly execute monitoring tasks ensures real-time monitoring and dynamic adjustment of application resource usage. This mechanism can flexibly adapt to the needs of different application characteristics and change frequencies, and promptly reflect the actual operating status of the system.

[0085] S4: When the system calls the number of high resource contention applications and the ID of the high resource contention application, when the number of high resource contention applications is greater than or equal to the preset threshold, the alarm control module will construct a processing signal and add the ID of the high resource contention application to the signal. Then, the module will send the generated processing signal in JSON string format through the network to the monitoring device to trigger the corresponding response mechanism.

[0086] It should be noted that the basis for the preset threshold is usually based on the analysis of system resource usage patterns and statistics of historical data; the processing signal is when the number of high resource competition applications is greater than or equal to the preset threshold, the module organizes the relevant information into a structured data object, and formats the object into a standardized message format, and sends it to the monitoring device via the Hypertext Transfer Protocol.

[0087] After the monitoring device receives the processing signal, it extracts the target application ID from the processing signal, and multiplies the preset monitoring frequency adjustment coefficient by the existing monitoring time to obtain a new monitoring time. During the new monitoring period, the number of threads connected to each application is monitored to obtain updated statistical results of the number of applications with high resource contention. If the number of applications with high resource contention is still greater than or equal to the preset threshold, the device will construct a secondary processing signal, which includes the target application ID and current resource status data and sends it to the watchdog circuit monitoring system.

[0088] It should be noted that the current resource status data is obtained by calling the interfaces provided by the process monitoring tool. Using these interfaces, the system can accurately monitor and analyze the resource usage of each application; the preset monitoring frequency adjustment coefficient is a value between 0 and 1 determined based on the system's historical resource usage, the importance of the application, and dynamic load changes; this coefficient is used to accurately adjust the monitoring frequency of specific applications to ensure that system resources are not over-consumed while improving monitoring sensitivity.

[0089] After receiving the secondary processing signal, the watchdog parses the signal content and extracts the target application ID and current resource status data. The system will compare the current resource status data with the preset resource usage threshold. When the current resource status data is greater than or equal to the resource usage threshold, the system will generate a specific alarm message based on the parsed secondary processing signal information, including the application ID and current resource status data; the alarm information will be sent to the administrator's desktop in a pop-up window, and relevant personnel will be notified by email.

[0090] After receiving the signal, the monitoring device adjusts the monitoring time according to the monitoring frequency adjustment coefficient and re-evaluates the application status. This method improves the response speed to changes in key application status, effectively balances monitoring accuracy and system resource consumption, ensures efficient and stable operation of the system, and reduces unnecessary resource waste.

[0091] It should be noted that the process of presetting resource usage thresholds is based on historical data analysis and system performance requirements. Technical personnel collect resource usage data of applications under different load conditions. By analyzing this data, they identify the resource usage patterns of applications under normal operation and high load conditions, and set reasonable resource usage thresholds based on these patterns. Example 2

[0092] See also Figure 3 , a watchdog circuit monitoring device, comprising a main monitoring device and a collaborative processing device;

[0093] The main monitoring device is used to count the number of connection threads of each application in the monitoring device, call historical data to obtain the application running time, obtain the statistical results and application running time, judge each application in the monitoring device, and screen out high-risk applications in the monitoring device based on the judgment results;

[0094] The collaborative processing device is used to mark the received high-risk applications, monitor and obtain the real-time access count and usage load accumulation of each application when the marked application is enabled, analyze the real-time competitiveness of each application, obtain the competitiveness statistics of each application and the number of high resource competition applications, and select to formulate a processing signal to send to the watchdog or to the monitoring device for tuning prompts, monitor the tuning response, set the monitoring time and combine the tuning response and the statistical update results of the number of high resource competition applications to determine whether to formulate a secondary processing signal and send it to the watchdog. After receiving the processing signal, the watchdog triggers the alarm mechanism.

[0095] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0096] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0097] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0098] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0099] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0101] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0102] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0103] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0104] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. Watchdog circuit monitoring system, characterized by: It includes data acquisition module, high-risk screening module, competition analysis module and alarm control module, and the signal connections between each module; The data collection module is used to count the number of connection threads of each application in the monitoring device, call historical data to obtain the application running time, and obtain statistical results and application running time; The high-risk screening module receives the statistical results of the number of connection threads of each application and the application running time to judge each application in the monitoring device, and screens out high-risk applications in the monitoring device based on the judgment results; The competition analysis module marks the received high-risk applications, monitors the marked applications when they are enabled, obtains the real-time access count and accumulated usage load of each application, analyzes the real-time competitiveness of each application, and obtains the competitiveness statistics of each application and the number of applications with high resource contention; The alarm control module selects and formulates processing signals based on the number of applications with high resource contention and sends them to the watchdog or prompts the monitoring device for tuning, monitors the tuning response, sets the monitoring time, and combines the tuning response and the statistical update results of the number of applications with high resource contention to determine whether to formulate a secondary processing signal and send it to the watchdog. After receiving the processing signal, the watchdog triggers the alarm mechanism; Apply a low-pass filter to the received network traffic monitoring sensor waveform data to remove high-frequency noise; When the application starts and establishes a connection, the network traffic monitoring sensor listens to the connection request and marks it as a connection establishment event; By traversing all connection establishment events captured by the network traffic monitoring sensor within a set statistical period, the number of threads that successfully established connections within the period is counted according to the source process ID and the target port belonging to the application, and the number of connection threads of each application is obtained; When the application process starts, the startup timestamp is captured by the operating system event recording component. Combined with the current sampling time, the application running time is obtained by subtracting the startup timestamp from the current sampling time. Call the data collection module database to extract the statistical results of the number of threads connected to each application and the application running time; Create an application list containing each application's ID, number of threads, and runtime. Initialize a list of high-risk applications and obtain the number of threads and runtime for each application. If the number of threads exceeds the thread count threshold or the runtime exceeds the runtime threshold, add the application ID to the initialized high-risk application list. The statistical results of the number of threads of each application and the application running time are compared with the threshold to filter out a list of high-risk applications.

2. The watchdog circuit monitoring system according to claim 1, wherein: In the high-risk application list database, a tag field is added to identify the status of the application. When a high-risk application is identified, the number of application accesses and the accumulated load are recorded in real time.

3. The watchdog circuit monitoring system according to claim 2, wherein: When the monitoring module captures a connection request, it accumulates the number of accesses to the high-risk application and stores the statistical data in the high-risk application list database to obtain the number of accesses to each high-risk application; Monitor the cumulative usage load of high-risk applications and divide the resident memory set size by the total system memory to obtain the memory usage. Divide the current number of threads by the maximum number of threads to get the thread ratio; The sum of the process's user-mode time and kernel-mode time is divided by the total CPU time during the sampling interval to obtain the CPU usage value.

4. The watchdog circuit monitoring system according to claim 3, wherein: Use the preset weight coefficients to obtain the CPU weighted value, memory usage weighted value, and thread number weighted value, and add all the weighted values to obtain the comprehensive load value; Collect all application comprehensive load values for standardization; A weighted algorithm is used to combine the normalized number of visits and the normalized load value to obtain a comprehensive competitiveness indicator.

5. The watchdog circuit monitoring system according to claim 4, wherein: Traverse the real-time competitiveness of all high-risk applications and check whether the real-time competitiveness of each application is greater than or equal to the preset competitiveness threshold. If the real-time competitiveness is greater than or equal to the competitiveness threshold, mark it as a high resource contention application. The real-time competitiveness of applications that is greater than or equal to the competitiveness threshold is recorded, and the final count value is used as the number of applications with high resource contention.

6. The watchdog circuit monitoring system according to claim 5, wherein: When the system calls the number of high resource contention applications and the number of high resource contention applications, when the number of high resource contention applications is greater than or equal to the preset threshold, a processing signal will be constructed and sent to the monitoring device to trigger the response mechanism; The monitoring device extracts the target application from the processed signal, multiplies the preset monitoring frequency adjustment coefficient by the existing monitoring time to obtain a new monitoring time, and monitors the number of threads connected to each application in the new monitoring cycle to obtain an updated number of applications with high resource contention.

7. The watchdog circuit monitoring system according to claim 6, wherein: If the number of applications with high resource contention is still greater than or equal to the preset threshold, the device will construct a secondary processing signal containing the target application ID and current resource status data and send it to the watchdog circuit monitoring system; After receiving the secondary processing signal, the watchdog analyzes the signal content and extracts the target application ID and current resource status data; Compare the current resource status data with the preset resource usage threshold. If the current resource status data is greater than or equal to the resource usage threshold, the alarm mechanism is triggered and a specific alarm message is generated based on the parsed secondary processing signal information. The alarm message includes the application ID and current resource status data.

8. A watchdog circuit monitoring device, configured to implement the watchdog circuit monitoring system according to any one of claims 1 to 7, characterized in that: It includes a main monitoring device and a collaborative processing device; The main monitoring device is used to count the number of connection threads of each application in the monitoring device, call historical data to obtain the application running time, obtain the statistical results and application running time, judge each application in the monitoring device, and screen out high-risk applications in the monitoring device based on the judgment results; The collaborative processing device is used to mark the received high-risk applications, monitor and obtain the real-time access count and usage load accumulation of each application when the marked application is enabled, analyze the real-time competitiveness of each application, obtain the competitiveness statistics of each application and the number of high resource competition applications, and select to formulate a processing signal to send to the watchdog or to the monitoring device for tuning prompts, monitor the tuning response, set the monitoring time and combine the tuning response and the statistical update results of the number of high resource competition applications to determine whether to formulate a secondary processing signal and send it to the watchdog. After receiving the processing signal, the watchdog triggers the alarm mechanism.

Images