Container internal process anomaly detection and processing method and system

Abstract

The invention relates to the technical field of container internal process detection, and discloses a container internal process anomaly detection and processing method and system.The container internal process anomaly detection and processing method comprises the steps that container process information of a target container is obtained, and operation key field features of each container process recorded in a container process list of the container process information are utilized; generating a container process feature set, calling a container process exception detection model to detect the exceptional container processes, extracting the exception type of each exceptional container process in a container process detection result, and considering the exception type of each exceptional container process, the operation cycles of a plurality of associated dependent processes and a to-be-executed container process list; according to the method, the container process exception handling strategy of the current detection round is generated, so that the abnormal container process is restarted, the accuracy of container process exception detection by the container management tool and the reasonability of abnormal container process handling are improved, and the user experience is ensured as much as possible on the premise of ensuring the health state of the container.

Description

Technical Field

[0001] The present invention relates to the technical field of container internal process detection, and in particular to a method and system for detecting and processing abnormalities in container internal processes. Background Art

[0002] Containers are a lightweight, operating system-level virtualization technology that enables the packaging and independent operation of applications and their dependencies by isolating process space, file systems, networks, and resources. With the widespread adoption of container technology in real-world applications, containers have become an indispensable infrastructure in modern IT environments, such as cloud computing and microservices architectures. However, managing and monitoring processes within containers has become a major challenge in ensuring stable system operation. Process anomalies in container environments can lead to service interruptions, resource exhaustion, and even affect the stability of the entire cluster. By monitoring process status, abnormal container processes can be promptly identified to prevent a single process anomaly from causing a container crash, which in turn could impact the service chain that relies on the container.

[0003] Although existing container management tools provide basic process viewing functions, they still have the following deficiencies in some practical application scenarios: (1) Memory leaks caused by container process anomalies may affect the calling and running of other processes in the container itself, and even cause the host machine memory to be exhausted, affecting the performance degradation of other containers or cascading crashes. Container management tools need to perform high-accuracy anomaly detection and operation management for each container process, and existing tools cannot meet the requirements; (2) Usually, when managing container processes, it is necessary to restart the abnormal container process to restore normal operation. However, due to the different types of anomalies of different container processes and the different severity of memory leaks caused by them, different container processes are also associated with dependent container processes. Restarting the abnormal container process will cause the associated dependent container processes to interrupt service. Therefore, when detecting and handling container process anomalies, it is necessary to consider the contradiction between the impact of the abnormal container process on the health status of the container and the user experience.

[0004] Therefore, how to improve the accuracy of container management tools in detecting container process anomalies and the rationality of handling abnormal container processes, while ensuring the user experience as much as possible while ensuring the health of the container, is a technical problem that needs to be solved urgently. Summary of the Invention

[0005] The main purpose of the present invention is to provide a method and system for detecting and handling abnormalities in container internal processes, aiming to solve at least one of the above technical problems.

[0006] To achieve the above objectives, the present invention provides a method for detecting and handling abnormalities in a process within a container, the method comprising the following steps: Obtaining container process information of the target container; wherein the container process information includes a container process list storing the running status and resource usage of each container process; Using the container process list, capture and parse the key field features of each container process to generate a container process feature set, call the container process anomaly detection model to perform anomaly detection on each container process, and obtain the container process detection result of the target container in the current detection round; Extracting the abnormality type of each abnormal container process in the container process detection result, considering the abnormality type of each abnormal container process, the running cycle of several associated dependent processes and the list of container processes to be executed, and generating a container process abnormality handling strategy for the current detection round; Based on the container process exception handling strategy, container process exception handling from the current detection round to the next detection round is performed on each abnormal container process in the container process detection result.

[0007] Optionally, obtain the container process information of the target container, including: Call the API interface provided by the target container's container platform or use the Shell command in the target container to obtain the target container's running status and resource usage; According to the identifier of the container process and the mapping relationship between the running status of the container process and the resource usage, a container process list storing the running status and resource usage is constructed.

[0008] Optionally, the container platform is configured as at least one of Docker, Kubernetes, or containerd, and the Shell command includes at least one of an exec command, a top command, or a stats command.

[0009] Optionally, using the container process list, capturing and parsing the key field characteristics of each container process to generate a container process feature set step specifically includes: By triggering a scheduled task, the running status and resource usage of each container process in the container process list are captured to obtain the container process running description information; Extract key running field features from the container process running description information to construct a container process feature set; wherein the key running field features include at least one of process ID, parent process ID, process status, CPU usage, and memory usage.

[0010] Optionally, the trigger period in the scheduled task trigger is configured to be associated with the number of abnormal container processes identified between the previous detection round and the current detection round; wherein, the trigger period is negatively correlated with the number of abnormal container processes between the previous detection round and the current detection round.

[0011] Optionally, calling the container process anomaly detection model to perform anomaly detection on each container process and obtaining the container process detection result of the target container in the current detection round specifically includes: Invoking a container process anomaly detection model; wherein the container process anomaly detection model is configured to train an initial convolutional neural network model using container process anomaly training samples constructed using a container process feature set of historical container processes of different anomaly types; The abnormal container process in the current detection round is detected by using the container process anomaly detection model and the container process feature set constructed by the target container in the current detection round to obtain the container process detection result of the target container in the current detection round.

[0012] Optionally, extracting the abnormality type of each abnormal container process in the container process detection result, considering the abnormality type of each abnormal container process, the running cycles of several associated dependent processes, and the list of container processes to be executed, and generating a container process abnormality handling strategy for the current detection round, specifically including: Extracting the abnormality type of each abnormal container process in the container process detection result, and evaluating the memory leakage rate of each abnormal container process based on the abnormality type; Considering the memory leak rate of each abnormal container process, the operating cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list, we establish an optimization goal based on the constraints of container memory leak security warnings and the minimum impact on the container process, and optimize the restart processing time for each abnormal container process. Generate a container process exception handling strategy for the current detection round based on the restart processing time of each abnormal container process in the container process detection results.

[0013] Optionally, consider the memory leak rate of each abnormal container process, the operating cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list. Establish an optimization goal based on the constraints of container memory leak security warnings and the minimum impact on container processes. Optimize and solve the restart processing time steps for each abnormal container process. Specifically, the steps include: Consider the memory leak rate of each abnormal container process, the running cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list; After each abnormal container process is assigned a restart processing time, from the current detection round to the next detection round, the remaining container memory at each moment determined based on the total memory allocated to the container, the memory usage value of each abnormal container process, normal container process, and container process to be executed at each moment, and the memory leakage rate of each abnormal container process is not less than the preset remaining memory warning value. After each abnormal container process is assigned a restart processing time, from the current detection round to the next detection round, the optimization goal is to minimize the cumulative sum of the impact quantification weights of each associated dependent process, which is determined based on the restart waiting time of each abnormal container process and the running cycle of the associated dependent process of each abnormal container process, and the important weight factor of the associated dependent process. An optimization algorithm is used to calculate the restart processing time of each abnormal container process.

[0014] Optionally, based on the container process exception handling strategy, container process exception handling steps from the current detection round to the next detection round are performed for each abnormal container process in the container process detection result, specifically including: Based on the restart processing time of each abnormal container process in the container process exception handling strategy, a restart operation is performed on the abnormal container process in the container from the current detection round to the next detection round; Based on the number of abnormal container processes from the current detection round to the next detection round, determine the scheduled task triggering method for capturing and parsing the key field characteristics of each container process in the next detection round.

[0015] In addition, to achieve the above objectives, the present invention also provides a system for detecting and handling abnormalities in container internal processes, including: An acquisition module, configured to acquire container process information of a target container; wherein the container process information includes a container process list storing the running status and resource usage of each container process; A detection module is used to use the container process list to capture and parse the key field features of each container process, generate a container process feature set, call the container process anomaly detection model to perform anomaly detection on each container process, and obtain the container process detection result of the target container in the current detection round; An extraction module is configured to extract the abnormality type of each abnormal container process in the container process detection result, and generate a container process abnormality handling strategy for the current detection round by considering the abnormality type of each abnormal container process, the operating cycles of several associated dependent processes, and the list of container processes to be executed; A processing module is configured to perform container process exception processing from a current detection round to a next detection round on each abnormal container process in the container process detection result based on the container process exception processing strategy.

[0016] The beneficial effects of the present invention are: a method and system for detecting and handling abnormalities in container internal processes are proposed, which obtains the container process information of the target container, uses the running key field characteristics of each container process recorded in the container process list of the container process information, generates a container process feature set and calls the container process abnormality detection model to detect abnormal container processes, and then extracts the abnormal type of each abnormal container process in the container process detection result, considers the abnormal type of each abnormal container process, the running cycle of several associated dependent processes and the list of container processes to be executed, and generates a container process abnormality handling strategy for the current detection round, thereby restarting the abnormal container process, improving the accuracy of container management tools in detecting container process abnormalities and the rationality of abnormal container process handling, and ensuring user experience as much as possible while ensuring the health of the container. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of the method for detecting and handling abnormalities in container internal processes of the present invention; Figure 2 This is a structural diagram of the container internal process anomaly detection and processing system of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0019] The embodiment of the present invention provides a method for detecting and handling abnormalities in a container process. Figure 1 , Figure 1 The figure is a flow chart of an embodiment of a method for detecting and handling abnormalities in a container process according to the present invention.

[0020] In this embodiment, a method for detecting and handling abnormalities in a process within a container is provided, the method comprising the following steps: S1: Obtain container process information of a target container; wherein the container process information includes a container process list storing the running status and resource usage of each container process; S2: Using the container process list, capture and parse the key field features of each container process to generate a container process feature set. Then, call the container process anomaly detection model to perform anomaly detection on each container process to obtain the container process detection result of the target container in the current detection round. S3: Extract the abnormality type of each abnormal container process in the container process detection result, consider the abnormality type of each abnormal container process, the running cycle of several associated dependent processes, and the list of container processes to be executed, and generate a container process abnormality handling strategy for the current detection round; S4: Based on the container process exception handling strategy, perform container process exception handling from the current detection round to the next detection round on each abnormal container process in the container process detection result.

[0021] It should be noted that although existing container management tools provide basic process viewing functions, they still have the following deficiencies in some actual application scenarios: (1) Memory leaks caused by container process anomalies may affect the calling and running of other processes in the container itself, and even cause the host machine memory to be exhausted, affecting the performance degradation of other containers or cascading crashes. Container management tools need to perform high-accuracy anomaly detection and operation management for each container process, and existing tools cannot meet the requirements; (2) Usually, when managing container processes, it is necessary to restart the abnormal container process to restore it to normal operation. However, due to the different types of anomalies of different container processes and the different severity of memory leaks caused by them, different container processes are also associated with dependent container processes. Restarting the abnormal container process will cause the associated dependent container processes to interrupt service. Therefore, when detecting and handling container process anomalies, it is necessary to consider the contradiction between the impact of the abnormal container process on the health status of the container and the user experience.

[0022] In order to solve the above problems, this embodiment proposes a method and system for detecting and handling abnormalities in container internal processes. By obtaining the container process information of the target container and using the running key field features of each container process recorded in the container process list of the container process information, a container process feature set is generated and a container process abnormality detection model is called to detect abnormal container processes. Then, by extracting the abnormality type of each abnormal container process in the container process detection result, considering the abnormality type of each abnormal container process, the running cycle of several associated dependent processes and the list of container processes to be executed, a container process abnormality handling strategy for the current detection round is generated, thereby restarting the abnormal container process, improving the accuracy of container management tools in detecting container process abnormalities and the rationality of abnormal container process handling, and ensuring user experience as much as possible while ensuring the health of the container.

[0023] In a preferred embodiment, the step of obtaining container process information of the target container specifically includes: S11: Call the API interface provided by the container platform of the target container or use the Shell command in the target container to obtain the running status and resource usage of the target container; S12: Construct a container process list storing the running status and resource usage according to the identifier of the container process and the mapping relationship between the running status and resource usage of the container process.

[0024] In actual applications, the container platform is configured as at least one of Docker, Kubernetes, or containerd, and the Shell command includes at least one of an exec command, a top command, or a stats command.

[0025] In this embodiment, the container process information of the target container is obtained through the API interface provided by the container platform or by using the Shell command in the target container to obtain the running status and resource usage of the target container. After obtaining the running status and resource usage of the target container, a container process list is constructed.

[0026] In a preferred embodiment, the steps of using the container process list to capture and parse the key field features of each container process and generate a container process feature set specifically include: S21: By triggering a scheduled task, the running status and resource usage of each container process in the container process list are captured to obtain the container process running description information; S22: Extract key running field features from the container process running description information and construct a container process feature set; wherein the key running field features include at least one of process ID, parent process ID, process status, CPU usage, and memory usage.

[0027] In actual applications, the trigger period in the scheduled task trigger is configured to be associated with the number of abnormal container processes identified between the previous detection round and the current detection round; wherein the trigger period is negatively correlated with the number of abnormal container processes between the previous detection round and the current detection round.

[0028] In a preferred embodiment, the steps of calling the container process anomaly detection model to perform anomaly detection on each container process and obtaining the container process detection result of the target container in the current detection round specifically include: S31: Invoking a container process anomaly detection model; wherein the container process anomaly detection model is configured to train an initial convolutional neural network model using container process anomaly training samples constructed using a container process feature set of historical container processes of different anomaly types; S32: Detect abnormal container processes in the current detection round using the container process anomaly detection model and the container process feature set constructed for the target container in the current detection round, and obtain a container process detection result for the target container in the current detection round.

[0029] In this embodiment, the running status and resource usage of each container process in the container process list are captured to construct a container process feature set, and then each container process in the target container is detected using a pre-built container process anomaly detection model and container process feature set to obtain the anomaly type of each abnormal container process in the target container in the current detection round.

[0030] In a preferred embodiment, the abnormality type of each abnormal container process in the container process detection result is extracted, and the abnormality type of each abnormal container process, the running cycles of several associated dependent processes, and the list of container processes to be executed are considered to generate a container process abnormality handling strategy for the current detection round, specifically including: S33: Extracting the abnormality type of each abnormal container process in the container process detection result, and evaluating the memory leakage rate of each abnormal container process based on the abnormality type; S34: Considering the memory leakage rate of each abnormal container process, the operating cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list, an optimization goal based on the constraint conditions of container memory leak security warning and the minimum impact of the container process is established, and the restart processing time of each abnormal container process is optimized. S35: Generate a container process exception handling strategy for the current detection round based on the restart processing time of each abnormal container process in the container process detection result.

[0031] Furthermore, considering the memory leakage rate of each abnormal container process, the operating cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list, we construct an optimization goal based on the constraints of container memory leak security warnings and the minimum impact on container processes. We then optimize and solve the restart processing time steps for each abnormal container process, specifically including: S341: Consider the memory leak rate of each abnormal container process, the running cycle of the dependent process associated with each abnormal container process, and the number of container processes to be executed in the list of container processes to be executed; S342: After each abnormal container process is assigned a restart processing time, from the current detection round to the next detection round, the remaining container memory at each moment determined based on the total container allocated memory, the memory usage of each abnormal container process, normal container process, and pending container process at each moment, and the memory leakage rate of each abnormal container process is not less than a preset remaining memory warning value as a constraint condition; after each abnormal container process is assigned a restart processing time, from the current detection round to the next detection round, the optimization goal is to minimize the cumulative sum of the impact quantified weights of each associated dependent process, which is calculated based on the restart waiting time of each abnormal container process and the running cycle of the associated dependent process of each abnormal container process, and the important weight factor of the associated dependent process; S343: Calculate the restart processing time of each abnormal container process using an optimization algorithm.

[0032] In a preferred embodiment, based on the container process exception handling strategy, the container process exception handling steps from the current detection round to the next detection round are performed for each abnormal container process in the container process detection result, specifically including: S41: Based on the restart processing time of each abnormal container process in the container process abnormality handling strategy, perform a restart operation on the abnormal container process in the container from the current detection round to the next detection round; S42: Determine a timed task triggering method for capturing and parsing key running field features of each container process in the next detection round based on the number of abnormal container processes from the current detection round to the next detection round.

[0033] In this embodiment, by extracting the abnormal type of each abnormal container process in the container process detection results, considering the abnormal type of each abnormal container process, the operating cycle of several associated dependent processes and the list of container processes to be executed, the container process abnormality handling strategy for the current detection round is generated, so as to restart the abnormal container process, improve the accuracy of the container management tool in detecting container processes abnormalities and the rationality of handling abnormal container processes, and ensure the user experience as much as possible while ensuring the health of the container.

[0034] Reference Figure 2 , Figure 2 This is a structural block diagram of an embodiment of the system for detecting and handling abnormal processes within a container according to the present invention.

[0035] like Figure 2 As shown, the container internal process anomaly detection and processing system proposed in the embodiment of the present invention includes: An acquisition module 10 is configured to acquire container process information of a target container; wherein the container process information includes a container process list storing the running status and resource usage of each container process; The detection module 20 is configured to use the container process list to capture and parse the key field features of each container process, generate a container process feature set, call the container process anomaly detection model to perform anomaly detection on each container process, and obtain the container process detection result of the target container in the current detection round; An extraction module 30 is configured to extract the anomaly type of each abnormal container process in the container process detection result, and generate a container process anomaly handling strategy for the current detection round based on the anomaly type of each abnormal container process, the operating cycles of several associated dependent processes, and a list of container processes to be executed; The processing module 40 is configured to perform container process exception processing from a current detection round to a next detection round on each abnormal container process in the container process detection result based on the container process exception processing strategy.

[0036] Other embodiments or specific implementations of the container internal process anomaly detection and processing system of the present invention can refer to the above-mentioned method embodiments and will not be repeated here.

[0037] It should be understood that, in the description of this specification, reference to terms such as "one embodiment," "another embodiment," "other embodiments," or "first to Nth embodiments" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any appropriate manner in any one or more embodiments or examples.

[0038] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0039] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting and handling abnormalities in a container internal process, characterized in that: The method comprises the following steps: Obtaining container process information of the target container; wherein the container process information includes a container process list storing the running status and resource usage of each container process; Using the container process list, capture and parse the key field features of each container process to generate a container process feature set, call the container process anomaly detection model to perform anomaly detection on each container process, and obtain the container process detection result of the target container in the current detection round; Extracting the abnormality type of each abnormal container process in the container process detection result, considering the abnormality type of each abnormal container process, the running cycle of several associated dependent processes and the list of container processes to be executed, and generating a container process abnormality handling strategy for the current detection round; Based on the container process exception handling strategy, container process exception handling from the current detection round to the next detection round is performed on each abnormal container process in the container process detection result.

2. The method for detecting and handling abnormalities in a container process according to claim 1, wherein: The steps to obtain the container process information of the target container include: Call the API interface provided by the target container's container platform or use the Shell command in the target container to obtain the target container's running status and resource usage; According to the identifier of the container process and the mapping relationship between the running status of the container process and the resource usage, a container process list storing the running status and resource usage is constructed.

3. The method for detecting and handling abnormalities in a container process according to claim 2, wherein: The container platform is configured as at least one of Docker, Kubernetes, or containerd, and the Shell command includes at least one of an exec command, a top command, or a stats command.

4. The method for detecting and handling abnormalities in a container process according to claim 1, wherein: Using the container process list, capturing and parsing the key field features of each container process to generate a container process feature set, specifically includes: By triggering a scheduled task, the running status and resource usage of each container process in the container process list are captured to obtain the container process running description information; Extract key running field features from the container process running description information to construct a container process feature set; wherein the key running field features include at least one of process ID, parent process ID, process status, CPU usage, and memory usage.

5. The method for detecting and handling abnormalities in a container process according to claim 4, wherein: The trigger period in the scheduled task trigger is configured to be associated with the number of abnormal container processes identified between the previous detection round and the current detection round; wherein the trigger period is negatively correlated with the number of abnormal container processes between the previous detection round and the current detection round.

6. The method for detecting and handling abnormalities in a container process according to claim 1, wherein: Calling the container process anomaly detection model to perform anomaly detection on each container process and obtain the container process detection results of the target container in the current detection round includes the following steps: Invoking a container process anomaly detection model; wherein the container process anomaly detection model is configured to train an initial convolutional neural network model using container process anomaly training samples constructed using a container process feature set of historical container processes of different anomaly types; The abnormal container process in the current detection round is detected by using the container process anomaly detection model and the container process feature set constructed by the target container in the current detection round to obtain the container process detection result of the target container in the current detection round.

7. The method for detecting and handling abnormalities in a container process according to claim 1, wherein: Extract the abnormality type of each abnormal container process in the container process detection result, consider the abnormality type of each abnormal container process, the running cycle of several associated dependent processes, and the list of container processes to be executed, and generate the container process abnormality handling strategy steps for the current detection round, specifically including: Extracting the abnormality type of each abnormal container process in the container process detection result, and evaluating the memory leakage rate of each abnormal container process based on the abnormality type; Considering the memory leak rate of each abnormal container process, the operating cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list, we establish an optimization goal based on the constraints of container memory leak security warnings and the minimum impact on the container process, and optimize the restart processing time for each abnormal container process. Generate a container process exception handling strategy for the current detection round based on the restart processing time of each abnormal container process in the container process detection results.

8. The method for detecting and handling abnormalities in a container process according to claim 7, wherein: Considering the memory leakage rate of each abnormal container process, the operating cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list, we construct an optimization goal based on the constraints of container memory leak security warnings and the minimum impact of container processes. We then optimize and solve the restart processing time steps for each abnormal container process, specifically including: Consider the memory leak rate of each abnormal container process, the running cycle of the dependent processes associated with each abnormal container process, and the number of pending container processes in the pending container process list; After each abnormal container process is assigned a restart processing time, from the current detection round to the next detection round, the remaining container memory at each moment determined based on the total memory allocated to the container, the memory usage value of each abnormal container process, normal container process, and container process to be executed at each moment, and the memory leakage rate of each abnormal container process is not less than the preset remaining memory warning value. After each abnormal container process is assigned a restart processing time, from the current detection round to the next detection round, the optimization goal is to minimize the cumulative sum of the impact quantification weights of each associated dependent process, which is determined based on the restart waiting time of each abnormal container process and the running cycle of the associated dependent process of each abnormal container process, and the important weight factor of the associated dependent process. An optimization algorithm is used to calculate the restart processing time of each abnormal container process.

9. The method for detecting and handling abnormalities in a container process according to claim 5, wherein: Based on the container process exception handling strategy, the container process exception handling steps from the current detection round to the next detection round are executed for each abnormal container process in the container process detection result, specifically including: Based on the restart processing time of each abnormal container process in the container process exception handling strategy, a restart operation is performed on the abnormal container process in the container from the current detection round to the next detection round; Based on the number of abnormal container processes from the current detection round to the next detection round, determine the scheduled task triggering method for capturing and parsing the key field characteristics of each container process in the next detection round.

10. A system for detecting and handling abnormalities in a container internal process, characterized in that: include: An acquisition module, configured to acquire container process information of a target container; wherein the container process information includes a container process list storing the running status and resource usage of each container process; A detection module is used to use the container process list to capture and parse the key field features of each container process, generate a container process feature set, call the container process anomaly detection model to perform anomaly detection on each container process, and obtain the container process detection result of the target container in the current detection round; An extraction module is configured to extract the abnormality type of each abnormal container process in the container process detection result, and generate a container process abnormality handling strategy for the current detection round by considering the abnormality type of each abnormal container process, the operating cycles of several associated dependent processes, and the list of container processes to be executed; A processing module is configured to perform container process exception processing from a current detection round to a next detection round on each abnormal container process in the container process detection result based on the container process exception processing strategy.

Images