Micro-service node monitoring method, device, equipment, medium and program product

Abstract

The invention provides a micro-service node monitoring method which can be applied to the technical field of artificial intelligence or the field of information security. The micro-service node monitoring method comprises the following steps: in response to a micro-service node monitoring instruction, obtaining first access relation data between micro-service nodes in a production environment; generating a node jump sequence and a node function execution sequence according to the first access relation data; inputting the node jump sequence and the node function execution sequence into a micro-service call risk model to identify an abnormal connection; and carrying out alarm display on the abnormal connection node. Wherein the micro-service calling risk model is obtained by pre-training based on access relation feature data among micro-service nodes in a test environment. The invention further provides a micro-service node monitoring device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence or information security, specifically to the field of microservice node anomaly identification technology, and more specifically to a microservice node monitoring method, device, equipment, medium and program product. Background Art

[0002] With the rapid development of cloud-native technologies, more enterprises and users are engaging in software development, and enterprise cloud migration has become a mainstream trend. In cloud-native environments, microservices architecture is the core architecture for applications. Its core value lies in resolving the coupling issues inherent in the original SOA (Service-Oriented Architecture) and reducing development complexity. However, this architectural model also leads to a large volume of east-west traffic, making traditional firewalls unable to monitor traffic between nodes. In this situation, if a single node is compromised, attackers can use it as a springboard to launch attacks on other nodes, making this attack difficult to monitor and detect. Therefore, a microservice node monitoring method is urgently needed to help operations personnel quickly identify and mitigate risks.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a microservice node monitoring method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a microservice node monitoring method is provided, comprising:

[0006] In response to a microservice node monitoring instruction, obtaining first access relationship data between microservice nodes in a production environment;

[0007] Generate a node jump sequence and a node function execution sequence according to the first access relationship data;

[0008] Inputting the node jump sequence and the node function execution sequence into a microservice call risk model to identify abnormal connections; and

[0009] Provide alarm display for abnormal connection nodes;

[0010] The microservice call risk model is pre-trained based on access relationship feature data between microservice nodes in a test environment.

[0011] According to an embodiment of the present disclosure, pre-training a microservice call risk model based on access relationship feature data between microservice nodes in a test environment includes:

[0012] Obtain second access relationship data between microservice application nodes in the test environment;

[0013] Extracting access relationship features according to the second access relationship data, the access relationship features including a node jump sequence and a node function execution sequence; and

[0014] The access relationship features are iteratively trained based on a reinforcement learning algorithm to generate a microservice call risk model.

[0015] According to an embodiment of the present disclosure, obtaining second access relationship data between microservice application nodes in a test environment includes:

[0016] Obtain access traffic data between microservice application nodes through one or more of a proxy method, a service grid method, a network packet capture method, and an application plug-in method; and

[0017] The execution sequence of node internal functions is obtained in real time by using application code instrumentation.

[0018] According to an embodiment of the present disclosure, the iterative training of the access relationship features based on the reinforcement learning algorithm to generate a microservice call risk model includes:

[0019] Initialize the state table, policy set, reward table, and value table of the microservice call risk model;

[0020] Randomly select and execute node jump actions or function execution actions according to the strategy set;

[0021] If a node jump action is executed, the jump value matrix is ​​updated according to the jump value matrix update formula;

[0022] If the function execution action is executed, the function value matrix is ​​updated according to the function value matrix update formula;

[0023] Update the current state according to the state table;

[0024] Repeat the above matrix update operation until the values ​​of the jump value matrix and the function value matrix no longer change.

[0025] According to an embodiment of the present disclosure, inputting the node jump sequence and the node function execution sequence into a microservice call risk model to identify abnormal connections includes:

[0026] Searching for a first Q value corresponding to the node jump sequence and a second Q value corresponding to the node function execution sequence according to the jump value matrix and the function value matrix respectively;

[0027] If it is determined that the first Q value or the second Q value is less than a preset threshold, it is determined that an abnormal connection exists in the current access.

[0028] According to an embodiment of the present disclosure, after obtaining the first access relationship data between microservice nodes in the production environment, the method further includes:

[0029] The first access relationship data is encrypted.

[0030] According to an embodiment of the present disclosure, the alarm display for abnormal connection nodes includes:

[0031] Identify the communication nodes and traffic details involved in the abnormal traffic; and

[0032] Push the communication node and the traffic details information to the display terminal.

[0033] A second aspect of the present disclosure provides a microservice node monitoring device, comprising:

[0034] An acquisition module, configured to acquire first access relationship data between microservice nodes in a production environment in response to a microservice node monitoring instruction;

[0035] an access relationship feature extraction module, configured to generate a node jump sequence and a node function execution sequence according to the first access relationship data;

[0036] an abnormal connection identification module, configured to input the node jump sequence and the node function execution sequence into a microservice call risk model to identify abnormal connections; and

[0037] Alarm module, used to display alarms for abnormal connection nodes;

[0038] The microservice call risk model is pre-trained based on access relationship feature data between microservice nodes in a test environment.

[0039] According to an embodiment of the present disclosure, it also includes: a model training module.

[0040] The model training module is used to pre-train a microservice call risk model based on the access relationship feature data between microservice nodes in the test environment.

[0041] According to an embodiment of the present disclosure, the model training module includes a data acquisition submodule, a feature extraction submodule and a training submodule.

[0042] The data acquisition submodule is used to obtain the second access relationship data between microservice application nodes in the test environment;

[0043] a feature extraction submodule, configured to extract access relationship features according to the second access relationship data, wherein the access relationship features include a node jump sequence and a node function execution sequence; and

[0044] The training submodule is used to iteratively train the access relationship features based on a reinforcement learning algorithm to generate a microservice call risk model.

[0045] According to an embodiment of the present disclosure, the data acquisition submodule includes a first acquisition unit and a second acquisition unit.

[0046] A first acquiring unit is configured to acquire access traffic data between microservice application nodes through one or more of a proxy method, a service grid method, a network packet capture method, and an application plug-in method; and

[0047] The second acquisition unit is used to acquire the execution sequence of the node internal function in real time by using the application code instrumentation method.

[0048] According to an embodiment of the present disclosure, the training submodule includes: an initialization unit, an execution unit, a value matrix updating unit, a state table updating unit and an iterative calculation unit.

[0049] Initialization unit, used to initialize the state table, policy set, reward table, and value table of the microservice call risk model;

[0050] The execution unit is used to randomly select and execute node jump actions or function execution actions according to the policy set;

[0051] The value matrix updating unit is used to update the jump value matrix according to the jump value matrix updating formula when executing the node jump action; and to update the function value matrix according to the function value matrix updating formula when executing the function execution action;

[0052] A state table updating unit, used for updating the current state according to the state table;

[0053] The iterative calculation unit is used to repeat the above matrix updating operation until the values ​​of the jump value matrix and the function value matrix no longer change.

[0054] According to an embodiment of the present disclosure, the abnormal connection identification module includes: a first determination submodule and a second determination submodule.

[0055] A first determining submodule is configured to search for a first Q value corresponding to the node jump sequence and a second Q value corresponding to the node function execution sequence according to a jump value matrix and a function value matrix respectively;

[0056] The second determining submodule is configured to determine that an abnormal connection exists in the current access if it is determined that the first Q value or the second Q value is less than a preset threshold.

[0057] According to an embodiment of the present disclosure, the device further includes an encryption module,

[0058] An encryption module is used to encrypt the first access relationship data.

[0059] According to an embodiment of the present disclosure, the alarm module includes: a third determination submodule and a display module.

[0060] A third determining submodule is configured to determine the communication nodes and traffic details involved in the abnormal traffic; and

[0061] The display module is used to push the communication node and the traffic details information to the display terminal.

[0062] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0063] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0064] The fifth aspect of the present disclosure further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0065] The microservice node monitoring method provided by the embodiment of the present disclosure identifies the first access relationship data between microservice nodes in the production environment based on the work order recognition model pre-trained in the test environment, determines abnormal connections, and displays alarms for abnormal connection nodes, helping operation and maintenance personnel to quickly locate risk nodes, thereby improving operation and maintenance efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0067] Figure 1 Schematically illustrates an application scenario diagram of the microservice node monitoring method, apparatus, device, medium, and program product according to an embodiment of the present disclosure;

[0068] Figure 2 The following schematically shows a module architecture diagram of a microservice node monitoring device according to an embodiment of the present disclosure;

[0069] Figure 3AOne of the flow charts of the training method of the microservice call risk model provided in accordance with an embodiment of the present disclosure is schematically shown;

[0070] Figure 3B The second flowchart of the training method of the microservice call risk model provided in accordance with an embodiment of the present disclosure is schematically shown;

[0071] Figure 3C Schematically illustrates a third flowchart of a method for training a microservice call risk model according to an embodiment of the present disclosure;

[0072] Figure 4 The following schematically shows a flow chart of a microservice node monitoring method according to an embodiment of the present disclosure;

[0073] Figure 5 The following schematically shows a flow chart of a microservice node monitoring method according to an embodiment of the present disclosure;

[0074] Figure 6 Schematically shows a structural block diagram of a microservice node monitoring device according to an embodiment of the present disclosure; and

[0075] Figure 7 A block diagram of an electronic device suitable for implementing a microservice node monitoring method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0076] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0077] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0078] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0079] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0080] First, the terms that appear in the embodiments of the present disclosure are explained:

[0081] Cloud native technologies: refers to a set of technologies, methodologies, and architectural design patterns for building and running applications in cloud environments to fully leverage the advantages of cloud computing, such as elasticity, scalability, and high availability.

[0082] Microservices architecture: A software architectural style that decomposes an application into a set of small, loosely coupled services, each of which implements a specific business function and interacts through a lightweight communication protocol (usually an HTTP RESTful API).

[0083] East-West Traffic: In a microservices architecture, east-west traffic refers to internal communication traffic between services, as opposed to north-south traffic (traffic between clients and servers).

[0084] Reinforcement learning: A machine learning method that learns how to make decisions by interacting with an environment. In this method, an agent learns the optimal strategy by performing actions and receiving feedback (rewards or penalties) from the environment.

[0085] State set: In reinforcement learning, the state set contains all possible states that the agent can be in.

[0086] Policy Set: A policy set defines all possible actions that the agent can take in a given state.

[0087] Reward Table: In reinforcement learning, a reward table is used to store the immediate rewards obtained after performing a specific action.

[0088] Value Table: The value table stores the expected cumulative reward for reaching a certain state or performing a certain action.

[0089] Based on the above technical problems, an embodiment of the present disclosure provides a microservice node monitoring method, which includes: in response to a microservice node monitoring instruction, obtaining first access relationship data between microservice nodes in a production environment; generating a node jump sequence and a node function execution sequence based on the first access relationship data; inputting the node jump sequence and the node function execution sequence into a microservice call risk model to identify abnormal connections; and displaying an alarm for abnormal connection nodes; wherein, the microservice call risk model is pre-trained based on the access relationship feature data between microservice nodes in a test environment.

[0090] Figure 1 The application scenario diagram of the microservice node monitoring method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0091] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a large-scale server installation scenario. A network 104 is used as a medium for providing a communication link between a first terminal device 101, a second terminal device 102, a third terminal device 103, and a server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0092] A user may use a first terminal device 101, a second terminal device 102, or a third terminal device 103 to interact with a server 105 via a network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, or the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0093] The first terminal device 101 , the second terminal device 102 , and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0094] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal devices.

[0095] It should be noted that the microservice node monitoring method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the microservice node monitoring device provided in the embodiment of the present disclosure can generally be set in the server 105. The microservice node monitoring method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the microservice node monitoring device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0096] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required. Figure 1 The application scenarios shown are merely examples of application scenarios and system architectures to which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments, or scenarios. It should be noted that the microservice node monitoring method and apparatus determined in the present disclosure can be used in the financial field, and can also be used in any field other than the financial field. The application field of the method and apparatus for microservice node monitoring determined in the present disclosure is not limited.

[0097] Figure 2 The module architecture diagram of the microservice node monitoring device according to the embodiment of the present disclosure is schematically shown as follows: Figure 2As shown in Figure 1, the system is divided into two main parts. The first is the structure diagram A1 for the model training phase in a test environment, which includes the access relationship capture module A11 and the intelligent learning module A12. The second is the structure diagram A2 for the model application phase in a production environment, which includes the access relationship capture module A21, the model judgment module A22, and the anomaly alarm module A23. The access relationship capture module A11 is responsible for capturing the access relationships between microservice application nodes, extracting relationship features, and generating node jump sequences and node function execution sequences. The intelligent learning module A12 is responsible for training the model based on reinforcement learning algorithms and intelligently generating jump value matrices and function value matrices for the call relationships between microservice nodes. During the model application phase, the implementation of the access relationship capture module A21 is largely consistent with the principles of module A11 during the model training phase. However, since traffic information is collected in a production environment, encrypted transmission is used to ensure the accuracy and security of the collected data. The collected data is then fed into the model judgment module A22. The model judgment module A22 uses the jump value matrix and function value matrix generated by the intelligent learning module A12 to determine whether there are any anomalies in the current microservice node connection.

[0098] The following will be based on Figure 1 The scene described and Figure 2 The architecture described by Figure 3A to Figure 5 The microservice node monitoring method of the disclosed embodiment is described in detail.

[0099] In the embodiment of the present disclosure, in order to solve the above problems, the east-west traffic of microservice application nodes is monitored, and timely warnings are given for abnormal access between nodes during application runtime. By learning the access call relationship between microservice nodes in the test environment, it is confirmed which application nodes in the microservice network have interactive relationships and the traffic characteristics of their interactions. Using the reinforcement learning method, a node access relationship model under normal business processes is formed as the microservice call risk model of the present disclosure. Figure 3A to Figure 3C Introduce the specific training process. Figure 3A One of the flowcharts of the method for training a microservice call risk model provided in accordance with an embodiment of the present disclosure is schematically shown. Figure 3B The second flowchart of the training method of the microservice call risk model provided in accordance with an embodiment of the present disclosure is schematically shown. Figure 3C The third flowchart of the method for training a microservice call risk model provided in accordance with an embodiment of the present disclosure is schematically shown.

[0100] like Figure 3A As shown, it includes operations S210 to S230.

[0101] In operation S210, second access relationship data between microservice application nodes is obtained in a test environment.

[0102] like Figure 3B As shown, operation S210 includes operation S211 and operation S212.

[0103] In operation S211, access traffic data between microservice application nodes is obtained through one or more of a proxy method, a service grid method, a network packet capture method, and an application plug-in method;

[0104] In operation S212, the execution sequence of the node's internal function is acquired in real time by using application code instrumentation.

[0105] In operation S220 , access relationship features are extracted according to the second access relationship data, where the access relationship features include a node jump sequence and a node function execution sequence.

[0106] In one example, during the model training phase, the access relationship between microservice application nodes is first captured through the access relationship capture module, relationship features are extracted, and node jump sequences and node function execution sequences are generated.

[0107] In an example, the following method can be used to capture the node jump sequence:

[0108] 1. Proxy mode: Use the sidecar proxy mode and utilize the sidecar container to provide service proxy functions. Traffic is forwarded from the container to the sidecar, which then aggregates the traffic into the model for statistics and analysis.

[0109] 2. Service grid method: Use service grid technology to add all microservices to the service grid, and then collect access traffic between microservices through the interface in the service grid.

[0110] 3. Network packet capture method: Use a network packet capture tool to capture the traffic between container nodes, and import the captured packet results into the model for statistics and analysis.

[0111] 4. In-application plug-in method: Add a traffic collection plug-in inside the microservice application to capture traffic data between applications.

[0112] For the node function execution sequence, the application code instrumentation method can be used to capture the execution sequence of the node internal function in real time when the application is running.

[0113] In operation S230 , the access relationship features are iteratively trained based on a reinforcement learning algorithm to generate a microservice call risk model.

[0114] like Figure 3C As described above, operation S230 includes operations S231 to S236.

[0115] In operation S231 , a state table, a policy set, a reward table, and a value table of a microservice call risk model are initialized.

[0116] In operation S232 , a node jump action or a function execution action is randomly selected and executed according to the policy set.

[0117] In operation S233, if a node jump action is executed, the jump value matrix is ​​updated according to the jump value matrix update formula.

[0118] In operation S234 , if the function execution action is executed, the function value matrix is ​​updated according to the function value matrix update formula.

[0119] In operation S235, the current state is updated according to the state table.

[0120] In operation S236, the above matrix updating operation is repeated until the values ​​of the jump value matrix and the function value matrix no longer change.

[0121] In one example, the collected node jump sequence and node function execution sequence are fed into the intelligent learning module, which is responsible for feature extraction and intelligent learning of the collected information to form a normal access call model between nodes. First, the state table, strategy set, reward table, and value table of the microservice call risk model are initialized. The state set consists of a binary tuple (N, F), (N k , F k ) represents the current state at node N k Function F is executed k The strategy set consists of a two-tuple (A N , A F ) constitutes the node jump strategy A N And function execution strategy A F , Indicates that the next step of strategy execution jumps to the kth microservice node, Represents the next strategy execution function F k . Reward Table N 、r F , where r N is an N*N jump reward matrix. If there is a historical path from node p to node q, then is 0, otherwise -1, if q is also a terminal node, then is 1; rF is the N*M function reward matrix. If there is a historical record of node i executing function j, then is 0, otherwise -1, if j is also a termination function, then is 1. Value table q N ,q F , where q Nis an N*N jump value matrix, with initial values ​​set to 0; q F It is an N*M function value matrix, and the initial values ​​are all set to 0. N is the number of all microservice nodes, and M is the number of all executable functions and parameters.

[0122] In an example, the following operations are performed to update the jump value matrix and the function value matrix:

[0123] (1) Randomly select a node a from all microservice entry nodes, with the initial state being (a, init).

[0124] (2) Randomly select a node b from all possible jump nodes in the current state, or choose not to jump and stay at the current node a, and randomly select a function v from all executable functions.

[0125] (3) Update the jump value matrix and function value matrix,

[0126] If you jump to node b, the jump value matrix update formula is:

[0127]

[0128] Where c is the next node that node b can jump to, and t is the attenuation coefficient, which ranges from 0 to 1.

[0129] If the function v is not jumped to execution, the function value matrix update formula is:

[0130]

[0131] Where v is the next function that node a can execute, and t is the attenuation coefficient, which ranges from 0 to 1.

[0132] (4) Update the current state according to the state table. If jumping to node b, the state is updated to (b, init). If not jumping to execute function v, the state is updated to (a, v). At the same time, determine whether the current state is the terminal state. If so, repeat step (1). If not, repeat step (2).

[0133] (5) The loop is terminated when the values ​​of the jump value matrix and the function value matrix no longer change. Jump value matrix and function value matrix

[0134] Figure 4 The flowchart of the microservice node monitoring method according to an embodiment of the present disclosure is schematically shown.

[0135] like Figure 4 As shown, the microservice node monitoring method of this embodiment includes operations S310 to S330, and the transaction processing method can be executed by a server or other computing devices.

[0136] In operation S310 , in response to a microservice node monitoring instruction, first access relationship data between microservice nodes in a production environment is obtained.

[0137] In one example, operations S310 to S330 are executed after receiving a microservice node monitoring instruction initiated by a user, and the traffic between microservice nodes can also be monitored in real time. During the model application stage, the first access relationship data between microservice nodes in the production environment can be regularly obtained, and the data acquisition method is the same as the aforementioned operation S210. Since the embodiment of the present disclosure collects traffic information in the production environment and performs post-monitoring. In order to prevent the access relationship data from being maliciously tampered with to cover up abnormal data, and to ensure the accuracy and security of the collected data, an encrypted transmission method is used to protect the security of the collected data, that is, the first access relationship data is encrypted.

[0138] In operation S320, a node jump sequence and a node function execution sequence are generated according to the first access relationship data.

[0139] In operation S330 , the node jump sequence and the node function execution sequence are input into a microservice call risk model to identify abnormal connections.

[0140] According to an embodiment of the present disclosure, the microservice call risk model is pre-trained based on access relationship feature data between microservice nodes in a test environment.

[0141] In one example, the pre-trained microservice call risk model is used to determine whether there is risky traffic based on the access relationship features obtained in the production environment. For the specific process, see Figure 5 Operation S331 and operation S332 are shown.

[0142] In operation S340 , an alarm is displayed for the abnormal connection node.

[0143] According to an embodiment of the present disclosure, displaying an alarm for an abnormal connection node includes: determining a communication node and traffic detail information involved in abnormal traffic; and pushing the communication node and the traffic detail information to a display terminal.

[0144] In one example, when it is determined that there is an abnormal connection, that is, when it is determined that there is an abnormality in the current access, the abnormal alarm module will immediately push the alarm result, and push the communication nodes involved in the abnormal traffic, traffic details and other information to the display terminal, prompting the operation and maintenance personnel to confirm whether it is an attack and make a quick response.

[0145] The microservice node monitoring method provided by the embodiment of the present disclosure identifies the first access relationship data between microservice nodes in the production environment based on the work order recognition model pre-trained in the test environment, determines abnormal connections, and displays alarms for abnormal connection nodes, helping operation and maintenance personnel to quickly locate risk nodes, thereby improving operation and maintenance efficiency.

[0146] Figure 5 The flowchart of the microservice node monitoring method according to the embodiment of the present disclosure is schematically shown. Figure 5 As shown, operation S330 includes operations S331 to S332.

[0147] In operation S331, a first Q value corresponding to the node jump sequence and a second Q value corresponding to the node function execution sequence are searched according to the jump value matrix and the function value matrix respectively;

[0148] In operation S332, if it is determined that the first Q value or the second Q value is less than a preset threshold, it is determined that an abnormal connection exists in the current access.

[0149] In one example, a node jump sequence and a node function execution sequence are generated for the information collected from the production environment. For the node jump and function execution in the sequence, the corresponding first Q value is queried in the jump value matrix and the function value matrix respectively. and the second Q value ,when or If it is a negative number or less than the specified threshold, it is determined that the current access is abnormal.

[0150] Based on the above microservice node monitoring method, the present disclosure also provides a microservice node monitoring device. Figure 6 The device is described in detail.

[0151] Figure 6 The following schematically shows a structural block diagram of a microservice node monitoring device according to an embodiment of the present disclosure.

[0152] like Figure 6 As shown, the microservice node monitoring device 600 of this embodiment includes an acquisition module 610 , an access relationship feature extraction module 620 , an abnormal connection identification module 630 and an alarm module 640 .

[0153] The acquisition module 610 is used to respond to the microservice node monitoring instruction and obtain the first access relationship data between the microservice nodes in the production environment. In one embodiment, the acquisition module 610 can be used to perform the operation S310 described above, which will not be repeated here.

[0154] The access relationship feature extraction module 620 is used to generate a node jump sequence and a node function execution sequence according to the first access relationship data. In one embodiment, the access relationship feature extraction module 620 can be used to perform the operation S320 described above, which will not be repeated here.

[0155] The abnormal connection identification module 630 is used to input the node jump sequence and the node function execution sequence into the microservice call risk model to identify abnormal connections. In one embodiment, the abnormal connection identification module 630 can be used to perform the operation S330 described above, which will not be repeated here.

[0156] The alarm module 640 is used to display an alarm for an abnormal connection node. In one embodiment, the alarm module 640 can be used to perform the operation S340 described above, which will not be repeated here.

[0157] According to an embodiment of the present disclosure, it also includes: a model training module.

[0158] The model training module is used to pre-train a microservice call risk model based on the access relationship feature data between microservice nodes in the test environment.

[0159] According to an embodiment of the present disclosure, the model training module includes a data acquisition submodule, a feature extraction submodule and a training submodule.

[0160] The data collection submodule is used to obtain the second access relationship data between the microservice application nodes in the test environment. In one embodiment, the data collection submodule can be used to perform the operation S210 described above, which will not be repeated here.

[0161] The feature extraction submodule is used to extract access relationship features based on the second access relationship data, and the access relationship features include node jump sequences and node function execution sequences; in one embodiment, the feature extraction submodule can be used to perform the operation S220 described above, which will not be repeated here.

[0162] The training submodule is configured to iteratively train the access relationship features based on a reinforcement learning algorithm to generate a microservice call risk model. In one embodiment, the training submodule may be configured to perform operation S230 described above, which will not be described in detail herein.

[0163] According to an embodiment of the present disclosure, the data acquisition submodule includes a first acquisition unit and a second acquisition unit.

[0164] The first acquisition unit is used to obtain access traffic data between microservice application nodes through one or more of a proxy method, a service grid method, a network packet capture method, and an application plug-in method; in one embodiment, the first acquisition unit can be used to perform the operation S211 described above, which will not be repeated here.

[0165] The second acquisition unit is used to acquire the execution sequence of the node internal function in real time by using the application code instrumentation method. In one embodiment, the second acquisition unit can be used to perform the operation S212 described above, which will not be repeated here.

[0166] According to an embodiment of the present disclosure, the training submodule includes: an initialization unit, an execution unit, a value matrix updating unit, a state table updating unit and an iterative calculation unit.

[0167] The initialization unit is used to initialize the state table, policy set, reward table, and value table of the microservice call risk model. In one embodiment, the initialization unit can be used to perform the operation S231 described above, which will not be repeated here.

[0168] The execution unit is used to randomly select and execute a node jump action or a function execution action according to the policy set; in one embodiment, the execution unit can be used to execute the operation S232 described above, which will not be repeated here.

[0169] The value matrix update unit is used to update the jump value matrix according to the jump value matrix update formula when executing a node jump action; and to update the function value matrix according to the function value matrix update formula when executing a function execution action. In one embodiment, the value matrix update unit can be used to execute the operations S233 and S234 described above, which will not be repeated here.

[0170] The state table updating unit is used to update the current state according to the state table. In one embodiment, the state table updating unit can be used to perform the operation S235 described above, which will not be repeated here.

[0171] The iterative calculation unit is used to repeat the above matrix update operation until the values ​​of the jump value matrix and the function value matrix no longer change. In one embodiment, the iterative calculation unit can be used to perform the operation S236 described above, which will not be repeated here.

[0172] According to an embodiment of the present disclosure, the abnormal connection identification module includes: a first determination submodule and a second determination submodule.

[0173] The first determination submodule is used to find the first Q value corresponding to the node jump sequence and the second Q value corresponding to the node function execution sequence according to the jump value matrix and the function value matrix respectively; in one embodiment, the first determination submodule can be used to perform the operation S331 described above, which will not be repeated here.

[0174] The second determining submodule is configured to determine that an abnormal connection exists in the current access if the first Q value or the second Q value is determined to be less than a preset threshold. In one embodiment, the second determining submodule may be configured to perform the operation S332 described above, which will not be described in detail here.

[0175] According to an embodiment of the present disclosure, the device further includes an encryption module,

[0176] The encryption module is configured to encrypt the first access relationship data. In one embodiment, the encryption module may be configured to execute the operation S350 described above, which will not be described in detail here.

[0177] According to an embodiment of the present disclosure, the alarm module includes: a third determination submodule and a display module.

[0178] The third determining submodule is used to determine the communication nodes and traffic details information involved in the abnormal traffic. In one embodiment, the third determining submodule can be used to perform the operation S340 described above, which will not be repeated here.

[0179] The display module is configured to push the communication node and the traffic details information to the display terminal. In one embodiment, the display module can be configured to execute the operation S340 described above, which will not be described in detail here.

[0180] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 610, the access relationship feature extraction module 620, the abnormal connection identification module 630, and the alarm module 640 can be combined into a single module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to an embodiment of the present disclosure, at least one of the acquisition module 610, the access relationship feature extraction module 620, the abnormal connection identification module 630, and the alarm module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware through any other reasonable method of circuit integration or packaging, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or any appropriate combination of any of these. Alternatively, at least one of the acquisition module 610 , the access relationship feature extraction module 620 , the abnormal connection identification module 630 and the alarm module 640 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0181] Figure 7 A block diagram of an electronic device suitable for implementing a microservice node monitoring method according to an embodiment of the present disclosure is schematically shown.

[0182] like Figure 7 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage unit 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0183] Various programs and data required for the operation of the electronic device 900 are stored in the RAM 903. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0184] According to an embodiment of the present disclosure, electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to bus 904. Electronic device 900 may also include one or more of the following components connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 908 including a hard disk; and a communication section 909 including a network interface card such as a LAN card or modem. Communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. Removable media 911, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 910 as needed, so that computer programs read from the removable media can be installed into storage section 908 as needed.

[0185] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the microservice node monitoring method according to the embodiments of the present disclosure.

[0186] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above, and / or one or more memories other than ROM 902 and RAM 903.

[0187] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to enable the computer system to implement the microservice node monitoring method provided by the embodiments of the present disclosure.

[0188] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 901 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0189] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0190] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from a removable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0191] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0192] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0193] Those skilled in the art will appreciate that the features described in the various embodiments of the present disclosure may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in the present disclosure. In particular, the features described in the various embodiments of the present disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of the present disclosure. All such combinations and / or couplings fall within the scope of the present disclosure.

[0194] The above describes the embodiments of the present disclosure. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be advantageously used in combination. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A microservice node monitoring method, characterized in that: The method comprises: In response to a microservice node monitoring instruction, obtaining first access relationship data between microservice nodes in a production environment; Generate a node jump sequence and a node function execution sequence according to the first access relationship data; Inputting the node jump sequence and the node function execution sequence into a microservice call risk model to identify abnormal connections; and Provide alarm display for abnormal connection nodes; The microservice call risk model is pre-trained based on access relationship feature data between microservice nodes in a test environment.

2. The method according to claim 1, characterized in that The microservice call risk model pre-trained based on the access relationship feature data between microservice nodes in the test environment includes: Obtain second access relationship data between microservice application nodes in the test environment; Extracting access relationship features according to the second access relationship data, the access relationship features including a node jump sequence and a node function execution sequence; and The access relationship features are iteratively trained based on a reinforcement learning algorithm to generate a microservice call risk model.

3. The method according to claim 2, characterized in that Acquiring the second access relationship data between the microservice application nodes in the test environment includes: Obtain access traffic data between microservice application nodes through one or more of a proxy method, a service grid method, a network packet capture method, and an application plug-in method; and The execution sequence of node internal functions is obtained in real time by using application code instrumentation.

4. The method according to claim 2, characterized in that The iterative training of the access relationship features based on the reinforcement learning algorithm to generate a microservice call risk model includes: Initialize the state table, policy set, reward table, and value table of the microservice call risk model; Randomly select and execute node jump actions or function execution actions according to the strategy set; If a node jump action is executed, the jump value matrix is ​​updated according to the jump value matrix update formula; If the function execution action is executed, the function value matrix is ​​updated according to the function value matrix update formula; Update the current state according to the state table; Repeat the above matrix update operation until the values ​​of the jump value matrix and the function value matrix no longer change.

5. The method according to claim 4, characterized in that Inputting the node jump sequence and the node function execution sequence into a microservice call risk model to identify abnormal connections includes: Searching for a first Q value corresponding to the node jump sequence and a second Q value corresponding to the node function execution sequence according to the jump value matrix and the function value matrix respectively; If it is determined that the first Q value or the second Q value is less than a preset threshold, it is determined that an abnormal connection exists in the current access.

6. The method according to any one of claims 1 to 5, characterized in that After obtaining the first access relationship data between the microservice nodes in the production environment, the method further includes: The first access relationship data is encrypted.

7. The method according to claim 6, characterized in that The alarm display of abnormal connection nodes includes: Identify the communication nodes and traffic details involved in the abnormal traffic; and Push the communication node and the traffic details information to the display terminal.

8. A microservice node monitoring device, characterized in that: The device comprises: An acquisition module, configured to acquire first access relationship data between microservice nodes in a production environment in response to a microservice node monitoring instruction; an access relationship feature extraction module, configured to generate a node jump sequence and a node function execution sequence according to the first access relationship data; an abnormal connection identification module, configured to input the node jump sequence and the node function execution sequence into a microservice call risk model to identify abnormal connections; and Alarm module, used to display alarms for abnormal connection nodes; The microservice call risk model is pre-trained based on access relationship feature data between microservice nodes in a test environment.

9. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images