Data center resource regulation and control method and system, program product and storage medium

Abstract

The invention discloses a data center resource regulation and control method and system, a program product and a storage medium. The method comprises the steps that when it is monitored that a first application with a high priority has a resource bottleneck due to waiting for input and output operation, a second application which is in positive correlation with the IO load change trend of the first application and has a low priority is located; through a pre-trained business logic model, generating a response feature including expected information entropy, data structure and size according to the request content of the first application; comparing the actual response feature of the second application with the expected feature, and calculating a content relevancy score; when the score is lower than a trust threshold value, that is, it is proved that the response content is irrelevant to the service logic, the IO resource quota upper limit of the second application is reduced, and after the waiting problem of the first application is relieved, the quota is increased. By implementing the technical scheme provided by the invention, the accuracy of resource regulation and control of the data center under a complex application relationship is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electric digital data processing, and in particular to a data center resource regulation method, system, program product and storage medium. BACKGROUND

[0002] With the rapid development of cloud computing, big data and artificial intelligence technology, data centers have become the core infrastructure supporting the operation of digital economy. In order to maximize the return on investment and reduce operating costs, it has become the mainstream mode of data center resource management to deploy a variety of different types of applications in high density on the same physical cluster.

[0003] In related technologies, to deal with the resource conflict problem brought by mixed deployment, one regulation method is to use hardware performance monitoring unit (such as Intel RDT) to monitor the occupation of shared resources such as last-level cache and memory bandwidth by each application in real time. When the performance indicators (such as latency) of the core application deteriorate, the system will associate the application with the highest resource occupation rate at the same time, and call the resource isolation technology (such as cgroups) at the operating system level to suppress it, in order to protect the performance of the core application.

[0004] However, in related technologies, since the regulation decision depends on the quantitative indicators of resource occupation, when there is business collaboration between high-priority applications and low-priority applications, inaccurate regulation behavior may produce a deteriorating effect. When the low-priority application is responding to the data request of the core high-priority application, the legitimate high load generated by the low-priority application may show high resource occupation rate, and thus be misjudged as malicious contention. At this time, the suppression of the related technology to the low-priority application will instead prolong the waiting time for the high-priority application to obtain the required data, thus exacerbating the performance deterioration problem of the high-priority application. SUMMARY

[0005] The present application provides a data center resource regulation method, system, program product and storage medium, which improves the accuracy of resource regulation of the data center under complex application relationships.

[0006] In a first aspect of the present application, a data center resource regulation method is provided, which comprises: The resource waiting index of a first application running in the data center is monitored; when the resource waiting index exceeds a preset resource waiting index threshold, a potential impact application whose real-time input / output operation load change trend is positively correlated with the resource waiting index change trend and whose business priority is lower than a first business priority corresponding to the first application is determined as a second application; information entropy of actual response data generated by the second application in response to a request of the first application is calculated, and a data structure and a data size of the actual response data are extracted to obtain actual response features; an expected response feature including an expected information entropy range, an expected data structure and an expected data size is generated based on a request content sent by the first application to the second application through a pre-trained business logic model; the actual response features and the expected response feature are compared to obtain an information entropy deviation value, a structure similarity score and a size matching score, and a content correlation score is obtained by weighted summation according to a preset weight; when the content correlation score does not exceed a preset trust threshold, a resource quota upper limit of an input / output operation of the second application is reduced by a preset first adjustment ratio; when the resource waiting index is lower than a preset first resource waiting index threshold, the resource quota upper limit of the input / output operation of the second application is increased by a preset second adjustment ratio.

[0007] In the above embodiment, after locating the low-priority application related to the performance degradation of the high-priority application, the present scheme does not directly suppress based on resource occupancy as in the prior art, but introduces a content correlation score mechanism. The score is obtained by comparing the actual response of the application with the expected response generated based on the business logic, so as to judge whether the high resource consumption of the low-priority application is to provide legitimate and valuable services for the high-priority application, avoiding the problem that the legitimate business cooperation is misjudged as malicious resource contention, and the core application performance degradation is aggravated due to false suppression, and finally improving the accuracy of resource regulation of the data center under complex application relationship.

[0008] In combination with some embodiments of the first aspect, in some embodiments, after calculating the information entropy of the actual response data generated by the second application in response to the request of the first application, and extracting the data structure and the data size of the actual response data to obtain the actual response features, the method further includes: obtaining a second application other response data sample set of other applications of different business priorities; calculating other data information entropy, other data structure and other data size of other response data in the other response data sample set to obtain other response feature data groups; calculating feature data mean variance between means of a plurality of other response feature data corresponding to each business priority in the other response feature data groups, and when any feature data mean variance exceeds a corresponding preset variance threshold, reading service quality configuration parameters corresponding to different business priorities from a configuration file of the second application; performing normalization processing on the actual response features based on the service quality configuration parameters to obtain corrected actual response features.

[0009] In the above embodiment, by calculating the mean variance of the feature data of the second application responding to different priority clients, it can be identified whether the response difference is caused by random anomalies or preset legal quality of service (QoS) strategy. After identifying the legal QoS strategy, the original observation data is normalized by using the configuration parameters, which restores a modified response feature that can be compared fairly and excludes the influence of legal service degradation. This avoids misjudging the normal differentiated service behavior of the application as a fault, ensures the fairness of subsequent evaluation, and therefore improves the accuracy of resource regulation of the data center under complex application relationships.

[0010] In combination with some embodiments of the first aspect, in some embodiments, after reading the quality of service configuration parameters corresponding to different service priorities from the configuration file of the second application, the method further includes: obtaining a service call link graph of the second application and identifying a set of downstream applications of the second application; calculating the mean variance of the downstream feature data when responding to different priority requests for each downstream application in the set of downstream applications; obtaining downstream quality of service configuration parameters of each downstream application in the set of downstream applications; calculating the service priority difference coefficient corresponding to each downstream application in the set of downstream applications; weighting and combining the quality of service configuration parameters based on the service priority difference coefficient to obtain a combined configuration parameter considering the influence of downstream services; and normalizing the actual response feature based on the combined configuration parameter to obtain a modified actual response feature.

[0011] In the above embodiment, by analyzing the service call link graph, the perspective of diagnosing performance problems is extended from isolated applications to complete downstream service dependency chains. After identifying the downstream applications, the service priority difference coefficient of each downstream application is calculated to quantify the legal performance fluctuations introduced by the QoS strategy of each downstream application. Then, by weighting and combining these influences, a combined configuration parameter is constructed that can fully reflect the overall influence of the downstream. Finally, the original observation data is normalized by using the parameter, which is equivalent to subtracting the legal performance jitter caused by all downstream dependencies when evaluating the second application, avoiding misattributing downstream problems to upstream applications, and therefore improving the accuracy of resource regulation of the data center under complex application relationships.

[0012] In combination with some embodiments of the first aspect, in some embodiments, when the resource waiting indicator exceeds the preset resource waiting indicator threshold, the potential influence application whose service priority is lower than the first service priority corresponding to the first application is determined as the second application after the change trend of the real-time input / output operation load is positively correlated with the change trend of the resource waiting indicator. obtaining network connection information of the second application; when a ratio of the number of outgoing connections to the number of incoming connections of the second application exceeds a preset proxy feature threshold, tracking outgoing data flow of the second application, and identifying a target application of the outgoing data flow; and determining the target application as the second application.

[0013] In the above embodiment, by analyzing the ratio of the number of outgoing connections to the number of incoming connections, it can be identified whether the observed application plays the role of a service gateway or a proxy. Once the proxy feature is identified, the outgoing data flow thereof is further tracked until the backend target application that truly processes the business logic is located. The problem of incorrect attribution of analysis target caused by the existence of middleware is solved, and it is ensured that the subsequent analysis and regulation are always directed to the root cause of the problem, rather than the innocent messenger application, thereby improving the accuracy of resource regulation of the data center under complex application relationships.

[0014] In combination with some embodiments of the first aspect, in some embodiments, after reducing the upper limit of the resource quota of the input and output operation of the second application by the preset first adjustment ratio, the method further includes: counting a small data response times of the second application to the first application in response data, when the small data response times exceed a preset small data times threshold within a preset time window, extracting a field type distribution feature in each response data, calculating a similarity between the field type distribution feature and a field type distribution feature of historical normal response data, and when the number of times that the similarity is lower than a preset similarity threshold exceeds a preset low similarity times threshold, reducing the resource quota upper limit of the second application by a preset penalty ratio.

[0015] In the above embodiment, when it is monitored that the potential impact application frequently returns small data responses, it is characterized as a fault. Instead of a deep check on the response data field type distribution feature, the appearance of data size can be penetrated, and by comparing the response content structure, it can be distinguished whether it is a legal empty response of no query result or an error information of service exception. This discrimination method from size to structure and then persistence avoids the error punishment to the application that returns legal empty data, and locates the abnormal application that falls into persistent failure and wastes resources, thereby improving the accuracy of resource regulation of the data center under complex application relationships.

[0016] In combination with some embodiments of the first aspect, in some embodiments, after the number of times that the similarity is lower than the preset similarity threshold exceeds the preset low similarity times threshold, the resource quota upper limit of the second application is reduced by the preset penalty ratio, the method further includes: record the number of responses of the second application to the first application in a preset detection time period; when the number of responses exceeds a preset upper limit of the number of responses, calculate the variance of data sizes of the response data in the detection time period; if the variance of data sizes is less than a preset variance threshold, and a ratio of a total size of the response data in the detection time period to a historical single response data size is greater than a preset segmentation ratio threshold, limit the maximum concurrent response number of the second application to a preset concurrency threshold.

[0017] In the above embodiment, after discovering that the number of responses abnormally increases, the variance of data sizes is calculated, and it is first identified whether the response stream has the characteristic of a large number of small packets with high consistency; then, by checking whether the total size of the responses is equivalent to a historical single large response, it is further confirmed that this is a specific inefficient behavior of splitting a single large response into a large number of small data packets for transmission; this double verification mechanism distinguishes response fragmentation from normal burst traffic, avoids misjudgment, and allows the system to take targeted measures to limit concurrency, thereby improving the accuracy of resource regulation in a complex application relationship in the data center.

[0018] In combination with some embodiments of the first aspect, in some embodiments, after increasing the upper limit of the resource quota of the input and output operation of the second application by a preset second adjustment ratio, the method further comprises: At the end of each preset sampling period, the number of requests sent by the first application to the second application is obtained; the request number growth rate of the number of requests in adjacent two sampling periods is calculated; when the request number growth rate exceeds a preset growth rate threshold, the request processing queue length of the second application is calculated; if the request processing queue length exceeds a preset queue length threshold, and the number of continuous times that the content correlation degree score exceeds a preset trust threshold exceeds a preset continuous number of times threshold, the resource quota restriction on the second application is removed, and the removal duration is proportional to the request number growth rate.

[0019] In the above embodiment, when the number of requests surges (the request number growth rate) is monitored and a processing bottleneck (the request processing queue length) is formed at the second application, by checking the content correlation degree score that is continuously positive, it is proved that the current resource shortage is caused by a legal and high-value burst of business. The resource restriction on the second application can be removed to actively ensure the smoothness of the core business link, avoiding the problem of damaging the performance of high-priority applications due to untimely regulation, so that the regulation strategy can dynamically adapt to changes in business traffic, thereby improving the accuracy of resource regulation in a complex application relationship in the data center.

[0020] In a second aspect, an embodiment of the present application provides a data center resource regulation system, comprising: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is configured to store computer program code, the computer program code comprising computer instructions, and the one or more processors invoke the computer instructions to enable the data center resource regulation system to perform the method described in the first aspect and any possible implementation manner of the first aspect.

[0021] In a third aspect, an embodiment of the present application provides a computer program product comprising instructions which, when executed on a data center resource regulation system, cause the data center resource regulation system to perform the method described in the first aspect and any possible implementation manner of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium comprising instructions which, when executed on a data center resource regulation system, cause the data center resource regulation system to perform the method described in the first aspect and any possible implementation manner of the first aspect.

[0023] It can be understood that the data center resource regulation system provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the data center resource regulation method provided in the embodiments of the present application. Therefore, the beneficial effects that can be achieved are referable to the beneficial effects in the corresponding method, which will not be described here again.

[0024] The one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: After the application is positioned to the low-priority application related to the performance degradation of the high-priority application, the present application does not suppress the low-priority application according to the resource occupancy rate as in the prior art, but introduces a content relevance scoring mechanism. The score is obtained by comparing the actual response of the application with the expected response generated based on the business logic, so as to determine whether the high resource consumption of the low-priority application provides a legitimate and valuable service for the high-priority application, avoiding the problem that the legitimate business cooperation is misjudged as malicious resource contention, and the performance degradation of the core application is aggravated due to the false suppression, and finally improving the accuracy of resource regulation of the data center under complex application relationship.

[0025] 2、The application calculates the mean square deviation of the feature data of the second application responding to different priority clients, so as to identify whether the response difference is caused by random anomaly or preset legal quality of service (QoS) strategy. After identifying the legal QoS strategy, the original observation data is normalized by using the configuration parameter, which restores a modified response feature excluding the influence of legal service degradation and being fairly comparable. This avoids misjudging the normal differentiated service behavior of the application as a fault, ensures the fairness of subsequent evaluation, and thus improves the accuracy of resource regulation of the data center under complex application relationships.

[0026] 3、The application analyzes the service call link diagram, and extends the diagnosis perspective of the performance problem from the isolated application to the complete downstream service dependency chain. After identifying the downstream application, the QoS strategy of each downstream application is quantified by calculating the business priority difference coefficient of each downstream application. Then, the combined configuration parameter reflecting the overall influence of the downstream is constructed by weighting and combining these influences. Finally, the original observation data is normalized by using the parameter, which is equivalent to subtracting the legal performance jitter caused by all downstream dependencies when evaluating the second application, avoiding misattributing the downstream problem to the upstream application, and thus improving the accuracy of resource regulation of the data center under complex application relationships. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 is a flowchart of a data center resource regulation method in an embodiment of the application; Figure 2 is another flowchart of a data center resource regulation method in an embodiment of the application; Figure 3 is an exemplary hardware structure diagram of a data center resource regulation system in an embodiment of the application. DETAILED DESCRIPTION

[0028] The terms used in the following embodiments of the application are only for the purpose of describing specific embodiments, and are not intended to be limiting to the application. As used in the specification and the appended claims of the application, the singular forms "a," "an," and "the" are intended to include both singular and plural forms, unless the context clearly indicates otherwise. It will be further understood that the terms "and / or" as used herein refer to any or all possible combinations of one or more of the associated listed items.

[0029] Hereinafter, the terms "first", "second", "third", "fourth", "fifth", "sixth", "seventh" and "eighth" are used only for descriptive purposes and should not be construed as implying or suggesting relative importance or an indicated number of technical features. Thus, features defined with "first", "second", "third", "fourth", "fifth", "sixth", "seventh" and "eighth" can explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, the meaning of "a plurality of" is two or more, unless otherwise specified.

[0030] In the related art, to deal with resource conflicts in a data center, a common method is to monitor the resource usage indicators of applications. When a first application of high priority has a resource waiting indicator exceeding a threshold, the system locates a second application of low priority with high input / output (I / O) operation load at the same time, and determines it as an interferer that is competing for resources. The logic of this method is that high I / O load and high resource waiting occur at the same time, which means that the former is the cause of the latter. However, if the high I / O load of the second application of low priority is exactly in response to a legitimate data request of the first application, then such high load is necessary and beneficial. At this time, the related art only limits the resource of the second application with high I / O load, which may block the path for the first application to obtain the required data, resulting in further prolongation of the waiting time, forming a negative effect and worsening the performance of the core application.

[0031] In the embodiments of the present application, after the second application related to the resource waiting of the first application is preliminarily located, a content relevance scoring mechanism based on business logic is introduced. This mechanism can generate an expected response image containing expected information entropy, data structure and size according to the request content issued by the first application through a pre-trained business logic model. Then, the actual response characteristics of the second application are compared with the expected response. Only when the actual response is seriously inconsistent with the expected response (i.e., the content relevance score is low), it is proved that the high I / O load of the second application is invalid or abnormal, and on this basis, the resource quota of the second application is adjusted. This method distinguishes between normal business cooperation and abnormal resource competition by verifying the business legitimacy of the data content, and avoids the problem of exacerbating the performance degradation of the core application due to false suppression.

[0032] Figure 1 is a flowchart of using the data center resource regulation method in the embodiments of the present application, including the following steps: S101, monitoring a resource waiting indicator of a first application running in a data center.

[0033] The data center refers to a physical or virtualized infrastructure for centrally deploying, running and managing computing, storage and network resources, such as an enterprise private cloud, a public cloud platform or a hybrid cloud environment; the first application represents a core business application in the data center that is under key protection, usually with high business priority and sensitive to response delay, such as an online transaction system, a real-time recommendation engine or a core API gateway; and the resource waiting indicator refers to a key performance indicator for measuring application performance bottlenecks, specifically the percentage of total CPU time that the central processing unit (CPU) is idle and the reason for the idling is waiting for an input / output operation to complete.

[0034] Specifically, in a high-density hybrid deployment data center environment, multiple applications share underlying physical I / O resources (such as solid state disks, network interface cards), and abnormal I / O behavior of an application can easily affect other applications. Instead of using indirect performance indicators (such as application latency), this method directly monitors the "I / O waiting time ratio", which can directly reflect whether the processor cycle of the application is wasted due to the inability to obtain or send data in time. A monitoring agent is deployed, which periodically collects CPU state data of the first application for processes or containers designated as the first application. By analyzing the time distribution of the CPU in different states such as user state, system state, idle state and I / O waiting state within a unit of time, the I / O waiting time ratio is calculated, thereby forming a real-time time series data reflecting the severity of the I / O bottleneck.

[0035] In some embodiments, the monitoring of the resource waiting indicator can be implemented in various ways: optionally, based on the extended Berkeley packet filter (eBPF) technology, which includes the following steps: an eBPF program is written and mounted to the kernel, which can track process scheduling events related to the first application; when the process enters a non-runnable sleep state due to an I / O request, the eBPF program records the current timestamp, and when the process is awakened, the timestamp is recorded again to obtain a timestamp pair; the monitoring agent in the user space aggregates these timestamp pairs, calculates the total I / O waiting time, and compares it with the total monitoring time to obtain the I / O waiting time ratio. It can be understood that other performance monitoring tools or technologies can also be used to monitor this indicator, which is not limited here.

[0036] S102、in the resource waiting indicator exceeds the preset resource waiting indicator threshold, the real-time input / output operation load trend is positively correlated with the resource waiting indicator trend, and the potential impact application with a business priority lower than the first business priority corresponding to the first application is determined as the second application.

[0037] The preset resource waiting index threshold is a preconfigured critical value for determining whether the I / O performance of the first application has been significantly deteriorated; the real-time input / output operation load represents the I / O activity intensity of the potential impact application in a unit of time, which can be quantified by the number of read / write operations per second (IOPS) or the number of read / write bytes per second (throughput); the change trend is the change direction and rate of an index in a specific time window, which is usually obtained by calculating the first derivative or slope of time series data; the positive correlation means that the change directions of two variables are consistent, that is, when one variable increases, the other variable also increases; the business priority is a label or a value assigned to different applications to represent the importance level thereof, which is used for decision-making in resource competition; and the potential impact application is a server application that logically provides services for the first application and is a direct suspect of causing I / O waiting of the first application.

[0038] Specifically, the trigger is triggered when the resource waiting index of the first application exceeds the preset threshold, thereby avoiding unnecessary calculation when the system is normally running. After the trigger, first, a list of applications having a service calling relationship with the first application is obtained as a candidate pool of potential impact applications. Then, three key checks are performed on each application in the candidate pool: first, correlation analysis, the resource waiting index time series of the first application and the I / O load time series of each potential impact application in a problem occurrence time window (for example, the past 5 minutes) are called. By calculating the Pearson correlation coefficient or other correlation measures between the two, applications with a correlation coefficient greater than a preset correlation threshold are screened out, which indicates that their I / O behaviors are highly synchronized with the waiting phenomenon of the first application. Second, priority check, from the applications screened out through correlation analysis, further screen out applications with a business priority lower than that of the first application, to ensure that the control measures will not mistakenly suppress more important applications than the core business. Third, one or more applications that meet all the above conditions are determined as the second application as the object of subsequent analysis and control.

[0039] In some embodiments, after the second application is determined, proxy identification and root cause tracing can be further performed to deal with the case that there is an intermediate forwarding layer in the service calling chain, so as to ensure that the control measures can act on the real resource-consuming backend service and avoid mistakenly suppressing innocent proxy applications.

[0040] First, all network connection information of the initially determined second application is obtained, including the identification (such as IP address, port or service name) of all peer applications establishing TCP / IP connection with the second application and the data flow direction (whether it is an outgoing connection initiated as a client or an incoming connection received as a server) of each connection, to construct a local network topology graph centered on the second application.

[0041] Next, the out-in connection ratio, i.e. the ratio of the number of out-connections to the number of in-connections, is calculated. A typical proxy or API gateway works in a mode of receiving requests (in-connections) from an upstream (e.g. a first application) and then forwarding the requests to one or more downstream backend services (out-connections), so the number of out-connections is usually much greater than or significantly more than the number of in-connections. When this ratio exceeds a preset proxy feature threshold, the second application preliminarily determined as a proxy is suspected, and a root tracing mechanism is started to actively track all out-connections of the proxy application, and by analyzing the target addresses of data packets or routing information in the service mesh, the target applications to which the data streams eventually converge are identified, and the target applications are the roots of processing business logic and generating high I / O load.

[0042] The target application to be traced is corrected as the final second application, and all subsequent analysis and control will be performed on the corrected second application.

[0043] In modern microservice architecture, proxy modes such as API gateway and message queue are very common. If the proxy itself is not identified and resource limited, not only the problem cannot be solved, but also the performance of more services that depend on the proxy will be deteriorated because the forwarding capability of the proxy is blocked, resulting in a negative effect that the more the control is, the worse the effect is. By performing the proxy identification and root tracing steps, the out-in connection ratio of the application is quantified to distinguish the proxy application from the backend service application; after the proxy is identified, the control target is corrected from the surface proxy that is only responsible for forwarding to the background service that actually generates load, avoiding the wrong attack on innocent middleware, so that the whole control decision is more accurate, and the overall accuracy of resource control of the data center under complex application relationships is finally improved.

[0044] S103, calculate the information entropy of the actual response data generated by the second application in response to the request of the first application, and extract the data structure and data size of the actual response data to obtain the actual response feature.

[0045] The actual response data refers to the real data payload output by the second application after processing the request of the first application; the information entropy is used to quantify the uncertainty or randomness of the response data content, and the higher the information entropy, the more complex and irregular the data content is; the data structure refers to the organization form and mode of the response data, such as the key name set of JSON object, the tag tree structure of XML or the field definition of Protobuf; the data size is the byte number of the response data; and the actual response feature is a multi-dimensional feature vector composed of the information entropy, data structure and data size.

[0046] Specifically, after determining the second application, a traffic capture module is deployed to intercept and analyze the response data packets from the second application to the first application. For each captured actual response data, a series of calculations are performed to extract the characteristics of the actual response data: first, calculate the information entropy, treat the response data as a byte sequence, count the frequency of each byte value from 0 to 255, and then apply the Shannon entropy formula to calculate the overall information entropy value. Second, extract the data structure, parse the data according to the pre-configured protocol type (such as HTTP / JSON, gRPC / Protobuf). For JSON, all keys are extracted and formed into a set or tree; for Protobuf, the filled field tags are decoded and identified. Finally, record the data size, which is completed by directly obtaining the byte length of the response data packet payload. The information entropy, data structure, and data size together constitute the actual response characteristics of the actual response data.

[0047] In some embodiments, the extraction of actual response characteristics can be achieved in various ways: optionally, based on application layer traffic proxy. This method includes the following steps: deploying a transparent seven-layer proxy (such as Envoy) at the network exit of the second application; configure the proxy rules to copy or perform deep packet inspection (DPI) on the response traffic to the first application; the analysis module built-in or attached to the proxy receives the response data, performs information entropy calculation, JSON / XML structure analysis and size statistics, and sends the results (actual response characteristics) to the control center. Optionally, based on application code instrumentation. This method includes the following steps: using dynamic bytecode injection technology (such as JavaAgent) or aspect-oriented programming (AOP) framework to intercept the function that returns the response in the code of the second application; in the interception logic, get the response object to be sent, analyze it directly in memory, calculate the information entropy, extract its field structure through reflection mechanism, and get its size after serialization; send the extracted features to the control center through an asynchronous message queue to reduce the performance impact on the main business process. It can be understood that other network packet capture or application monitoring technologies can also be used to extract features, which are not limited here.

[0048] S104, based on the request content sent by the first application to the second application, the pre-trained business logic model generates expected response characteristics including expected information entropy range, expected data structure and expected data size.

[0049] The pre-trained business logic model refers to a model that has been learned and trained through historical normal interaction data and can understand the business association logic between the first application and the second application; the request content refers to the request data sent by the first application to the second application; the expected response feature is a feature that a legal or normal response should have, which is predicted by the business logic model according to the request content, and is not an exact value, but a composite structure containing a range, a template and an expected value, for example, the information entropy should be between [2.5, 3.5], the data structure should contain “user_id”, “items” and other key fields, and the data size should be between 1KB and 2KB.

[0050] Specifically, a machine learning model is used to dynamically generate an expected response image. The business logic model is trained by learning a large number of request-response data pairs, and the goal is to find the mapping relationship between a specific request and the normal response features (information entropy, structure, size). When the regulation process runs, the captured request content sent by the first application is input into the pre-trained business logic model, and the model will output a corresponding expected response feature according to the business semantics of the request (for example, whether the request is for a single user information or a batch of commodity lists) and the knowledge learned from historical data. The expected feature provides a dynamic, closely related to business logic, gold standard for subsequent comparison and scoring.

[0051] In some embodiments, the pre-trained business logic model can be constructed in various ways: optionally, a model based on request classification and statistical image. This method includes the following steps: in the training stage, first cluster the historical request data or classify it using regular expressions, and divide the request into different business types; for each business type, calculate the statistical distribution (such as mean, variance, common structure template) of the entropy, structure and size of all corresponding normal response data; when a new request arrives, it is first classified into a certain business type, and then the statistical image corresponding to the type is directly called as the expected response feature. Optionally, an end-to-end generation model based on deep learning. This method includes the following steps: in the training stage, a model such as Seq2Seq (sequence to sequence) or Transformer architecture is used, the input is the text or structured data of the request, and the output is the feature vector of the response; the model learns a large number of request-response pairs to autonomously master the complex mapping relationship from the request to the response feature; input the new request content into the trained model, and the model directly generates an expected response feature vector (containing expected entropy, structure and size). It can be understood that other machine learning or statistical modeling methods can also be used to construct the model, which is not limited here.

[0052] S105, compare the actual response feature with the expected response feature to obtain an information entropy deviation value, a structural similarity score and a size matching degree score, and weight and sum according to a preset weight to obtain a content correlation degree score.

[0053] The information entropy deviation value is used to quantify the deviation degree of the actual information entropy from the expected range; the structural similarity score is used to quantify the fitting degree of the actual data structure and the expected structure; the size matching degree score is used to quantify the closeness degree of the actual data size and the expected size; the preset weight refers to the importance coefficient allocated to the three sub-scores, which can be adjusted according to the business characteristics; and the content correlation degree score is the final comprehensive score, which represents the close degree of the response content of the second application and the business intention requested by the first application. The higher the score, the more relevant and more reliable.

[0054] Specifically, the actual response feature obtained in S103 is compared with the expected response feature generated in S104 item by item, and three sub-scores are calculated: the information entropy deviation value is calculated, if the actual information entropy is within the expected range, the score is 1 (or full score); if it deviates, a penalty score is calculated according to the distance of deviation, the farther the deviation, the lower the score; the structural similarity score is calculated, the actual data structure (such as the JSON key set) is compared with the expected data structure, the Jaccard Similarity or tree edit distance algorithm can be used to calculate their similarity, and a score of 0 to 1 is obtained; the size matching degree score is calculated, similar to the information entropy, a score of 0 to 1 is given according to the matching of the actual data size and the expected size range. Finally, according to the preset weight, the three sub-scores are weighted and summed to obtain the content correlation degree score.

[0055] In some embodiments, the comparison and scoring process can be implemented in various ways: optionally, a scoring method based on normalized distance: for information entropy and data size, calculate the normalized deviation, and then convert it to a score of 0-1 through a Gaussian function; for data structure, extract the actual and expected JSON key path set, and calculate their Jaccard similarity coefficient as the score; multiply the three scores by the corresponding weights and sum to obtain the final score. Optionally, a scoring method based on fuzzy logic: define multiple fuzzy language variables (such as "too low", "normal", "too high") for each feature (entropy, structure, size); compare the actual feature value with the expected feature to determine the membership degree in each fuzzy variable; through the preset fuzzy rule base, fuzzy reasoning is carried out to finally obtain the content correlation degree score. It can be understood that other multi-criteria decision or vector space model methods can also be used for scoring, which is not limited here.

[0056] S106, when the content correlation score does not exceed the preset trust threshold, reducing the upper limit of the resource quota of the input / output operation of the second application by a preset first adjustment ratio.

[0057] The preset trust threshold is a critical score for judging whether the response is trustworthy, and below this threshold means that the response content has low relevance to the business request, and may be an abnormal or malicious response; the first adjustment ratio refers to the reduction ratio used when the resource limit is first performed; the upper limit of the resource quota of the input / output operation refers to the upper limit of the I / O resource usage allocated by the operating system or virtualization layer for the application (container or process), such as the upper limit of the IOPS of the disk or the upper limit of the network bandwidth.

[0058] Specifically, when the content correlation score calculated by S105 is lower than the preset trust threshold, it is determined that the second application has generated a high I / O load, but the response content does not match the request of the first application. This is a typical abnormal response mode, for example, a small amount of user data should be returned, but a large amount of irrelevant log or error information is returned. At this time, the high load of the second application is no longer considered as a legal business behavior, but is regarded as a kind of resource abuse. Therefore, the regulation system will call the underlying resource management interface, and reduce the I / O resource quota upper limit of the second application according to the preset first adjustment ratio. For example, the upper limit of the disk write rate of the second application is reduced from unlimited to 50MB / s, aiming to suppress its abnormal I / O behavior, so as to release the occupied shared I / O resources, so that the first application can normally perform its own I / O operation, thereby reducing its resource waiting index.

[0059] In some embodiments, the adjustment of the resource quota can be implemented in various ways: optionally, the blkio subsystem of the Linux control group is used: the cgroup path where the second application is located is located; read its current read / write rate limit file; calculate the new rate upper limit value according to the first adjustment ratio, and write the new value to the file, and the kernel will immediately enforce the new I / O quota. Optionally, through the quality of service (QoS) policy of the storage system. This method includes the following steps: 1) if the data center uses a centralized storage system (such as Ceph, SAN) that supports QoS, the storage volume of the second application will have a corresponding QoS policy; the regulation system finds the storage volume ID associated with the second application by calling the API of the storage system; modify the QoS policy of the storage volume, and reduce the IOPS upper limit or bandwidth upper limit of the storage volume according to the first adjustment ratio. It can be understood that the resource limit can also be realized through the QoS policy of the virtualization management platform (such as vSphere) or the network switch, which is not limited here.

[0060] In some embodiments, in addition to general regulation based on content relevance scores, refined identification and punishment mechanisms for specific attack patterns can also be integrated to more accurately respond to invalid packet attacks and data segmentation attacks.

[0061] The first method is used to identify invalid small packet attacks. First, the system continuously counts the number of small data responses with data sizes smaller than the expected size in the responses from the second application to the first application within a preset time window. When this count exceeds a preset small data count threshold within an evaluation cycle, a preliminary anomaly is determined. The system then performs structured parsing of each small data response to extract a field type distribution feature. This feature is a quantized vector describing the proportion of different data types (such as strings, integers, floating-point numbers, Booleans, and nested objects) in the response data. For example, for a JSON response, the system iterates through all key-value pairs, counts the number of each value type, and generates a distribution histogram. This real-time feature vector is then compared to a standard field type distribution feature established by learning from a large amount of historical normal response data. This calculation uses algorithms such as cosine similarity or the Jaccard similarity coefficient to generate a quantitative similarity score. This similarity score is continuously tracked. When the cumulative number of times the score falls below the preset similarity threshold exceeds a preset low similarity threshold, it is confirmed that this is a persistent, non-incidental invalid small packet attack. Once confirmed, the I / O resource quota upper limit of the second application is lowered according to a preset penalty ratio that is significantly larger than the first adjustment ratio.

[0062] The second is used to identify data segmentation attacks. First, in a very short detection period, the high frequency records the total number of responses of the second application to the first application. When the response number abnormally soars in a short time, exceeding the preset upper limit of the response number, there is a suspicion of high frequency attack, and the data size of all responses in the detection period is collected to calculate the statistical variance of the data set. A very small variance value means that the sizes of all response packets are highly consistent, which is itself an unnatural pattern and is highly likely to be an attacker who has copied the same data template in bulk. In order to confirm finally, perform aggregation verification: sum the data sizes of all responses in the period to obtain a total data size, and then calculate the ratio of the total data size to the average data size of historical normal business responses. If the ratio is significantly greater than a preset segmentation ratio threshold, a complete chain of evidence can be formed to prove that the attacker maliciously segmented a large data that should have been returned once into a large number of small data packets with highly consistent content and size, and attacked the first application by high frequency response. For this mode of attack by frequency rather than single traffic, simple I / O speed limit is not effective. Therefore, once confirmed, directly limit the maximum concurrent response number of the second application, and limit the concurrent processing capacity to a very low level by modifying the configuration of the running environment (such as the thread pool size of the application server or the concurrent connection number limit of the service grid), thereby fundamentally disintegrating the ability of high frequency attack.

[0063] The detection and regulation steps of these specific attack patterns significantly improve the response speed and regulation accuracy of the system in the face of advanced threats. Instead of relying on a single, universal content relevance index, the system constructs a portrait of two typical attack patterns, invalid small packets and data segmentation, through the combined analysis of multiple fine-grained features such as response size, field type distribution, response frequency, and data size variance. From general low relevance responses, it distinguishes behaviors with clear attack intent and matches more targeted and more intensive regulation strategies, avoiding the use of one-size-fits-all methods to handle all exceptions, thereby improving the accuracy and timeliness of resource regulation in complex attack scenarios.

[0064] S107、In resource waiting index is lower than the preset first resource waiting index threshold, the second application's input and output operation resource quota upper limit is increased by the preset second adjustment ratio.

[0065] The first resource waiting index threshold can be the same as the trigger threshold in S102, or it can be a lower recovery threshold to prevent the system from frequent oscillation near the critical point; the second adjustment ratio refers to the increase ratio used when the system recovers and restores resources to the second application.

[0066] Specifically, after executing the resource restriction measures of S106, the resource waiting indicator of the first application is continuously monitored. If the indicator drops below the preset recovery threshold, it means that the control measures are effective and the I / O bottleneck has been alleviated. At this time, in order to avoid permanent performance suppression of the second application (whose abnormal behavior may be only temporary) and affecting the ability to handle other normal business, the control system will gradually and gradually increase the resource quota upper limit that was lowered in S106 according to the preset second adjustment ratio. This gradual recovery method, rather than completely lifting the restriction at one time, is a protective strategy that can restore the resource quota of the second application under the premise of stable performance of the first application until it returns to the original level or a new level that is compatible with the current system load.

[0067] In the above embodiment, after locating low-priority applications that are associated with performance degradation in high-priority applications, this solution does not suppress them based solely on resource utilization, as in existing technologies. Instead, it introduces a content relevance scoring mechanism. This scoring compares the actual responses of applications with expected responses generated based on business logic to determine whether the high resource consumption of low-priority applications is providing legitimate and valuable services to high-priority applications. This avoids misinterpreting legitimate business collaboration as malicious resource contention, which can exacerbate core application performance degradation due to erroneous suppression. Ultimately, it improves the accuracy of resource regulation in data centers under complex application relationships.

[0068] In other embodiments of the present application, when the second application functions as a service gateway or a complex application that relies on multiple downstream services, legitimate service degradation behavior of downstream services may be mistakenly attributed to a failure of the currently observed application itself. The data center resource control method provided in this application can identify differentiated behavior as a result of a pre-defined and legitimate quality of service policy, rather than a failure of the application itself, thereby avoiding erroneous resource control decisions.

[0069] like Figure 2 FIG. 1 is another flow chart of the data center resource control method provided in an embodiment of the present application, including the following steps: S201: Monitor a resource waiting indicator of a first application running in a data center.

[0070] S202. When the resource waiting indicator exceeds a preset resource waiting indicator threshold, a potential influencing application whose changing trend of the real-time input and output operation load is positively correlated with the changing trend of the resource waiting indicator and whose business priority is lower than the first business priority corresponding to the first application is determined as the second application.

[0071] S203: Calculate the information entropy of actual response data generated by the second application in response to the request of the first application, and extract the data structure and data size of the actual response data to obtain actual response features.

[0072] Steps S201-S203 are similar to steps S101-S103 in the embodiment shown in Figure 1 The steps S101-S103 in the embodiment shown in FIG. 1A can be referred to for details, which will not be described herein.

[0073] S204, obtaining a second application other response data sample set of other applications of different service priorities.

[0074] The other applications refer to all client applications having a service calling relationship with the second application except the first application; and the other response data refers to data payloads returned by the second application when responding to requests of the other applications.

[0075] Specifically, the high I / O load generated by the second application and the abnormal response (e.g., small amount of data) to the first application may not be malicious or faulty, but normal business logic built-in for providing differentiated services to clients of different priorities. To verify this possibility, evidence of interactions between the second application and all known clients is actively collected. Through service discovery mechanism or network traffic monitoring, all client applications initiating requests to the second application are identified, and the service priorities of these applications are queried. Subsequently, a series of response data of the second application to these different priority applications are captured and stored, forming a sample set containing rich response instances with service priority as the category label.

[0076] In some embodiments, the acquisition of the response data sample set can be implemented in various ways: optionally, based on service mesh telemetry data collection: a request is sent to the control plane of the service mesh (such as Istio) to obtain a list of all downstream services taking the second application as an upstream service; the service priority labels of these downstream services are obtained through the metadata of the service mesh; the traffic mirroring rules of the service mesh are configured to copy all response traffic of the second application to these different priority services to a dedicated data collection service, thereby constructing the sample set. It can be understood that other network monitoring or log analysis techniques can also be used to implement the acquisition of the sample set, which is not limited herein.

[0077] S205, calculating other data information entropy, other data structure and other data size of the other response data in the other response data sample set, to obtain other response feature data groups.

[0078] Wherein, other data information entropy, other data structure and other data size refer to the same feature extraction calculation as S103 for each response sample collected in S204; other response feature data set represents a structured data set storing feature vectors (composed of information entropy, structure, size) of all samples and retaining the original business priority label of each feature vector corresponding to the client application.

[0079] Specifically, each response data in the sample set is traversed. For each data, the information entropy is calculated using the Shannon entropy formula to quantify the complexity of the content; the data format (such as JSON, XML) is parsed and the structure mode is extracted to understand the organization paradigm; the byte length is obtained to measure the physical size. After the processing is completed, the original response data sample set is converted into the response feature data set.

[0080] S206, calculate the feature data mean variance between the means of the plurality of other response feature data corresponding to each business priority in the other response feature data set, and when any feature data mean variance exceeds a corresponding preset variance threshold, read the quality of service configuration parameters corresponding to different business priorities from the configuration file of the second application.

[0081] Wherein, the feature data mean refers to the average value calculated for all response feature data in the same business priority group; the feature data mean variance is used to represent the dispersion degree between the feature data means of different business priority groups, and the greater the variance, the more significant the difference in quality of service obtained by different priorities; the quality of service configuration parameter is a rule defined in the configuration file of the second application for guiding how to provide different responses (such as different size limits, content details) for different priority requests, which has been preset in the configuration file in advance.

[0082] Specifically, first, statistical analysis is performed on the feature data set generated by S205, all feature vectors are grouped according to business priority, and the mean of the feature vectors in each group is calculated to obtain a plurality of average response features. Then, the variance between these average response features is calculated. For example, the variance of the average data size of all groups is calculated separately. If this variance value exceeds the preset threshold, it indicates that the second application has implemented a differentiated service strategy according to the client priority. Once this assumption is verified, the configuration file (such as YAML, properties or XML file) of the second application is directly searched and parsed by accessing the deployment environment of the second application, and the quality of service configuration (QoS) parameters defined therein are extracted.

[0083] In some embodiments, variance calculation and configuration reading can be implemented in various ways: optionally, through linkage with a configuration center: application configuration in the data center is managed by a centralized configuration center (such as Nacos, Consul); after the variance calculation exceeds the threshold, an API request is initiated to the configuration center according to the identity of the second application; the configuration set effective in the current environment of the application is queried, and the parameters related to service quality are parsed from the returned configuration data. It can be understood that the configuration file can also be read through other automated operation and maintenance tools or directly through remote execution of commands, which is not limited here.

[0084] In some embodiments, after identifying that the second application itself has a differentiated service policy, the complete service call link can be further traced back, the differentiated service behavior of each dependent service in the downstream is quantitatively analyzed, a combined configuration parameter reflecting the comprehensive influence of the downstream services is constructed, and thus the actual response characteristics are deeply corrected, and misjudgment caused by QoS transmission effect on the service dependency chain is avoided.

[0085] Specifically, the deep correction process is started after S206 confirms that the second application has a QoS behavior, and the core logic is that the response characteristics of the second application are not only determined by itself, but are more likely to be deeply influenced by the downstream services it depends on.

[0086] The complete service call link diagram of the second application is obtained to identify a set of directly dependent downstream applications. All child spans (Child Span) with the second application as the parent span (Parent Span) can be extracted by querying the back-end storage of a distributed tracking system (such as OpenTelemetry, Jaeger), and the services corresponding to these child spans are identified as downstream applications; or the service topology diagram can be obtained by querying the control plane of a service mesh (such as Istio), and all destination services of the outbound traffic from the second application are parsed.

[0087] For the set of downstream applications identified in the previous step, the analysis process of S204 to S206 is independently performed for each downstream application. The response sample set of each downstream application to different priority requests is collected, the response characteristics (information entropy, structure, size) are calculated, and finally the mean variance of the downstream characteristic data representing the strength of the QoS policy of each downstream application is calculated. At the same time, the downstream service quality configuration parameters of each downstream application are tried to be obtained.

[0088] The service priority difference coefficient corresponding to each downstream application is calculated, which is used to measure the contribution of each downstream service to the final response characteristics of the second application. First, the mean variance values of the feature data of all downstream applications obtained in the previous step are collected. Then, for the i-th application in the set of downstream applications, the difference coefficient is calculated as the ratio of the mean variance of the feature data of the application itself to the sum of the mean variances of the feature data of all applications in the set. This normalized coefficient makes the weight of the downstream application with more significant QoS policy (larger variance) higher, and vice versa.

[0089] Based on the calculated service priority difference coefficient, the service quality configuration parameters of all downstream applications are combined by weighting. The service quality configuration parameters (e.g., scaling ratio of response size, pruning list of content field, etc.) of each downstream application are multiplied by the corresponding difference coefficient, and then all the products are accumulated or combined in other pre-set ways. Thus, the combined configuration parameters are obtained. The combined parameters are no longer the configuration of any single application, but the equivalent representation of the QoS effect of the entire downstream service ecosystem on the second application.

[0090] The actual response characteristics are normalized using the combined configuration parameters. The processing method is similar to S207. For example, if the combined parameters show that the response size is expected to be reduced to 35% of the normal size under the priority of the current request due to the combined influence of downstream services, then the system will divide the actually observed response size by 0.35 to restore the theoretical value without QoS influence. A corrected actual response characteristic is obtained.

[0091] The downstream influence analysis and combination correction step acknowledges that in a complex call chain, the response characteristics of an upstream application are often the aggregation and embodiment of the response characteristics of all its downstream services. By calculating the service priority difference coefficient, the influence weight of each downstream service QoS policy is quantified, and the equivalent combined configuration parameters are constructed. The normalization processing is no longer based on the QoS declaration of the second application itself, but on the real behavior of the entire service dependency system behind it. It effectively distinguishes whether the second application itself is faulty or it has transmitted a legitimate degraded response from downstream services, thereby ensuring the accuracy of the regulation decision and improving the overall accuracy of resource regulation in the data center under complex application relationships.

[0092] S207, the actual response characteristics are normalized based on the service quality configuration parameters to obtain the corrected actual response characteristics.

[0093] The normalization processing refers to mathematical transformation of the actual response characteristics according to the QoS parameters to eliminate the influence of priority differentiated services and convert to a standard, priority-independent baseline.

[0094] Specifically, first, determine the business priority of the first application, and then find the rules applicable to that priority in the read QoS configuration parameters. For example, the rule may be "For low-priority applications, the response size is reduced to 20% of the normal size." Then the data size value in the actual response feature is divided by 20% to obtain a theoretical size that should be in the absence of a QoS policy. Similarly, if the QoS policy affects the data structure (for example, omitting certain non-core fields for low-priority users), the expected structure is adjusted accordingly before comparing the structural similarity. After reverse conversion, a revised actual response feature is obtained. This revised feature is compared with the expected feature generated by the model to ensure the fairness of the comparison.

[0095] In some embodiments, normalization of the actual response characteristics can be achieved through various methods: Optionally, inverse adjustment based on a scaling factor: The QoS profile defines scaling factors for various characteristics at different priorities; the priority of the first application is obtained and the corresponding scaling factor is found; the obtained actual characteristic values ​​are divided one by one by the corresponding scaling factor to obtain the corrected characteristic values. It is understood that other mathematical transformations or calibration models can also be used to achieve normalization, which is not limited here.

[0096] S208. Generate an expected response feature including an expected information entropy range, an expected data structure, and an expected data size based on the request content sent by the first application to the second application through the pre-trained business logic model.

[0097] S209: Compare the actual response features with the expected response features to obtain an information entropy deviation value, a structural similarity score, and a size matching score, and perform weighted summation according to preset weights to obtain a content relevance score.

[0098] S210: When the content relevance score does not exceed a preset trust threshold, reduce the resource quota upper limit of the input and output operations of the second application according to a preset first adjustment ratio.

[0099] S211 : When the resource waiting indicator is lower than a preset first resource waiting indicator threshold, increase the resource quota upper limit of the input and output operations of the second application according to a preset second adjustment ratio.

[0100] Steps S208-S211 and Figure 1 In the illustrated embodiment, steps S104 to S107 are similar, and the descriptions of steps S104 to S107 may be referred to, and will not be repeated here.

[0101] In some embodiments of the present application, after the application performance is stabilized by the continuous resource regulation, a forward-looking resource quota dynamic lifting mechanism can also be introduced to actively identify and adapt to legitimate traffic surges, thereby maximizing the application performance and response capability in high-load scenarios while ensuring system stability.

[0102] Specifically, at the end of each preset sampling period, the total number of requests sent by the first application to the second application within this period is obtained through monitoring components such as APM probes or telemetry data of service mesh. Then, the request numbers of the current period and the last period are calculated, and the request number growth rate is obtained according to the formula (current period request number - last period request number) / last period request number. When this growth rate exceeds a preset growth rate threshold for filtering daily fluctuations, it is preliminarily determined that a sudden traffic peak may have occurred, and the real-time running state of the second application, especially the request processing queue length, is detected. This indicator can be obtained by querying the runtime environment of the application (such as JMX MBean of Java application) or from the infrastructure monitoring system (such as Prometheus), reflecting the degree of request backlog. Next, first, it is confirmed whether the request processing queue length has exceeded the preset queue length threshold, which indicates that the resources currently allocated to the second application are insufficient to cope with the request pressure, and a processing bottleneck has occurred; second, historical records are queried to verify whether the content relevance score calculated in step S210 has continuously exceeded the preset trust threshold in the past period of time, which is the key to distinguishing between good intentions and malicious attacks, ensuring that the application to be supported is one that has performed well and consistently provided high-quality services in the long term, thereby effectively preventing the erroneous support of resources for continuously growing junk requests or slow attacks. Only when the three conditions of high-speed request growth, request queue backlog, and historical service quality trust are met at the same time, it is finally confirmed that it is a legitimate traffic surge. At this time, the I / O resource quota limit on the second application is temporarily lifted or increased to a high level. Moreover, in order to achieve dynamic response, the duration of the lifted limit is designed to be in a positive relationship with the request number growth rate, for example, the lifted duration = base duration x (1 + growth rate), which means that the more rapid the business growth, the longer the resource support window period.

[0103] By associating the request growth rate and queue length load indicators with the content relevance score, a service quality indicator, malicious traffic attacks can be distinguished from benign traffic surges, avoiding the erroneous triggering of resource limits due to legitimate high-concurrency requests, ensuring the service performance and user experience of critical businesses during peak periods, and thereby improving the intelligence and accuracy of resource regulation in complex application relationships in data centers.

[0104] In the above embodiment, by calculating the mean square deviation of the feature data of the second application responding to different priority clients, it can be identified whether the response difference is caused by random anomaly or preset legal quality of service (QoS) strategy. After identifying the legal QoS strategy, the original observation data is normalized by using the configuration parameters of the legal QoS strategy, which restores a modified response feature excluding the influence of legal service degradation and avoiding misjudgment of normal differentiated service behavior of the application as fault, thus improving the fairness of subsequent evaluation and the accuracy of resource regulation of the data center under complex application relationship.

[0105] The following describes an exemplary data center resource regulation system 300 provided by an embodiment of the present application. Figure 3 FIG. 1 is an exemplary hardware structure diagram of the data center resource regulation system 300 provided by an embodiment of the present application.

[0106] In some embodiments, the data center resource regulation system 300 is a computer device or includes a computer device in the data center resource regulation system 300. The computer device includes a processor, a memory and a network interface connected by a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store data. The network interface of the computer device is configured to communicate with other terminals or servers outside through a network connection. In some embodiments, the network interface can be a wired network interface, and in some embodiments, the network interface can also be a wireless network interface. The computer program is executed by the processor to implement the method in the embodiments of the present application.

[0107] Those skilled in the art can understand that, Figure 3 The structure shown in FIG. 1 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0108] The above-described and above-embodied examples are only used to illustrate the technical solutions of the present application, but not to limit the same. Although the foregoing has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

[0109] In the above embodiments, the term "when" can be interpreted as "if" or "after" or "in response to determining" or "in response to detecting" depending on the context. Similarly, the phrase "upon determining" or "if detecting (the stated condition or event)" can be interpreted as "if determining" or "in response to determining" or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)" depending on the context.

[0110] In the above embodiments, all or part of the methods can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the methods can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media (such as DVD), or semiconductor media (such as solid state disk), etc.

[0111] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by a computer program to instruct the relevant hardware to complete, and the program can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above-mentioned method embodiments. The aforementioned storage medium includes ROM or random access memory (RAM), magnetic disk or optical disk, and various media that can store program codes.

Claims

1. A data center resource control method, characterized in that: include: Monitoring a resource waiting indicator of a first application running in a data center, where the resource waiting indicator is a percentage of idle time of a processor of the first application waiting for input and output operations; When the resource waiting indicator exceeds a preset resource waiting indicator threshold, a potential influencing application whose changing trend of the real-time input and output operation load is positively correlated with the changing trend of the resource waiting indicator and whose service priority is lower than the first service priority corresponding to the first application is determined as the second application, the potential influencing application being a server application that receives and processes requests from the first application; Calculating the information entropy of actual response data generated by the second application in response to the request of the first application, and extracting the data structure and data size of the actual response data to obtain actual response characteristics; Generate, through a pre-trained business logic model, an expected response feature including an expected information entropy range, an expected data structure, and an expected data size based on the request content sent by the first application to the second application; Comparing the actual response features with the expected response features to obtain an information entropy deviation value, a structural similarity score, and a size matching score, and performing weighted summation according to preset weights to obtain a content relevance score; When the content relevance score does not exceed a preset trust threshold, reducing the resource quota upper limit of the input and output operations of the second application according to a preset first adjustment ratio; When the resource waiting indicator is lower than a preset first resource waiting indicator threshold, the resource quota upper limit of the input and output operations of the second application is increased according to a preset second adjustment ratio.

2. The method according to claim 1, characterized in that After calculating the information entropy of the actual response data generated by the second application in response to the request of the first application, and extracting the data structure and data size of the actual response data to obtain the actual response feature, the method further includes: Obtaining other response data sample sets of the second application to other applications with different service priorities; Calculate other data information entropy, other data structure, and other data size of other response data in the other response data sample set to obtain other response feature data groups; Calculating a feature data mean variance between means of a plurality of other response feature data corresponding to each service priority in the other response feature data group, and when any of the feature data mean variance exceeds a corresponding preset variance threshold, reading a quality of service configuration parameter corresponding to the different service priorities from a configuration file of the second application; The actual response characteristics are normalized based on the quality of service configuration parameters to obtain corrected actual response characteristics.

3. The method according to claim 2, characterized in that After reading the quality of service configuration parameters corresponding to different service priorities from the configuration file of the second application, the method further includes: Obtaining a service call chain graph of the second application, and identifying a set of downstream applications of the second application; For each downstream application in the downstream application set, respectively calculating the mean variance of downstream feature data when responding to requests of different priorities; Respectively obtaining downstream service quality configuration parameters of each downstream application in the downstream application set; Calculating the business priority difference coefficient corresponding to each downstream application in the downstream application set respectively, where the business priority difference coefficient is the ratio of the response data feature variance when each downstream application processes requests of different priorities to the mean variance of the downstream feature data; Performing a weighted combination of the quality of service configuration parameters based on the business priority difference coefficient to obtain a combined configuration parameter that takes into account the impact of downstream services; The actual response characteristics are normalized based on the combined configuration parameters to obtain a corrected actual response characteristic.

4. The method according to claim 1, wherein When the resource waiting indicator exceeds a preset resource waiting indicator threshold, after determining as a second application a potential impacting application whose change trend of the real-time input / output operation load is positively correlated with the change trend of the resource waiting indicator and whose service priority is lower than the first service priority corresponding to the first application, the method further includes: Obtaining network connection information of the second application, the network connection information including identifiers of other applications connected to the second application and data transmission directions of each connection; When the ratio of the number of outbound connections to the number of inbound connections of the second application exceeds a preset proxy characteristic threshold, tracking the outbound data flow of the second application and identifying the target application of the outbound data flow; The target application is determined as a second application.

5. The method according to claim 1, wherein After reducing the resource quota upper limit of the input and output operations of the second application according to the preset first adjustment ratio, the method further includes: Counting the number of small data responses in which the response data size is smaller than the expected data size in the response of the second application to the first application; When the number of small data responses exceeds a preset small data number threshold within a preset time window, extracting the field type distribution characteristics in the response data each time; Calculating the similarity between the field type distribution characteristics and the field type distribution characteristics of historical normal response data; When the number of times that the similarity is lower than the preset similarity threshold exceeds a preset low similarity number threshold, the resource quota upper limit of the second application is reduced according to a preset penalty ratio, and the penalty ratio is greater than the first adjustment ratio.

6. The method according to claim 5, characterized in that After reducing the resource quota upper limit of the second application according to a preset penalty ratio when the number of times the similarity is lower than the preset similarity threshold exceeds a preset low similarity number threshold, the method further includes: Recording the number of responses of the second application to the first application within a preset detection time period; When the number of responses exceeds a preset upper limit of the number of responses, the data size variance of each response data within the detection time period is calculated; If the data size variance is smaller than the preset variance threshold, and the ratio of the total response data size within the detection time period to the historical single response data size is larger than the preset segmentation ratio threshold, the maximum number of concurrent responses of the second application is limited to the preset concurrency threshold.

7. The method according to claim 1, characterized in that After increasing the resource quota upper limit of the input and output operations of the second application according to the preset second adjustment ratio, the method further includes: At the end of each preset sampling period, obtaining the number of requests sent by the first application to the second application; Calculate the request quantity growth rate of the request quantity within two adjacent sampling periods; When the request quantity growth rate exceeds a preset growth rate threshold, calculating the request processing queue length of the second application; If the request processing queue length exceeds the preset queue length threshold, and the content relevance score exceeds the preset trust threshold for more consecutive times than the preset consecutive times threshold, the resource quota restriction on the second application is lifted, and the lifting duration is proportional to the growth rate of the number of requests.

8. A data center resource control system, characterized in that: The data center resource control system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the data center resource control system to execute the method described in any one of claims 1-7.

9. A computer program product comprising instructions, characterized in that When the computer program product is run on a data center resource control system, the data center resource control system is enabled to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium comprising instructions, characterized in that: When the instruction is executed on a data center resource control system, the data center resource control system is caused to execute the method according to any one of claims 1 to 7.

Images