Early warning event execution method and device, storage medium and electronic equipment

Abstract

The invention discloses an early warning event execution method and device, a storage medium and electronic equipment, and relates to the technical field of cloud computing, and the method comprises the steps: configuring a tracking connection limit number in an initial state for a binding interface of a target virtual machine, and determining a dynamic threshold range according to the tracking connection limit number in the initial state; determining the current tracking connection number of the binding interface according to the network data message received by the binding interface; and determining whether to execute an early warning event or not according to a first size relationship between the current tracking connection number and the tracking connection limit number in the initial state and a second size relationship between the current tracking connection number and the dynamic threshold range. By adopting the technical scheme, the problem that real-time monitoring and intelligent early warning of the connection tracking number of the virtual machine cannot be realized is solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cloud computing technology, and more specifically, to a method, device, storage medium, and electronic device for executing a warning event. Background Art

[0002] With the rapid development of cloud computing, virtual machines (VMs) have become a core component, providing flexible computing resource allocation and management. A VM is a complete computer system simulated by software, running in a completely isolated environment. Due to the widespread adoption of cloud computing, the number and application scenarios of VMs are constantly increasing. Excessive connection tracking counts for VMs can lead to excessive consumption of system resources, impacting the performance and stability of the VMs and the entire cloud environment. Therefore, effectively limiting these numbers is crucial. Currently, cloud environments lack effective mechanisms for managing VM connection tracking counts, making it difficult to address surges in connections caused by malicious attacks or abnormal behavior. Furthermore, existing methods for monitoring VM connection tracking counts are often inaccurate and inaccurate, failing to issue effective warnings when VM connection tracking counts are about to exceed reasonable limits.

[0003] Regarding the problem that related technologies cannot realize real-time monitoring and intelligent early warning of virtual machine connection tracking numbers, no effective solution has been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide a method, device, storage medium and electronic device for executing a warning event, so as to at least solve the problem in the related art that it is impossible to achieve real-time monitoring and intelligent warning of the number of virtual machine connection tracking.

[0005] According to one embodiment of the present application, a method for executing a warning event is provided, including: configuring a tracking connection limit number in an initial state for a binding interface of a target virtual machine, and determining a dynamic threshold range based on the tracking connection limit number in the initial state; determining the current tracking connection number of the binding interface based on network data packets received by the binding interface; and determining whether to execute the warning event based on a first size relationship between the current tracking connection number and the tracking connection limit number in the initial state, and a second size relationship between the current tracking connection number and the dynamic threshold range.

[0006] According to another embodiment of the present application, a device for executing a warning event is provided, including: a first determination module, used to configure a tracking connection limit number in an initial state for a binding interface of a target virtual machine, and determine a dynamic threshold range based on the tracking connection limit number in the initial state; a second determination module, used to determine the current tracking connection number of the binding interface based on a network data packet received by the binding interface; and a third determination module, used to determine whether to execute the warning event based on a first size relationship between the current tracking connection number and the tracking connection limit number in the initial state, and a second size relationship between the current tracking connection number and the dynamic threshold range.

[0007] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when run.

[0008] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0009] According to another embodiment of the present application, a computer program product is provided, including a computer program, which implements the steps of any of the above method embodiments when executed by a processor.

[0010] This application configures an initial tracking connection limit for each target virtual machine's bound interface. Based on the initial tracking connection limit, a dynamic threshold range is determined, typically fluctuating by a certain percentage (e.g., 10%) around the initial value to accommodate normal fluctuations in virtual machine traffic and avoid frequent false alarms. Next, network data packets received by the virtual machine's bound interface are parsed and tracked in real time, extracting relevant connection information (such as source IP, destination IP, port number, etc.), and updating the virtual machine's current tracking connection count. By continuously monitoring the current tracking connection count, the latest status of the virtual machine's network connections can be monitored. Finally, based on the current tracking connection count, two criteria are used for judgment: first, comparison with the initial tracking connection limit, and second, comparison with the dynamic threshold range. Depending on the relationship between these two values, corresponding warning events are executed. If the current tracking connection count slightly exceeds the initial limit but remains below the upper limit of the dynamic threshold, a minor warning event is triggered. If the current tracking connection count not only exceeds the initial limit but also exceeds the upper limit of the dynamic threshold, a severe warning event is triggered. This technical solution solves the problem of inability to implement real-time monitoring and intelligent warnings for virtual machine connection tracking. Furthermore, by setting initial connection limits and dynamic thresholds for virtual machine interfaces based on resource requirements and historical data analysis, the number of network connections can be monitored and intelligently determined in real time, thereby providing intelligent warnings of abnormal situations. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] Figure 1 This is a hardware structure block diagram of a server device according to a method for executing a warning event in an embodiment of the present application;

[0013] Figure 2 is a flowchart of a method for executing a warning event according to an embodiment of the present application;

[0014] Figure 3 This is a system architecture diagram of a method for limiting the number of virtual machine connection tracking in a cloud environment according to an embodiment of the present application;

[0015] Figure 4 This is a flow chart of limiting the number of virtual machine connection tracking in a cloud environment according to an embodiment of the present application;

[0016] Figure 5 is a structural block diagram of an execution device for a warning event according to an embodiment of the present application; DETAILED DESCRIPTION

[0017] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0018] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0019] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0020] As an optional implementation method, the method embodiment provided in the embodiment of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 FIG is a hardware structure diagram of a server device according to an embodiment of the present application for executing a warning event. Figure 1 As shown, the server device may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a microprocessor MPU or a programmable logic device FPGA) and a memory 104 for storing data. The server device may also include a transmission device 106 and an input / output device 108 for communication functions. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0021] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the execution method of the early warning event in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories can be connected to the server device via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0022] The transmission device 106 is used to receive or send data via a network. A specific example of the aforementioned network may include a wireless network provided by a communication provider of the server device. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0023] In this embodiment, a method for executing a warning event is provided, which is applied to the above-mentioned server device. Figure 2 is a flow chart of a method for executing a warning event according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0024] Step S202: configuring a tracking connection limit number in an initial state for the binding interface of the target virtual machine, and determining a dynamic threshold range according to the tracking connection limit number in the initial state;

[0025] Optionally, a virtual machine in a cloud environment is primarily used to process web page requests. During the configuration phase, based on an analysis of the virtual machine's historical data and current business needs, the administrator decides to set an initial limit of 3000 tracked connections for the virtual machine, with a dynamic threshold fluctuation range of 10%. Based on the initial limit of tracked connections, the lower limit of the dynamic threshold is determined to be 3000*(1-10%)=2700, and the upper limit is determined to be 3000*(1+10%)=3300.

[0026] Step S204, determining the current tracking connection number of the binding interface according to the network data message received by the binding interface;

[0027] Optionally, a virtual machine in a cloud environment is responsible for processing user live streaming connection requests. To ensure service stability and security, administrators need to monitor the current number of tracked connections on the virtual machine's bound interface in real time. The administrator configures the Open vSwitch (OVS) flow table rules in the cloud platform management system to ensure that all network data packets passing through the bound interface are intercepted and processed by OVS. These rules include, but are not limited to, passing all packets entering and leaving the bound interface to the Connection Tracking Zone (ct_zone) module for connection tracking. When OVS intercepts a data packet, it extracts the packet's five-tuple information (source IP, source port, destination IP, destination port, and transport layer protocol) and passes it to the kernel's ct_zone module. The ct_zone module maintains a connection tracking table that records the status and information of each connection. When a new connection is established or an old connection is disconnected, ct_zone automatically updates the connection tracking table to reflect the current number of tracked connections on the eth1 interface.

[0028] Step S206 : determining whether to execute an early warning event based on a first size relationship between the current number of traced connections and the traced connection limit in the initial state, and a second size relationship between the current number of traced connections and the dynamic threshold range.

[0029] Optionally, a virtual machine is used to handle the reception and distribution of live streams. An administrator configures an initial tracking connection limit of 3000 connections for the network interface of the virtual machine and sets a dynamic threshold range of 10%. Therefore, the lower limit is 3000*(1-10%)=2700, and the upper limit is 3000*(1+10%)=3300. Using OVS and the kernel's ct_zone function, the current number of tracked connections on the network interface is monitored in real time. Assume the current number of connections is 3200. If the current number of tracked connections, 3200, exceeds the initial tracking connection limit of 3000 by a first magnitude, but does not exceed the upper limit of the dynamic threshold range by a second magnitude, 3300, a first warning event is executed. If the current number of tracked connections, 3500, exceeds the initial tracking connection limit of 3000 by a first magnitude, but does not exceed the upper limit of the dynamic threshold range by a second magnitude, 3300, a second warning event is executed.

[0030] Through the above method, an initial limit on the number of tracked connections is configured for each target virtual machine's bound interface. Based on the initial limit, a dynamic threshold range is determined, typically fluctuating by a certain percentage (e.g., 10%) around the initial value to accommodate normal fluctuations in virtual machine traffic and avoid frequent false alarms. Next, network data packets received by the virtual machine's bound interface are parsed and tracked in real time, extracting relevant connection information (such as source IP, destination IP, port number, etc.), and updating the virtual machine's current number of tracked connections. By continuously monitoring the current number of tracked connections, the latest status of the virtual machine's network connections can be monitored. Finally, based on the current number of tracked connections, two criteria are used to determine the current number of tracked connections: first, by comparing it with the initial limit, and second, by comparing it with the dynamic threshold range. Depending on the relationship between these two values, corresponding warning events are executed. If the current number of tracked connections slightly exceeds the initial limit but remains below the upper limit of the dynamic threshold, a minor warning event is triggered. If the current number of tracked connections exceeds both the initial limit and the upper limit of the dynamic threshold, a major warning event is triggered. This technical solution solves the problem of inability to implement real-time monitoring and intelligent warnings for the number of virtual machine connection tracking. Furthermore, by setting initial connection limits and dynamic thresholds for virtual machine interfaces based on resource requirements and historical data analysis, the number of network connections can be monitored and intelligently determined in real time, thereby providing intelligent warnings of abnormal situations.

[0031] In an exemplary embodiment, a tracking connection limit number in an initial state is configured for a binding interface of a target virtual machine, and a dynamic threshold range is determined based on the tracking connection limit number in the initial state, including: determining an upper limit of the dynamic threshold range by multiplying the tracking connection limit number in the initial state by a first threshold, and determining a lower limit of the dynamic threshold range by multiplying the tracking connection limit number in the initial state by a second threshold; and determining the dynamic threshold range based on the upper limit and the lower limit of the dynamic threshold range.

[0032] Optionally, based on historical data and business forecasts, the initial tracking connection limit for the virtual machine processing order and payment requests is set to 5000. Taking into account traffic fluctuations and business needs, the first threshold is set to 1.1 (10% of the initial limit), and the second threshold is set to 0.9 (10% of the initial limit). Multiplying the initial tracking connection limit of 5000 by the first threshold of 1.1 yields an upper limit of the dynamic threshold range of 5000 * 1.1 = 5500. Multiplying the initial tracking connection limit of 5000 by the second threshold of 0.9 yields a lower limit of the dynamic threshold range of 5000 * 0.9 = 4500.

[0033] By setting dynamic thresholds through the above process, we can effectively prevent VM resource abuse, such as surges in connection numbers caused by abnormal traffic or attacks, thereby ensuring the stability and security of the cloud environment. The upper limit of the dynamic threshold provides a clear boundary for early warning and action, while the lower limit ensures that even during low traffic, the VM maintains a certain level of connection processing capacity, avoiding resource waste.

[0034] In an exemplary embodiment, the current tracking connection number of the binding interface is determined based on the network data packet received by the binding interface, including: parsing the network data packet to parse out the five-tuple information included in the network data packet; determining whether there is a connection record corresponding to the five-tuple information in the connection tracking table maintained by the connection tracking area; if not, creating a connection record corresponding to the five-tuple information in the connection tracking table to obtain an updated connection tracking table; if exists, updating the tracking connection number in the connection record corresponding to the five-tuple information according to the five-tuple information to obtain an updated connection tracking table; and obtaining the current connection tracking number of the binding interface in the updated connection tracking table.

[0035] Optionally, when the network interface of the virtual machine receives a network data packet, OVS first intercepts and parses the data packet. OVS extracts the five-tuple information (source IP address, source port, destination IP address, destination port and transport layer protocol) in the data packet according to the pre-set flow table rules. The parsed five-tuple information is passed to the kernel's ct_zone module. Based on this information, the ct_zone module searches the connection tracking table it maintains to see if there is a corresponding connection record. If it does not exist, a new connection tracking record is created and its status is marked as the initial state; if it exists, the relevant information of the connection tracking record is updated, such as the activity of the connection, data transmission volume, etc. The tracking module periodically (for example, every 1 second) queries the connection tracking table in the ct_zone module to obtain the current actual number of connections of the virtual machine.

[0036] In summary, the above implementation simplifies the complexity of network connection management by parsing data packets and updating connection status. Maintaining a connection tracking table allows for the detection of unusual changes in the number of connections, such as a sudden surge in connection requests. This helps identify potential network security issues and enable the implementation of appropriate defensive measures.

[0037] In an exemplary embodiment, whether to execute a warning event is determined based on a first size relationship between the current number of tracking connections and the tracking connection limit in the initial state, and a second size relationship between the current number of tracking connections and the dynamic threshold range, including: when the first size relationship indicates that the current number of tracking connections is greater than the tracking connection limit in the initial state, and the second size relationship indicates that the current number of tracking connections is less than the upper limit of the dynamic threshold range, executing the first warning event; wherein the first warning event includes at least one of the following: lighting up the minor over-limit warning indicator corresponding to the target virtual machine in the management interface, and recording information that the current number of tracking connections of the target virtual machine exceeds the limit.

[0038] Alternatively, on a cloud platform, VM A's initial tracking connection limit is set to 4000, with a dynamic threshold range of [3600, 4400] (±10% fluctuation). Due to an increase in VM A's traffic, the current number of tracking connections reaches 4100, exceeding the initial limit of 4000 but not yet reaching the upper dynamic threshold of 4400. On the VM management interface of the cloud platform, VM A's status bar turns yellow, and the Minor Limit Exceeded warning indicator illuminates. A Minor Limit Exceeded warning message appears: "Current number of connections 4100, exceeding the limit of 4000 but not reaching the upper limit of 4400," alerting the administrator. The log file also records the time, VM ID, and the Minor Limit Exceeded warning message (e.g., "Current number of tracking connections 4100, exceeding the limit of 4000, recommends checking network traffic and application behavior").

[0039] In summary, the above implementation method, through the early warning and response mechanism, the cloud platform can promptly identify and handle situations where the number of connections exceeds the limit slightly, effectively preventing potential risks, while ensuring the continuity and stability of user services.

[0040] In an exemplary embodiment, determining whether to execute an early warning event is based on a first size relationship between the current number of traced connections and the limit number of traced connections in an initial state, and a second size relationship between the current number of traced connections and a dynamic threshold range. The determination includes: when the first size relationship indicates that the current number of traced connections is greater than the limit number of traced connections in the initial state, and the second size relationship indicates that the current number of traced connections is greater than an upper limit of the dynamic threshold range, executing a second early warning event; wherein the second early warning event includes at least one of the following: sending an emergency early warning notification to an online administrator, initiating a security check process for a target virtual machine, and suspending all network interfaces of the target virtual machine.

[0041] Alternatively, on an enterprise cloud platform, VM C's initial tracking connection limit is 4000, with a dynamic threshold range of [3600, 4400]. Due to a network attack on VM C, the current number of tracked connections rises sharply to 4500, and then quickly increases to 5000, significantly exceeding the upper limit of the dynamic threshold range. At this point, a second alert event is executed, sending an emergency alert notification to the online administrator via the cloud platform's instant messaging system. The notification reads: "The current number of tracked connections for VM C (ID: 321654) is 5000, far exceeding the upper limit of the dynamic threshold of 4400. Please check and take action immediately." Simultaneously, a security check is initiated for VM C, including analyzing network traffic, checking firewall logs, and detecting intrusion signs to determine the specific type and source of the attack. After the security check initially determines that VM C is under a distributed denial of service (DDoS) attack, all network interfaces of VM C are automatically suspended, blocking new connection requests and protecting the cloud environment from further resource abuse.

[0042] In the above implementation, the second warning event can trigger an immediate and effective response in the event of a serious over-limit situation. Through diversified warnings and targeted security measures, security risks are quickly controlled, ensuring the overall security and stable operation of the cloud environment.

[0043] In an exemplary embodiment, after configuring the tracking connection limit number in the initial state for the binding interface of the target virtual machine, the above method also includes: increasing the tracking connection limit number in the initial state when it is detected that the CPU usage of the physical server where the target virtual machine is located continues to exceed the third threshold, the difference between the actual number of connections of the target virtual machine and the upper limit of the dynamic threshold range within the target time period is less than the fourth threshold, and the business volume of the target virtual machine is in an increasing state.

[0044] Optionally, a virtual machine is used to handle viewer viewing requests and interactive comments. Before the live broadcast began, the administrator configured an initial tracking connection limit of 3,000 connections for the virtual machine's network interface, with a dynamic threshold range of 2,700 to 3,300 connections. After the live broadcast began, the number of viewers rapidly increased, and the resulting viewing requests and interactive comments caused the actual number of connections on the virtual machine to quickly increase to nearly 3,300. The cloud platform management system continuously monitored the CPU usage of the physical server hosting the virtual machine and found that it had consistently exceeded 80% (assuming the third threshold was 75%) shortly after the live broadcast began, indicating that server resources were approaching saturation. The difference between the actual number of connections and the upper limit of the dynamic threshold was less than 300 (assuming the fourth threshold was 10% of the upper limit), and based on the analysis of viewer growth trends before the live broadcast, traffic was showing significant growth. At this point, the initial tracking connection limit for the virtual machine needed to be increased. First, a new tracking connection limit was calculated, raising the initial limit from 3,000 to 3,600. Then, the dynamic threshold is recalculated based on the new tracking connection limit number, with the lower limit being (3600*(1-10%))=3240 and the upper limit being (3600*(1+10%))=3960.

[0045] In summary, the above embodiment not only enhances the resource management capability of the cloud environment by dynamically adjusting the tracking connection limit, but also ensures timely response and optimization of virtual machine performance when business volume surges, while maintaining system stability and security.

[0046] In an exemplary embodiment, after configuring the tracking connection limit number in the initial state for the binding interface of the target virtual machine, the above method also includes: reducing the tracking connection limit number in the initial state when it is detected that the CPU usage of the physical server where the target virtual machine is located does not continuously exceed the third threshold, the difference between the actual number of connections of the target virtual machine and the upper limit of the dynamic threshold range within the target time period is greater than the fourth threshold, and the business volume of the target virtual machine is in a declining state.

[0047] Alternatively, an online education platform's virtual machine usage significantly decreased during the holiday. The administrator configured an initial tracking connection limit of 5,000 connections for the virtual machine's network interface, with a dynamic threshold set between 4,500 and 5,500 connections to accommodate the high concurrent user access during normal working days. On the second day of the holiday, the CPU utilization of the physical server hosting the virtual machine did not exceed 45% (assuming the third threshold is 50%) throughout the day. This indicates that the server has sufficient processing capacity and does not require a high connection limit. The actual number of connections for the virtual machine during the target time period (e.g., the past 24 hours) averaged 3,500, a difference of 2,000 from the upper limit of the dynamic threshold of 5,500, significantly exceeding the fourth threshold (for example, the fourth threshold could be set at 5% of the upper limit, or 275 connections). Analysis of user login data and course participation confirmed that the virtual machine's traffic volume had significantly decreased compared to a normal working day. In this case, the initial tracking connection limit for the virtual machine needs to be lowered. First, a new tracking connection limit is calculated, lowering the initial tracking connection limit from 5,000 to 4,000. Then, the dynamic threshold is recalculated based on the new tracking connection limit number, with the lower limit being (4000*(1-10%))=3600 and the upper limit being (4000*(1+10%))=4400.

[0048] In summary, the above implementation method can not only adapt to changes in business needs by dynamically adjusting the number of tracking connection limits, but also find the best balance between resource utilization and cost control, while ensuring the security and stable operation of the system.

[0049] In order to facilitate understanding of the implementation methods of the present application, relevant scenarios are now explained, but this does not limit the present application.

[0050] In related technologies, the connection tracking number monitoring method is often not accurate and timely enough. It cannot monitor the connection status of the virtual machine in real time, cannot dynamically adjust the limit threshold, and cannot issue effective warnings when the virtual machine connection tracking number is about to exceed a reasonable range, making it difficult for administrators to take timely measures to deal with potential risks.

[0051] In order to avoid the occurrence of the above-mentioned problems, as an optional implementation method, an optional embodiment of the present application proposes a method for limiting the number of connection tracking of virtual machines in a cloud environment. Based on an open source virtual switch and kernel support for connection tracking areas, effective limitation of the number of tracking connections of interfaces bound to virtual machines is achieved. When the actual number of tracking connections of the virtual machine exceeds the configured number of tracking connections, a tracking connection number warning is issued in time to remind the user that the current number of tracking connections of the virtual machine is large and to check whether there is a risk of attack. At the same time, a dynamic threshold is adopted, and the set threshold fluctuates by 10% to improve the flexibility and adaptability of limiting the number of connection tracking of virtual machines in the cloud environment and ensure the stable operation of the cloud environment.

[0052] Optional, Figure 3 This is a system architecture diagram of a method for limiting the number of virtual machine connection tracking in a cloud environment according to an embodiment of the present application. Figure 3 The system includes: a configuration module 32, a tracking module 34, a judgment module 36, an early warning module 38, and an adjustment module 40;

[0053] Optionally, a configuration module 32 is configured to configure an initial limit on the number of tracked connections for each interface bound to a virtual machine based on OVS and the kernel, setting a dynamic threshold fluctuation range of 10% and a basic threshold of no less than 3000. This configuration module interacts with the cloud environment management system and the virtual machine configuration file to write the configuration information to the corresponding location, ensuring that the virtual machine can limit the number of connection tracking according to the set parameters during startup and operation.

[0054] Optionally, the tracking module 34 utilizes OVS and the kernel's support for ct_zone to track the actual number of virtual machine connections in real time. It includes the OVS data packet parsing component and the kernel's ct_zone tracking component, which work together to accurately obtain and record the virtual machine's network connection status information.

[0055] Optionally, a judgment module 36 compares the actual number of virtual machine connections obtained through real-time tracking with the configured tracking connection limit and dynamic threshold. This judgment module uses efficient algorithms and logical judgment to quickly and accurately determine whether the actual number of connections exceeds the set range, providing a basis for early warning and dynamic adjustment.

[0056] Optionally, the early warning module 38 issues an early warning when the actual number of traced connections for a virtual machine exceeds the configured number of traced connections and the upper limit of a dynamic threshold. The early warning module is connected to multiple early warning channels (such as a management system interface, an email server, and an SMS gateway) to promptly communicate early warning information to users.

[0057] Optionally, adjustment module 40 dynamically adjusts the tracking connection limit and dynamic threshold based on the real-time operating status of the cloud environment and the business needs of the virtual machine. The adjustment module analyzes various information, such as resource usage in the cloud environment, performance indicators of the virtual machine, and user business requests, to achieve reasonable adjustments to the tracking connection limit and dynamic threshold.

[0058] Optional, Figure 4 This is a flow chart for limiting the number of virtual machine connection tracking in a cloud environment according to an embodiment of the present application, which specifically includes the following steps:

[0059] Step 1: Initialize the configuration. In a cloud environment, based on OVS and the kernel, configure an initial limit on the number of tracked connections for each VM's bound interface. Set the dynamic threshold's upper and lower fluctuation range to 10%, and set a base threshold of no less than 3,000.

[0060] Optionally, if the basic threshold is set to 3000, the lower limit of the dynamic threshold is 3000*(1-10%)=2700, and the upper limit is 3000*(1+10%)=3300.

[0061] Optionally, the administrator enters the virtual machine configuration page through the management interface of the cloud platform. On this page, for each virtual machine, select the binding interface for which the connection tracking number limit is required. In the configuration interface, enter the initial tracking connection limit, for example, set it to 5000. At the same time, based on the rule that the basic threshold is not less than 3000 and the fluctuation is 10%, the lower limit of the dynamic threshold is calculated to be (5000*(1-10%))=4500, and the upper limit is (5000*(1+10%))=5500. The configuration module stores this configuration information in the cloud platform database and the configuration file corresponding to the virtual machine to ensure that the virtual machine can read the correct configuration parameters during startup and operation.

[0062] Step 2: Connection tracking. Leveraging OVS and the kernel's support for ct_zone, the actual number of connections in a virtual machine is tracked in real time. Specifically, when a network data packet enters a virtual machine, OVS parses the data packet according to pre-set rules, extracting relevant connection information (such as source IP address, source port, destination IP address, destination port, and transport layer protocol), and passes this information to the kernel's ct_zone module, which then tracks and records the connection.

[0063] Optionally, when the network interface of the virtual machine receives a network data packet, OVS first intercepts and parses the data packet. OVS extracts the five-tuple information (source IP address, source port, destination IP address, destination port and transport layer protocol) in the data packet according to the pre-set flow table rules. The parsed five-tuple information is passed to the kernel's ct_zone module. Based on this information, the ct_zone module searches the connection tracking table it maintains to see whether there is a corresponding connection record. If it does not exist, a new connection tracking record is created and its status is marked as the initial state; if it exists, the relevant information of the connection tracking record is updated, such as the activity of the connection, data transmission volume, etc. The tracking module periodically (for example, every 1 second) queries the connection tracking table in the ct_zone module to obtain the current actual number of connections of the virtual machine, and stores the data in the cache area in the memory so that the subsequent judgment module can quickly read and process it.

[0064] Step 3: Threshold determination. The actual number of VM connections tracked in real time is compared with the configured tracking connection limit and the dynamic threshold. If the actual number of connections exceeds the configured tracking connection limit and the upper limit of the dynamic threshold, the next warning step is executed. If the actual number of connections is within the dynamic threshold, connection tracking and determination continue.

[0065] Optionally, the judgment module periodically reads the actual number of connections of the virtual machine from the cache area (for example, every 5 seconds). The actual number of connections is compared with the configured tracking connection limit (such as 5000) and the dynamic threshold (lower limit 4500, upper limit 5500). If the actual number of connections is less than or equal to the upper limit of the dynamic threshold (i.e., less than or equal to 5500), the judgment module does not perform any operation and continues to wait for the next data reading and judgment; if the actual number of connections is greater than the configured tracking connection limit (5000) and greater than the upper limit of the dynamic threshold (5500), the warning module is triggered to issue a warning.

[0066] Optional, dynamic threshold mechanism and intelligent early warning strategy allow the number of connections to remain within the normal business fluctuation range (±10%) without triggering an alarm, reducing false alarms. Only when the number of connections exceeds the basic threshold and the dynamic upper limit at the same time will it be judged as an abnormality (such as a DDoS attack).

[0067] Step 4: Warning: When the actual number of tracking connections of the virtual machine exceeds the configured number of tracking connections and exceeds the upper limit of the dynamic threshold, a tracking connection number warning is issued.

[0068] Optionally, the warning method can usually take various forms, such as sending a warning message to the cloud platform management system, displaying a prominent prompt message on the management interface, or notifying the user through email, text message, etc., reminding the user that the current virtual machine has a large number of tracking connections and checking whether there is a risk of attack.

[0069] Optionally, when the judgment module triggers an early warning, the early warning module will first send an early warning message to the interface of the cloud platform management system. On the interface of the cloud platform management system, the corresponding virtual machine entry will be displayed in red, and a prompt box will pop up, displaying the words "The number of tracking connections of the virtual machine [virtual machine name] has exceeded the limit, please check whether there is an attack risk." At the same time, the early warning module sends an early warning email to the pre-configured administrator email address. The email content includes detailed information such as the name of the virtual machine, IP address, current actual number of connections, configured tracking connection limit, and dynamic threshold, so that the administrator can fully understand the situation and perform subsequent processing. In addition, the early warning module can also send SMS warnings to the administrator's mobile phone through integration with the SMS gateway. The SMS content briefly describes the abnormal number of virtual machine connection tracking, ensuring that the administrator can receive the information in time and know the problem even if he is not in front of the computer.

[0070] Step 5: Dynamic Adjustment. Dynamically adjust the connection limit and dynamic threshold based on the real-time operating status of the cloud environment and the business needs of the VMs. For example, if a VM's traffic suddenly increases, requiring more connections, its connection limit and dynamic threshold can be appropriately increased. Conversely, if the VM's traffic decreases, the corresponding values ​​can be lowered. During this adjustment, the dynamic threshold should remain within a 10% fluctuation range, never falling below the base threshold of 3,000.

[0071] An optional multi-level linkage early warning and response mechanism first determines whether the basic threshold is exceeded, then checks whether the dynamic upper limit is exceeded, and adjusts the threshold in real time based on the dynamic tuning capabilities at runtime and the changes in the virtual machine business load, while maintaining a ±10% floating rule.

[0072] Optionally, the adjustment module monitors various performance indicators and service data in the cloud platform to determine whether to adjust the tracking connection limit and dynamic threshold. For example, if the CPU utilization of the physical server hosting a virtual machine consistently exceeds 80%, the actual number of connections for the virtual machine remains high for a period of time (e.g., approaching or exceeding the upper limit of the dynamic threshold), and the service volume of the virtual machine continues to grow, the adjustment module determines that the tracking connection limit for the virtual machine needs to be increased. The adjustment module first calculates a new tracking connection limit, for example, raising the original limit from 5,000 to 6,000. Based on the new tracking connection limit, the dynamic threshold is recalculated, with a lower limit of 5,400 (6,000 * (1-10%)) and an upper limit of 6,600 (6,000 * (1+10%)). The adjustment module updates the new configuration information to the cloud platform database and the virtual machine's configuration file, and notifies relevant modules (such as the tracking module and the judgment module) to operate according to the new configuration parameters. During the configuration update process, the adjustment module ensures that the network connection of the virtual machine is not affected. It gradually applies the new configuration parameters through a smooth transition to avoid network anomalies caused by sudden parameter changes.

[0073] In summary, this application leverages OVS and kernel support for ct_zone to implement VM connection tracking limit. This leverages existing technologies, avoids code redundancy and performance degradation caused by repeated development of connection tracking mechanisms, and improves system stability and maintainability. By setting dynamic thresholds, with fluctuations of 10% or more and no less than 3,000, limiting VM connection tracking limits is more flexible and intelligent, adapting to diverse business scenarios and cloud environment changes. Dynamic thresholds can avoid unnecessary warnings when VM traffic fluctuates normally, while providing timely warnings when abnormal connection growth occurs, alerting users to potential attack risks. This timely connection tracking warning feature helps users quickly identify potential VM security issues and take timely action, such as checking network traffic and troubleshooting attack sources. This ensures the secure and stable operation of VMs in cloud environments and reduces service interruptions and data loss caused by attacks or abnormal connections.

[0074] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0075] This embodiment also provides a system for executing early warning events. This system is used to implement the above-mentioned embodiments and preferred embodiments, and the details already described will not be repeated. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0076] Figure 5 is a structural block diagram of an execution device for a warning event according to an embodiment of the present application, such as Figure 5 As shown, the device includes:

[0077] A first determining module 52 is configured to configure a tracking connection limit number in an initial state for the binding interface of the target virtual machine, and determine a dynamic threshold range according to the tracking connection limit number in the initial state;

[0078] A second determining module 54 is configured to determine the current number of tracked connections of the binding interface according to the network data message received by the binding interface;

[0079] The third determining module 56 is configured to determine whether to execute a warning event based on a first size relationship between the current number of traced connections and the traced connection limit in the initial state, and a second size relationship between the current number of traced connections and the dynamic threshold range.

[0080] Through the above-described device, an initial tracking connection limit is configured for each target virtual machine's bound interface. Based on the initial tracking connection limit, a dynamic threshold range is determined, typically fluctuating by a certain percentage (e.g., 10%) around the initial value to accommodate normal fluctuations in virtual machine traffic and avoid frequent false alarms. Next, network data packets received by the virtual machine's bound interface are parsed and tracked in real time, extracting relevant connection information (such as source IP, destination IP, port number, etc.), and updating the virtual machine's current tracking connection count. By continuously monitoring the current tracking connection count, the latest status of the virtual machine's network connections can be monitored. Finally, based on the current tracking connection count, two criteria are used for judgment: first, comparison with the initial tracking connection limit, and second, comparison with the dynamic threshold range. Depending on the relationship between these two values, corresponding warning events are executed. If the current tracking connection count slightly exceeds the initial limit but remains below the upper limit of the dynamic threshold, a minor warning event is triggered. If the current tracking connection count not only exceeds the initial limit but also exceeds the upper limit of the dynamic threshold, a major warning event is triggered. The above-described technical solution solves the problem of inability to implement real-time monitoring and intelligent warning of the number of virtual machine connection tracking. Furthermore, by setting initial connection limits and dynamic thresholds for virtual machine interfaces based on resource requirements and historical data analysis, the number of network connections can be monitored and intelligently determined in real time, thereby providing intelligent warnings of abnormal situations.

[0081] In an exemplary embodiment, the first determining module is further configured to determine an upper limit of the dynamic threshold range by multiplying the number of trace connection limits in the initial state by a first threshold, and to determine a lower limit of the dynamic threshold range by multiplying the number of trace connection limits in the initial state by a second threshold; and to determine the dynamic threshold range based on the upper limit and the lower limit of the dynamic threshold range.

[0082] In an exemplary embodiment, the above-mentioned second determination module is also used to parse the network data packet to parse out the five-tuple information included in the network data packet; determine whether there is a connection record corresponding to the five-tuple information in the connection tracking table maintained by the connection tracking area; if not, create a connection record corresponding to the five-tuple information in the connection tracking table to obtain an updated connection tracking table; if exists, update the number of tracking connections in the connection record corresponding to the five-tuple information according to the five-tuple information to obtain an updated connection tracking table; obtain the current connection tracking number of the bound interface in the updated connection tracking table.

[0083] In an exemplary embodiment, the above-mentioned third determination module is also used to execute a first warning event when the first size relationship indicates that the current number of tracking connections is greater than the tracking connection limit number in the initial state, and the second size relationship indicates that the current number of tracking connections is less than the upper limit of the dynamic threshold range; wherein, the first warning event includes at least one of the following: lighting up the minor over-limit warning indicator corresponding to the target virtual machine in the management interface, and recording information that the current number of tracking connections of the target virtual machine exceeds the limit.

[0084] In an exemplary embodiment, the third determination module is further configured to execute a second warning event when the first size relationship indicates that the current number of traced connections is greater than the traced connection limit in the initial state, and the second size relationship indicates that the current number of traced connections is greater than the upper limit of the dynamic threshold range; wherein the second warning event includes at least one of the following: sending an emergency warning notification to an online administrator, initiating a security check process for the target virtual machine, and suspending all network interfaces of the target virtual machine.

[0085] In an exemplary embodiment, the above-mentioned device also includes: an adding module for configuring the tracking connection limit number in the initial state for the binding interface of the target virtual machine, and then increasing the tracking connection limit number in the initial state when it is detected that the CPU usage of the physical server where the target virtual machine is located continues to exceed the third threshold, the difference between the actual number of connections of the target virtual machine and the upper limit of the dynamic threshold range within the target time period is less than the fourth threshold, and the business volume of the target virtual machine is in a growing state.

[0086] In an exemplary embodiment, the above-mentioned device also includes: a reduction module, which is used to configure the tracking connection limit number in the initial state for the binding interface of the target virtual machine. The method also includes: when it is detected that the CPU usage of the physical server where the target virtual machine is located does not continuously exceed the third threshold, the difference between the actual number of connections of the target virtual machine and the upper limit of the dynamic threshold range within the target time period is greater than the fourth threshold, and the business volume of the target virtual machine is in a declining state, reducing the tracking connection limit number in the initial state.

[0087] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above method embodiments when run.

[0088] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0089] An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0090] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0091] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0092] An embodiment of the present application further provides another computer program product, comprising a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above method embodiments are implemented.

[0093] An embodiment of the present application further provides a computer program, which includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of any of the above method embodiments.

[0094] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0095] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0097] The above is a detailed introduction to the execution method, device, storage medium and electronic device of a warning event provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for executing a warning event, characterized in that: include: Configuring a limit number of trace connections in an initial state for the binding interface of the target virtual machine, and determining a dynamic threshold range based on the limit number of trace connections in the initial state; Determining a current tracking connection number of the binding interface according to the network data message received by the binding interface; Whether to execute an early warning event is determined according to a first size relationship between the current number of traced connections and the traced connection limit in the initial state, and a second size relationship between the current number of traced connections and the dynamic threshold range.

2. The method for executing a warning event according to claim 1, characterized in that: Configuring an initial tracking connection limit for the bound interface of the target virtual machine and determining a dynamic threshold range based on the initial tracking connection limit includes: determining an upper limit of the dynamic threshold range by multiplying the number of trace connection limits in the initial state by a first threshold, and determining a lower limit of the dynamic threshold range by multiplying the number of trace connection limits in the initial state by a second threshold; The dynamic threshold range is determined according to an upper limit of the dynamic threshold range and a lower limit of the dynamic threshold range.

3. The method for executing a warning event according to claim 1, characterized in that: Determining the current number of tracked connections of the binding interface according to the network data message received by the binding interface includes: Parsing the network data message to parse out quintuple information included in the network data message; Determining whether there is a connection record corresponding to the five-tuple information in the connection tracking table maintained by the connection tracking area; If the five-tuple information does not exist, create a connection record corresponding to the five-tuple information in the connection tracking table to obtain an updated connection tracking table; if the five-tuple information does exist, update the number of tracked connections in the connection record corresponding to the five-tuple information according to the five-tuple information to obtain an updated connection tracking table; The current connection tracking number of the bound interface is obtained in the updated connection tracking table.

4. The method for executing a warning event according to claim 1, characterized in that: Determining whether to execute a warning event according to a first size relationship between the current number of traced connections and the traced connection limit in the initial state, and a second size relationship between the current number of traced connections and the dynamic threshold range, includes: When the first size relationship indicates that the current number of tracked connections is greater than the tracked connection limit in the initial state, and the second size relationship indicates that the current number of tracked connections is less than the upper limit of the dynamic threshold range, a first warning event is executed; wherein the first warning event includes at least one of the following: lighting up a minor over-limit warning indicator corresponding to the target virtual machine on the management interface, and recording information that the current number of tracked connections of the target virtual machine exceeds the limit.

5. The method for executing a warning event according to claim 1, characterized in that: Determining whether to execute a warning event according to a first size relationship between the current number of traced connections and the traced connection limit in the initial state, and a second size relationship between the current number of traced connections and the dynamic threshold range, includes: When the first size relationship indicates that the current number of tracked connections is greater than the tracked connection limit in the initial state, and the second size relationship indicates that the current number of tracked connections is greater than the upper limit of the dynamic threshold range, a second warning event is executed; wherein the second warning event includes at least one of the following: sending an emergency warning notification to an online administrator, initiating a security check process for the target virtual machine, and suspending all network interfaces of the target virtual machine.

6. The method for executing a warning event according to claim 1, characterized in that: After configuring the tracking connection limit in the initial state for the binding interface of the target virtual machine, the method further includes: When it is detected that the CPU usage of the physical server where the target virtual machine is located continues to exceed the third threshold, the difference between the actual number of connections of the target virtual machine and the upper limit of the dynamic threshold range within the target time period is less than the fourth threshold, and the business volume of the target virtual machine is in an increasing state, the tracking connection limit number in the initial state is increased.

7. The method for executing a warning event according to claim 1, characterized in that: After configuring the tracking connection limit in the initial state for the binding interface of the target virtual machine, the method further includes: When it is detected that the CPU usage of the physical server where the target virtual machine is located does not continuously exceed the third threshold, the difference between the actual number of connections of the target virtual machine and the upper limit of the dynamic threshold range within the target time period is greater than the fourth threshold, and the business volume of the target virtual machine is in a declining state, the tracking connection limit number in the initial state is reduced.

8. A device for executing a warning event, characterized in that: include: A first determining module is configured to configure a tracking connection limit number in an initial state for a binding interface of a target virtual machine, and determine a dynamic threshold range according to the tracking connection limit number in the initial state; A second determining module, configured to determine the current tracking connection number of the binding interface according to the network data message received by the binding interface; The third determining module is configured to determine whether to execute a warning event based on a first size relationship between the current number of traced connections and the traced connection limit in the initial state, and a second size relationship between the current number of traced connections and the dynamic threshold range.

9. An electronic device, characterized in that: include: memory for storing computer programs; A processor is configured to implement the steps of the method for executing a warning event according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method for executing a warning event according to any one of claims 1 to 7 are implemented.

Images