Memory transaction detection method and device and electronic equipment

Abstract

The invention discloses a memory transaction detection method and device and electronic equipment. The method comprises the following steps: acquiring an object relation graph of a node to be monitored in a virtual machine; the memory usage amount in the object relation graph is converted into dominated memory usage amount through a dominated memory quantification model, and a memory usage statistical table of the to-be-monitored node is determined according to the dominated memory usage amount; generating a global memory use wide table of the to-be-monitored node according to the memory use statistical table, the node dimension table and the type dimension table; the global memory use wide table is detected through a contribution analysis algorithm, a memory transaction detection result is obtained, and the contribution analysis algorithm analyzes the influence degree of code change information on memory use of the to-be-monitored node by introducing surprise factors. According to the method and the device, the technical problems of low efficiency and delay caused by incapability of effectively identifying and quantifying an implicit relationship between objects in memory use and neglecting the influence of code change time on memory stability in a memory monitoring method in the related technology are solved.

Description

Technical Field

[0001] This application relates to the field of system monitoring and data analysis, and more specifically, to a method, apparatus, and electronic device for detecting memory anomalies. Background Technology

[0002] In the field of system monitoring and data analysis, especially in distributed application environments based on the JVM (Java Virtual Machine), memory monitoring technology faces a series of challenges. JVM memory monitoring methods, such as non-intrusive monitoring using Java Agents combined with dynamic bytecode enhancement technologies (e.g., frameworks like ASM or ByteBuddy), and memory information monitoring provided through memory snapshots using local monitoring tools (e.g., JProfiler or VisualVM), have become standard industry practices. These tools and technologies can collect object creation and destruction events, calculate the memory usage of each type of object, and even provide multi-dimensional attribute acquisition based on threads and class loaders.

[0003] However, these standard monitoring methods fall short in identifying the root causes of memory leaks. This is because they rely too heavily on statistics of an object's physical memory usage, failing to delve into the impact of implicit references between objects on memory growth. For example, while the growth of an object P may seem negligible, the accumulated memory of its many child objects C can lead to a surge in global memory usage, a phenomenon often overlooked by traditional methods. This is akin to a tree in a forest appearing healthy, but the soil beneath its roots is quietly eroding; traditional monitoring techniques cannot detect this hidden "soil erosion"—the memory growth caused by implicit dominance relationships between objects.

[0004] Furthermore, most existing memory analysis models focus on directly collected basic attributes, such as object type and thread, while neglecting the crucial factor of code version. In reality, every code commit, especially the addition of new features or bug fixes, can alter memory usage patterns, profoundly impacting memory stability. However, monitoring methods in related technologies do not consider the influence of code changes on memory anomalies, often leading to blind diagnosis of memory problems.

[0005] Furthermore, while time series analysis algorithms with high accuracy and sensitivity can provide more refined monitoring results, their complex statistical calculations can lead to high computational costs in ultra-large systems. This is especially true in continuous integration and continuous deployment (CI / CD) environments, where frequent code updates require faster analysis speeds, but existing algorithms cannot meet this demand, resulting in a waste of computing resources.

[0006] There is currently no effective solution to the above problems. Summary of the Invention

[0007] This application provides a memory anomaly detection method, apparatus, and electronic device to at least solve the technical problems of inefficiency and sluggishness caused by the inability of memory monitoring methods in related technologies to effectively identify and quantify implicit relationships between objects in memory use and to ignore the impact of code change time on memory stability.

[0008] According to one aspect of the embodiments of this application, a memory anomaly detection method is provided, comprising: acquiring an object relationship graph of a node to be monitored in a virtual machine, wherein the object relationship graph is used to record object reference relationships in the node to be monitored and the type, thread, and memory usage of each object; converting the memory usage in the object relationship graph into dominant memory usage through a dominant memory quantization model, and determining a memory usage statistics table of the node to be monitored based on the dominant memory usage, wherein the dominant memory quantization model is used to quantify the contribution of each object in the object relationship graph to memory usage, and the dominant memory usage is used to reflect the influence of object reference relationships on memory usage; generating a global memory usage wide table of the node to be monitored based on the memory usage statistics table, a node dimension table, and a type dimension table, wherein the node dimension table is used to record node information of the node to be monitored, and the type dimension table is used to record code change information of the node to be monitored; and detecting the global memory usage wide table through a contribution analysis algorithm to obtain the memory anomaly detection result of the node to be monitored, wherein the contribution analysis algorithm introduces a surprise factor to analyze the influence of code change information on the memory usage of the node to be monitored, and the surprise factor is used to adjust the weight of code change information in memory anomaly detection.

[0009] Optionally, the object relationship diagram is determined as follows: a monitoring channel corresponding to the node to be monitored is determined through a preset remote management protocol, wherein the preset remote management protocol provides multiple interfaces for querying and modifying the running status of the node to be monitored; a preset agent program file is sent to the node to be monitored through the monitoring channel, and the preset agent program file is loaded through the target interface in the preset remote management protocol, wherein the preset agent program file is used to monitor the internal object activities of the node to be monitored, and the target interface is the interface in the preset remote management protocol that allows external entities to access and control the node to be monitored; during the class loading phase of the preset agent program file, bytecode enhancement technology is used to monitor the node to be monitored, and object lifecycle events in the node to be monitored are obtained through acquisition probes, wherein the object lifecycle includes the object reference relationships in the node to be monitored and the type, thread, and memory usage of each object; an object relationship diagram is generated based on the object lifecycle events.

[0010] Optionally, the memory usage in the object relationship graph is transformed into dominant memory usage through a dominant memory quantification model, including: determining the dominant relationships in the object relationship graph through a dominant algorithm in the dominant memory quantification model, and determining the dominant tree corresponding to the object relationship graph based on the dominant relationships, wherein the dominant algorithm is used to analyze the object reference relationships in the object relationship graph, and the dominant tree is used to reflect the dominant relationships between objects in the node to be monitored; determining the dominant memory usage of each object in the dominant tree through an objective function in the dominant memory quantification model, wherein the objective function quantifies the influence of the dominant relationship on the memory usage of the node to be monitored through a dominant relationship decay factor and a dominant cost amplification function, wherein the dominant relationship decay factor is used to simulate the indirectness and decay effect of the dominant relationship, and the dominant cost amplification function is used to quantify and amplify the additional memory and computational cost when an object in the node to be monitored dominates a sub-object.

[0011] Optionally, the dominant memory usage of each object in the dominance tree is determined by the objective function in the dominant memory quantification model, including: determining the target memory usage and leaf node weights of the target object in the dominance tree, wherein the target object is any object in the dominance tree, and the leaf node weights are the basic weights of the target object's memory consumption; determining the dominance relationship decay factor and dominance cost amplification function for quantifying the memory usage of the node to be monitored; determining the objective function based on the target memory usage, leaf node weights, dominance relationship decay factor, and dominance cost amplification function, and determining the target dominant memory usage of the target object through the objective function.

[0012] Optionally, the memory usage statistics table of the node to be monitored is determined based on the amount of memory used, including: determining the target type and target thread of the target object; determining the memory usage sequence of the target object based on the target type, target thread and target amount of memory used; merging the memory usage sequences of all objects in the node to be monitored to obtain the memory usage statistics table of the node to be monitored.

[0013] Optionally, the type dimension table is determined by: obtaining the running code corresponding to the node to be monitored according to a preset time interval; determining the type information in the running code, and determining the module, commit number and commit date of the type information; and determining the type dimension table based on the type information, module, commit number and commit date.

[0014] Optionally, a contribution analysis algorithm is used to detect memory anomalies in the global memory usage wide table to obtain the memory anomaly detection results for the monitored node. This includes: determining the target similarity deviation of the global memory usage wide table using the contribution analysis algorithm, wherein the target similarity deviation reflects the degree of deviation between the behavior pattern of the multidimensional time series data in the global memory usage wide table at a preset time point and the historical behavior pattern; determining the surprise factor for detecting memory anomalies in the global memory usage wide table; determining the surprise value of the global memory usage wide table at a preset time point based on the target similarity deviation and the surprise factor, wherein the surprise value is a quantitative indicator for measuring the degree of anomalies in the global memory usage wide table; and determining the memory anomaly detection results based on the surprise value and a preset threshold, wherein if the surprise value is greater than the preset threshold, it is determined that there is memory anomaly in the monitored node.

[0015] Optionally, the method further includes: determining a detection time window for using a wide table to detect memory anomalies in global memory; resetting the detection time window if the memory anomaly detection results show that the monitored node has memory anomalies; and expanding the detection time window if the memory anomaly detection results obtained from a preset number of consecutive detections do not show that the monitored node has memory anomalies.

[0016] According to another aspect of the embodiments of this application, a memory anomaly detection device is also provided, comprising: an acquisition module, configured to acquire an object relationship graph of a node to be monitored in a virtual machine, wherein the object relationship graph is used to record object reference relationships in the node to be monitored and the type, thread, and memory usage of each object; and a quantization module, configured to convert the memory usage in the object relationship graph into dominant memory usage through a dominant memory quantization model, and determine a memory usage statistics table of the node to be monitored based on the dominant memory usage, wherein the dominant memory quantization model is used to quantify the contribution of each object in the object relationship graph to memory usage, and the dominant memory usage is used to reflect the object reference relationships. The module analyzes the impact of relationships on memory usage. A generation module generates a global memory usage table for the monitored nodes based on memory usage statistics, node dimension tables, and type dimension tables. The node dimension table records node information, and the type dimension table records code change information. A detection module uses a contribution analysis algorithm to detect memory anomalies in the global memory usage table, obtaining the detection results. The contribution analysis algorithm introduces a surprise factor to analyze the impact of code change information on memory usage of the monitored nodes, adjusting the weight of code change information in memory anomaly detection.

[0017] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and used to execute the above-described memory anomaly detection method.

[0018] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned memory anomaly detection method by running the computer program.

[0019] According to another aspect of the embodiments of this application, a computer program product is also provided, including computer instructions, which, when executed by a processor, implement the above-described memory anomaly detection method.

[0020] In this embodiment, an object relationship graph of the node to be monitored in the virtual machine is obtained. This graph records object reference relationships and the type, thread, and memory usage of each object within the monitored node. The memory usage in the object relationship graph is converted into dominant memory usage using a dominant memory quantification model. A memory usage statistics table for the monitored node is then determined based on this dominant memory usage. The dominant memory quantification model quantifies the contribution of each object in the object relationship graph to memory usage, and the dominant memory usage reflects the impact of object reference relationships on memory usage. A global memory usage wide table for the monitored node is generated based on the memory usage statistics table, the node dimension table, and the type dimension table. The node dimension table records node information, class... The dimension table is used to record code change information of the nodes to be monitored. The global memory usage wide table is detected by the contribution analysis algorithm to obtain the memory anomaly detection results of the nodes to be monitored. The contribution analysis algorithm introduces a surprise factor to analyze the impact of code change information on the memory usage of the nodes to be monitored. The surprise factor is used to adjust the weight of code change information in memory anomaly detection, so as to accurately identify and locate the root cause of virtual machine memory anomalies. This achieves the technical effect of effectively improving the efficiency and accuracy of memory monitoring in complex system environments. It also solves the technical problems of inefficiency and sluggishness caused by the inability of memory monitoring methods in related technologies to effectively identify and quantify the implicit relationships between objects in memory usage and to ignore the impact of code change time on memory stability. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0022] Figure 1 This is a hardware structure diagram of a computer terminal for implementing a memory anomaly detection method according to an embodiment of this application;

[0023] Figure 2 This is a flowchart of a memory anomaly detection method according to an embodiment of this application;

[0024] Figure 3 This is a flowchart of a method for generating a node memory usage statistics table according to an embodiment of this application;

[0025] Figure 4 This is a schematic diagram illustrating the changing trend of a surprise factor according to an embodiment of this application;

[0026] Figure 5 This is a structural diagram of a memory anomaly detection system according to an embodiment of this application;

[0027] Figure 6 This is a structural diagram of a memory anomaly detection device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] First, some nouns or terms that appear in the explanation of the embodiments of this application shall be interpreted as follows:

[0031] JVM (Java Virtual Machine): A virtual computer environment that runs Java bytecode. It provides a runtime environment that enables the execution of Java applications, allowing for hardware- and operating system-independent code execution.

[0032] JMX (Java Management Extensions) is a standard component of the Java platform used to monitor and manage applications running on the JVM. It provides a set of APIs that allow developers to access and manage various resources and performance metrics within the JVM in a unified manner.

[0033] Java Agent: A special JVM plugin that can be dynamically loaded when the JVM starts. It is used to modify the bytecode being executed by the JVM, thereby enabling the monitoring or modification of the JVM's internal activities.

[0034] Dominator Tree: A technique used to analyze program control flow graphs. Dominator trees are constructed using specific algorithms (such as Tarjan's or Lengauer-Tarjan's algorithms) to determine dominance relationships in program execution; that is, whether one basic block dominates another, implying that the dominant block has a certain degree of control over the dominated block.

[0035] The Lengauer-Tarjan algorithm is used to compute dominance relationships in a control flow graph. It can find the direct ruler of a basic block in linear time, thus constructing a dominance tree. Compared to the Tarjan algorithm, the Lengauer-Tarjan algorithm offers faster speed and less additional space requirements under certain conditions.

[0036] Adtributor algorithm: A time series anomaly root cause analysis method used for anomaly detection and root cause analysis in complex multi-dimensional data scenarios. It is especially suitable for highly dynamic environments such as advertising systems, and can quickly locate the root cause of problems when key performance indicators fluctuate abnormally.

[0037] Git repository: A distributed version control system used to track multiple modifications to files, widely used in source code management during software development. A Git repository stores project source code and also records historical information about each code change, including the hash value of each commit (called a commit number), the changes made, and the committer.

[0038] Commit Number: In a version control system, whenever a file is modified and committed to the repository, the system automatically generates a unique hash value to identify this commit. This hash value is the commit number. The commit number contains information about the timestamp of the code change, the committer, and details of the change. It is an important identifier for tracking the history of code versions.

[0039] To address the issue of poor memory monitoring efficiency in related technologies, this application provides a method for detecting memory anomalies. This method can run on... Figure 1 The computer terminal shown is described below.

[0040] The memory anomaly detection method provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing a memory anomaly detection method is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions connected via wired and / or wireless networks. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0041] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be implemented wholly or partially as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be wholly or partially integrated into any other element in the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0042] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the memory anomaly detection method in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned memory anomaly detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0043] The transmission module 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission module 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0044] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0045] It should be noted here that, in some optional embodiments, the above... Figure 1 The computer terminal shown may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that... Figure 1 This is only one instance of a specific particular instance, and is intended to illustrate the types of components that may exist in the aforementioned computer terminal.

[0046] In the above operating environment, this application provides an embodiment of a memory anomaly detection method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0047] Figure 2 This is a flowchart of a memory anomaly detection method according to an embodiment of this application, such as... Figure 2As shown, the method includes the following steps:

[0048] Step S202: Obtain the object relationship graph of the node to be monitored in the virtual machine. The object relationship graph is used to record the object reference relationship in the node to be monitored and the type, thread, and memory usage of each object.

[0049] Step S204: The memory usage in the object relationship graph is converted into the dominant memory usage through the dominant memory quantification model, and the memory usage statistics table of the node to be monitored is determined based on the dominant memory usage. The dominant memory quantification model is used to quantify the contribution of each object in the object relationship graph to memory usage, and the dominant memory usage is used to reflect the influence of object reference relationships on memory usage.

[0050] Step S206: Generate a global memory usage wide table for the nodes to be monitored based on the memory usage statistics table, the node dimension table, and the type dimension table. The node dimension table is used to record the node information of the nodes to be monitored, and the type dimension table is used to record the code change information of the nodes to be monitored.

[0051] Step S208: The global memory usage wide table is detected by the contribution analysis algorithm to obtain the memory anomaly detection results of the node to be monitored. The contribution analysis algorithm introduces a surprise factor to analyze the impact of code change information on the memory usage of the node to be monitored. The surprise factor is used to adjust the weight of code change information in memory anomaly detection.

[0052] Through steps S202 to S208 above, the goal of accurately identifying and locating the root cause of virtual machine memory anomalies is achieved. This effectively improves the efficiency and accuracy of memory monitoring in complex system environments, thereby solving the inefficiencies and sluggishness caused by the inability of related memory monitoring methods to effectively identify and quantify the implicit relationships between objects in memory usage and to ignore the impact of code change time on memory stability. A detailed explanation follows.

[0053] In step S202 above, the Java Agent can capture the object relationship graph of the node to be monitored in the JVM environment (this application mainly uses the Java Virtual Machine environment as an example). This object relationship graph records in detail the reference relationships between objects inside the JVM, as well as the type, thread ownership, and actual memory usage of each object. This process is similar to drawing an ecosystem diagram in a busy forest, not only identifying the location and size (type, memory usage) of each organism (object), but also depicting the interdependencies (reference relationships) between them, providing comprehensive basic data for subsequent in-depth analysis.

[0054] In this embodiment, the object relationship diagram can be determined as follows: A monitoring channel corresponding to the node to be monitored is determined through a preset remote management protocol, wherein the preset remote management protocol provides multiple interfaces for querying and modifying the running status of the node to be monitored; a preset agent program file is sent to the node to be monitored through the monitoring channel, and the preset agent program file is loaded through the target interface in the preset remote management protocol, wherein the preset agent program file is used to monitor the internal object activities of the node to be monitored, and the target interface is the interface in the preset remote management protocol that allows external entities to access and control the node to be monitored; during the class loading stage of the preset agent program file, bytecode enhancement technology is used to monitor the node to be monitored, and object lifecycle events in the node to be monitored are obtained through a collection probe, wherein the object lifecycle includes object reference relationships in the node to be monitored and the type, thread, and memory usage of each object; an object relationship diagram is generated based on the object lifecycle events. The specific process analysis is as follows:

[0055] First, the nodes to be monitored are automatically or manually registered in the data collection module, i.e., the nodes to be monitored are selected.

[0056] Secondly, a two-way secure monitoring channel is established between the data collection module and the monitored nodes through the JMX remote management protocol (i.e., the aforementioned preset remote management protocol). JMX, as a powerful management framework, not only provides a series of standard interfaces for querying and modifying the JVM's runtime status, but also allows external management systems to interact with the JVM through these interfaces to obtain detailed performance and health metrics. Simultaneously, the establishment of the monitoring channel provides the necessary infrastructure and access control for subsequent memory monitoring activities, ensuring the real-time nature and security of memory data.

[0057] Next, the Java Agent binary file (i.e., the aforementioned preset agent program file) is sent to the node to be monitored through the established monitoring channel, and dynamic loading is triggered through the JMX interface (i.e., the aforementioned target interface). The key to the Java Agent lies in its ability to utilize bytecode enhancement technology to embed monitoring logic during the class loading phase, such as implanting lightweight data collection probes, which can capture object lifecycle information without modifying the application's source code.

[0058] Once the Java Agent is activated in the JVM environment, it begins to capture lifecycle events such as the creation and destruction of objects in the monitored nodes in real time. This monitoring process covers detailed information such as object reference relationships, types, belonging threads, and specific memory usage. Through built-in collection probes, the system can seamlessly acquire this key data, providing a data foundation for building an object relationship graph. Finally, the collected object lifecycle events are comprehensively organized to generate an object relationship graph that reflects the reference relationships and memory usage characteristics between objects.

[0059] In the above process, the establishment of JMX channels, the intelligent implantation of lightweight agents, the real-time monitoring of object activities, and the accurate generation of object relationship graphs lay a solid foundation for the subsequent steps of dominant memory quantification and anomaly detection. It also demonstrates a deep understanding and response to the memory anomaly detection needs in complex system environments, enabling the system to monitor and analyze JVM memory usage more accurately and comprehensively, thereby effectively preventing and locating memory-related problems.

[0060] In step S204 above, the direct memory usage in the object relationship graph obtained in step S202 can be converted into dominant memory usage using the dominant memory quantification model. The dominant memory quantification model encompasses implicit dominance relationships between objects. By constructing a Dominator Tree data structure, the system can quantify the contribution of each object to memory usage, including not only the memory directly occupied by the object itself, but also the memory indirectly occupied by other objects under its dominance.

[0061] Optionally, the memory usage in the object relationship graph is transformed into dominant memory usage through a dominant memory quantification model, including: determining the dominant relationships in the object relationship graph through a dominant algorithm in the dominant memory quantification model, and determining the dominant tree corresponding to the object relationship graph based on the dominant relationships, wherein the dominant algorithm is used to analyze the object reference relationships in the object relationship graph, and the dominant tree is used to reflect the dominant relationships between objects in the node to be monitored; determining the dominant memory usage of each object in the dominant tree through an objective function in the dominant memory quantification model, wherein the objective function quantifies the influence of the dominant relationship on the memory usage of the node to be monitored through a dominant relationship decay factor and a dominant cost amplification function, wherein the dominant relationship decay factor is used to simulate the indirectness and decay effect of the dominant relationship, and the dominant cost amplification function is used to quantify and amplify the additional memory and computational cost when an object in the node to be monitored dominates a sub-object.

[0062] In this embodiment, directly aggregating the memory occupied by objects by type and thread would fail to reveal the hidden memory growth blind spots in the JVM's reference relationships. Therefore, a dominant memory quantification model can be used to model the object reference relationships in the object relationship graph as dominant relationships, and further convert the memory usage of each object into dominant memory usage. This is then aggregated by type and thread to obtain a memory usage statistics table for the nodes to be monitored. Figure 3 As shown, the specific process analysis is as follows:

[0063] 1. Identification and modeling of dominance relationships.

[0064] By analyzing the object reference relationships in the object relationship graph using a dominance algorithm (such as the Lengauer-Tarjan algorithm), the dominant object in the memory lifetime is identified. In other words, the "dominance relationship between objects" reveals the "dominance relationship between objects and memory." This object relationship graph is shown below. Figure 3 The top left figure shows the algorithm. The Lengauer-Tarjan algorithm effectively handles complex references between objects, constructing a topological structure reflecting object dominance relationships, namely the Dominator Tree, as shown in the figure. Figure 3 As shown in the upper right image, this Dominator Tree not only displays the direct rulers of each object but also considers indirect dominion relationships. This is analogous to how, in a forest ecosystem, it focuses not only on direct predator-prey relationships but also on indirect influences at higher levels of the food chain, providing a more comprehensive view of memory relationships.

[0065] 2. Objective function design and memory-controlled computation.

[0066] In this embodiment, the dominant memory usage of each object in the dominance tree can be determined by the objective function in the dominant memory quantification model. This includes: determining the target memory usage and leaf node weights of the target object in the dominance tree, where the target object is any object in the dominance tree, and the leaf node weights are the basic weights of the target object's memory consumption; determining the dominance relationship decay factor and dominance cost amplification function to quantify the memory usage of the node to be monitored; determining the objective function based on the target memory usage, leaf node weights, dominance relationship decay factor, and dominance cost amplification function, and determining the target dominant memory usage of the target object through the objective function.

[0067] Specifically, the design of the objective function involves three important parameters: leaf node weight α, dominance decay factor γ, and dominance cost amplification function f. aug .

[0068] Among them, the leaf node weight α is the basic weight to ensure the memory consumption of the target object, usually α = 1.0;

[0069] The dominance decay factor γ is used to simulate the indirectness and decay effect of dominance relationships, where γ∈(0,1). In graph theory, the more indirect the dominance relationship, the weaker its influence tends to be. The introduction of the γ factor reflects this principle, ensuring that the model can more realistically reflect the dominance influence between objects.

[0070] Domination cost amplification function f aug This quantifies the additional memory and computational costs incurred when a target object dominates its child objects. In a JVM environment, the management cost of large or complex objects is often higher than that of small objects. augBy incorporating consideration of the number of loadable pointers in the CPU cache line, the cost of managing these large objects is amplified, ensuring the model accurately reflects the complexity of memory management. The specific expression can be as follows:

[0071]

[0072] In the formula, f aug (P) represents the additional memory cost of the target object P controlling its child objects children(P), and count(children(P)) represents the number of direct child objects of the target object P. This represents the proportion of pointer space occupied by a cache line for each child object referenced by the target object P. The smaller the denominator, the higher the cost.

[0073] Using the parameters mentioned above, the objective function can comprehensively consider the target memory usage of the target object, the weight of the leaf nodes, the indirect influence of domination, and the management cost, thereby accurately calculating the dominant memory usage of each object. The specific implementation process is as follows: Figure 3 The code in the lower right corner is shown in the figure. The specific expression of the objective function is as follows:

[0074]

[0075] In the formula, L P Let f represent the target memory usage of target object P, α represent the weight of the leaf nodes of target object P, and f represent the target memory usage of target object P. aug (P) represents the dominance cost amplification function, γ represents the dominance decay factor, sizeof(P) represents the memory usage of the target object P, and L C This indicates the memory usage of the child objects of the target object P.

[0076] 3. Generate and analyze memory usage statistics based on the amount of memory used.

[0077] In this embodiment of the application, determining the memory usage statistics table of the node to be monitored based on the amount of dominant memory usage includes: determining the target type and target thread of the target object; determining the memory usage sequence of the target object based on the target type, target thread and target dominant memory usage; merging the memory usage sequences of all objects in the node to be monitored to obtain the memory usage statistics table of the node to be monitored.

[0078] Specifically, after the memory dominance quantization model completes its calculations, it will be aggregated according to the object type and thread. Taking the target object mentioned above as an example, it is first necessary to determine its corresponding target type, target thread, and target dominant memory usage calculated by the memory dominance quantization model. Then, a memory usage sequence of the target object is constructed to track and record the changing trend of the target object's dominant memory usage over time under specific types and threads.

[0079] Furthermore, the memory usage sequences of all objects in the monitored nodes are merged to generate a complete memory usage statistics table, such as... Figure 3 The lower left figure shows the memory usage statistics table. This table contains the dominant memory usage aggregated by type and thread, reflecting the memory consumption overview of the node under different dimensions, such as [type, thread, dominant memory usage].

[0080] In the above process, through the memory domination quantification model, the system can not only identify direct memory consumption, but also deeply reveal the compound memory cost caused by object relationships, including the hidden memory growth caused by references and domination relationships between objects. This effectively makes up for the blind spots of traditional monitoring methods in analyzing memory growth and improves the accuracy and efficiency of memory monitoring.

[0081] In step S206 above, after completing the quantification of dominant memory, the memory usage statistics table can be associated with the node dimension table and the type dimension table to generate a global memory usage wide table for the nodes to be monitored. This global memory usage wide table not only includes the dominant memory usage aggregated by type and thread, but also integrates node information (such as data center, node ID) and code change information (such as type, module, commit number, and commit date).

[0082] In this embodiment of the application, the type dimension table can be determined in the following way: obtain the running code corresponding to the node to be monitored according to a preset time interval; determine the type information in the running code, and determine the module to which the type information belongs, the submission number and the submission date; determine the type dimension table based on the type information, the module to which it belongs, the submission number and the submission date.

[0083] Specifically, the data collection module can pull the source code corresponding to the node to be monitored from the Git repository at preset time intervals (such as 1 hour), and then build a type dimension table with type as the dimension key and module, commit number, commit time and committer as attributes, containing columns [type, module, commit number, commit date].

[0084] Furthermore, the data collection module retrieves the memory usage statistics table of the monitored nodes from each monitoring node through the JMX monitoring channel at 30-second intervals. Then, it associates the node dimension table with the node ID as the condition and the type dimension table with the type as the condition, finally obtaining a global memory usage wide table containing columns [time, node, data center, type, thread, module, commit number, commit date, dominant memory usage].

[0085] In step S208 above, a contribution analysis algorithm can be used to perform in-depth analysis of the generated global memory usage wide table to detect memory anomalies and locate their root causes. This contribution analysis algorithm is based on the Adtributor framework and introduces a time-decaying surprise factor, incorporating the time dimension of code changes into the weight calculation to analyze the degree of impact of code changes on memory usage. Notably, the calculation mechanism of the surprise factor makes the impact of recent code changes on memory anomalies more significant, helping the system to more accurately identify potential memory leaks or abnormal growth.

[0086] Optionally, a contribution analysis algorithm is used to detect memory anomalies in the global memory usage wide table to obtain the memory anomaly detection results for the monitored node. This includes: determining the target similarity deviation of the global memory usage wide table using the contribution analysis algorithm, wherein the target similarity deviation reflects the degree of deviation between the behavior pattern of the multidimensional time series data in the global memory usage wide table at a preset time point and the historical behavior pattern; determining the surprise factor for detecting memory anomalies in the global memory usage wide table; determining the surprise value of the global memory usage wide table at a preset time point based on the target similarity deviation and the surprise factor, wherein the surprise value is a quantitative indicator for measuring the degree of anomalies in the global memory usage wide table; and determining the memory anomaly detection results based on the surprise value and a preset threshold, wherein if the surprise value is greater than the preset threshold, it is determined that there is memory anomaly in the monitored node.

[0087] In this embodiment, the contribution analysis algorithm is cleverly applied to the detection of a global memory usage wide table to identify and quantify memory anomalies. Its core mechanism involves calculating target similarity deviation and introducing a surprise factor to measure and judge the degree of deviation between the behavioral patterns and historical patterns of multidimensional time series data at different time points, thereby determining the existence of memory anomalies. The specific process analysis is as follows:

[0088] 1. Determine the target similarity deviation D JS (p,q).

[0089] Target similarity deviation D JS (p,q) is a quantitative indicator used in the contribution analysis algorithm to reflect the difference between the behavior pattern of the global memory usage wide table at a preset time point and the historical behavior pattern. It measures the degree of deviation between the JVM memory consumption attributes (such as dominant memory usage, type, threads, etc.) at a specific time point and the average or typical behavior of these attributes over a period of time.

[0090] 2. Define the surprise factor W ij .

[0091] Surprise Factor W ijIn this embodiment, it plays the role of a dynamic weight, dynamically adjusting the weight of code change information in memory anomaly detection based on the proximity of the code change's time to the current time. Recent code changes (e.g., changes with commit dates close to the current time) will be assigned a higher surprise factor, thus having a greater impact when calculating the surprise value. The specific expression can be as follows:

[0092]

[0093] In the formula, α and β are configurable hyperparameters that can be dynamically configured by different code teams based on code stability; i is the dimension index, j is the row index, and T is the dimension number. j T represents the submission time of the code change information. now Indicates the current time.

[0094] It should be noted that different values ​​of the submission time T dynamically affect the calculation of the surprise value, while the calculation of the surprise value for other dimensions is independent of these values. Assuming α = 2 and β = 10, the trend of the surprise factor is as follows: Figure 4 As shown, the surprise value doubles within 5 days of submission, while the weight starts to decline from 5 days ago until there is almost no surprise value after 15 days.

[0095] 3. Surprise value and memory anomaly detection.

[0096] Based on target similarity deviation D JS (p,q) and surprise factor W ij It can calculate the surprise value S of the global memory usage wide table at a preset time point. ij (m). The specific expression is as follows:

[0097] Original expression: S ij (m)=D JS (p,q);

[0098] The expression after adding the surprise factor: S ij (m)=W ij ·D JS (p,q).

[0099] After calculating the surprise value, the system compares it with a preset threshold. If the surprise value exceeds the threshold, the system will determine that there is memory anomaly in the monitored node, triggering further alarms and root cause analysis processes.

[0100] In the above process, the contribution analysis algorithm achieves intelligent analysis and anomaly detection of memory behavior patterns by combining target similarity deviation and surprise factor. It not only considers the memory consumption behavior at the current time point, but also integrates the time dimension of code changes. Through a dynamic weight adjustment mechanism, it enhances the sensitivity and recognition ability of memory anomalies caused by recent code changes.

[0101] Optionally, the above method further includes: determining a detection time window for using a wide table to detect memory anomalies in global memory; resetting the detection time window if the memory anomaly detection results show that the monitored node has memory anomalies; and expanding the detection time window if the memory anomaly detection results obtained from a preset number of consecutive detections do not show that the monitored node has memory anomalies.

[0102] In this embodiment, dynamic management of the detection time window is a key measure to optimize monitoring efficiency and accuracy. It can not only adapt to the dynamic changes in memory usage in the JVM runtime environment, but also effectively balance resource consumption and monitoring sensitivity.

[0103] Specifically, when applying the enhanced Adtributor algorithm to the global memory usage wide table to perform memory anomaly detection and root cause analysis, a basic detection time window T can be set first to define the frequency and scope of memory anomaly detection. In the initial stage, the system will periodically execute the memory anomaly detection algorithm according to this window period to detect potential abnormal behavior.

[0104] When the system detects memory anomalies in a monitored node using the contribution analysis algorithm, it immediately resets the detection time window to the base window period T to ensure that intensive detection can be performed in the shortest possible period in the early stages of anomalies, so as to quickly capture more details of the anomalies and take timely countermeasures.

[0105] Conversely, if the system does not detect any memory anomalies within a consecutive preset number of detection cycles (e.g., N times), the detection time window will gradually expand according to the Fibonacci sequence, with an upper limit of 10T, thereby reducing the consumption of computing resources during the stable period and avoiding unnecessary burdens caused by excessive detection.

[0106] The aforementioned strategy of dynamically adjusting the detection time window achieves a delicate balance between maximizing monitoring efficiency and minimizing resource consumption by intelligently identifying the system's operating status to automatically optimize the monitoring frequency. Particularly in large-scale distributed systems, this mechanism not only improves the response speed to sudden memory issues but also significantly reduces unnecessary computational overhead during stable system operation. This, in turn, significantly enhances the economy and practicality of the entire monitoring system while ensuring monitoring quality.

[0107] Figure 5 This is a structural diagram of a memory anomaly detection system according to an embodiment of this application. Figure 5 As shown, the system mainly includes a data collection module, a data statistics module, and a monitoring node.

[0108] Specifically, the entire process begins with the data collection module, which first completes the "monitoring registration" action: registering the name, IP address, port, and corresponding authentication information of all nodes to be monitored in the node information database; this information is encapsulated into node communication handles for subsequent two-way authentication. Then, the data collection module shakes hands with the JMX MBeanServer on the target monitoring node through the established JMX channel, completing the "establishing a secure monitoring channel" step. Once the channel is ready, the data collection module "distributes" the Java Agent bytecode file to each node to be monitored and triggers the monitoring node to dynamically load the Agent via JMX instructions. Once the Agent is successfully loaded, it immediately "registers a probe" within the target JVM, becoming part of the memory information collector.

[0109] The memory information collector (i.e., the implanted probe) monitors object creation / destruction events in real time, capturing object type, thread ID, object size, and reference relationships between objects. This data is first fed into the "Dominant Memory Aggregator" to construct the dominance tree and calculate dominant memory usage, outputting a "Dominant Memory Statistics Table" at the node granularity. This table contains node ID, object type, thread ID, and the calculated dominant memory usage.

[0110] Meanwhile, the code information synchronizer periodically pulls the latest code from the Git repository, parses the module, commit number, commit time, and committer for each object type, and generates a "type dimension table". The data collection module performs two associations with the node dimension table, type dimension table, and dominant memory statistics table: the first "association by node" links node information to the statistical results; the second "association by type" links code change information to the corresponding object type, ultimately forming a "global dominant memory statistics table", which is a global memory usage wide table containing time, node, data center, type, thread, module, commit number, commit date, and dominant memory usage.

[0111] The global memory usage wide table is pushed to the data statistics module in real time. The data statistics module internally stores the detection history and uses an "enhanced Adtributor operator" to perform anomaly detection and root cause analysis on the wide table. This operator uses a predefined surprise factor and dynamic window mechanism: if no anomalies are found for several consecutive periods, the window period is expanded according to the Fibonacci sequence to reduce computational load; once an anomaly is detected, the window period is immediately reset to the baseline value to ensure timeliness. The detection results are "written back to the detection record" for subsequent auditing, and root cause information is pushed to operations or developers through the "anomaly notification" interface, enabling precise tracing from memory anomalies to code changes.

[0112] Overall, this application combines deep analysis of dominator trees with multi-dimensional attribution of the enhanced Adtributor algorithm to construct a dominator tree-based memory quantification model and a dimension-enhanced anomaly attribution algorithm. Supplemented by a dynamic window detection mechanism, it achieves intelligent monitoring and efficient analysis of JVM memory usage. Compared to existing technologies, its advantages are mainly reflected in the following aspects:

[0113] 1. Accurately identify memory growth blind spots: By constructing a dominance tree based on the object relationship graph and introducing a dominance decay factor and a dominance cost amplification function, this application can accurately calculate the dominance memory usage of objects, thereby identifying hidden memory consumption and potential memory leak points caused by references and dominance relationships between objects.

[0114] 2. Enhanced sensitivity to code changes: By introducing a time-decaying surprise factor into the surprise value calculation of the Adtributor algorithm, this application can more sensitively detect the impact of new code changes on memory stability, which helps to quickly locate memory problems caused by recent code updates.

[0115] 3. Intelligent optimization of resource consumption: The dynamic window detection mechanism automatically adjusts the detection cycle according to the stability of the system, which not only ensures a rapid response when anomalies occur, but also reduces unnecessary resource waste, achieving a win-win situation of monitoring efficiency and cost control.

[0116] 4. Multi-dimensional data fusion architecture: By linking runtime memory metrics with code change records of the version control system through the type dimension, the analytical dimensions of memory anomaly analysis are expanded, enabling the investigation of the root cause of anomalies from a higher perspective and tracing the source of memory anomalies to code changes.

[0117] According to embodiments of this application, a memory anomaly detection device is provided. It should be noted that the memory anomaly detection device of this application can be used to execute the memory anomaly detection method provided in embodiments of this application. The memory anomaly detection device provided in embodiments of this application will be described below.

[0118] Figure 6 This is a structural diagram of a memory anomaly detection device provided according to an embodiment of this application. Figure 5 As shown, the device includes:

[0119] The acquisition module 60 is used to acquire the object relationship graph of the node to be monitored in the virtual machine. The object relationship graph is used to record the object reference relationship in the node to be monitored and the type, thread, and memory usage of each object.

[0120] The quantization module 62 is used to convert the memory usage in the object relationship graph into the dominant memory usage through the dominant memory quantization model, and to determine the memory usage statistics table of the node to be monitored based on the dominant memory usage. The dominant memory quantization model is used to quantify the contribution of each object in the object relationship graph to memory usage, and the dominant memory usage is used to reflect the influence of object reference relationships on memory usage.

[0121] The generation module 64 is used to generate a global memory usage wide table for the node to be monitored based on the memory usage statistics table, the node dimension table, and the type dimension table. The node dimension table is used to record the node information of the node to be monitored, and the type dimension table is used to record the code change information of the node to be monitored.

[0122] The detection module 66 is used to detect the global memory usage wide table through the contribution analysis algorithm to obtain the memory anomaly detection results of the node to be monitored. The contribution analysis algorithm introduces a surprise factor to analyze the impact of code change information on the memory usage of the node to be monitored. The surprise factor is used to adjust the weight of code change information in memory anomaly detection.

[0123] Through the acquisition module, quantization module, generation module, and detection module in the aforementioned memory anomaly detection device, the goal of accurately identifying and locating the root cause of virtual machine memory anomalies is achieved. This realizes the technical effect of effectively improving the efficiency and accuracy of memory monitoring in complex system environments, and solves the technical problems of inefficiency and sluggishness caused by the inability of memory monitoring methods in related technologies to effectively identify and quantify the implicit relationships between objects in memory use and to ignore the impact of code change time on memory stability.

[0124] In the memory anomaly detection device provided in this application embodiment, the acquisition module is further used to determine the monitoring channel corresponding to the node to be monitored through a preset remote management protocol. The preset remote management protocol provides multiple interfaces for querying and modifying the running status of the node to be monitored. A preset agent program file is sent to the node to be monitored through the monitoring channel, and the preset agent program file is loaded through the target interface in the preset remote management protocol. The preset agent program file is used to monitor the internal object activities of the node to be monitored, and the target interface is the interface in the preset remote management protocol that allows external entities to access and control the node to be monitored. During the class loading stage of the preset agent program file, bytecode enhancement technology is used to monitor the node to be monitored, and object lifecycle events in the node to be monitored are obtained through a collection probe. The object lifecycle includes object reference relationships in the node to be monitored and the type, thread, and memory usage of each object. An object relationship graph is generated based on the object lifecycle events.

[0125] In the memory anomaly detection device provided in this application embodiment, the quantization module is further used to determine the dominance relationship in the object relationship graph through the dominance algorithm in the dominance memory quantization model, and to determine the dominance tree corresponding to the object relationship graph based on the dominance relationship. The dominance algorithm is used to analyze the object reference relationship in the object relationship graph, and the dominance tree is used to reflect the dominance relationship between objects in the node to be monitored. The dominance memory usage of each object in the dominance tree is determined through the objective function in the dominance memory quantification model. The objective function quantifies the influence of the dominance relationship on the memory usage of the node to be monitored through the dominance relationship decay factor and the dominance cost amplification function. The dominance relationship decay factor is used to simulate the indirectness and decay effect of the dominance relationship, and the dominance cost amplification function is used to quantify and amplify the additional memory and computational cost when an object in the node to be monitored dominates a sub-object.

[0126] In the memory anomaly detection device provided in this application embodiment, the quantization module is further used to determine the target memory usage and leaf node weight of the target object in the dominance tree, wherein the target object is any object in the dominance tree, and the leaf node weight is the basic weight of the memory consumption of the target object; determine the dominance relationship decay factor and dominance cost amplification function for quantifying the memory usage of the node to be monitored; determine the objective function based on the target memory usage, leaf node weight, dominance relationship decay factor and dominance cost amplification function, and determine the target dominance memory usage of the target object through the objective function.

[0127] In the memory anomaly detection device provided in this application embodiment, the quantization module is also used to determine the target type and target thread of the target object; determine the memory usage sequence of the target object based on the target type, target thread and target dominated memory usage; and merge the memory usage sequences of all objects in the node to be monitored to obtain the memory usage statistics table of the node to be monitored.

[0128] In the memory anomaly detection device provided in this application embodiment, the generation module is further configured to obtain the running code corresponding to the node to be monitored according to a preset time interval; determine the type information in the running code, and determine the module to which the type information belongs, the submission number and the submission date; and determine the type dimension table based on the type information, the module to which it belongs, the submission number and the submission date.

[0129] In the memory anomaly detection device provided in this application embodiment, the detection module is further configured to determine the target similarity deviation of the global memory usage wide table through a contribution analysis algorithm, wherein the target similarity deviation is used to reflect the degree of deviation between the behavior pattern of the multidimensional time series data in the global memory usage wide table at a preset time point and the historical behavior pattern; determine the surprise factor for memory anomaly detection of the global memory usage wide table; determine the surprise value of the global memory usage wide table at a preset time point based on the target similarity deviation and the surprise factor, wherein the surprise value is a quantitative indicator for measuring the degree of anomaly of the global memory usage wide table; determine the memory anomaly detection result based on the surprise value and a preset threshold, wherein if the surprise value is greater than the preset threshold, it is determined that there is memory anomaly in the node to be monitored.

[0130] In the memory anomaly detection device provided in this application embodiment, the detection module is further used to determine the detection time window for using a wide table to detect memory anomalies in global memory; when the memory anomaly detection result shows that there is memory anomaly in the monitored node, the detection time window is reset; when the memory anomaly detection results obtained from a preset number of consecutive detections do not show that there is memory anomaly in the monitored node, the detection time window is expanded.

[0131] This application also provides an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and used to execute the above-described memory anomaly detection method.

[0132] It should be noted that the aforementioned electronic equipment is used to perform Figure 2 The memory anomaly detection method shown above also applies to this electronic device, and will not be repeated here.

[0133] This application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device containing the non-volatile storage medium executes the above-described memory anomaly detection method by running the computer program.

[0134] It should be noted that the aforementioned non-volatile storage media is used for execution. Figure 2The memory anomaly detection method shown above also applies to this non-volatile storage medium, and will not be repeated here.

[0135] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described memory anomaly detection method.

[0136] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The memory anomaly detection method shown above also applies to this computer program product, and will not be repeated here.

[0137] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0138] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0140] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0141] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0142] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0143] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting abnormal memory movement, characterized in that, include: Obtain the object relationship graph of the node to be monitored in the virtual machine, wherein the object relationship graph is used to record the object reference relationship in the node to be monitored and the type, thread, and memory usage of each object; The memory usage in the object graph is converted into dominant memory usage by the dominant memory usage quantification model, and the memory usage statistics table of the node to be monitored is determined based on the dominant memory usage. The dominant memory usage quantification model is used to quantify the contribution of each object in the object graph to memory usage, and the dominant memory usage is used to reflect the influence of the object reference relationship on memory usage. A global memory usage wide table for the node to be monitored is generated based on the memory usage statistics table, node dimension table, and type dimension table. The node dimension table is used to record the node information of the node to be monitored, and the type dimension table is used to record the code change information of the node to be monitored. The global memory usage wide table is detected by a contribution analysis algorithm to obtain the memory anomaly detection results of the monitored node. The contribution analysis algorithm introduces a surprise factor to analyze the impact of the code change information on the memory usage of the monitored node. The surprise factor is used to adjust the weight of the code change information in memory anomaly detection.

2. The method according to claim 1, characterized in that, The object relationship diagram is determined in the following way: The monitoring channel corresponding to the node to be monitored is determined by a preset remote management protocol, wherein the preset remote management protocol provides multiple interfaces for querying and modifying the operating status of the node to be monitored; The preset agent program file is sent to the node to be monitored through the monitoring channel, and the preset agent program file is loaded through the target interface in the preset remote management protocol. The preset agent program file is used to monitor the internal object activities of the node to be monitored, and the target interface is the interface in the preset remote management protocol that allows external entities to access and control the node to be monitored. During the class loading phase of the preset agent program file, bytecode enhancement technology is used to monitor the node to be monitored, and object lifecycle events in the node to be monitored are obtained by collecting probes. The object lifecycle includes the object reference relationship in the node to be monitored and the type, thread, and memory usage of each object. Generate the object relationship graph based on the object's lifecycle events.

3. The method according to claim 1, characterized in that, The memory usage in the object relationship graph is transformed into dominant memory usage through a dominant memory quantification model, including: The dominance relationship in the object relationship graph is determined by the dominance algorithm in the dominance memory quantization model, and the dominance tree corresponding to the object relationship graph is determined based on the dominance relationship. The dominance algorithm is used to analyze the object reference relationship in the object relationship graph, and the dominance tree is used to reflect the dominance relationship between objects in the node to be monitored. The dominant memory usage of each object in the dominant tree is determined by the objective function in the dominant memory quantification model. The objective function quantifies the influence of the dominant relationship on the memory usage of the monitored node by a dominant relationship decay factor and a dominant cost amplification function. The dominant relationship decay factor is used to simulate the indirectness and decay effect of the dominant relationship, and the dominant cost amplification function is used to quantify and amplify the additional memory and computational cost when an object in the monitored node dominates a child object.

4. The method according to claim 3, characterized in that, Determining the dominant memory usage of each object in the dominant tree using the objective function in the dominant memory quantification model includes: Determine the target memory usage and leaf node weights of the target object in the dominance tree, wherein the target object is any object in the dominance tree, and the leaf node weights are the basic weights of the memory consumption of the target object; Determine the dominance decay factor and dominance cost amplification function to quantify the memory usage of the node to be monitored; The objective function is determined based on the target memory usage, the leaf node weight, the dominance decay factor, and the dominance cost amplification function, and the target dominance memory usage of the target object is determined through the objective function.

5. The method according to claim 4, characterized in that, The memory usage statistics table for the monitored node is determined based on the controlled memory usage, including: Determine the target type and target thread of the target object; The memory usage sequence of the target object is determined based on the target type, the target thread, and the target dominated memory usage. Merge the memory usage sequences of all objects in the node to be monitored to obtain the memory usage statistics table of the node to be monitored.

6. The method according to claim 1, characterized in that, The type dimension table is determined in the following way: Obtain the running code corresponding to the node to be monitored according to a preset time interval; Determine the type information in the running code, and determine the module, commit number, and commit date to which the type information belongs; The type dimension table is determined based on the type information, the module to which it belongs, the submission number, and the submission date.

7. The method according to claim 1, characterized in that, The global memory usage wide table is used to detect anomalies in the monitored node by a contribution analysis algorithm, resulting in the following: The target similarity deviation of the global memory usage wide table is determined by the contribution analysis algorithm, wherein the target similarity deviation is used to reflect the degree of deviation between the behavior pattern of the multidimensional time series data in the global memory usage wide table at a preset time point and the historical behavior pattern. Determine the surprise factor for using a wide table to detect memory anomalies in the global memory; The surprise value of the global memory usage wide table at the preset time point is determined based on the target similarity deviation and the surprise factor, wherein the surprise value is a quantitative indicator that measures the degree of anomaly of the global memory usage wide table; The memory anomaly detection result is determined based on the surprise value and a preset threshold, wherein if the surprise value is greater than the preset threshold, it is determined that the monitored node has memory anomalies.

8. The method according to claim 7, characterized in that, The method further includes: Determine the detection time window for using a wide table to detect memory anomalies in the global memory; If the memory anomaly detection result shows that the monitored node has memory anomalies, the detection time window is reset; If the memory anomaly detection results obtained from a preset number of consecutive detections do not show any memory anomalies in the monitored node, the detection time window is expanded.

9. A memory anomaly detection device, characterized in that, include: The acquisition module is used to acquire the object relationship graph of the node to be monitored in the virtual machine. The object relationship graph is used to record the object reference relationship in the node to be monitored and the type, thread, and memory usage of each object. The quantization module is used to convert the memory usage in the object relationship graph into the dominant memory usage through the dominant memory quantization model, and to determine the memory usage statistics table of the node to be monitored based on the dominant memory usage. The dominant memory quantization model is used to quantify the contribution of each object in the object relationship graph to memory usage, and the dominant memory usage is used to reflect the influence of the object reference relationship on memory usage. The generation module is used to generate a global memory usage wide table for the node to be monitored based on the memory usage statistics table, the node dimension table, and the type dimension table. The node dimension table is used to record the node information of the node to be monitored, and the type dimension table is used to record the code change information of the node to be monitored. The detection module is used to detect the global memory usage wide table through a contribution analysis algorithm to obtain the memory anomaly detection results of the node to be monitored. The contribution analysis algorithm introduces a surprise factor to analyze the impact of the code change information on the memory usage of the node to be monitored. The surprise factor is used to adjust the weight of the code change information in the memory anomaly detection.

10. An electronic device, characterized in that, include: A memory and a processor, wherein the memory is used to store program instructions; The processor, connected to the memory, is used to execute the memory anomaly detection method according to any one of claims 1 to 8.

11. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the memory anomaly detection method according to any one of claims 1 to 8 by running the computer program.

12. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the memory anomaly detection method according to any one of claims 1 to 8.

Images