A memory exception early warning method, device and medium based on data mining

Abstract

The application discloses a memory abnormality early warning method and device based on data mining and a medium, relates to the technical field of memory abnormality early warning, and comprises the following steps: performing semantic element mapping on memory running semantic data, and outputting a semantic state time sequence vector; performing cross-domain time sequence alignment and associated feature extraction on the semantic state time sequence vector and memory performance index data, and outputting memory associated rules; performing cause-effect analysis on the memory performance index data, constructing a graph structure on a cause-effect edge set through a PC algorithm, and outputting a memory index cause-effect graph; performing memory behavior deduction on real-time memory running semantic data according to the memory associated rules, outputting memory abnormality early warning data, performing cause-effect tracing and report integration on the memory abnormality early warning data through the memory index cause-effect graph, and outputting a memory abnormality early warning report. The application realizes interpretable early warning and root cause positioning of memory abnormality through the cooperation of semantic state time sequence vector construction and memory index cause-effect graph generation.

Description

Technical Field

[0001] This invention relates to the field of memory anomaly early warning technology, and in particular to a memory anomaly early warning method, device and medium based on data mining. Background Technology

[0002] In recent years, memory anomaly early warning methods have evolved from static threshold-based monitoring to time-series analysis and machine learning model prediction based on historical performance indicators. In the field of computer memory anomaly early warning, the main approach involves collecting low-level performance indicators such as memory usage, page fault frequency, and cache hit rate. Anomaly detection models are then constructed using statistical process control, isolated forest algorithms, or long short-term memory networks. This has formed a methodological framework driven by performance time-series data and centered on pattern recognition. The evolution of this framework has enhanced the ability to identify explicit patterns such as continuous increases in memory usage or sudden spikes in access latency, providing a fundamental support for ensuring service stability.

[0003] However, existing solutions have shortcomings in terms of interpretability and foresight of early warnings. Current early warning methods struggle to establish interpretable correlations between statistical anomalies in memory performance metrics and the internal high-level semantic features that trigger these anomalies. This results in early warning information failing to pinpoint specific suspicious code or logic. Furthermore, existing solutions primarily focus on mining correlations between metrics, lacking modeling of causal relationships among multiple performance metrics within the memory management sub-component. Consequently, they cannot trace back to the root cause metrics in complex fault scenarios, thus limiting the accuracy of early warnings and the efficiency of operational response. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a memory anomaly early warning method based on data mining to solve the problems of deficiencies in the interpretability and foresight of early warnings.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] Firstly, this invention provides a memory anomaly early warning method based on data mining, comprising: collecting memory operation semantic data and memory performance index data; mapping semantic elements to the memory operation semantic data to generate semantic element vectors; performing temporal aggregation on the semantic element vectors to output a semantic state temporal vector; performing cross-domain temporal alignment and correlation feature extraction on the semantic state temporal vectors and memory performance index data to output a correlation feature set; performing interpretable rule parsing on the correlation feature set to output memory correlation rules; performing causal analysis on the memory performance index data to output a causal edge set; constructing a graph structure on the causal edge set using a PC algorithm to output a memory index causal graph; performing memory behavior inference on real-time memory operation semantic data according to the memory correlation rules to generate memory behavior prediction data; comparing the deviation between the memory behavior prediction data and the memory performance index data to output memory anomaly early warning data; and performing causal tracing and report integration on the memory anomaly early warning data through the memory index causal graph to output a memory anomaly early warning report.

[0008] As a preferred embodiment of the memory anomaly early warning method based on data mining described in this invention, the specific steps of mapping semantic elements of memory runtime semantic data to generate a semantic element vector are as follows:

[0009] Separate data elements from the semantic data of memory operation and output a set of structured semantic elements;

[0010] The structured semantic element set is encoded and transformed into a vector, and the original semantic vector is output.

[0011] The original semantic vectors are scaled using a normalization method to generate semantic element vectors.

[0012] As a preferred embodiment of the memory anomaly early warning method based on data mining described in this invention, the specific steps of performing temporal aggregation on semantic element vectors to output semantic state temporal vectors are as follows:

[0013] The semantic element vectors are divided into windows according to the temporal order of the collected semantic data in memory, and the set of element vector windows is output.

[0014] Perform vector summation on each element vector window in the set of element vector windows, and output the window semantic state vector;

[0015] The semantic state vectors of the window are arranged and combined in chronological order to output the semantic state time sequence vector.

[0016] As a preferred embodiment of the memory anomaly early warning method based on data mining described in this invention, the specific steps of performing cross-domain temporal alignment and correlation feature extraction between the semantic state temporal vector and memory performance index data to output a correlation feature set are as follows:

[0017] Perform time-point alignment processing on the semantic state temporal vector and memory performance index data, and output a set of memory data pairs;

[0018] Extract dependency features from the set of in-memory data and output the original sequence of related features.

[0019] The original associated feature sequence is processed by recursive feature elimination to perform feature selection and dimension adjustment, and an associated feature set is output.

[0020] As a preferred embodiment of the memory anomaly early warning method based on data mining described in this invention, the specific steps of performing interpretable rule parsing on the associated feature set and outputting memory association rules are as follows:

[0021] The decision tree inductive algorithm is used to learn rules from the associated feature set and output a preliminary set of rules.

[0022] Filter the initial rule set by confidence level and output the confidence rule set;

[0023] Redundant rules are merged and structured in the set of confidence rules, and memory-associative rules are output.

[0024] As a preferred embodiment of the memory anomaly early warning method based on data mining described in this invention, the steps include: performing causal analysis on memory performance index data, outputting a set of causal edges, and constructing a graph structure from the causal edge set using a PC algorithm to output a causal graph of memory indicators.

[0025] Perform conditional independence tests on memory performance metrics and output the independence test data;

[0026] Based on independence test data, undirected causal edges are discovered in memory performance index data, and a set of undirected causal edges is output.

[0027] The PC algorithm is used to infer the causal directionality of the undirected causal edge set and synthesize the directed acyclic graph structure, outputting a preliminary index causal graph.

[0028] Loop detection and elimination are performed on the preliminary causal graph of indicators, and the memory causal graph of indicators is output.

[0029] As a preferred embodiment of the memory anomaly early warning method based on data mining described in this invention, the specific steps of performing memory behavior inference on real-time memory operation semantic data according to memory association rules to generate memory behavior prediction data are as follows:

[0030] Based on memory association rules, perform rule matching and rule mapping on real-time memory runtime semantic data, and output a real-time mapping result vector;

[0031] The parameterized vector derivation is performed on the real-time mapping result vector to output a preliminary memory prediction sequence;

[0032] The initial memory prediction sequence is integrated and formatted to generate memory behavior prediction data.

[0033] As a preferred embodiment of the memory anomaly early warning method based on data mining described in this invention, the specific steps of performing causal tracing and report integration on memory anomaly early warning data through a memory indicator causal graph, and outputting a memory anomaly early warning report, are as follows:

[0034] Identify abnormal performance indicators from memory anomaly warning data and output a set of abnormal indicator nodes;

[0035] In the memory metric causal graph, reverse causal path tracing is performed on the set of abnormal metric nodes to output the set of root cause metric nodes.

[0036] The root cause indicator node set and the abnormal indicator node set are fused and the report is formatted to output a memory anomaly warning report.

[0037] In a second aspect, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the memory anomaly warning method based on data mining as described in the first aspect of the present invention.

[0038] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the memory anomaly warning method based on data mining as described in the first aspect of the present invention.

[0039] The beneficial effects of this invention are as follows: By employing a dual-mechanism approach of constructing semantic state temporal vectors and generating memory indicator causal graphs, interpretable early warning and root cause localization of memory anomalies are achieved. By mapping memory runtime semantic data to semantic element vectors and performing temporal aggregation, a quantitative correlation is established between high-level semantics and low-level memory behavior, enabling interpretable representation of memory anomaly patterns caused by code logic. Through causal analysis of memory performance indicator data and the application of the PC algorithm to construct a memory indicator causal graph, the memory indicator causal graph reveals the causal influence paths and directions between various performance indicators within memory, establishing a reverse tracing network for anomaly indicators. In the early warning phase, the combination of behavior deduction driven by semantic state temporal vectors and causal tracing supported by the memory indicator causal graph ensures that the output memory anomaly early warning report simultaneously includes the program semantic features that triggered the anomaly and the root cause indicator chain leading to the anomaly. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a flowchart of a memory anomaly early warning method based on data mining.

[0042] Figure 2 This is a flowchart for generating semantic element vectors.

[0043] Figure 3 This is a flowchart for outputting memory association rules.

[0044] Figure 4 This is a flowchart for outputting the cause-effect graph of memory metrics. Detailed Implementation

[0045] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0046] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0047] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0048] Reference Figures 1-4 This is one embodiment of the present invention, which provides a memory anomaly early warning method based on data mining, including the following steps:

[0049] S1. Collect memory operation semantic data and memory performance index data, perform semantic element mapping on the memory operation semantic data, generate semantic element vectors, perform temporal aggregation on the semantic element vectors, and output semantic state temporal vectors.

[0050] Collect memory operation semantic data and memory performance index data, separate data elements from the memory operation semantic data, and output a set of structured semantic elements.

[0051] Specifically, collecting memory runtime semantic data is achieved by recording the function call stack sequence, marking the code block identifiers executed, and capturing the object type information of memory operations in real time during memory execution; collecting memory performance index data is achieved by reading the underlying performance counters that reflect memory status and efficiency, including process resident set size, page fault count, memory allocation and release frequency, overall memory utilization, and cache access statistics.

[0052] The semantic data of memory operation is separated into data elements. Specifically, the symbol names and call order information of each function call are read from the real-time recorded function call stack sequence, the corresponding control flow basic block number is read from the marked code block identifier, and the type name and memory layout characteristics of the object are extracted from the object type information of the captured memory operation. The symbol names, call order information, control flow basic block number, type name and memory layout characteristics are classified and organized into data items with clear field structures, forming a structured semantic element set composed of function call information, code block identifier information and object type information.

[0053] The structured semantic element set is encoded and transformed into a vector, and the original semantic vector is output.

[0054] Specifically, the process iterates through each item in the structured semantic element set, including function call information, code block identifier information, and object type information. A one-to-one integer number is established for each of the different function call information, code block identifier information, and object type information that appears, starting from 1 and assigned sequentially according to their order of appearance, forming a complete integer mapping relationship. Using this integer mapping relationship, each item in the structured semantic element set is replaced with its corresponding integer number, outputting the indexed semantic elements. Based on the integer numbers, a two-dimensional numerical table is initialized, with the number of rows equal to the largest integer number and the number of columns equal to the vector dimension of the structured semantic element set. The initial value for each position in the two-dimensional numerical table is generated using a standard orthogonal initialization method. The corresponding row in the two-dimensional numerical table is located using the integer number in the indexed semantic elements, and all values ​​from that row are extracted as a real number vector. The real number vectors corresponding to the function call information, code block identifier information, and object type information are concatenated according to field order to output the original semantic vector.

[0055] The original semantic vectors are scaled using a normalization method to generate semantic element vectors.

[0056] Specifically, for each dimension of the original semantic vector, the maximum and minimum values ​​of the corresponding dimensions of all original semantic vectors within the current time window are statistically analyzed. Based on the maximum-minimum normalization formula, the values ​​of each dimension are linearly mapped to the interval [0,1] to obtain a vector with unified scale, i.e., the semantic element vector.

[0057] The semantic element vectors are divided into windows according to the time order of the collected semantic data in memory, and the set of element vector windows is output.

[0058] Specifically, all semantic element vectors are arranged according to the acquisition time sequence of the corresponding memory-based semantic data, forming a strictly time-ordered sequence of semantic element vectors. A continuous interval is set as a window, covering a continuous segment of semantic element vectors within the sequence. A sliding step size is set to control the forward movement of the window within the sequence. The window length is set to 100 semantic element vectors, and the sliding step size is set to 20 semantic element vectors, with values ​​suitable for typical memory load scenarios (e.g., single-process memory usage of 1GB–16GB, sampling frequency of 10). (Hz–100Hz) When memory load increases (such as multi-process high concurrency or memory-intensive applications) and semantic state changes accelerate, shorten the window length (e.g., reduce to 60–80) to improve response speed. When under low load or in a stable memory behavior phase, increase the window length (e.g., 120–150) to enhance pattern stability. The value is based on the average duration range of abnormal behavior in historical memory operation semantic data, which is 80–120 sampling points. Selecting 100 can fully cover typical abnormal patterns. The sliding step size is 20% of the window length, i.e., 20, to maintain computational overhead while ensuring detection sensitivity.

[0059] Starting from the beginning of the semantic element vector sequence, extract all semantic element vectors of the first continuous interval to form the first window; move the starting position of the window forward by one sliding step in time order, and extract the continuous semantic element vectors of the sliding step again to form the next window. Repeat the sliding and extraction operation until the end of the window exceeds the last element of the semantic element vector sequence; all extracted windows maintain the time order of the internal semantic element vectors and are arranged according to the order in which the windows were generated, outputting a set of element vector windows composed of windows.

[0060] Perform vector summation on each element vector window in the set of element vector windows, and output the window semantic state vector.

[0061] Specifically, iterate through each element vector window in the set of element vector windows. For each element vector window, align all semantic element vectors contained in the element vector window according to their dimensional positions, and sum the values ​​at the same dimensional position to obtain a summed result vector with the same dimension as the semantic element vector. The summed result vector is the window semantic state vector of the corresponding element vector window. After performing the same vector summation operation on all element vector windows, output a set composed of the semantic state vectors of each window.

[0062] The semantic state vectors of the window are arranged and combined in chronological order to output the semantic state time sequence vector.

[0063] Specifically, based on the generation order of the element vector windows in the set of element vector windows, which corresponds to the order of acquisition time of the semantic data in memory, the window semantic state vector corresponding to each element vector window is extracted in sequence, and all window semantic state vectors are connected in time order to form a vector sequence organized by time evolution, namely the semantic state time sequence vector.

[0064] S2. Perform cross-domain temporal alignment and related feature extraction on the semantic state temporal vector and memory performance index data, output the related feature set, and perform interpretable rule parsing on the related feature set to output memory association rules.

[0065] The semantic state time-series vector and memory performance index data are aligned at specific times, and the resulting set of memory data pairs is output.

[0066] Specifically, each window semantic state vector in the semantic state time sequence vector is associated with the collection timestamp, and each record in the memory performance index data is associated with the collection timestamp. Based on the time granularity, the semantic state vectors of the same window and the memory performance index data records are aligned. When the timestamp exists in one side but is missing in the other, the missing data is filled in using forward padding or linear interpolation. Forward padding means using the memory performance index data or window semantic state vector of the previous valid time point as the filler value, and linear interpolation means using the median value between the data of the two time points before and after the missing time point according to the time ratio as the filler value. The aligned window semantic state vectors and the corresponding memory performance index data form a one-to-one time sequence pair, and all time sequence pairs constitute a set of memory data pairs.

[0067] Dependency feature extraction is performed on the set of in-memory data, and the original associated feature sequence is output.

[0068] Specifically, the process iterates through each time-series pair in the memory data set. For each time-series pair, the window semantic state vector and memory performance index data are paired. Each dimension of the window semantic state vector is paired with the value of each performance index in the memory performance index data at the same time point. For each pair of variables, the Pearson correlation coefficient is calculated. The Pearson correlation coefficient is obtained by calculating the ratio of the product of the covariance and the standard deviation of the two variables. The Pearson correlation coefficients between all dimensions and all performance indices are organized into a two-dimensional matrix and expanded into a one-dimensional vector by rows. All one-dimensional vectors corresponding to the pair are arranged in chronological order, and the original associated feature sequence is output.

[0069] The formula for calculating the Pearson correlation coefficient is as follows:

[0070] ;

[0071] in, The Pearson correlation coefficient represents the relationship between the window semantic state vector and memory performance metrics. Indicates a time point identifier. Indicates the number of time points involved in the calculation. Indicates the first The numerical value of the window semantic state vector in the current dimension at each time point. Indicates the first The value of the current performance metric in the memory performance metric data at each point in time. The mean of the window semantic state vector. This represents the mean of memory performance metrics.

[0072] The original associated feature sequence is processed by recursive feature elimination to perform feature selection and dimension adjustment, and an associated feature set is output.

[0073] Specifically, the original associated feature sequence is used as input. Based on the numerical stability and magnitude of change of each feature dimension in the time dimension, the importance score of each feature dimension is determined (the standard deviation of each feature dimension in the time dimension is used as a measure of magnitude of change, and the reciprocal of the variance of each feature dimension in the time dimension is used as a measure of numerical stability; the measure of magnitude of change and the measure of numerical stability are weighted and fused to output the importance score); the feature dimension with the lowest importance score is removed, and the importance score of each of the remaining feature dimensions is re-determined; the removal and re-evaluation of importance are repeated, reducing one feature dimension in each iteration, until the number of retained feature dimensions equals the preset evaluation number; the retained feature dimensions are extracted from the original associated feature sequence and organized while maintaining the temporal structure to output the associated feature set.

[0074] Furthermore, the preset evaluation quantity is set to 30% of the total dimension of the original associated feature sequence, which is determined based on the average proportion of effective features in historical memory anomaly cases; the 30% ratio can significantly reduce redundancy and noise interference while retaining discriminative features, thus maintaining the accuracy of subsequent rule parsing and improving computational efficiency.

[0075] The decision tree inductive algorithm is used to learn rules from the associated feature set and output a preliminary set of rules.

[0076] Specifically, the associated feature set is input into the decision tree induction algorithm. The decision tree induction algorithm recursively selects splitting features based on the information gain index to split the associated feature set into nodes. That is, the information gain index is evaluated by comparing the reduction of data entropy before and after the split. The greater the reduction in entropy, the better the splitting effect. The decision tree induction algorithm selects the feature and splitting point that maximizes information gain as the splitting condition of the current node, divides the associated feature set into subsets according to the splitting condition, and recursively performs the same selection and splitting process on each subset to form a decision tree structure. All paths from the root node to the leaf node of the decision tree are traversed, and the feature splitting conditions and leaf node categories on each path are converted into logical rules in the form of conditions. All logical rules constitute a preliminary rule set.

[0077] The initial rule set is filtered by confidence level, and the confidence rule set is output.

[0078] Specifically, for each rule in the initial rule set, the number of times each rule is triggered on the historical memory operation semantic data and memory performance index data corresponding to the associated feature set, and the number of times memory anomalies actually occur after triggering, are counted. The number of memory anomalies is compared with the total number of triggers, and the ratio is the confidence level of each rule. A confidence level threshold is set, and rules with a confidence level greater than or equal to the confidence level threshold are retained, while rules with a confidence level less than the confidence level threshold are removed. All retained rules constitute the confidence rule set.

[0079] Furthermore, the confidence threshold was set to 0.85, determined based on backtesting analysis of historical memory anomaly cases: in a large number of known anomaly scenarios, the average confidence of effective rules is concentrated between 0.82 and 0.90; setting it to 0.85 can retain highly reliable rules while avoiding over-filtering of potentially useful rules. The confidence threshold can effectively suppress low-confidence rules generated by noise or accidental associations, improve the accuracy and interpretability of memory association rules, and ensure the stability of memory behavior inference. With the confidence threshold set to 0.85, a balance needs to be struck between rule reliability and coverage. If the threshold is too high (e.g., ≥0.95), effective but not absolutely certain rules will be eliminated, reducing the recall rate of anomaly detection; if the threshold is too low (e.g., ≤0.7), false rules generated by data noise or accidental co-occurrence will be introduced, affecting the accuracy of early warnings. After multiple rounds of offline verification, 0.85 can maintain a reasonable number of rules while maintaining a high accuracy rate, ensuring that subsequent memory behavior inferences have sufficient discriminative power and stability, and therefore it was selected as the confidence threshold.

[0080] Redundant rules are merged and structured in the set of confidence rules, and memory-associative rules are output.

[0081] Specifically, the process iterates through all confidence rules in the confidence rule set, identifies rule pairs with overlapping preconditions (preconditions refer to the feature dimensions and corresponding value constraints used in each confidence rule to determine whether the current confidence rule is triggered) and consistent conclusions, merges the preconditions of rule pairs into a unified range or set covering the values ​​of the rule pairs, forming a new merged rule set; the new merged rule set is then categorized according to the type of feature dimensions involved (such as function call related, code block identifier related, object type related, and memory performance index related), and within each category, it is arranged in ascending order of condition complexity, forming an ordered set of categorized rules as the memory association rule output.

[0082] By aligning semantic states and performance metrics across domains, extracting temporal correlation features, and combining recursive feature elimination with interpretable rule learning, an automatic mapping from low-level memory behavior to high-level anomaly patterns is achieved. It effectively integrates complementary information from semantic context and performance data, and ensures the reliability and readability of rules through confidence filtering and rule structuring. This provides a high-precision, low-redundancy, and interpretable foundation of memory correlation rules for real-time inference and causal tracing, significantly improving the accuracy and timeliness of memory anomaly warnings.

[0083] S3. Perform causal analysis on memory performance index data, output a set of causal edges, and construct a graph structure for the set of causal edges using the PC algorithm to output a causal graph of memory indexes.

[0084] Perform conditional independence tests on memory performance metrics and output the independence test results.

[0085] Specifically, two arbitrary performance metrics are selected from the memory performance metrics data as the variable pair to be judged, and different combinations are selected from the remaining performance metrics to form a condition set. For each combination of variable pair and condition set, a test method based on conditional mutual information is used. The dependency relationship is judged by statistically analyzing the conditional mutual information between any two performance metrics under the given condition set (whether there is still a correlation between the variable pair given the values ​​of each performance metric in the condition set, i.e., a change in one value causes a change in the other value). If the conditional mutual information is equal to zero, the current variable pair is considered to be conditionally independent under the current condition set; if the conditional mutual information is not equal to zero, the current variable pair is considered not to be conditionally independent under the current condition set. All variable pairs, corresponding condition sets, conditional mutual information values, and judgment results of whether conditional independence is satisfied are summarized and the independence test data is output.

[0086] Based on independence test data, undirected causal edges are discovered in memory performance index data, and a set of undirected causal edges is output.

[0087] Specifically, a fully connected undirected graph is initialized, where each node corresponds to a memory performance metric. Each record in the independence test data is traversed; if two memory performance metrics are conditionally independent under an empty condition set, the edge between the two nodes is removed from the graph. The process continues traversing all independence records under all condition sets. Whenever two memory performance metrics are found to be conditionally independent under a condition set, and the current condition set is included in the set of adjacent nodes of the two nodes in the current graph, the edge between the two nodes is removed. After processing all independence records, the remaining edges in the graph are the undirected causal edges, and all undirected causal edges constitute the undirected causal edge set.

[0088] The PC algorithm is used to infer the causal directionality of the undirected causal edge set and synthesize the directed acyclic graph structure, outputting a preliminary index causal graph.

[0089] Specifically, an initial undirected graph is constructed based on a set of undirected causal edges. All structures in the graph containing three nodes (three nodes refer to any three nodes interconnected in the form of "X—Y—Z", where there is no edge between X and Z, and Y is connected to both X and Z) are traversed. If the middle node is not in the set of conditions that make the two endpoint nodes independent, the directions from the two endpoint nodes to the middle node are determined. Based on the two directions from the endpoint nodes to the middle node, the remaining undirected edges are checked sequentially according to the direction propagation rules of the PC algorithm: if orienting the current undirected edge in one direction would lead to a loop in the graph, or conflict with the determined direction, another direction is chosen or the edge remains undirected. Only when the rule can uniquely determine a direction without creating a loop is the current edge oriented. Each orientation operation ensures that no loop is introduced and maintains consistency with the oriented edges. After orienting all edges with determinable directions, a directed graph without loops is generated; this directed graph is the preliminary causal graph.

[0090] Loop detection and elimination are performed on the preliminary causal graph of indicators, and the memory causal graph of indicators is output.

[0091] Specifically, a depth-first search algorithm is used to traverse the graph structure, recording the access paths and the direction of each edge. Once a cycle is found, the orientation relationships of the node nodes in the preliminary causal graph are analyzed, and undirected edges that can be adjusted without violating existing conditional independence are sought to break the cycle. If multiple edges can be used for adjustment, the adjustment target is selected based on the principle of maintaining consistency with the determined direction. Cycle detection and elimination are repeated until all cycles are eliminated, ensuring that no new cycles are generated in the graph structure, and the in-memory causal graph is output. The cycle detection and elimination process ensures that a cycle-free directed graph structure is obtained without destroying the original causal inference results.

[0092] S4. Based on memory association rules, perform memory behavior inference on real-time memory operation semantic data, generate memory behavior prediction data, compare the deviation between memory behavior prediction data and memory performance index data, output memory anomaly warning data, and perform causal tracing and report integration on memory anomaly warning data through memory index causal graph, and output memory anomaly warning report.

[0093] Based on memory association rules, rule matching and rule mapping are performed on real-time memory runtime semantic data, and a real-time mapping result vector is output.

[0094] Specifically, the real-time memory runtime semantic data is processed by semantic element mapping and temporal aggregation to obtain the semantic state vector corresponding to the current time window. The preconditions in the memory association rules are compared one by one to determine whether the semantic state vector satisfies each rule (satisfying each rule means that the value of each feature dimension involved in the semantic state vector conforms to the corresponding constraint in the current memory association rule). For all satisfied rules, the corresponding conclusion category is recorded. According to the predefined category dimension mapping relationship in the memory association rules, the current corresponding dimension is set to 1 and the remaining dimensions are set to 0 in the result vector, and the resulting binary vector is the real-time mapping result vector.

[0095] Furthermore, the predefined category-dimensional mapping relationship is established during the rule generation phase: the conclusion category of each memory association rule (such as page fault, memory leak, and allocation delay) is assigned a globally unique integer number, which corresponds to a fixed dimension position in the real-time mapping result vector; all possible conclusion categories are uniformly numbered in the order of their first appearance, forming a one-to-one mapping table from conclusion category to vector dimension index; the mapping table is fixed after the rule parsing is completed and remains unchanged in subsequent real-time inferences.

[0096] The parameterized vector derivation of the real-time mapping result vector is performed to output the preliminary memory prediction sequence.

[0097] Specifically, the binary activation state of each dimension in the real-time mapping result vector is multiplied bit by bit with a preset memory behavior parameter template (for each conclusion category, such as page faults and memory leaks, the mean or typical change pattern of the memory performance index corresponding to the occurrence of the conclusion category is extracted from historical memory performance index data to form a real number vector consistent with the memory performance index dimension; the real number vector serves as the memory behavior parameter template corresponding to the current conclusion category and is bound to the corresponding dimension in the real-time mapping result vector; the templates of all conclusion categories together constitute a complete memory behavior parameter template set), where each dimension corresponds to a fixed... A fixed-length real-number vector is generated during the memory association rule generation stage based on the statistical characteristics of historical memory performance index data (statistical characteristics refer to the mean and variance of various performance indicators associated with specific conclusion categories, such as page faults and memory leaks). The real-number vectors corresponding to the dimensions with a value of 1 in the real-time mapping result vector are accumulated in the same position to obtain a composite vector consistent with the dimensions of the memory performance index. The composite vectors of multiple time points are processed continuously in a sliding window manner to form a vector sequence arranged in chronological order. This vector sequence is the preliminary memory prediction sequence.

[0098] The initial memory prediction sequence is integrated and formatted to generate memory behavior prediction data.

[0099] Specifically, the composite vectors at each time point in the initial memory prediction sequence are aligned dimensionally according to the field order of the memory performance index data to ensure that the positions of each performance index are consistent. The composite vectors at consecutive time points are timestamped, with the timestamps synchronized with the acquisition time of the real-time memory operation semantic data. The timestamped composite vectors are converted into structured records according to the output format (including index name, value, and timestamp). This involves obtaining the index names of each performance index in the memory performance index data; the index names define the semantic meaning of each dimension of the composite vector. Each dimension of the composite vector is traversed, and the value of the current dimension is paired with the corresponding index name. The index name, value, and the timestamp of the current time point are then combined into a triplet. Each triplet constitutes a structured record, representing the predicted value of a certain memory performance index at a certain moment. All structured records are combined in chronological order to generate memory behavior prediction data.

[0100] The deviation between memory behavior prediction data and memory performance index data is compared, and memory anomaly warning data is output.

[0101] Specifically, records with the same timestamp in the memory behavior prediction data and memory performance indicator data are matched to ensure alignment in the time dimension. For each timestamp, all performance indicator names are traversed, and the predicted value of the current performance indicator in the memory behavior prediction data is calculated with the actual value of the corresponding performance indicator in the memory performance indicator data. If the absolute value of the difference exceeds the preset deviation threshold of the performance indicator, the current performance indicator at the current time point is marked as abnormal; if the absolute value of the difference does not exceed the preset deviation threshold of the performance indicator, the current performance indicator at the current time point is marked as normal. All marked abnormal performance indicators, timestamps, predicted values, actual values, and deviations are organized into structured entries, and all structured entries constitute memory anomaly warning data.

[0102] Furthermore, the preset deviation threshold is set based on the fluctuation range of historical memory performance index data under normal operating conditions. Specifically, the value is half the width of the upper and lower limit interval formed by adding or subtracting twice the standard deviation of the mean of each performance index in historical normal data. For example, if the historical normal mean of the performance index is 100 and the standard deviation is 15, then the deviation threshold is set to 30. The setting is based on statistical process control theory, which can cover about 95% of normal fluctuations under normal distribution, effectively distinguishing significant deviations caused by real anomalies from regular random fluctuations, and taking into account both sensitivity and robustness.

[0103] The system identifies abnormal performance indicators from memory anomaly warning data and outputs a set of abnormal indicator nodes.

[0104] Specifically, the structured entries in the memory anomaly warning data are read one by one. Each structured entry contains a timestamp, performance metric name, predicted value, actual value, and deviation. The performance metric name field is extracted from each structured entry. The performance metric name field clearly identifies the specific memory performance metric where the anomaly occurred, such as "page fault count," "resident set size," or "memory allocation frequency." All extracted performance metric names are collected in order of appearance and deduplicated to ensure that each performance metric name is retained only once. According to the node naming convention defined in the memory metric cause-effect graph, it is verified whether the extracted performance metric name has a corresponding node in the memory metric cause-effect graph. For performance metric names that exist in the memory metric cause-effect graph, the corresponding node is included in the result set. The set of all nodes that meet the conditions is the anomaly metric node set.

[0105] In the causal graph of memory metrics, reverse causal path tracing is performed on the set of abnormal metric nodes to output the set of root cause metric nodes.

[0106] Specifically, starting from each node in the set of abnormal indicator nodes, a depth-first search is performed in the reverse direction of the directed edges in the memory indicator causal graph. That is, starting from each abnormal indicator node, all direct parent nodes pointing to the current node are searched; the parent node is added to the queue of nodes to be expanded, and the parent node search operation is repeated for each parent node, recursively tracing back to its own parent node until a node with no incoming edges (i.e., a node with an in-degree of zero) is reached.

[0107] During the tracing process, all traversed nodes and their causal paths with the starting abnormal node are recorded. To avoid redundant calculations and loop interference, an access marking mechanism is used to ensure that each node is processed only once. After tracing all abnormal indicator nodes, all head nodes with an in-degree of zero and located on at least one backtracking path from the abnormal indicator node are collected. If an intermediate node does not have an in-degree of zero but appears frequently in multiple backtracking paths and is not marked as abnormal, it is also considered a potential root cause. All head nodes and intermediate nodes that meet the root cause determination criteria are combined into a root cause indicator node set.

[0108] The root cause indicator node set and the abnormal indicator node set are fused and the report is formatted to output a memory anomaly warning report.

[0109] Specifically, each node in the abnormal indicator node set is associated with the corresponding memory anomaly warning data entry, and the timestamp, actual value, predicted value, and deviation are extracted; each node in the root cause indicator node set is associated with the causal path information in the memory indicator causal graph, and the tracing path from each node to each abnormal indicator node is recorded; the anomaly occurrence time, abnormal performance indicator name and deviation details, the corresponding root cause performance indicator name, and the causal path description from the root cause to the anomaly are organized to form structured text; the structured text is encapsulated and a memory anomaly warning report is output.

[0110] This embodiment also provides a computer device applicable to the memory anomaly warning method based on data mining, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the memory anomaly warning method based on data mining as proposed in the above embodiment.

[0111] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0112] This embodiment also provides a storage medium storing a computer program, which, when executed by a processor, implements the memory anomaly warning method based on data mining as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0113] In summary, this invention achieves interpretable early warning and root cause localization of memory anomalies through a dual-mechanism approach of constructing semantic state temporal vectors and generating memory indicator causal graphs. By mapping memory runtime semantic data to semantic element vectors and performing temporal aggregation, a quantitative correlation is established between high-level semantics and low-level memory behavior, enabling interpretable representation of memory anomaly patterns caused by code logic. Through causal analysis of memory performance indicator data and the application of the PC algorithm to construct a memory indicator causal graph, the graph reveals the causal influence paths and directions between various performance indicators within memory, establishing a reverse tracing network for anomaly indicators. In the early warning phase, the behavioral deduction driven by semantic state temporal vectors and the causal tracing supported by the memory indicator causal graphs combine to ensure that the output memory anomaly early warning report simultaneously includes the program semantic features that triggered the anomaly and the root cause indicator chain leading to the anomaly.

[0114] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A memory anomaly early warning method based on data mining, characterized in that: include, Collect memory operation semantic data and memory performance index data, perform semantic element mapping on the memory operation semantic data, generate semantic element vectors, perform temporal aggregation on the semantic element vectors, and output semantic state temporal vectors. Cross-domain temporal alignment and associated feature extraction are performed between semantic state temporal vectors and memory performance index data to output associated feature sets. Interpretable rule parsing is then performed on the associated feature sets to output memory association rules. Perform causal analysis on memory performance metrics data, output a set of causal edges, and construct a graph structure from the set of causal edges using the PC algorithm to output a causal graph of memory metrics. Memory behavior is inferred from real-time memory operation semantic data according to memory association rules, generating memory behavior prediction data. The deviation between the memory behavior prediction data and memory performance index data is compared, and memory anomaly warning data is output. Specifically, records with the same timestamp in the memory behavior prediction data and memory performance index data are matched to ensure that the two are aligned in the time dimension. For each timestamp, all performance index names are traversed, and the difference between the predicted value of the current performance index in the memory behavior prediction data and the actual value of the corresponding performance index in the memory performance index data is calculated. If the absolute value of the difference exceeds the preset deviation threshold of the performance indicator, the current performance indicator at the current time point is marked as abnormal; if the absolute value of the difference does not exceed the preset deviation threshold of the performance indicator, the current performance indicator at the current time point is marked as normal. All marked abnormal performance indicators, timestamps, predicted values, actual values, and deviations are organized into structured entries, and all structured entries constitute memory anomaly early warning data; Furthermore, the cause-effect graph of memory indicators is used to trace the cause of memory anomaly warning data and integrate the reports, and output memory anomaly warning reports.

2. The memory anomaly early warning method based on data mining as described in claim 1, characterized in that: The specific steps for mapping semantic elements into semantic elements of memory-based semantic data to generate semantic element vectors are as follows: Separate data elements from the semantic data of memory operation and output a set of structured semantic elements; The structured semantic element set is encoded and transformed into a vector, and the original semantic vector is output. The original semantic vectors are scaled using a normalization method to generate semantic element vectors.

3. The memory anomaly early warning method based on data mining as described in claim 2, characterized in that: The specific steps for performing temporal aggregation on semantic element vectors to output semantic state temporal vectors are as follows: The semantic element vectors are divided into windows according to the temporal order of the collected semantic data in memory, and the set of element vector windows is output. Perform vector summation on each element vector window in the set of element vector windows, and output the window semantic state vector; The semantic state vectors of the window are arranged and combined in chronological order to output the semantic state time sequence vector.

4. The memory anomaly early warning method based on data mining as described in claim 3, characterized in that: The specific steps for performing cross-domain temporal alignment and associated feature extraction between semantic state temporal vectors and memory performance index data, and outputting an associated feature set, are as follows: Perform time-point alignment processing on the semantic state temporal vector and memory performance index data, and output a set of memory data pairs; Extract dependency features from the set of in-memory data and output the original sequence of related features. The original associated feature sequence is processed by recursive feature elimination to perform feature selection and dimension adjustment, and an associated feature set is output.

5. The memory anomaly early warning method based on data mining as described in claim 4, characterized in that: The specific steps for parsing the associated feature set into interpretable rules and outputting memory association rules are as follows: The decision tree inductive algorithm is used to learn rules from the associated feature set and output a preliminary set of rules. Filter the initial rule set by confidence level and output the confidence rule set; Redundant rules are merged and structured in the set of confidence rules, and memory-associative rules are output.

6. The memory anomaly early warning method based on data mining as described in claim 5, characterized in that: The steps involve performing causal analysis on memory performance metrics data, outputting a set of causal edges, and constructing a graph structure from these edges using a PC algorithm to output a causal graph of memory metrics. Perform conditional independence tests on memory performance metrics and output the independence test data; Based on independence test data, undirected causal edges are discovered in memory performance index data, and a set of undirected causal edges is output. The PC algorithm is used to infer the causal directionality of the undirected causal edge set and synthesize the directed acyclic graph structure, outputting a preliminary index causal graph. Loop detection and elimination are performed on the preliminary causal graph of indicators, and the memory causal graph of indicators is output.

7. The memory anomaly early warning method based on data mining as described in claim 1, characterized in that: The specific steps for performing memory behavior inference on real-time memory operation semantic data according to memory association rules and generating memory behavior prediction data are as follows: Based on memory association rules, perform rule matching and rule mapping on real-time memory runtime semantic data, and output a real-time mapping result vector; The parameterized vector derivation is performed on the real-time mapping result vector to output a preliminary memory prediction sequence; The initial memory prediction sequence is integrated and formatted to generate memory behavior prediction data.

8. The memory anomaly early warning method based on data mining as described in claim 1, characterized in that: The specific steps for performing causal tracing and report integration of memory anomaly warning data through a causal graph of memory indicators, and outputting a memory anomaly warning report, are as follows: Identify abnormal performance indicators from memory anomaly warning data and output a set of abnormal indicator nodes; In the memory metric causal graph, reverse causal path tracing is performed on the set of abnormal metric nodes to output the set of root cause metric nodes. The root cause indicator node set and the abnormal indicator node set are fused and the report is formatted to output a memory anomaly warning report.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the memory anomaly early warning method based on data mining as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the memory anomaly early warning method based on data mining as described in any one of claims 1 to 8.

Images