Service dependence information determination method and device and electronic equipment

Abstract

The invention discloses a service dependency information determination method and device and electronic equipment. A target service container corresponding to a service dependency extraction request is determined; matching a to-be-processed file associated with the target service container according to preset keyword information and a preset network endpoint format, and determining a first candidate file and first character string information; according to the first character string information, recognizing a preset number of preorder characters in front of each first character string based on a preorder word classification model, and determining a preorder character recognition result; screening the first character string information according to the preorder character recognition result, and determining second character string information; identifying a second candidate file corresponding to the second character string information according to a file classification model, and determining file attributes; and taking the second candidate file of which the file attribute is consistent with the preset file attribute as the target configuration file, and obtaining the target service dependency information based on the second character string information of the target configuration file, so that the efficiency of extracting the service dependency information is improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, and electronic device for determining service dependency information. Background Technology

[0002] In a containerized microservice environment, in order to ensure the security and stability of service containers, it is usually necessary to determine the service dependency information of the microservices in the service containers. The service dependency information is detailed data used to characterize the key resources, configurations and external services required for the operation of the microservices in the service containers.

[0003] Currently, service dependency information is mainly extracted through two methods. The first is by monitoring and analyzing network traffic to determine service dependencies. However, this method often requires capturing sufficient data samples over a long period to infer service dependencies, resulting in low efficiency in obtaining service dependency information. The second method is by analyzing source code to determine service dependencies. However, in real-world applications, service source code is often unavailable, hindering the extraction and processing of service dependency information. Summary of the Invention

[0004] This invention provides a method, apparatus, and electronic device for determining service dependency information, which improves the efficiency of extracting service dependency information and ensures the integrity and accuracy of the target service dependency information.

[0005] According to one aspect of the present invention, a method for determining service dependency information is provided, the method comprising: Upon receiving a service dependency extraction request, determine the target service container corresponding to the service dependency extraction request; Based on preset keyword information and preset network endpoint format, at least one file to be processed associated with the target service container is matched to determine at least one first candidate file and first string information corresponding to each first candidate file; wherein, the first string information includes: at least one first string and the position information of each first string in the first candidate file; For at least one first candidate file, based on the position information of each first string, a pre-trained preceding word classification model is used to identify a preset number of preceding characters before each first string in the first candidate file, and the preceding character recognition result corresponding to each first string is determined. Based on the preceding character recognition results, the first string information corresponding to each first candidate file is filtered and processed to determine the second string information, and at least one second candidate file corresponding to the second string information is determined; wherein, the second candidate file is a file in at least one first candidate file; Based on a pre-trained file classification model, the text content of at least one second candidate file is identified and processed to determine the file attributes corresponding to each second candidate file. The second candidate file whose file attributes match the preset file attributes is used as the target configuration file, and the target service dependency information corresponding to the target service container is obtained based on the second string information corresponding to the target configuration file; wherein, the target service dependency information is used to characterize the information that the microservices in the target service container depend on for running.

[0006] According to another aspect of the present invention, a service dependency information determination apparatus is provided, the apparatus comprising: The container determination module is used to determine the target service container corresponding to the service dependency extraction request when a service dependency extraction request is received. The string determination module is used to match at least one file to be processed associated with the target service container based on preset keyword information and preset network endpoint format, and determine at least one first candidate file and first string information corresponding to each first candidate file; wherein, the first string information includes: at least one first string and the position information of each first string in the first candidate file; The character recognition module is used to, for at least one first candidate file, recognize a preset number of preceding characters before each first string in the first candidate file based on the position information of each first string and a pre-trained preceding word classification model, and determine the preceding character recognition result corresponding to each first string; The string filtering module is used to filter the first string information corresponding to each first candidate file based on the recognition result of the preceding characters, determine the second string information, and determine at least one second candidate file corresponding to the second string information; wherein, the second candidate file is a file in at least one of the first candidate files; The file attribute determination module is used to identify the text content of at least one second candidate file based on a pre-trained file classification model, and determine the file attributes corresponding to each second candidate file. The service dependency information determination module is used to select a second candidate file whose file attributes match the preset file attributes as the target configuration file, and obtain the target service dependency information corresponding to the target service container based on the second string information corresponding to the target configuration file; wherein, the target service dependency information is used to characterize the information that the microservices in the target service container depend on for operation.

[0007] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory that is communicatively connected to at least one processor; wherein, The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the service dependency information determination method of any embodiment of the present invention.

[0008] According to another aspect of the present invention, a computer-readable storage medium is provided that stores computer instructions for causing a processor to execute and implement the service dependency information determination method of any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, characterized in that the computer program, when executed by a processor, implements a service dependency information determination method as described in any embodiment of the present invention.

[0010] The technical solution of this invention, upon receiving a service dependency extraction request, determines the target service container corresponding to the request, matches at least one file to be processed associated with the target service container based on preset keywords and preset network endpoint formats, and determines at least one first candidate file and a first string information corresponding to each first candidate file. This achieves traversal processing of all files containing potential service dependency information in the target service container, avoiding omissions of service dependency information and ensuring the completeness of subsequently determined service dependency information. For at least one first candidate file, based on the position information of each first string, a pre-trained prefix word classification module is used to identify a preset number of prefix characters before each first string in the first candidate file, determining the prefix character recognition result corresponding to each first string. Based on the prefix character recognition result, the first string information corresponding to each first candidate file is filtered to determine second string information and at least one second candidate file corresponding to the second string information. Based on a pre-trained file classification model, the text content of at least one second candidate file is identified to determine the file attributes of each second candidate file. The second candidate file whose file attributes match the preset file attributes is used as the target configuration file. By identifying preceding characters and determining file attributes, irrelevant information is effectively eliminated, reducing misidentified network endpoint information and making the subsequently determined target service dependency information more accurate. Based on the second string information corresponding to the target configuration file, the target service dependency information corresponding to the target service container is obtained, and a network isolation strategy is generated based on this information. This invention eliminates the need to obtain application source code or rely on a cumbersome and lengthy traffic collection process. By quickly identifying the service dependencies of microservices within the target service container through files associated with it, it improves the efficiency of service dependency extraction, meeting the speed requirements of practical applications. It solves the problems of existing technologies where source code cannot be obtained, network traffic monitoring is insufficient to obtain complete service dependency information, and service dependency information extraction efficiency is low. Furthermore, by performing progressive filtering on the files to be processed corresponding to the target service container, erroneous dependency information is eliminated, ensuring that the target service dependency information represents the service connections required by the actual application, guaranteeing the completeness and accuracy of dependency extraction. In addition, this invention can recognize and process files in various formats such as JSON, YAML, and XML, and even custom formats, demonstrating strong versatility and applicability. Service dependency information is extracted through static analysis, which does not require the service to reside and run in the target service container for an extended period, thus having minimal impact on service performance. In practical application deployments, embodiments of this invention can be integrated into the operation and maintenance process of containerized applications as a standalone tool, enabling secure and automatic configuration of network isolation policies based on the determined target service dependency information, thereby enhancing the security protection capabilities of microservice systems.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a method for determining service dependency information provided in an embodiment of the present invention; Figure 2 This is an example diagram of an algorithm for determining service dependency information provided in an embodiment of the present invention; Figure 3 This is an example diagram of the algorithm for determining the first string provided in an embodiment of the present invention; Figure 4 This is a flowchart of the algorithm for determining the second string information provided in an embodiment of the present invention; Figure 5 This is a flowchart of the algorithm for determining the second string information corresponding to the target configuration file provided in an embodiment of the present invention; Figure 6 This is a flowchart of a method for determining service dependency information provided in an embodiment of the present invention; Figure 7 This is a flowchart of an algorithm for determining network endpoint information corresponding to environmental variables, provided by an embodiment of the present invention. Figure 8 This is a schematic diagram of the structure of a service dependency information determination device provided in an embodiment of the present invention; Figure 9 This is a schematic diagram of the structure of an electronic device that implements the service dependency information determination method of this invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Example 1 Figure 1 This is a flowchart of a service dependency information determination method provided in Embodiment 1 of the present invention. This embodiment is applicable to containerized microservice environments, where service dependency information corresponding to a target service container is determined through a configuration file corresponding to the target service container. This method can be executed by a service dependency information determination device, which can be implemented in hardware and / or software. This service dependency information determination device can be configured in electronic devices such as mobile phones, computers, or servers. Figure 1 As shown, the method includes: S110. Upon receiving a service dependency extraction request, determine the target service container corresponding to the service dependency extraction request.

[0017] The service dependency extraction request can be a request to extract service dependencies from a service container. The service container corresponding to the service dependency extraction request is designated as the target service container. The target service container can be a container that hosts a predefined microservice instance.

[0018] Specifically, in a containerized microservice environment, when a service dependency extraction request is received, the request is parsed and processed to determine the target service container corresponding to the service dependency extraction request.

[0019] In this embodiment of the invention, after determining the target service container, the method further includes: traversing all original files associated with the target service container, so that when it is detected that the directory to which the original file belongs is not a preset directory and the text content of the original file conforms to a preset text format, the original file is taken as a file to be processed, so as to obtain at least one file to be processed.

[0020] The original files associated with the target service container can be files in the working directory of the target service container, or all files contained in the root directory of the target service container. The default directories can be pre-defined directories corresponding to the target service container that are unrelated to the application configuration. Optionally, the default directories can be system binary and library file directories (e.g., / bin, / sbin, / lib, / lib64, etc.), documentation directories (e.g., / doc, etc.), log and temporary directories (e.g., / log, / tmp, / cache, etc.), dependent module directories (e.g., / node_modules, / vendor, / dist, etc.), and pseudo-filesystem directories ( / proc, / dev, / sys, / run, etc.).

[0021] The preset text format can be a pre-defined standard file format. Optionally, the preset file format can be plaintext. The file to be processed can be a plaintext file determined from all the original files, not belonging to the preset directory.

[0022] Specifically, if the target service container defines an application working directory, file traversal is performed based on the working directory to avoid invalid traversal. If the target service container does not define a working directory, file recursively traversal is performed from the root file directory of the target service container to achieve traversal processing of all original files associated with the target service container. During the traversal of original files, to improve traversal efficiency, original files whose directories are preset directories are removed. Furthermore, since the configuration files corresponding to service dependency information are usually in plaintext format, the file content of the original files is validated. If the text content of the original file contains unreadable characters, the original file is removed to eliminate interference from binary files. Original files whose directories are not preset directories and whose text format is plaintext are designated as pending files to determine at least one pending file corresponding to the target service container.

[0023] S120. Based on preset keyword information and preset network endpoint format, match at least one file to be processed associated with the target service container to determine at least one first candidate file and first string information corresponding to each first candidate file; wherein, the first string information includes: at least one first string and the position information of each first string in the first candidate file.

[0024] The preset keyword information can be pre-set keywords associated with service dependencies. Multiple preset keywords can be included. For example, preset keyword information may include: "host", "url", "api", "interface", "remote", "server", "address", "connect", etc.

[0025] The default network endpoint format can be a pre-defined standard format for network endpoint information corresponding to service dependencies. This network endpoint information can be the accessible address or identifier of the microservice on the network. For example, network endpoint information can be a hostname, IP address, port number, etc. Accordingly, the default network endpoint format can be a standard format for network endpoint information.

[0026] The first candidate file can be a file to be processed that includes at least one preset keyword corresponding to preset keyword information and network endpoint information corresponding to a preset network endpoint format. The first string can be a string in the first candidate file corresponding to the network endpoint information in the preset network endpoint format. The position information of the first string in the first candidate file is used to characterize the string position of the first string in the corresponding first candidate file.

[0027] Specifically, for at least one file to be processed associated with the target service container, the file content of each file to be processed is matched according to the preset keyword information and the preset network endpoint format. When it is detected that the file content includes at least one preset keyword corresponding to the preset keyword information and the network endpoint information corresponding to the preset network endpoint format, the file to be processed is determined as the first candidate file, and the string corresponding to the network endpoint information of the preset network endpoint format in the first candidate file is determined as the first string, and the position information of the first string is recorded.

[0028] For example, see Figure 2 and Figure 3 , Figure 2 This is an example diagram of an algorithm for determining service dependency information; Figure 3 This is an example diagram of the algorithm for determining the first string.

[0029] Figure 2 Service containers in This corresponds to the target service container mentioned above. The network endpoint set corresponds to the target service dependency information to be determined. A predefined exclusion directory. This corresponds to the preset directory mentioned above. Figure 2 In , corresponding to Figure 3 The specific processing steps in the process.

[0030] Figure 3 Service address set in Corresponding to the preset keyword information and preset network endpoint format mentioned above, the container working directory The excluded directory set corresponds to the directories of all original files associated with the target service container mentioned above. This corresponds to the set of directories after excluding the preset directories. Network endpoint candidate set. This corresponds to the first string of information mentioned above.

[0031] Based on service address set Determine the set of service addresses The matching regular expression is used to perform regular expression matching on the corresponding file content. (For the container's working directory...) Iterate through all the original files in the directory to determine the directory and filename of each original file. If the directory containing the original file belongs to an excluded directory set or if the original file contains unreadable characters, then the original file is removed to obtain at least one file to be processed. Based on regular expressions matching the service address set, the content of each file to be processed is matched. When a file is detected to contain at least one preset keyword ("host", "url", "api", etc.) corresponding to preset keyword information and network endpoint information corresponding to a preset network endpoint format (such as a string in IP address format, domain name, or specific port number), the file to be processed is identified as a first candidate file, and all first string information in all first candidate files is obtained, i.e., the network endpoint candidate set. .

[0032] Optionally, the method for determining the first candidate file and the first string information may be: scanning and processing at least one file to be processed associated with the target service container, so that when it is detected that the file to be processed includes at least one preset keyword corresponding to preset keyword information and network endpoint information in a preset network endpoint format, the file to be processed is determined as the first candidate file, and the string in the first candidate file corresponding to the network endpoint information is used as the first string.

[0033] Specifically, a regular expression is determined based on preset keyword information and preset network endpoint format. For at least one file to be processed associated with the target service container, the file content of each file to be processed is subjected to regular expression matching to obtain a matching result. When the matching result indicates that the file to be processed contains at least one preset keyword corresponding to the preset keyword information and network endpoint information in the preset network endpoint format, the file to be processed is designated as the first candidate file, and the string corresponding to the network endpoint information in the first candidate file is designated as the first string, along with the position information of the first string within the first candidate file.

[0034] S130. For at least one first candidate file, based on the position information of each first string, a pre-trained preceding word classification model is used to identify a preset number of preceding characters before each first string in the first candidate file, and the preceding character recognition result corresponding to each first string is determined.

[0035] The preceding word classification model can be a pre-trained machine learning model used to identify a predetermined number of preceding characters before the first string in the first candidate file, to determine whether these preceding characters contain a predetermined keyword. The predetermined number can be a pre-set number of characters, for example, 50 characters. The preceding characters are the characters preceding the first string in the first candidate file. The preceding characters can be determined based on the position information of the first string. The preceding character recognition result is used to characterize whether the predetermined number of preceding characters includes the predetermined keyword corresponding to the predetermined keyword information.

[0036] Specifically, since the first string determined solely by regular expression matching based on preset keyword information and preset network endpoint format may not actually be a string related to the configuration dependency—for example, if the first candidate file is a descriptive text file, the hostname appearing in the descriptive text file and the first string corresponding to the hostname are not strings related to service dependencies—for at least one first candidate file, a pre-trained prefix word classification model can be used to determine whether a preset number of prefix characters in each first string of the first candidate file belong to the preset keywords in the preset keyword information.

[0037] The specific processing can be as follows: Based on the position information of each first string, determine a preset number of preceding characters before each first string. Perform word extraction processing on the preset number of preceding characters to determine the preceding word of the first string, where the preceding word is the first word preceding the first string. Recognize the preceding word based on a pre-trained preceding word classification model to obtain the preceding character recognition result corresponding to the first string.

[0038] S140. Based on the preceding character recognition results, filter and process the first string information corresponding to each first candidate file to determine the second string information, and determine at least one second candidate file corresponding to the second string information.

[0039] The second string information may include at least one second string and its position information within the candidate files. The second string may be a first string whose preceding word is a preset keyword from the preset keyword information. The second candidate file may be the first candidate file to which the second string information belongs. It should be noted that if none of the first strings in a first candidate file are second strings, then the first candidate file is discarded. A second candidate file is a file within at least one first candidate file.

[0040] Specifically, based on the recognition results of the preceding characters corresponding to each first string, the first string containing the preset keyword information corresponding to the preset keyword information among the preset number of preceding characters is determined as the second string. The position information of the second string is determined based on the position information of the first string. The position information of the second string and the second string are used as the second string information. The first candidate file corresponding to the second string information is then used as the second candidate file.

[0041] Optionally, the second string information can be determined as follows: if, based on the recognition result of the preceding characters, a preset number of preceding characters include a preset keyword corresponding to the preset keyword information, the first string corresponding to the preceding characters is taken as the second string; the second string information is determined based on the position information corresponding to at least one second string and the second string.

[0042] Specifically, for each first string in each first candidate file, if the preceding word of the first string is a preset keyword, the first string is taken as the second string, the first candidate file to which the second string belongs is determined as the second candidate file, and the position information of the first string in the first candidate file is taken as the position information of the second string in the second candidate file.

[0043] For example, in conjunction with the above examples, see Figure 2 and Figure 4 , Figure 4 This is a flowchart of the algorithm for determining the second string information. Figure 2 middle , corresponding to Figure 4 The specific processing steps in the process. This corresponds to the second string of information mentioned above.

[0044] Figure 4 The network endpoint candidate set generated by the keyword filtering algorithm in [the context of the algorithm]. Corresponding to the first string of information mentioned above, the filtered network endpoint candidate set Corresponding to the second string information mentioned above, the aforementioned word corresponds to the preceding word in the aforementioned preset number of preceding characters.

[0045] For the first string of each first candidate file, an index is built based on the position information of each first string to determine a preset number of preceding characters. These preset number of preceding characters are then extracted to determine the aforementioned words (preceding words). If the aforementioned word is a preset keyword in the preset keyword information, the first string corresponding to the aforementioned word is used as the second string to obtain the second string information. .

[0046] For example, if the first candidate file is a package.json file, and the first string in the package.json file is "mariadb", the first 50 characters of this first string are identified to determine the preceding word. Then, a preceding word classification model is used to identify the preceding word, which is determined to be "and". Since this preceding word does not belong to any of the preset keywords in the preset keyword information, the first string is discarded. As another example, if the first string is "mysql-db", after character identification by the preceding word classification model, its preceding word is determined to be "host". This preceding word belongs to any of the preset keywords in the preset keyword information, so the first string is used as the second string. Based on the above, false positive strings unrelated to service dependencies can be filtered out, improving the accuracy of the subsequently determined target service dependency information.

[0047] S150. Based on the pre-trained file classification model, the text content of at least one second candidate file is identified and processed to determine the file attributes corresponding to each second candidate file.

[0048] The file classification model can be used to identify file attributes of the second candidate file. File attributes indicate whether the second candidate file is a configuration file or another type of file. Other types of files can include log files, sample code files, or documentation files.

[0049] Specifically, for at least one second candidate file, the file content of each second candidate file is identified based on a pre-trained file classification model to determine whether each second candidate file is a configuration file or other file, so as to obtain the file attributes of each second candidate file.

[0050] Optionally, to avoid extracting irrelevant string information from non-configuration files, a file classification model can be trained first. This trained model can then be used to identify file attributes of the second candidate file. The file classification model can be the one determined by the FastText model. The output is set to "two categories": one for "configuration files" and the other for "other files".

[0051] Multiple raw file samples of various suspected configuration files were obtained. These raw file samples covered common configuration file extensions such as .json, .yaml, .ini, .xml, .toml, .cfg, and .properties. For example, 58,521 raw file samples of suspected configuration files were obtained.

[0052] Multiple original file samples are deduplicated and filtered to identify the true configuration file samples and determine the theoretical file attributes corresponding to the configuration file samples. For example, deduplication and filtering are performed on 58,521 suspected configuration file samples to obtain 30,532 configuration file samples.

[0053] Meanwhile, multiple non-configuration file samples were collected from various open-source projects, and the theoretical file attributes corresponding to these samples were determined to be "other files". For example, 46,312 non-configuration file samples (including source code, scripts, documentation, and other resource files) were collected from each of the open-source projects such as WordPress, phpMyAdmin, Drupal, Kibana, and Elasticsearch as file samples for the "other files" category.

[0054] Based on multiple configuration file samples and multiple non-configuration file samples, the file classification model to be trained is processed to obtain the actual file attributes corresponding to each file sample. Based on the actual file attributes and theoretical file attributes, a loss value is determined, and the model parameters of the file classification model to be trained are adjusted based on the loss value to obtain a well-trained file classification model. For example, the aforementioned approximately 30k configuration file samples and 46k non-configuration file samples are mixed as a training set (split into 80% training and 20% testing, and the model parameters are adjusted to focus on improving the recall rate for configuration file recognition), and the file classification model to be trained is then obtained.

[0055] S160. The second candidate file whose file attributes match the preset file attributes is used as the target configuration file, and the target service dependency information corresponding to the target service container is obtained based on the second string information corresponding to the target configuration file.

[0056] The preset file attributes can be configuration file attributes. The target configuration file can be a file containing service dependency information, selected from at least one second candidate file. The target service dependency information is used to characterize the information that the microservices in the target service container depend on for operation. In other words, the target service dependency information can be used to characterize the network endpoint information that the microservices in the target service container depend on for operation.

[0057] Specifically, when processing each second candidate file based on the trained file classification model, the complete text content of the second candidate file is analyzed by the file classification model to determine the corresponding file attributes. When the file attribute is a configuration file, the second candidate file is used as the target configuration file, and the network endpoint information corresponding to the second string of the target configuration file is determined. When the file attribute is not a configuration file, the second candidate file is discarded. Based on the network endpoint information corresponding to all second strings of all target configuration files, the target service dependency information is obtained. Through the above processing, the accurate extraction of service dependency information from configuration files can be further ensured, avoiding misidentification caused by similar content appearing in some non-configuration files, and improving the accuracy and reliability of service dependency information extraction.

[0058] For example, many application source code repositories may contain sample configuration snippets or default value descriptions. By using a file classification model to identify these second candidate files, these second candidate files will not be mistakenly treated as configuration files for dependency extraction, thereby further improving the accuracy of service dependency information.

[0059] For example, in conjunction with the above examples, see Figure 2 and Figure 5 , Figure 5 The flowchart illustrates the algorithm for determining the second string information corresponding to the target configuration file. Figure 2 In , corresponding to Figure 5 The specific processing procedure. This represents all the information in the second string. This represents the second string of information corresponding to the target configuration file.

[0060] Figure 5 Network Configuration Candidate Set Represents all second string information, network endpoint set This represents the second string information corresponding to the target configuration file. File attribute identification processing is performed on all second candidate files to select those with the file attribute of a configuration file as the target configuration file. Based on the second string information in the target configuration file, the target service dependency information is determined.

[0061] The technical solution of this embodiment, upon receiving a service dependency extraction request, determines the target service container corresponding to the request, matches at least one file to be processed associated with the target service container based on preset keywords and preset network endpoint formats, and determines at least one first candidate file and a first string information corresponding to each first candidate file. This achieves traversal processing of all files containing potential service dependency information in the target service container, avoiding omissions of service dependency information and ensuring the completeness of subsequently determined service dependency information. For at least one first candidate file, based on the position information of each first string, a pre-trained prefix word classification module is used to identify a preset number of prefix characters before each first string in the first candidate file, determining the prefix character recognition result corresponding to each first string. Based on the prefix character recognition result, the first string information corresponding to each first candidate file is filtered to determine second string information and at least one second candidate file corresponding to the second string information. Based on a pre-trained file classification model, the text content of at least one second candidate file is identified to determine the file attributes of each second candidate file. The second candidate file whose file attributes match the preset file attributes is used as the target configuration file. By identifying preceding characters and determining file attributes, irrelevant information is effectively eliminated, reducing misidentified network endpoint information and making the subsequently determined target service dependency information more accurate. Based on the second string information corresponding to the target configuration file, the target service dependency information corresponding to the target service container is obtained, and a network isolation strategy is generated based on this information. This invention eliminates the need to obtain application source code or rely on a cumbersome and lengthy traffic collection process. By quickly identifying the service dependencies of microservices within the target service container image, it improves the efficiency of service dependency extraction, meeting the speed requirements of practical applications. It solves the problems of existing technologies where source code cannot be obtained, network traffic monitoring is insufficient to obtain complete service dependency information, and service dependency information extraction efficiency is low. Furthermore, by performing progressive filtering on the files to be processed corresponding to the target service container, erroneous dependency information is eliminated, ensuring that the target service dependency information represents the service connections required by the actual application, guaranteeing the completeness and accuracy of dependency extraction. In addition, this invention can recognize and process files in various formats such as JSON, YAML, and XML, and even custom formats, demonstrating strong versatility and applicability. Service dependency information is extracted through static analysis, which does not require the service to reside and run in the target service container for an extended period, thus having minimal impact on service performance. In practical deployments, embodiments of this invention can be integrated as a standalone tool into the operation and maintenance processes of containerized applications in a plug-and-play manner. This allows for the secure and automatic configuration of network isolation policies based on the determined target service dependency information, thereby enhancing the security protection capabilities of microservice systems.

[0062] Example 2 Figure 6 This is a flowchart of a method for determining service dependency information according to Embodiment 2 of the present invention. This embodiment is a preferred embodiment of the above embodiments. For specific implementation details, please refer to the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here. Figure 6 As shown, the method includes: S210. Upon receiving a service dependency extraction request, determine the target service container corresponding to the service dependency extraction request.

[0063] S220. Based on preset keyword information and preset network endpoint format, match at least one file to be processed associated with the target service container to determine at least one first candidate file and a first string information corresponding to each first candidate file.

[0064] The first string information includes: at least one first string and the position information of each first string in the first candidate file.

[0065] Optionally, before performing pre-character recognition processing on the first candidate file based on the pre-word classification model, a pre-trained pre-word classification module can be trained first. Specifically: multiple original sample files in various file formats associated with network configuration are obtained; the text content of the original sample files is parsed to determine the configuration information corresponding to the original sample files; the configuration information is matched using a preset regular expression to determine the matching result; when the matching result is that the configuration information includes network endpoint information corresponding to preset keyword information, if the first word before the network endpoint information is a preset keyword in the preset keyword information, the original sample file to which the configuration information belongs is determined as the first sample file, and the preset keyword in the first sample file is marked to construct the first training sample; if the first word before the network endpoint information is not a preset keyword in the preset keyword information, the original sample file to which the configuration information belongs is determined as the second sample file, and the string at the preset position of the configuration information in the second sample file is marked to construct the second training sample; the pre-word classification model to be trained is trained based on multiple first training samples and multiple second training samples, so that when the pre-word classification model to be trained meets the preset training completion conditions, a trained pre-word classification model is obtained.

[0066] The original sample file can be a configuration file sample related to service dependencies, determined from an open-source codebase. Optionally, multiple file formats can be JSON, INI, XML, YAML, TOML, etc. Configuration information can be string information related to network configuration. A preset regular expression can be used to determine whether the configuration information includes network endpoint information corresponding to preset keyword information. The first sample file can be an original sample file where the first word before the network endpoint information is the preset keyword. Correspondingly, the second sample file can be an original sample file where the first word before the network endpoint information is not the preset keyword. It should be noted that here, the first word corresponds to the preceding word mentioned above. The preset position can be the string position corresponding to the first word before the network endpoint information in the configuration information.

[0067] The preset training completion conditions can be that the training iterations of the pre-order word classification model to be trained reach a preset number of iterations, or that the recall rate of the pre-order word classification model to be trained falls within a preset recall range. Optionally, the pre-order word classification model can be implemented based on the FastText model, used to determine whether the first word preceding the network endpoint information is a preset keyword.

[0068] Specifically, multiple original sample files in various file formats related to network configuration are obtained. The text content of each original sample file is parsed and processed to determine the configuration information corresponding to the original sample file. The configuration information of the original sample files is matched using a preset regular expression to determine whether the configuration information includes network endpoint information corresponding to preset keyword information.

[0069] If the configuration information includes network endpoint information corresponding to the preset keyword information, then determine whether the first word before the network endpoint information is a preset keyword in the preset keyword information. If the first word before the network endpoint information is a preset keyword in the preset keyword information, then determine the original sample file to which the configuration information belongs as the first sample file, and mark the preset keywords in the first sample file to obtain the first training sample.

[0070] If the configuration information does not include network endpoint information corresponding to the preset keyword information, the original sample file is discarded. If the first word before the network endpoint information is not a preset keyword in the preset keyword information, the corresponding original sample file is used as the second sample file, and the first word before the network endpoint information in the second sample file is marked to construct the second training sample.

[0071] The pre-word classification model is trained using multiple first training samples and multiple second training samples. The trained pre-word classification model is obtained when the number of training iterations of the pre-word classification model reaches a preset number or the recall rate of the pre-word classification model falls within a preset recall range.

[0072] For example, sample configuration files containing network configuration information were obtained from open-source code repositories, totaling approximately 32,122 samples in JSON, INI, XML, YAML, and TOML formats. All sample configuration files were cleaned (empty and duplicate files were removed) and parsed to extract configuration information, including configuration item keys and values. The configuration item keys were then standardized (including removing underscores and other punctuation, splitting hyphenated or camelCase compound words, and converting them to root word forms).

[0073] The configuration item values ​​in the configuration information are matched using preset regular expressions to determine whether they contain network endpoint information such as Uniform Resource Locators (URLs), domain names, and Internet Protocol Addresses (IP Addresses). If a configuration item value contains such network endpoint information, the corresponding configuration item key is determined to be either a preset keyword or a non-preset keyword. This is used to label the configuration file samples, and samples without actual values ​​(e.g., empty template configuration items) are manually corrected in conjunction with the documentation. A dataset containing 47,343 configuration item key samples was ultimately constructed, of which approximately 7,062 were labeled as preset keywords in the first training sample set, and approximately 40,281 were labeled as other (non-preset keywords) in the second training sample set.

[0074] The training set is used to train a pre-order word classification model (using 100-dimensional word vectors, 5 training epochs, a learning rate of 0.1, and a word ngram length of 1 (representing a single word), etc., and the parameters are optimized to ensure that the pre-order word classification model has a high recall rate for the "preset keyword" category).

[0075] S230. For at least one first candidate file, based on the position information of each first string, a pre-trained preceding word classification model is used to identify a preset number of preceding characters before each first string in the first candidate file, and the preceding character recognition result corresponding to each first string is determined.

[0076] For example, in conjunction with the above example, for at least one first candidate file, the first 20 preceding characters of each first string in each first candidate file are extracted, and the word at the end of the character segment of these 20 preceding characters (the preceding word of the first string) is determined. After the same preprocessing process as the training samples, the pre-trained preceding word classification model is input for classification prediction to obtain the preceding character recognition result.

[0077] S240. Based on the preceding character recognition results, filter and process the first string information corresponding to each first candidate file to determine the second string information, and determine at least one second candidate file corresponding to the second string information.

[0078] The second candidate file is a file from at least one of the first candidate files.

[0079] S250. Based on the pre-trained file classification model, the text content of at least one second candidate file is identified and processed to determine the file attributes corresponding to each second candidate file, and the second candidate file whose file attributes are consistent with the preset file attributes is taken as the target configuration file.

[0080] S260. For at least one target configuration file, determine the set of target network endpoints corresponding to the target service container based on the second string information corresponding to each target configuration file.

[0081] The target network endpoint set may include at least one target network endpoint information. The target network endpoint information may be the network endpoint information corresponding to the second string in the target configuration file.

[0082] Specifically, for at least one target configuration file, based on the second string corresponding to each target configuration file, target network endpoint information corresponding to each second string is determined to obtain at least one target network endpoint information corresponding to each target configuration file. Based on the target network endpoint information in at least one target configuration file, a set of target network endpoints is determined.

[0083] S270. Based on the target network endpoint set, determine the target service dependency information of the target service container.

[0084] Specifically, based on the set of target network endpoints, the information of all target network endpoints that the target service container depends on is determined. This target network endpoint information is then processed to determine the target service dependency information corresponding to the microservices within the target service container. Optionally, all target network endpoint information is subjected to structured processing to obtain target service dependency information in a structured format.

[0085] S280. Iterate through multiple environment variables associated with the target service container to determine the supplementary service dependency information of the target service container based on the variable values ​​corresponding to the environment variables that meet the preset conditions when it is determined that the environment variables meet the preset conditions.

[0086] Environment variables are parameters used to configure service behavior, pass sensitive information, or define runtime dependencies. Preset conditions can be pre-defined conditions that environment variables must meet in relation to service dependencies. Optionally, environment variables can be determined to meet preset conditions by: detecting that an environment variable conforms to the preset network endpoint format corresponding to the target service container, and that the variable name matches preset keyword information.

[0087] The supplementary service dependency information can be determined based on the network endpoint information corresponding to the variable values ​​of environment variables that meet preset conditions.

[0088] Specifically, for multiple environment variables associated with the target service container, each environment variable is analyzed to determine whether it meets preset conditions. That is, the variable name of the environment variable is input into a pre-trained prefix word classification model to determine if the variable name matches preset keyword information. Additionally, the variable values ​​of the environment variables are examined to determine whether they include network endpoint information.

[0089] When the variable name of the environment variable matches the preset keyword information, and when the variable value of the environment variable includes network endpoint information, supplementary service dependency information is determined based on the network endpoint information corresponding to the variable value of the environment variable.

[0090] It should be noted that in practical applications, some application configuration information is injected into the container through environment variables (such as database connection addresses, which are usually provided in the form of environment variables). Therefore, the environment variables corresponding to the target service container can also be detected to determine supplementary service dependency information.

[0091] For example, see Figure 2 and Figure 7 , Figure 7 This is a flowchart of the algorithm for determining the network endpoint information corresponding to environment variables. Figure 2 In Corresponding to Figure 7 The specific processing steps within. This includes the service address set. Corresponding to the preset keyword information and preset network endpoint format mentioned above, This indicates the network endpoint information corresponding to the environment variable. This indicates the updated target service dependency information.

[0092] Based on service address set Determine the set of service addresses The system uses regular expressions to match environment variables, performing regular expression matching to determine if the variable values ​​conform to a preset network endpoint format. Specifically, it determines whether the environment variables contain network endpoint information related to service dependencies, such as hostnames, domain names, or IP addresses. The system also inputs the environment variable names into a pre-defined word classification model to determine if the names contain preset keywords such as "HOST," "ADDR," and "IP." If the variable values ​​conform to the preset network endpoint format and the variable names contain preset keywords, the environment variable is considered to meet the preset conditions. The system then extracts and processes the environment variable values ​​to determine supplementary service dependency information.

[0093] For example, WordPress applications support configuring database connections via environment variables. Taking WordPress as an example, if the target service container's environment variables include WORDPRESS_DB_HOST=mysql, where the variable name "DB_HOST" matches the preset keyword in the preset keyword information for database host configuration, and its variable value "mysql" conforms to the preset network endpoint format, indicating it is the host identifier of the database service, then the variable name and value of this environment variable are extracted and processed to determine the database service endpoint that the WordPress service depends on. That is, the service dependency information corresponding to the WordPress service is determined to be: the WordPress service depends on a database service named "mysql," and the network endpoint information mysql (i.e., the database hostname) is extracted accordingly. By analyzing environment variables, the scope of dependency extraction is expanded, ensuring the completeness and comprehensiveness of service dependency information extraction.

[0094] S290. Based on the supplementary service dependency information, update the target service dependency information to determine the updated target service dependency information, and then determine the network isolation strategy corresponding to the target service container based on the updated target service dependency information.

[0095] The network isolation policy corresponding to the target service container is used to restrict communication between the target service container and other service containers, as well as between the target service container and the external network, in order to improve security.

[0096] Specifically, based on the supplementary service dependency information, the target service dependency information is updated to determine the updated target service dependency information, and a network isolation policy corresponding to the target service container is generated according to the updated target service dependency information.

[0097] For example, for the target service container, through the above-described layer-by-layer processing, the network endpoint information on which the microservices within the target service container depend is determined; that is, several hostnames or IP addresses (such as database service addresses, external API service addresses, etc.) are identified. Furthermore, by analyzing the environment variables of the target service container, network endpoint information configured through these environment variables may also be obtained. This network endpoint information is used as a dependency list for the microservices of the target service container, and corresponding network isolation policies are automatically generated based on this service list, enabling fine-grained control and security protection of network access between microservices.

[0098] It should be noted that the processing flow of the embodiments of the present invention is completed on the static data of the target service container, without actually running the application or intercepting and monitoring its network traffic, and will not affect the running performance of the microservices of the target service container.

[0099] The technical solution of this embodiment, upon receiving a service dependency extraction request, determines the target service container corresponding to the request, matches at least one file to be processed associated with the target service container based on preset keywords and preset network endpoint formats, and determines at least one first candidate file and a first string information corresponding to each first candidate file. This achieves traversal processing of all files containing potential service dependency information in the target service container, avoiding omissions of service dependency information and ensuring the completeness of subsequently determined service dependency information. For at least one first candidate file, based on the position information of each first string, a pre-trained prefix word classification module is used to identify a preset number of prefix characters before each first string in the first candidate file, determining the prefix character recognition result corresponding to each first string. Based on the prefix character recognition result, the first string information corresponding to each first candidate file is filtered to determine second string information and at least one second candidate file corresponding to the second string information. Based on a pre-trained file classification model, the text content of at least one second candidate file is identified to determine the file attributes of each second candidate file. The second candidate file whose file attributes match the preset file attributes is used as the target configuration file. By identifying preceding characters and determining file attributes, irrelevant information is effectively eliminated, reducing misidentified network endpoint information and making the subsequently determined target service dependency information more accurate. For at least one target configuration file, based on the second string information corresponding to each target configuration file, the set of target network endpoints corresponding to the target service container is determined, and the target service dependency information of the target service container is determined based on the target network endpoint set. By analyzing the environment variables of the target service container, supplementary service dependency information is determined, and the target service dependency information is updated based on the supplementary service dependency information. The network isolation strategy corresponding to the target service container is then determined based on the updated target service dependency information. This invention does not require obtaining application source code or relying on a cumbersome and lengthy traffic collection process. By quickly identifying the service dependencies of microservices in the target service container by analyzing the files inside the target service container image, the efficiency of service dependency extraction is improved, meeting the speed requirements in practical applications. It solves the problems of existing technologies that cannot obtain source code or that it is difficult to obtain complete service dependency information through network traffic monitoring, as well as the low efficiency of service dependency information extraction. Meanwhile, by performing a progressive filtering process on the files to be processed corresponding to the target service container, erroneous dependency information is eliminated, ensuring that the target service dependency information is the service connection required by the actual application, thus guaranteeing the completeness and accuracy of dependency extraction. Furthermore, this embodiment of the invention can recognize and process files in various formats such as JSON, YAML, XML, and even custom formats, demonstrating strong versatility and applicability.Service dependency information is extracted through static analysis, which does not require the service to reside and run in the target service container for an extended period, thus having minimal impact on service performance. In practical deployments, embodiments of this invention can be integrated as a standalone tool into the operation and maintenance processes of containerized applications in a plug-and-play manner. This allows for the secure and automatic configuration of network isolation policies based on the determined target service dependency information, thereby enhancing the security protection capabilities of microservice systems.

[0100] Example 3 Figure 8 This is a schematic diagram of a service dependency information determination device provided in Embodiment 3 of the present invention. Figure 8 As shown, the device includes: a container determination module 310, a string determination module 320, a character recognition module 330, a string filtering module 340, a file attribute determination module 350, and a service dependency information determination module 360.

[0101] The container determination module 310 is used to determine the target service container corresponding to the service dependency extraction request when a service dependency extraction request is received; the string determination module 320 is used to match at least one file to be processed associated with the target service container according to preset keyword information and preset network endpoint format, and determine at least one first candidate file and first string information corresponding to each first candidate file; wherein, the first string information includes: at least one first string and the position information of each first string in the first candidate file; the character recognition module 330 is used to, for the at least one first candidate file, based on the position information of each first string, perform recognition processing on a preset number of preceding characters before each first string in the first candidate file according to a pre-trained preceding word classification model, and determine the preceding character recognition result corresponding to each first string; the string filtering module 3 40 is used to filter and process the first string information corresponding to each first candidate file based on the preceding character recognition result, determine the second string information, and determine at least one second candidate file corresponding to the second string information; wherein, the second candidate file is a file in the at least one first candidate file; the file attribute determination module 350 is used to recognize and process the text content of the at least one second candidate file according to a pre-trained file classification model, and determine the file attributes corresponding to each second candidate file; the service dependency information determination module 360 ​​is used to take the second candidate file whose file attributes are consistent with the preset file attributes as the target configuration file, and obtain the target service dependency information corresponding to the target service container based on the second string information corresponding to the target configuration file; wherein, the target service dependency information is used to characterize the information that the microservice in the target service container depends on for operation.

[0102] The technical solution of this embodiment, upon receiving a service dependency extraction request, determines the target service container corresponding to the request, matches at least one file to be processed associated with the target service container based on preset keywords and preset network endpoint formats, and determines at least one first candidate file and a first string information corresponding to each first candidate file. This achieves traversal processing of all files containing potential service dependency information in the target service container, avoiding omissions of service dependency information and ensuring the completeness of subsequently determined service dependency information. For at least one first candidate file, based on the position information of each first string, a pre-trained prefix word classification module is used to identify a preset number of prefix characters before each first string in the first candidate file, determining the prefix character recognition result corresponding to each first string. Based on the prefix character recognition result, the first string information corresponding to each first candidate file is filtered to determine second string information and at least one second candidate file corresponding to the second string information. Based on a pre-trained file classification model, the text content of at least one second candidate file is identified to determine the file attributes of each second candidate file. The second candidate file whose file attributes match the preset file attributes is used as the target configuration file. By identifying preceding characters and determining file attributes, irrelevant information is effectively eliminated, reducing misidentified network endpoint information and making the subsequently determined target service dependency information more accurate. Based on the second string information corresponding to the target configuration file, the target service dependency information corresponding to the target service container is obtained, and a network isolation strategy is generated based on this information. This invention eliminates the need to obtain application source code or rely on a cumbersome and lengthy traffic collection process. By quickly identifying the service dependencies of microservices within the target service container image, it improves the efficiency of service dependency extraction, meeting the speed requirements of practical applications. It solves the problems of existing technologies where source code cannot be obtained, network traffic monitoring is insufficient to obtain complete service dependency information, and service dependency information extraction efficiency is low. Furthermore, by performing progressive filtering on the files to be processed corresponding to the target service container, erroneous dependency information is eliminated, ensuring that the target service dependency information represents the service connections required by the actual application, guaranteeing the completeness and accuracy of dependency extraction. In addition, this invention can recognize and process files in various formats such as JSON, YAML, and XML, and even custom formats, demonstrating strong versatility and applicability. Service dependency information is extracted through static analysis, which does not require the service to reside and run in the target service container for an extended period, thus having minimal impact on service performance. In practical deployments, embodiments of this invention can be integrated as a standalone tool into the operation and maintenance processes of containerized applications in a plug-and-play manner. This allows for the secure and automatic configuration of network isolation policies based on the determined target service dependency information, thereby enhancing the security protection capabilities of microservice systems.

[0103] Optionally, based on the above embodiments, the device further includes: a supplementary service dependency determination module, configured to traverse multiple environment variables associated with the target service container, so as to determine the supplementary service dependency information of the target service container based on the variable values ​​corresponding to the environment variables that satisfy the preset conditions when it is determined that the environment variables satisfy the preset conditions; and a service dependency update module, configured to update the target service dependency information based on the supplementary service dependency information, determine the updated target service dependency information, and determine the network isolation strategy corresponding to the target service container based on the updated target service dependency information.

[0104] Optionally, a supplementary service dependency determination module includes a condition judgment unit, used to determine that the environment variable meets a preset condition when it is detected that the environment variable conforms to the preset network endpoint format corresponding to the target service container and the variable name of the environment variable matches the preset keyword information.

[0105] Optionally, the device further includes: a file to be processed determination module, used to traverse all original files associated with the target service container, so as to determine the original file as a file to be processed when it is detected that the directory to which the original file belongs is not a preset directory and the text content of the original file conforms to a preset text format, so as to obtain at least one file to be processed.

[0106] Optionally, a string determination module is used to scan and process at least one file to be processed associated with the target service container, so that when it is detected that the file to be processed includes at least one preset keyword corresponding to preset keyword information and network endpoint information in the preset network endpoint format, the file to be processed is determined as a first candidate file, and the string in the first candidate file corresponding to the network endpoint information is used as the first string.

[0107] Optionally, the device further includes: a classification model training module, used to acquire multiple original sample files in various file formats associated with network configuration; parse the text content of the original sample files to determine the configuration information corresponding to the original sample files; match the configuration information using a preset regular expression to determine the matching result; when the matching result indicates that the configuration information includes network endpoint information corresponding to the preset keyword information, if the first word before the network endpoint information is a preset keyword in the preset keyword information, then the original sample file to which the configuration information belongs is determined as the first sample file, and the preset keyword in the first sample file is marked to construct a first training sample; if the first word before the network endpoint information is not a preset keyword in the preset keyword information, then the original sample file to which the configuration information belongs is determined as the second sample file, and the string at a preset position in the configuration information in the second sample file is marked to construct a second training sample; and train the pre-order word classification model to be trained based on multiple first training samples and multiple second training samples, so that when the pre-order word classification model to be trained meets the preset training completion conditions, a trained pre-order word classification model is obtained.

[0108] Optionally, the string filtering module includes a second string information determination unit, used to determine the first string corresponding to the preceding characters as the second string when, based on the preceding character recognition result, the preset number of preceding characters include a preset keyword corresponding to the preset keyword information; and to determine the second string information based on at least one second string and the position information corresponding to the second string.

[0109] Optionally, the service dependency information determination module is used to determine, for at least one of the target configuration files, a set of target network endpoints corresponding to the target service container based on the second string information corresponding to each target configuration file; and to determine the target service dependency information of the target service container based on the set of target network endpoints.

[0110] The service dependency information determination device provided in the embodiments of the present invention can execute the service dependency information determination method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0111] Example 4 Figure 9This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0112] like Figure 9 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0113] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0114] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the service dependency information determination method.

[0115] In some embodiments, the service dependency information determination method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the service dependency information determination method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the service dependency information determination method by any other suitable means (e.g., by means of firmware).

[0116] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] Computer programs used to implement the service dependency information determination method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0118] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0119] Example 5 Embodiment 5 of the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to execute a service dependency information determination method, the method comprising: Upon receiving a service dependency extraction request, the target service container corresponding to the service dependency extraction request is determined; based on preset keyword information and preset network endpoint format, at least one file to be processed associated with the target service container is matched to determine at least one first candidate file and first string information corresponding to each first candidate file; wherein, the first string information includes: at least one first string and the position information of each first string in the first candidate file; for the at least one first candidate file, based on the position information of each first string, a preset number of preceding characters before each first string in the first candidate file are identified based on a pre-trained preceding word classification model to determine the preceding character recognition result corresponding to each first string; based on the preceding... The sequence character recognition results are used to filter and process the first string information corresponding to each first candidate file to determine the second string information, and to determine at least one second candidate file corresponding to the second string information; wherein, the second candidate file is a file in the at least one first candidate file; the text content of the at least one second candidate file is recognized and processed according to a pre-trained file classification model to determine the file attributes corresponding to each second candidate file; the second candidate file whose file attributes are consistent with the preset file attributes is used as the target configuration file, and the target service dependency information corresponding to the target service container is obtained based on the second string information corresponding to the target configuration file; wherein, the target service dependency information is used to characterize the information that the microservices in the target service container depend on for operation.

[0120] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0121] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0122] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0123] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0124] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0125] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for determining service dependency information, characterized in that, include: Upon receiving a service dependency extraction request, determine the target service container corresponding to the service dependency extraction request; Based on preset keyword information and preset network endpoint format, at least one file to be processed associated with the target service container is matched to determine at least one first candidate file and a first string information corresponding to each first candidate file; wherein, the first string information includes: at least one first string and the position information of each first string in the first candidate file; For the at least one first candidate file, based on the position information of each first string, a preset number of preceding characters before each first string in the first candidate file are identified and processed based on a pre-trained preceding word classification model to determine the preceding character recognition result corresponding to each first string; Based on the preceding character recognition results, the first string information corresponding to each first candidate file is filtered and processed to determine the second string information, and at least one second candidate file corresponding to the second string information is determined; wherein, the second candidate file is a file in the at least one first candidate file; The text content of at least one second candidate file is identified and processed based on a pre-trained file classification model to determine the file attributes corresponding to each second candidate file. The second candidate file whose file attributes match the preset file attributes is used as the target configuration file, and the target service dependency information corresponding to the target service container is obtained based on the second string information corresponding to the target configuration file; wherein, the target service dependency information is used to characterize the information that the microservice in the target service container depends on for operation.

2. The method according to claim 1, characterized in that, The method further includes: The system iterates through multiple environment variables associated with the target service container. When it is determined that the environment variables meet preset conditions, the system determines the supplementary service dependency information of the target service container based on the variable values ​​corresponding to the environment variables that meet the preset conditions. Based on the supplementary service dependency information, the target service dependency information is updated to determine the updated target service dependency information, and a network isolation strategy corresponding to the target service container is determined based on the updated target service dependency information.

3. The method according to claim 2, characterized in that, The environmental variables are determined to meet the preset conditions in the following manner: If the environment variable is found to conform to the preset network endpoint format corresponding to the target service container, and the variable name of the environment variable matches the preset keyword information, the environment variable is determined to meet the preset conditions.

4. The method according to claim 1, characterized in that, After determining the target service container corresponding to the service dependency extraction request, the method further includes: All original files associated with the target service container are traversed and processed. When it is detected that the directory to which the original file belongs is not a preset directory and the text content of the original file conforms to a preset text format, the original file is regarded as a file to be processed, so as to obtain at least one file to be processed.

5. The method according to claim 1, characterized in that, The step of matching at least one file to be processed associated with the target service container based on preset keyword information and preset network endpoint format to determine at least one first candidate file and a first string information corresponding to each first candidate file includes: At least one file to be processed associated with the target service container is scanned and processed so that when the file to be processed is found to include at least one preset keyword corresponding to preset keyword information and network endpoint information in the preset network endpoint format, the file to be processed is determined as a first candidate file, and the string in the first candidate file corresponding to the network endpoint information is used as the first string.

6. The method according to claim 1, characterized in that, Before the pre-trained preceding word classification model is used to identify a predetermined number of preceding characters for each first string in the first candidate file, the method further includes: Obtain multiple raw sample files in various file formats associated with network configuration; The text content of the original sample file is parsed to determine the configuration information corresponding to the original sample file; The configuration information is matched using a preset regular expression to determine the matching result; When the matching result is that the configuration information includes network endpoint information corresponding to the preset keyword information, if the first word before the network endpoint information is the preset keyword in the preset keyword information, then the original sample file to which the configuration information belongs is determined as the first sample file, and the preset keyword in the first sample file is marked and processed to construct the first training sample; If the first word before the network endpoint information is not a preset keyword in the preset keyword information, then the original sample file to which the configuration information belongs is determined as the second sample file, and the string at the preset position of the configuration information in the second sample file is marked to construct the second training sample; The training process is performed on the pre-order word classification model to be trained based on multiple first training samples and multiple second training samples, so that when the pre-order word classification model to be trained meets the preset training completion conditions, a trained pre-order word classification model is obtained.

7. The method according to claim 1, characterized in that, The step of filtering and processing the first string information corresponding to each first candidate file based on the preceding character recognition result to determine the second string information includes: If, based on the preceding character recognition result, it is determined that the preset number of preceding characters includes a preset keyword corresponding to the preset keyword information, then the first string corresponding to the preceding character is taken as the second string; The second string information is determined based on at least one of the second strings and the position information corresponding to the second string.

8. The method according to claim 1, characterized in that, The step of obtaining the target service dependency information corresponding to the target service container based on the second string information corresponding to the target configuration file includes: For at least one of the target configuration files, a set of target network endpoints corresponding to the target service container is determined based on the second string information corresponding to each target configuration file. Based on the target network endpoint set, the target service dependency information of the target service container is determined.

9. A service dependency information determination device, characterized in that, include: The container determination module is used to determine the target service container corresponding to the service dependency extraction request when a service dependency extraction request is received. The string determination module is used to match at least one file to be processed associated with the target service container based on preset keyword information and preset network endpoint format, and determine at least one first candidate file and first string information corresponding to each first candidate file; wherein, the first string information includes: at least one first string and the position information of each first string in the first candidate file; The character recognition module is used to, for the at least one first candidate file, perform a predetermined number of preceding characters in each first string in the first candidate file based on the position information of each first string and a pre-trained preceding word classification model, and determine the preceding character recognition result corresponding to each first string. The string filtering module is used to filter the first string information corresponding to each first candidate file based on the preceding character recognition result, determine the second string information, and determine at least one second candidate file corresponding to the second string information; wherein, the second candidate file is a file in the at least one first candidate file; The file attribute determination module is used to identify and process the text content of the at least one second candidate file based on a pre-trained file classification model, and determine the file attributes corresponding to each second candidate file. The service dependency information determination module is used to select a second candidate file whose file attributes match the preset file attributes as the target configuration file, and obtain the target service dependency information corresponding to the target service container based on the second string information corresponding to the target configuration file; wherein, the target service dependency information is used to characterize the information that the microservices in the target service container depend on for operation.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the service dependency information determination method according to any one of claims 1-8.

Images