Storage Device Storage Operation Record Analysis Method Based on Data Source Tracing

Abstract

This invention discloses a storage device operation record analysis method based on data traceability, relating to the field of data processing technology. The method includes: acquiring the serial links corresponding to four types of records, as well as the main characteristics and associated characteristics of the serial links; constructing a link analysis model and a model analysis method; using the link analysis model to acquire fault characteristics, and using the fault characteristics as the analysis result of the operation records. This invention addresses the problem in existing storage device operation record analysis methods that cannot effectively serialize different record types in storage operation records, leading to an inability to effectively locate the root cause of faults after acquiring faults in the operation records, and an inability to label operation records associated with faults, resulting in low fault diagnosis efficiency and lingering security risks after diagnosis.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a method for analyzing storage operation records of storage devices based on data traceability. Background Technology

[0002] Storage device operation log analysis refers to the process of collecting, processing, and interpreting operation logs generated during the operation of storage devices. These logs record in detail the device's read and write activities, access requests, and status changes, which are used to track and understand its behavioral history. The core objectives of this analysis include fault diagnosis, performance optimization, security auditing, and capacity planning. Achieving this analysis usually involves multiple technical aspects, and this analysis can significantly improve the reliability and security of storage systems.

[0003] Existing methods for analyzing storage operation records in storage devices typically analyze data record sets based on their storage addresses. They often employ methods like dimensionality reduction to quickly obtain analysis results, aiming to improve data analysis efficiency. While this improved approach allows for rapid data record analysis, it fails to effectively link different record types within the storage operation records. This results in difficulties in pinpointing the root cause of faults after they are identified, and inability to annotate operation records associated with faults. Consequently, troubleshooting is inefficient, and potential security risks remain even after troubleshooting. For example, patent application CN115081778A discloses a data record analysis method, apparatus, device, and storage medium. This solution utilizes... By performing dimensionality reduction on data records, the analysis results of data records can be quickly obtained using the average value of bucket metrics, thus improving the efficiency of data record analysis. However, other improvements to storage device operation record analysis methods typically use user operation commands and database responses as block-chain storage for operation record verification and analysis. This improved method can only analyze user operation records and database response records, and still cannot effectively link different record types in the storage operation records. This results in the inability to effectively locate the root cause of the fault after obtaining the fault in the operation records, and the inability to label operation records related to the fault. Consequently, the problem of low fault diagnosis efficiency and lingering security risks after diagnosis is caused. Therefore, it is necessary to improve the existing storage device operation record analysis methods. Summary of the Invention

[0004] This invention aims to at least partially solve one of the technical problems in the prior art by proposing a storage device storage operation record analysis method based on data traceability. This method addresses the problem that existing storage device storage operation record analysis methods cannot effectively link different record types in the storage operation records, resulting in the inability to effectively locate the root cause of the fault after obtaining the fault in the operation record, and the inability to mark the operation records associated with the fault. This leads to low fault diagnosis efficiency and the existence of potential safety hazards after the diagnosis.

[0005] To achieve the above objectives, this application provides a method for analyzing storage operation records of storage devices based on data traceability, comprising the following steps: The system retrieves the record content corresponding to four types of records within the storage device, and obtains multiple serial links based on all record content. The four types of records include read / write records, fault records, configuration records, and security records. The system analyzes all serial links and obtains the main characteristics and associated characteristics of each serial link based on the analysis results. A link analysis model is constructed based on four types of records; a link analysis database is constructed based on the main characteristics and correlation characteristics of all serial links; the link analysis database is stored in the link analysis model, and a model analysis method is constructed. When analyzing operation records within a storage device, a link analysis model and model analysis methods are used to analyze the operation records to be analyzed, and fault characteristics are obtained based on the analysis results. These fault characteristics are then used as the analysis results for the operation records to be analyzed.

[0006] Furthermore, the record content corresponding to the four types of records in the storage device is obtained, and multiple serial links are obtained based on all record content, including: Retrieve all historical operation records stored in the storage device, and record the historical operation records containing four types of records as serial analysis records; retrieve all serial analysis records in the historical operation records. The link acquisition method is used to obtain the serial links of all serial analysis records. The link acquisition method includes: for any serial analysis record, obtaining the execution time of all operation records in the serial analysis record, and recording the first occurrence time of read / write records, fault records, configuration records and security records in the serial analysis record as the first read / write time, the first fault time, the first configuration time and the first security time, respectively.

[0007] Furthermore, the link acquisition method also includes: Based on the time sequence, the first read / write time, the first failure time, the first configuration time, and the first security time are arranged in order. Based on the arranged time order, the four types of records are recorded as the first execution record, the second execution record, the third execution record, and the fourth execution record, respectively. The sequence of execution records from the first execution record to the second execution record, the third execution record, and the fourth execution record is denoted as the serial link of the serial analysis records. Obtain the serial links for all serial analysis records.

[0008] Furthermore, all serial links are analyzed, and based on the analysis results, the main characteristics and associated characteristics of each serial link are obtained, including: Link feature analysis is used to obtain the main features and related features of all serial analysis records. Link feature analysis includes: for the nth execution record and the (n+1)th execution record in any serial analysis record, based on the native data fields of the storage device and standardized metadata tags, obtaining the common identification field between the nth execution record and the (n+1)th execution record, and recording it as the identification field. There may be multiple identification fields. Get all the time points when the nth execution record in the serial analysis record is executed, and record them as the preceding time points; get all the time points when the (n+1)th execution record in the serial analysis record is executed, and record them as the following time points, where n is a positive integer less than or equal to 3 and greater than or equal to 1.

[0009] Furthermore, link feature analysis also includes: Establish a timeline from left to right, and mark all preceding and subsequent time points within the timeline; within the timeline: for any preceding time point α, if there is a subsequent time point to the right of the preceding time point α, record the number of subsequent time points to the right of the preceding time point α as m1, and record all subsequent time points to the right of the preceding time point α as time points to be screened; for any time point to be screened: obtain the identification field of the nth execution record corresponding to the preceding time point α, and the identification field of the (n+1)th execution record corresponding to the time point to be screened; If there are two identical discrimination fields β among all the discrimination fields corresponding to the current time point α and the time point to be screened, the time point to be screened is recorded as the associated time point of the previous time point α, and discrimination field β is recorded as the associatable field of the previous time point α; if all the discrimination fields corresponding to the current time point α and the time point to be screened are different, the time point to be screened is recorded as the discarded time point.

[0010] Furthermore, link feature analysis also includes: The number of associated time points of the preceding time point α is denoted as m2, and the value of m2 divided by m1 is denoted as the association ratio of the preceding time point α. If there is no subsequent time point to the right of the previous time point α, the correlation ratio of the previous time point α is recorded as 0. Obtain the correlation ratios for all preceding time points, and denote the closed interval formed by the maximum and minimum values ​​among all non-zero correlation ratios as the correlation ratio interval; denote the set of all associable fields as the sub-link features.

[0011] Furthermore, link feature analysis also includes: The main features of the serial links in the serial analysis record are denoted as {δ1, δ2, δ3}, and the association features of the serial links in the serial analysis record are denoted as {γ1, γ2, γ3}, where δn and γn are the association ratio range and sub-link features corresponding to the nth execution record and the (n+1)th execution record in the serial analysis record, respectively. Obtain the main characteristics and associated characteristics of the serial links for all serial analysis records.

[0012] Furthermore, a link analysis model is constructed based on four types of records; a link analysis database is constructed based on the main characteristics and association characteristics of all serial links; the link analysis database is stored in the link analysis model, and the model analysis methods include: A link analysis model is constructed, wherein the input of the link analysis model is the acquisition module of four types of records in the operation log, and the output of the link analysis model is the fault characteristics; The main features and associated features of the serial links obtained from all serial analysis records are stored in the main database and the associated database, respectively. The database containing all serial analysis records, the serial links, the main database, and the associated database is called the link analysis database.

[0013] Furthermore, the model analysis methods include: When the operation record to be analyzed is obtained, the acquisition module at the input end of the link analysis model obtains the execution time of all four types of records in the operation record to be analyzed, and obtains the serial links of the operation record to be analyzed based on the link acquisition method, which are recorded as the link to be analyzed. When there is a serial link A in the link analysis database that is the same as the link to be analyzed, the subject features and association features corresponding to the serial link A in the subject database and the association database are respectively recorded as the subject judgment criteria and the association judgment criteria. The main features and associated features of the link to be analyzed are obtained based on the link feature analysis method, and are respectively denoted as the main body to be analyzed and the associated link to be analyzed.

[0014] Furthermore, model analysis methods also include: For any interval δn in the subject to be analyzed, when the minimum value of δn in the subject to be analyzed is less than the minimum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed being relatively low; when the maximum value of δn in the subject to be analyzed is greater than the maximum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed being relatively high; when the minimum value of δn in the subject to be analyzed is less than the minimum value of δn in the subject judgment criteria, and the maximum value of δn is greater than the maximum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed fluctuating significantly. For any set γn in the association to be analyzed, if any discriminant field B in γn is not within the association judgment criterion γn, the fault feature is recorded as the association mode between the nth execution record and the (n+1)th execution record in the operation record to be analyzed is abnormal, and the discriminant field B is recorded as the abnormal association field.

[0015] The beneficial effects of this invention are as follows: This application first obtains the record content corresponding to four types of records in the storage device, and obtains multiple serial links based on all record content; it analyzes all serial links, and obtains the main features and associated features of each serial link based on the analysis results. The advantage of this is that by obtaining multiple serial links corresponding to four types of records in the storage device, it is possible to obtain all serial links that the four types of records in the storage device can form through the operation records already stored in the storage device. Furthermore, through the main features and associated features of each serial link, it is possible to effectively locate the root cause of the fault and obtain the operation records associated with the fault after obtaining the fault in the operation record analysis process based on the serial links, thereby improving the efficiency of fault diagnosis and resolving the safety hazards after diagnosis based on the operation records associated with the fault, and reducing the risk of fault recurrence. This application also constructs a link analysis model based on four types of records; constructs a link analysis database based on the main characteristics and related characteristics of all serial links; stores the link analysis database into the link analysis model and constructs a model analysis method; finally, it uses the link analysis model and model analysis method to analyze the operation records to be analyzed, and obtains fault characteristics based on the analysis results, using the fault characteristics as the analysis results of the operation records to be analyzed. The advantage of this is that by constructing a link analysis model and obtaining the fault characteristics of the operation records to be analyzed through the link analysis model, it is possible to uniformly acquire and analyze the links of the operation records to be analyzed using the link analysis model, thereby improving the acquisition efficiency and making the analysis results more intuitive when acquiring the faults generated by the operation and the root causes of the faults in the operation records to be analyzed. Attached Figure Description

[0016] Figure 1 This is a flowchart of the steps of the method of the present invention; Figure 2 This is a flowchart illustrating the link acquisition method and link feature analysis method of the present invention; Figure 3 This is a structural block diagram of the electronic device of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1, please refer to Figure 1 As shown, this application provides a method for analyzing storage operation records of storage devices based on data traceability, including the following steps: Step S1: Obtain the record content corresponding to the four types of records in the storage device, and obtain multiple serial links based on all record content. The four types of records include read / write records, fault records, configuration records, and security records. Analyze all serial links and obtain the main characteristics and related characteristics of each serial link based on the analysis results. Step S1 includes: Step S101, obtaining all historical operation records stored in the storage device, and recording the historical operation records containing four types of records as serial analysis records; obtaining all serial analysis records in the historical operation records; In the specific implementation process, since the operation records recorded in the storage device used for analysis in this embodiment only include read and write records, fault records, configuration records and security records, the above four types of records are recorded as four categories of records for subsequent analysis. In the specific implementation, the four categories of records can be added, deleted or modified according to the type of operation records recorded in the storage device being analyzed, so as to ensure that the serial links obtained in the subsequent analysis can cover all operation records in the storage device. Step S102: Use the link acquisition method to obtain the serial links of all serial analysis records. The link acquisition method includes: Step S1021: For any serial analysis record, obtain the execution time of all operation records in the serial analysis record, and record the first occurrence time of the read / write record, fault record, configuration record and security record in the serial analysis record as the first read / write time, the first fault time, the first configuration time and the first security time, respectively. In the analysis of this embodiment, for example, during a data analysis, the execution times of all operation records in a series analysis record are shown in Table 1. Through analysis, it can be found that the first read / write time, first failure time, first configuration time, and first security time corresponding to the series analysis record are 2025-05-10 08:00, 2025-05-10 18:30, 2025-05-10 18:35, and 2025-05-10 18:36, respectively. By sorting the above times, the sorted order is still the first read / write time, first failure time, first configuration time, and first security time. Therefore, the corresponding four types of records, namely read / write records, failure records, configuration records, and security records, can be recorded as the first execution record, the second execution record, the third execution record, and the fourth execution record, respectively. Table 1 Record type Execution time Read and write records 2025-05-10 08:00 Read and write records 2025-05-10 12:00 Fault Log 2025-05-10 18:30 Configuration records 2025-05-10 18:35 Security Records 2025-05-10 18:36 Fault Log 2025-05-10 19:00 Configuration records 2025-05-10 19:03 Security Records 2025-05-10 19:05 Step S1022: Based on the time sequence, the first read / write time, the first failure time, the first configuration time, and the first security time are arranged in order of time. Based on the arranged time sequence, the four types of records are recorded as the first execution record, the second execution record, the third execution record, and the fourth execution record in sequence. In the specific implementation process, if in another data analysis, the first read / write time, first failure time, first configuration time, and first safety time corresponding to a serial analysis record are 2025-06-01 01:00, 2025-06-01 02:10, 2025-06-01 00:00, and 2025-06-01 02:10 respectively, then by sorting the above times, the sorted order is first configuration time, first read / write time, first failure time, and first safety time. Then, the corresponding four types of records, namely configuration record, read / write record, failure record, and safety record, can be recorded as the first execution record, the second execution record, the third execution record, and the fourth execution record, respectively. Step S1023: Record the first execution record - the second execution record - the third execution record - the fourth execution record as the serial link of the serial analysis record; In the analysis of this embodiment, please refer to Figure 2 As shown, the first, second, third, and fourth execution records obtained through the analysis of Table 1 form a series of interconnected records: read / write record - fault record - configuration record - security record. In practice, by acquiring the corresponding interconnected links within all interconnected records, all interconnected relationships for the four types of records can be obtained. This facilitates the acquisition of the characteristics of each interconnected relationship during subsequent analysis, thereby providing data support for the analysis of operation records. Step S1024: Obtain the serial links of all serial analysis records.

[0019] Step S1 further includes: Step S103, using the link feature analysis method to obtain the main features and related features of all serial analysis records. The link feature analysis method includes: Step S1031, for the nth execution record and the (n+1)th execution record in any serial analysis record, based on the native data fields of the storage device and the standardized metadata tags, to obtain the common identification field between the nth execution record and the (n+1)th execution record, and record it as the identification field. There may be multiple identification fields. In the analysis of this embodiment, when analyzing the corresponding serial analysis records in Table 1, when n is 1, the analysis focuses on read / write records and fault records. By obtaining the native data fields and standardized metadata tags of the storage device, the common identification fields between read / write records and fault records are obtained, including: device serial number, LBA address, HBA card identifier, fiber optic link ID, and flash memory chip number. These common identification fields can be recorded as identification fields. In specific implementation, the common identification fields between any two types of operation records can be obtained based on the native data fields and standardized metadata tags of the actual storage device to facilitate subsequent data analysis. Step S1032: Obtain all time points when the nth execution record in the serial analysis record is executed, and record them as the preceding time points; obtain all time points when the (n+1)th execution record in the serial analysis record is executed, and record them as the following time points, where n is a positive integer less than or equal to 3 and greater than or equal to 1; In the analysis of this embodiment, by analyzing the read / write records and fault records in Table 1, the preceding time points are 2025-05-10 08:00 and 2025-05-10 12:00, and the following time points are 2025-05-10 18:30 and 2025-05-10 19:00. For the preceding time point 2025-05-10 08:00, the value of m1 is 2. Analysis shows that the LBA address in the identification field of the read / write record corresponding to the preceding time point 2025-05-10 08:00 is the same as the LBA address in the identification field of the read / write record corresponding to the following time point 2025-05-10 18:30. Since the addresses are the same and both are 0x1A3F20-0x1A3F30, meaning the identification field β is LBA=0x1A3F20-0x1A3F30, the later time point 2025-05-10 18:30 can be recorded as the associated time point of the earlier time point 2025-05-10 08:00, and the LBA address can be recorded as the associative field of the earlier time point 2025-05-10 08:00. However, for the later time point 2025-05-10 19:00, there are two completely identical identification fields among all the identification fields corresponding to the earlier time point 2025-05-10 08:00 and the later time point 2025-05-10 19:00. Therefore, the later time point 2025-05-10 19:00 can be recorded as an abandoned time point.

[0020] The link feature analysis method also includes: step S1033, establishing a time axis from left to right, and marking all previous and subsequent time points within the time axis; within the time axis: for any previous time point α, if there is a subsequent time point to the right of the previous time point α, the number of subsequent time points to the right of the previous time point α is recorded as m1, and all subsequent time points to the right of the previous time point α are recorded as time points to be screened; for any time point to be screened: obtaining the identification field of the nth execution record corresponding to the previous time point α, and the identification field of the (n+1)th execution record corresponding to the time point to be screened; In step S1034, if there are two identical discrimination fields β among all the discrimination fields corresponding to the current time point α and the time point to be screened, the time point to be screened is recorded as the associated time point of the previous time point α, and the discrimination field β is recorded as the associatable field of the previous time point α; if all the discrimination fields corresponding to the current time point α and the time point to be screened are different, the time point to be screened is recorded as the discarded time point.

[0021] The link feature analysis method also includes: step S1035, recording the number of associated time points of the preceding time point α as m2, and recording the value of m2 divided by m1 as the association ratio of the preceding time point α; In the analysis of this embodiment, by analyzing the read / write records and fault records in Table 1 as described above, the number of associated time points for the preceding time point 2025-05-10 08:00 is 1, therefore the association ratio for the preceding time point 2025-05-10 08:00 is 0.5; in addition, for another preceding time point 2025-05-10 12:00 obtained from the above analysis, the corresponding association ratio is 0.5 after analysis, and the associated field is the HBA card identifier; therefore, when subsequently obtaining the main features and associated features corresponding to the serial analysis records, for δ1 and γ1 corresponding to n=1, δ1 is [0.5], and γ1 is {LBA address, HBA card identifier}; by setting n to 2 and 3, δ2 and γ2 corresponding to n=2, and δ3 and γ3 corresponding to n=3, can be analyzed, thereby obtaining the complete main features and associated features; Step S1036: When there is no subsequent time point to the right of the previous time point α, the correlation ratio of the previous time point α is recorded as 0. Step S1037: Obtain the correlation ratio of all previous time points, and denote the closed interval formed by the maximum and minimum values ​​among all non-zero correlation ratios as the correlation ratio interval; denote the set formed by all associatable fields as the sub-link feature.

[0022] The link feature analysis method also includes: step S1038, where the main features of the serial links in the serial analysis record are denoted as {δ1, δ2, δ3}, and the associated features of the serial links in the serial analysis record are denoted as {γ1, γ2, γ3}, where δn and γn are the associated ratio interval and sub-link features corresponding to the nth execution record and the (n+1)th execution record in the serial analysis record, respectively. In the specific implementation process, if different serial analysis records are analyzed and different main features and associated features are found for the same serial link, the union of all main features corresponding to the same serial link and the union of all associated features corresponding to the same serial link can be used as the main features and associated features of the serial link in subsequent analysis.

[0023] Step S2: Construct a link analysis model based on four types of records; construct a link analysis database based on the main characteristics and related characteristics of all serial links; store the link analysis database into the link analysis model and construct the model analysis method. Step S2 includes: Step S201, constructing a link analysis model, wherein the input of the link analysis model is the acquisition module for the four types of records in the operation record, and the output of the link analysis model is the fault characteristics; Step S202: Store the main features and associated features of the serial links obtained from all serial analysis records into the main database and the associated database respectively, and denote the database containing all serial analysis records, the serial links, the main database, and the associated database as the link analysis database.

[0024] Step S203, the model analysis method includes: Step S2031, when the operation record to be analyzed is obtained, the acquisition module at the input end of the link analysis model obtains the execution time of all four types of records in the operation record to be analyzed, and obtains the serial link of the operation record to be analyzed based on the link acquisition method, which is denoted as the link to be analyzed; Step S2032: When there is a serial link A in the link analysis database that is the same as the link to be analyzed, the main features and related features of the serial link A in the main database and the related database are recorded as the main judgment criteria and the related judgment criteria, respectively. In the specific implementation process, for example, during a data analysis, the serial link A of the obtained serial analysis record is read / write record - fault record - configuration record - security record. Therefore, the main features and associated features corresponding to Table 1 above can be called as the main judgment criteria and associated judgment criteria. Through the complete analysis of the serial analysis record in Table 1, the main features and associated features obtained are {[0.5], [0.4, 0.6], [0.5]} and {{LBA address, HBA card identifier}, {fiber link ID, flash memory chip number}, {configuration effective time, security event trigger time}}. Step S2033: Obtain the main features and associated features of the link to be analyzed based on the link feature analysis method, and denot them as the main body to be analyzed and the associated link to be analyzed, respectively.

[0025] The model analysis method further includes: step S2034, for any interval δn in the subject to be analyzed, when the minimum value of δn in the subject to be analyzed is less than the minimum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed is relatively low; when the maximum value of δn in the subject to be analyzed is greater than the maximum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed is relatively high; when the minimum value of δn in the subject to be analyzed is less than the minimum value of δn in the subject judgment criteria, and the maximum value of δn is greater than the maximum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed fluctuates greatly. In the analysis of this embodiment, for example, if δ1 in the subject to be analyzed is [0.3, 0.4], and since δ1 in the subject determination standard obtained above is [0.5], the maximum and minimum values ​​of δ1 in the subject determination standard are both 0.5. Then, through analysis, it is found that the minimum value of δ1 in the subject to be analyzed, 0.3, is less than the minimum value of δn in the subject determination standard, 0.5. This indicates that in the link read / write record - fault record - configuration record - security record, the number of associated time points corresponding to the read / write record and the fault record is small. This will result in an incomplete data matching between the read / write record and the fault record. Therefore, the fault feature can be recorded as the low association frequency between the first execution record and the second execution record in the operation record to be analyzed. This will increase the number of associated time points corresponding to the read / write record and the fault record when troubleshooting, so as to achieve a more complete data matching between the read / write record and the fault record. Step S2035: For any set γn in the association to be analyzed, when any discriminant field B in γn is not within the association judgment criterion γn, the fault feature is recorded as the association mode between the nth execution record and the (n+1)th execution record in the operation record to be analyzed is abnormal, and the discriminant field B is recorded as the abnormal association field. In the analysis of this embodiment, for example, if γ1 in the association to be analyzed is {device serial number, LBA address}, and since γ1 in the association judgment criteria obtained above is {LBA address, HBA card identifier}, there is a situation where the identification field device serial number in the association to be analyzed is not within the association judgment criteria γ1. This indicates that in the link read / write record - fault record - configuration record - security record, there is an association method between the read / write record and the fault record that is not within the association judgment criteria. Therefore, the identification field device serial number can be recorded as an abnormal association field to facilitate fault elimination.

[0026] Step S3: When analyzing the operation records in the storage device, the link analysis model and model analysis method are used to analyze the operation records to be analyzed, and the fault characteristics are obtained based on the analysis results. The fault characteristics are used as the analysis results of the operation records to be analyzed.

[0027] Example 2, please refer to Figure 3 As shown, Figure 3A schematic diagram of an electronic device is provided, which may include a processor, a communication interface, a memory, and a communication bus. The processor, communication interface, and memory communicate with each other via the communication bus. The memory stores computer-readable instructions, and the processor can call these instructions. When the processor executes a computer-readable instruction, it performs steps similar to those in the data traceability-based storage device operation record analysis method to achieve the following functions: First, it acquires the record content corresponding to four types of records within the storage device and obtains multiple serial links based on all record content; it analyzes all serial links and obtains the main characteristics and associated characteristics of each serial link based on the analysis results; then, it constructs a link analysis model based on the four types of records; it constructs a link analysis database based on the main characteristics and associated characteristics of all serial links; it stores the link analysis database in the link analysis model and constructs a model analysis method; finally, when analyzing operation records within the storage device, it uses the link analysis model and model analysis method to analyze the operation records to be analyzed and obtains fault characteristics based on the analysis results, using these fault characteristics as the analysis results for the operation records to be analyzed.

[0028] Furthermore, when the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0029] Example 3: This application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the storage device storage operation record analysis method based on data traceability provided by the above methods. The method includes: first, obtaining the record content corresponding to four types of records in the storage device, and obtaining multiple serial links based on all record content; analyzing all serial links, and obtaining the main features and related features of each serial link based on the analysis results; then, constructing a link analysis model based on the four types of records; constructing a link analysis database based on the main features and related features of all serial links; storing the link analysis database in the link analysis model, and constructing a model analysis method; finally, when analyzing the operation records in the storage device, using the link analysis model and the model analysis method to analyze the operation records to be analyzed, and obtaining fault features based on the analysis results, using the fault features as the analysis results of the operation records to be analyzed.

[0030] Example 4: This application also provides a computer-readable storage medium. This application provides a storage medium storing a computer program. When the computer program is executed by a processor, it performs the steps described above in the storage device storage operation record analysis method based on data tracing, to achieve the following functions: First, it obtains the record content corresponding to four types of records in the storage device, and obtains multiple serial links based on all record content; it analyzes all serial links, and obtains the main characteristics and associated characteristics of each serial link based on the analysis results; then, it constructs a link analysis model based on the four types of records; it constructs a link analysis database based on the main characteristics and associated characteristics of all serial links; it stores the link analysis database in the link analysis model and constructs a model analysis method; finally, when analyzing the operation records in the storage device, it uses the link analysis model and model analysis method to analyze the operation records to be analyzed, and obtains fault characteristics based on the analysis results, using the fault characteristics as the analysis results of the operation records to be analyzed.

[0031] Based on the above description of the embodiments, the embodiments of the present invention can be provided as methods, systems, or computer program products. Based on this understanding, the above technical solutions, in essence or in terms of their contribution to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or certain parts of the embodiments.

[0032] In the embodiments provided in this application, it should be understood that the disclosed system or method can be implemented in other ways. The embodiments described above are merely illustrative. For example, the division of modules or units is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple modules or units may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces. The indirect coupling or communication connection between systems, modules, and units may be electrical, mechanical, or other forms.

[0033] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for analyzing storage operation records of storage devices based on data traceability, characterized in that, Includes the following steps: The system retrieves the record content corresponding to four types of records within the storage device, and obtains multiple serial links based on all record content. The four types of records include read / write records, fault records, configuration records, and security records. The system analyzes all serial links and obtains the main characteristics and associated characteristics of each serial link based on the analysis results. A link analysis model is constructed based on four types of records; a link analysis database is constructed based on the main characteristics and correlation characteristics of all serial links; the link analysis database is stored in the link analysis model, and a model analysis method is constructed. When analyzing operation records within a storage device, a link analysis model and model analysis methods are used to analyze the operation records to be analyzed, and fault characteristics are obtained based on the analysis results. These fault characteristics are then used as the analysis results for the operation records to be analyzed.

2. The method for analyzing storage operation records of storage devices based on data traceability according to claim 1, characterized in that, Retrieve the record content corresponding to four types of records within the storage device, and obtain multiple serial links based on all record content, including: Retrieve all historical operation records stored in the storage device, and record the historical operation records containing four types of records as serial analysis records; retrieve all serial analysis records in the historical operation records. The link acquisition method is used to obtain the serial links of all serial analysis records. The link acquisition method includes: for any serial analysis record, obtaining the execution time of all operation records in the serial analysis record, and recording the first occurrence time of read / write records, fault records, configuration records and security records in the serial analysis record as the first read / write time, the first fault time, the first configuration time and the first security time, respectively.

3. The method for analyzing storage operation records of storage devices based on data traceability according to claim 2, characterized in that, Link acquisition methods also include: Based on the time sequence, the first read / write time, the first failure time, the first configuration time, and the first security time are arranged in order. Based on the arranged time order, the four types of records are recorded as the first execution record, the second execution record, the third execution record, and the fourth execution record, respectively. The sequence of execution records from the first execution record to the second execution record, the third execution record, and the fourth execution record is denoted as the serial link of the serial analysis records. Obtain the serial links for all serial analysis records.

4. The method for analyzing storage operation records of storage devices based on data traceability according to claim 3, characterized in that, All series links are analyzed, and based on the analysis results, the main characteristics and related characteristics of each series link are obtained, including: Link feature analysis is used to obtain the main features and related features of all serial analysis records. Link feature analysis includes: for the nth execution record and the (n+1)th execution record in any serial analysis record, based on the native data fields of the storage device and standardized metadata tags, obtaining the common identification field between the nth execution record and the (n+1)th execution record, and recording it as the identification field. There may be multiple identification fields. Get all the time points when the nth execution record in the serial analysis record is executed, and record them as the preceding time points; get all the time points when the (n+1)th execution record in the serial analysis record is executed, and record them as the following time points, where n is a positive integer less than or equal to 3 and greater than or equal to 1.

5. The method for analyzing storage operation records of storage devices based on data traceability according to claim 4, characterized in that, Link feature analysis also includes: Establish a timeline from left to right, and mark all preceding and subsequent time points within the timeline; within the timeline: for any preceding time point α, if there is a subsequent time point to the right of the preceding time point α, record the number of subsequent time points to the right of the preceding time point α as m1, and record all subsequent time points to the right of the preceding time point α as time points to be screened; for any time point to be screened: obtain the identification field of the nth execution record corresponding to the preceding time point α, and the identification field of the (n+1)th execution record corresponding to the time point to be screened; If there are two identical discrimination fields β among all the discrimination fields corresponding to the current time point α and the time point to be screened, the time point to be screened is recorded as the associated time point of the previous time point α, and discrimination field β is recorded as the associatable field of the previous time point α; if all the discrimination fields corresponding to the current time point α and the time point to be screened are different, the time point to be screened is recorded as the discarded time point.

6. The method for analyzing storage operation records of storage devices based on data traceability according to claim 5, characterized in that, Link feature analysis also includes: The number of associated time points of the preceding time point α is denoted as m2, and the value of m2 divided by m1 is denoted as the association ratio of the preceding time point α. If there is no subsequent time point to the right of the previous time point α, the correlation ratio of the previous time point α is recorded as 0. Obtain the correlation ratios for all preceding time points, and denote the closed interval formed by the maximum and minimum values ​​among all non-zero correlation ratios as the correlation ratio interval; denote the set of all associable fields as the sub-link features.

7. The method for analyzing storage operation records of storage devices based on data traceability according to claim 6, characterized in that, Link feature analysis also includes: The main features of the serial links in the serial analysis record are denoted as {δ1, δ2, δ3}, and the association features of the serial links in the serial analysis record are denoted as {γ1, γ2, γ3}, where δn and γn are the association ratio range and sub-link features corresponding to the nth execution record and the (n+1)th execution record in the serial analysis record, respectively. Obtain the main characteristics and associated characteristics of the serial links in all serial analysis records.

8. The method for analyzing storage operation records of storage devices based on data traceability according to claim 7, characterized in that, A link analysis model is constructed based on four types of records; a link analysis database is constructed based on the main characteristics and associated characteristics of all serial links. The methods for storing link analysis databases into the link analysis model and constructing the model include: A link analysis model is constructed, wherein the input of the link analysis model is the acquisition module of four types of records in the operation log, and the output of the link analysis model is the fault characteristics; The main features and associated features of the serial links obtained from all serial analysis records are stored in the main database and the associated database, respectively. The database containing all serial analysis records, the serial links, the main database, and the associated database is called the link analysis database.

9. The method for analyzing storage operation records of storage devices based on data traceability according to claim 8, characterized in that, Model analysis methods include: When the operation record to be analyzed is obtained, the acquisition module at the input end of the link analysis model obtains the execution time of all four types of records in the operation record to be analyzed, and obtains the serial links of the operation record to be analyzed based on the link acquisition method, which are recorded as the link to be analyzed. When there is a serial link A in the link analysis database that is the same as the link to be analyzed, the subject features and association features corresponding to the serial link A in the subject database and the association database are respectively recorded as the subject judgment criteria and the association judgment criteria. The main features and associated features of the link to be analyzed are obtained based on the link feature analysis method, and are respectively denoted as the main body to be analyzed and the associated link to be analyzed.

10. The method for analyzing storage operation records of storage devices based on data traceability according to claim 9, characterized in that, Model analysis methods also include: For any interval δn in the subject to be analyzed, when the minimum value of δn in the subject to be analyzed is less than the minimum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed being relatively low; when the maximum value of δn in the subject to be analyzed is greater than the maximum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed being relatively high; when the minimum value of δn in the subject to be analyzed is less than the minimum value of δn in the subject judgment criteria, and the maximum value of δn is greater than the maximum value of δn in the subject judgment criteria, the fault feature is recorded as the correlation frequency between the nth execution record and the (n+1)th execution record in the operation record to be analyzed fluctuating significantly. For any set γn in the association to be analyzed, if any discriminant field B in γn is not within the association judgment criterion γn, the fault feature is recorded as the association mode between the nth execution record and the (n+1)th execution record in the operation record to be analyzed is abnormal, and the discriminant field B is recorded as the abnormal association field.

Images