A risk early warning method and system for an information system

Abstract

The application discloses a risk early warning method and system for an information system, and relates to the technical field of risk early warning. A tracking unit is arranged at a business request processing entrance of the information system, so that a tracking identifier of the business request is obtained; memory allocation call sampling is performed in a processing process of the business request, so that memory allocation call information is obtained; metadata records of the business request are generated; the metadata records are stored, so that a sampling metadata table of the information system is obtained; when it is identified that the business request ends, asynchronous release state checking processing is performed on the sampling metadata table, so that a leakage point set is obtained; the leakage point set is analyzed and processed, so that a leakage index value corresponding to a call stack characteristic hash is obtained; then, abnormality judgment processing is performed, so that a risk result corresponding to the call stack characteristic hash is obtained; and finally, the information system is subjected to risk early warning, so that the effectiveness of memory risk early warning management of the information system is improved.

Description

Technical Field

[0001] This invention relates to the field of risk warning technology, specifically to a risk warning method and system for information systems. Background Technology

[0002] In the field of information system operation and maintenance management technology, with the continuous evolution of software architecture towards microservices and high-concurrency processing, real-time and accurate monitoring of the internal operating status of information systems has become a core technical link in ensuring business continuity and improving service quality. As the core platform carrying modern business logic and data flow, information systems have complex internal component interactions and frequent dynamic resource allocation. Against this background, risk warning methods that combine fine-grained data collection and intelligent analysis can build a more sensitive and in-depth perception network in the complex software system, thereby significantly improving the automation and intelligence level of operation and maintenance, and enhancing the inherent accuracy of information systems and the reliability of service delivery.

[0003] In the current field of risk warning technology, only macro-level indicators at the system level, such as overall system memory utilization and CPU load, are periodically collected and compared and alerted based on pre-set fixed thresholds. While this method can capture significant, system-level resource exhaustion events, it is clearly inadequate when dealing with gradual resource depletion caused by minor defects, such as slow memory leaks. Such leaks have a negligible impact on a single business request, and their signals are completely drowned out by massive amounts of normal performance fluctuation data. This makes the warning mechanism based on macro thresholds and short-term statistics severely lagging behind, often only triggering alerts when resource consumption approaches physical limits, and failing to pinpoint the specific leaking code. This makes it difficult for operations and maintenance personnel to intervene effectively before the failure becomes catastrophic, and may also generate a large number of non-targeted false alarms due to unreasonable thresholds. Ultimately, unpredictable resource exhaustion may lead to service interruption, seriously affecting system reliability and business continuity. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a risk warning method and system for information systems, which can effectively solve the problems mentioned in the background section.

[0005] To achieve the above objectives, the first aspect of the present invention is implemented through the following technical solution: a risk warning method for an information system, comprising deploying a tracking unit at the business request processing entry point of the information system, generating a tracking identifier for the business request through the tracking unit, thereby obtaining the tracking identifier of the business request.

[0006] During the processing of business requests, memory allocation call sampling is performed to obtain the memory allocation call information of business requests in the information system, and then the metadata record of the business request is generated. The metadata record of the business request includes the trace identifier of the business request, memory allocation call information, and call stack feature hash.

[0007] The metadata records of business requests in the information system are stored to obtain the sampled metadata table of the information system.

[0008] Upon identifying the end of a business request, an asynchronous release status check is performed on the sampled metadata table of the information system to obtain a set of leakage points in the information system.

[0009] The system analyzes and processes the set of leakage points of the information system within a preset time window to obtain the leakage index value corresponding to the call stack feature hash of the information system. It then performs anomaly judgment processing on the leakage index value corresponding to the call stack feature hash of the information system to obtain the risk result corresponding to the call stack feature hash of the information system, and then provides risk warning for the information system.

[0010] Furthermore, the process of sampling memory allocation calls during the processing of business requests is as follows: when a business request makes a memory allocation call, the memory allocation value of the business request is collected, and the sampling frequency is adjusted.

[0011] During the processing of business requests, memory allocation calls are sampled at an adjusted sampling frequency to obtain memory allocation call information and call stack feature hash of business requests in the information system. The memory allocation call information includes memory allocation address and memory allocation value.

[0012] Furthermore, the specific process of adjusting the sampling frequency is as follows: the memory allocation value of the service request is compared with the set memory allocation threshold. If the memory allocation value of the service request is less than or equal to the set memory allocation threshold, the memory allocation call sampling continues at the current sampling frequency. If the memory allocation value of the service request is greater than the set memory allocation threshold, the current sampling frequency is added to the set sampling frequency supplement value to obtain the sampling frequency target value, and the memory allocation call sampling is performed with the sampling frequency target value.

[0013] Furthermore, the asynchronous release status verification process for the sampled metadata table of the information system is as follows: upon detecting the end of a business request, a background verification task is triggered, and the background verification task reads the tracking identifier of the business request from the memory storage of the current thread.

[0014] Based on the trace identifier of the business request, a query is performed in the sampled metadata table of the information system to obtain the metadata records of all business requests containing the trace identifier. For each obtained metadata record of the business request, a memory status verification operation is performed.

[0015] Furthermore, the specific process of performing the memory status verification operation is as follows: The memory status verification operation calls the debugging interface provided by the memory allocator to confirm whether the memory block pointed to by the memory allocation address recorded in the metadata record of the business request is still marked as allocated. If it is confirmed that the memory block is still marked as allocated, the metadata record of the business request is marked as a leakage point of the information system, and all marked metadata records are collected to form a leakage point set of the information system. If it is confirmed that the memory block has been marked as released, no marking is performed.

[0016] Furthermore, the analysis and processing of the set of leakage points of information systems within the preset time window is specifically carried out by setting a preset time window of fixed length and collecting the set of leakage points of all information systems within the preset time window.

[0017] Based on the call stack feature hash in the metadata record of the business request, the leak points in the information system's leak point set are classified and aggregated. For leak points with the same call stack feature hash, the number of times the leak point corresponding to the call stack feature hash appears is counted.

[0018] The frequency of leaks corresponding to call stack feature hashes is obtained by dividing the number of times the leak point appears by the number of times the memory allocation call corresponding to the call stack feature hash is sampled within the preset time window.

[0019] For leak points with the same call stack feature hash, the memory allocation values ​​in the metadata records corresponding to the leak points are summed to obtain the total amount of leaked memory corresponding to the call stack feature hash.

[0020] Furthermore, the specific process for obtaining the leakage index value corresponding to the call stack feature hash of the information system is as follows: the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system are comprehensively processed to obtain the leakage index value corresponding to the call stack feature hash of the information system. The leakage index value corresponding to the call stack feature hash of the information system represents the quantification result of the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system, which together quantify the severity of memory leakage risk of the code path corresponding to the call stack.

[0021] Furthermore, the abnormal judgment processing of the leakage index value corresponding to the call stack feature hash of the information system is as follows: the risk result corresponding to the call stack feature hash of the information system includes risky and risk-free.

[0022] The leakage indicator value corresponding to the call stack feature hash of the information system is compared with the preset leakage indicator threshold. If the leakage indicator value corresponding to the call stack feature hash of the information system is higher than the preset leakage indicator threshold, the risk result corresponding to the call stack feature hash of the information system is marked as risky; otherwise, the risk result corresponding to the call stack feature hash of the information system is marked as risk-free.

[0023] Furthermore, the specific process of providing risk warnings for the information system is as follows: if the risk result corresponding to the call stack feature hash of the information system is marked as risky, then a risk warning is issued to the information system, and the risk warning information is sent to the management personnel for warning; if the risk result corresponding to the call stack feature hash of the information system is marked as risk-free, then no risk warning is issued to the information system.

[0024] A second aspect of the present invention provides a risk warning system for an information system, comprising: a tracking identifier module, configured to deploy a tracking unit at the business request processing entry point of the information system, and generate a tracking identifier for the business request through the tracking unit, thereby obtaining the tracking identifier of the business request.

[0025] The data recording module is used to sample memory allocation calls during the processing of business requests, obtain memory allocation call information of business requests in the information system, and then generate metadata records of business requests. The metadata records of business requests include the trace identifier of the business request, memory allocation call information, and call stack feature hash.

[0026] The data storage module is used to store the metadata records of business requests in the information system, and obtain the sampled metadata table of the information system.

[0027] The verification and processing module is used to asynchronously release the status of the sampled metadata table of the information system when the business request is identified as ending, so as to obtain the set of leakage points of the information system.

[0028] The risk warning module is used to analyze and process the set of leakage points of the information system within a preset time window, obtain the leakage index value corresponding to the call stack feature hash of the information system, perform anomaly judgment processing on the leakage index value corresponding to the call stack feature hash of the information system, obtain the risk result corresponding to the call stack feature hash of the information system, and then provide risk warning for the information system.

[0029] The present invention has the following beneficial effects:

[0030] (1) This invention uses a dual association system of tracking identifiers and call stack feature hashes to accurately bind tiny, single-request memory allocation failure events to specific source code files and line numbers. This enables the system to capture continuously generated micro-leakage signals and issue warnings in the precise form of code lines and business requests, thus achieving accurate tracing and early warning of memory leak risks.

[0031] (2) This invention accurately locates the source of leakage to specific code files and line numbers by calling stack feature hash, and uses tracking identifiers to associate it with specific business, realizing a leap from vague alarms of insufficient system memory to accurate diagnosis of a specific type of leakage in a certain line of code of a certain business interface. This shortens the root cause analysis time from traditional day-level experience-based investigation to minute-level automated location. Furthermore, by comprehensively analyzing the frequency and total amount of leakage, the risk level is automatically classified, guiding maintenance personnel to prioritize the issues that pose the greatest threat to system stability, greatly optimizing the input-output ratio of maintenance resources.

[0032] (3) By sampling memory allocation calls and analyzing call stack features during the processing of business requests, this invention makes the monitoring and location of memory leaks no longer dependent on manual inspection and overly rough statistical data, thereby significantly improving the automation level of memory leak detection. The low overhead of the entire system enables it to be applied in production environments, reducing the performance degradation caused by traditional detection methods and meeting the dual requirements of real-time and high efficiency of information systems. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the method flow of the present invention.

[0034] Figure 2 This is a schematic diagram of the system module connections of the present invention. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] Please see Figure 1 As shown, the first aspect of the present invention provides a technical solution: a risk warning method for an information system, comprising deploying a tracking unit at the business request processing entry point of the information system, generating a tracking identifier for the business request through the tracking unit, thereby obtaining the tracking identifier of the business request.

[0037] It should be added that the tracking unit is a software interception component deployed at the business request processing entry point of the information system. Its function is to generate and inject a unique tracking identifier for each business request and bind the identifier to the processing context of the business request to ensure that it can be accessed and associated by subsequent sampling and verification stages throughout the entire life cycle of the business request.

[0038] During the processing of business requests, memory allocation call sampling is performed to obtain the memory allocation call information of business requests in the information system, and then the metadata record of the business request is generated. The metadata record of the business request includes the trace identifier of the business request, memory allocation call information, and call stack feature hash.

[0039] The metadata records of business requests in the information system are stored to obtain the sampled metadata table of the information system.

[0040] Upon identifying the end of a business request, an asynchronous release status check is performed on the sampled metadata table of the information system to obtain a set of leakage points in the information system.

[0041] The system analyzes and processes the set of leakage points of the information system within a preset time window to obtain the leakage index value corresponding to the call stack feature hash of the information system. It then performs anomaly judgment processing on the leakage index value corresponding to the call stack feature hash of the information system to obtain the risk result corresponding to the call stack feature hash of the information system, and then provides risk warning for the information system.

[0042] Specifically, memory allocation call sampling is performed during the processing of business requests. The process is as follows: when a business request makes a memory allocation call, the memory allocation value of the business request is collected, and the sampling frequency is adjusted. By dynamically adjusting the monitoring intensity according to the memory allocation scale, the utilization efficiency of monitoring resources is optimized, ensuring that higher attention is paid to large-capacity memory allocation behavior, thereby balancing the detection coverage and system performance overhead.

[0043] It should be explained that the memory allocation value of a business request reflects the size of the memory capacity requested by the memory allocation function call during the processing of that business request. This memory allocation value is obtained directly by calling the memory allocator.

[0044] During the processing of business requests, memory allocation calls are sampled at an adjusted sampling frequency to obtain memory allocation call information and call stack feature hash of business requests in the information system. The memory allocation call information includes memory allocation address and memory allocation value.

[0045] It should be noted that the memory allocation address of the business request reflects the starting position of the memory block obtained by the memory allocation call in the process of the business request in the process of the memory allocation call. This memory allocation address is obtained directly by calling the memory allocator. The call stack feature hash of the business request represents the unique feature of the function call sequence on the program execution path at the time when the memory allocation call occurs in the process of the business request. This call stack feature hash is obtained directly by calling the memory allocator.

[0046] Specifically, the sampling frequency is adjusted as follows: the memory allocation value of the business request is compared with the set memory allocation threshold. If the memory allocation value of the business request is less than or equal to the set memory allocation threshold, the memory allocation call sampling continues at the current sampling frequency. If the memory allocation value of the business request is greater than the set memory allocation threshold, the current sampling frequency is added to the set sampling frequency supplement value to obtain the sampling frequency target value, and the memory allocation call sampling is performed at the sampling frequency target value.

[0047] Specifically, the sampling metadata table of the information system is subjected to asynchronous release status verification. The specific process is as follows: when the business request is identified as ending, a background verification task is triggered. The background verification task reads the tracking identifier of the business request from the memory storage of the current thread.

[0048] Based on the trace identifier of the business request, a query is performed in the sampled metadata table of the information system to obtain the metadata records of all business requests containing the trace identifier. For each obtained metadata record of the business request, a memory status verification operation is performed.

[0049] Specifically, the memory status verification operation is performed as follows: The memory status verification operation calls the debugging interface provided by the memory allocator to confirm whether the memory block pointed to by the memory allocation address recorded in the metadata record of the business request is still marked as allocated. If it is confirmed that the memory block is still marked as allocated, the metadata record of the business request is marked as a leakage point of the information system, and all marked metadata records are collected to form a leakage point set of the information system. If it is confirmed that the memory block has been marked as released, no marking is performed, which helps to accurately identify memory resources that have not been released after the business request logic ends.

[0050] Specifically, the process involves analyzing and processing the set of information system leakage points within a preset time window. The specific process is as follows: set a preset time window of fixed length and collect the set of leakage points of all information systems within the preset time window.

[0051] Based on the call stack feature hash in the metadata record of the business request, the leak points in the information system's leak point set are classified and aggregated. For leak points with the same call stack feature hash, the number of times the leak point corresponding to the call stack feature hash appears is counted. This helps to merge scattered leak events belonging to the same code segment, thus highlighting the leak problem of that code path.

[0052] The frequency of leaks corresponding to call stack feature hashes is obtained by dividing the number of times the leak point appears by the number of times the memory allocation call corresponding to the call stack feature hash is sampled within the preset time window.

[0053] For leak points with the same call stack feature hash, the memory allocation values ​​in the metadata records corresponding to the leak points are summed to obtain the total amount of leaked memory corresponding to the call stack feature hash.

[0054] Specifically, the leakage index value corresponding to the call stack feature hash of the information system is obtained. The specific process is as follows: the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system are comprehensively processed to obtain the leakage index value corresponding to the call stack feature hash of the information system. The leakage index value corresponding to the call stack feature hash of the information system represents the quantification result of the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system, which together quantify the severity of memory leakage risk of the code path corresponding to the call stack.

[0055] In this embodiment, the leakage index value corresponding to the call stack feature hash of the information system can be obtained through the following analysis method, with the specific analysis conditions as follows:

[0056] ;

[0057] In the formula, This represents the leakage indicator value corresponding to the call stack feature hash of the information system. This indicates the frequency of leak points corresponding to the call stack feature hash of the information system. This represents the weighting factor corresponding to the set frequency of occurrence of a unit leak point. This represents the total amount of leaked memory corresponding to the call stack feature hash of the information system. This represents the weighting factor corresponding to the set total leaked memory per unit.

[0058] It should be added that, in this embodiment, the preset weighting factors corresponding to the frequency of occurrence of unit leakage points and the total amount of leakage memory per unit are obtained from the risk warning database.

[0059] It should be explained that the weighting factors corresponding to the frequency of occurrence of leakage points per unit and the total amount of leaked memory per unit are used to adjust the importance of the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system in the process of analyzing and obtaining leakage index values. For example, a mapping relationship between the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system and the weighting factors is set in the risk warning database. Through the pre-set mapping relationship, the weighting factors corresponding to the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system in real time can be obtained. By matching the frequency of occurrence of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system with the pre-set mapping relationship, the weighting factors corresponding to the frequency of occurrence of leakage points per unit and the total amount of leaked memory per unit are obtained.

[0060] In this implementation plan, there is a correlation between the frequency of leakage points corresponding to the call stack feature hash of the information system and the total amount of leaked memory; they are not independent entities. For example, although high-frequency, small memory leaks have a small impact on a single instance, they accumulate rapidly and cause significant long-term harm. On the other hand, low-frequency, large memory block leaks, although infrequent, can cause a significant impact on the memory pool on a single instance. By comprehensively analyzing the leakage index value corresponding to the call stack feature hash of the information system, we can quantitatively assess the sum of the immediate resource pressure and long-term cumulative risk caused by the memory leak in that code path. This helps operations and maintenance personnel to judge the urgency and potential impact of the problem, thereby formulating a clear priority remediation strategy, achieving optimal allocation of limited operations and maintenance resources, and prioritizing the handling of leakage points that pose the greatest threat to the overall stability of the system.

[0061] Specifically, the leakage indicator value corresponding to the call stack feature hash of the information system is subjected to anomaly judgment processing. The specific processing process is as follows: the risk result corresponding to the call stack feature hash of the information system includes risky and no risk.

[0062] The leakage indicator value corresponding to the call stack feature hash of the information system is compared with the preset leakage indicator threshold. If the leakage indicator value corresponding to the call stack feature hash of the information system is higher than the preset leakage indicator threshold, the risk result corresponding to the call stack feature hash of the information system is marked as risky; otherwise, the risk result corresponding to the call stack feature hash of the information system is marked as risk-free.

[0063] Specifically, the risk warning process for the information system is as follows: if the risk result corresponding to the call stack feature hash of the information system is marked as risky, then a risk warning is issued for the information system, and risk warning information containing the code location and leakage type corresponding to the call stack feature hash is generated and sent to the management personnel for warning. If the risk result corresponding to the call stack feature hash of the information system is marked as risk-free, then no risk warning is issued for the information system.

[0064] It should be added that risk warning information containing the code location and leakage type corresponding to the call stack feature hash is generated. Based on the call stack information mapping table stored in the risk warning database, the source code file path, function name, and line number corresponding to the call stack feature hash are parsed out and recorded as the code location corresponding to the call stack feature hash. Then, the frequency of leakage points and the total amount of leaked memory obtained from the call stack feature hash within a preset time window are read. The frequency of leakage points is compared with a preset high-frequency leakage frequency threshold, and the total amount of leaked memory is compared with a preset large memory leakage threshold. When the frequency of leakage points is greater than the high-frequency leakage frequency threshold and the total amount of leaked memory is less than the large memory leakage threshold, the leakage type is determined to be high-frequency. For small memory block leaks, when the frequency of the leak point is greater than the high-frequency leak frequency threshold and the total leaked memory amount is greater than or equal to the large memory leak amount threshold, the leak type is determined to be a high-frequency secondary large memory block leak. When the frequency of the leak point is less than or equal to the high-frequency leak frequency threshold and the total leaked memory amount is greater than or equal to the large memory leak amount threshold, the leak type is determined to be a low-frequency secondary large memory block leak. When the frequency of the leak point is less than or equal to the high-frequency leak frequency threshold and the total leaked memory amount is less than the large memory leak threshold, the leak type is determined to be a low-frequency secondary small memory block leak. The code location corresponding to the parsed call stack feature hash and the determined leak type are combined to generate the risk warning information containing the code location corresponding to the call stack feature hash and the leak type.

[0065] A second aspect of the present invention provides a risk warning system for an information system, comprising: a tracking identifier module, configured to deploy a tracking unit at the business request processing entry point of the information system, and generate a tracking identifier for the business request through the tracking unit, thereby obtaining the tracking identifier of the business request.

[0066] The data recording module is used to sample memory allocation calls during the processing of business requests, obtain memory allocation call information of business requests in the information system, and then generate metadata records of business requests. The metadata records of business requests include the trace identifier of the business request, memory allocation call information, and call stack feature hash.

[0067] The data storage module is used to store the metadata records of business requests in the information system, and obtain the sampled metadata table of the information system.

[0068] The verification and processing module is used to asynchronously release the status of the sampled metadata table of the information system when the business request is identified as ending, so as to obtain the set of leakage points of the information system.

[0069] The risk warning module is used to analyze and process the set of leakage points of the information system within a preset time window, obtain the leakage index value corresponding to the call stack feature hash of the information system, perform anomaly judgment processing on the leakage index value corresponding to the call stack feature hash of the information system, obtain the risk result corresponding to the call stack feature hash of the information system, and then provide risk warning for the information system.

[0070] It should be noted that a risk warning method and system for information systems also includes a risk warning database, which stores memory allocation thresholds, sampling frequency supplementary values, fixed-length preset time windows, weight factors corresponding to the frequency of occurrence of unit leakage points, weight factors corresponding to the total amount of leaked memory per unit, leakage index thresholds, call stack information mapping tables, high-frequency leakage frequency thresholds, and large memory leakage thresholds obtained by analyzing historical data.

[0071] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0072] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention.

Claims

1. A risk warning method for information systems, characterized in that, include: A tracing unit is deployed at the business request processing entry point of the information system. The tracing unit generates a tracing identifier for the business request, thereby obtaining the tracing identifier of the business request. During the processing of business requests, memory allocation call sampling is performed to obtain the memory allocation call information of business requests in the information system, and then the metadata record of the business request is generated. The metadata record of the business request includes the trace identifier of the business request, memory allocation call information, and call stack feature hash. The metadata records of business requests in the information system are stored to obtain the sampled metadata table of the information system; Upon identifying the end of a business request, an asynchronous release status check is performed on the sampled metadata table of the information system to obtain a set of leakage points in the information system. The system analyzes and processes the set of leakage points of the information system within a preset time window to obtain the leakage index value corresponding to the call stack feature hash of the information system. It then performs anomaly judgment processing on the leakage index value corresponding to the call stack feature hash of the information system to obtain the risk result corresponding to the call stack feature hash of the information system, and then provides risk warning for the information system. The specific process of analyzing and processing the set of information system leakage points within the preset time window is as follows: Set a preset time window of fixed length and collect a set of all information system leak points within the preset time window; Based on the call stack feature hash in the metadata record of the business request, the leak points in the information system's leak point set are classified and aggregated. For leak points with the same call stack feature hash, the number of times the leak point corresponding to the call stack feature hash appears is counted. Divide the number of times the leak point corresponding to the call stack feature hash appears by the total number of samplings of memory allocation calls corresponding to the call stack feature hash within the preset time window to obtain the frequency of the leak point corresponding to the call stack feature hash. For leak points with the same call stack feature hash, the memory allocation value in the metadata record corresponding to the leak point is added to obtain the total leaked memory corresponding to the call stack feature hash. The specific process for obtaining the leakage indicator value corresponding to the call stack feature hash of the information system is as follows: The frequency of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system are comprehensively processed to obtain the leakage index value corresponding to the call stack feature hash of the information system. The leakage index value corresponding to the call stack feature hash of the information system represents the quantification result of the frequency of leakage points and the total amount of leaked memory corresponding to the call stack feature hash of the information system, which together quantify the severity of memory leakage risk of the code path corresponding to the call stack.

2. The risk warning method for an information system according to claim 1, characterized in that: The specific process of sampling memory allocation calls during the processing of business requests is as follows: When a business request makes a memory allocation call, the memory allocation value of the business request is collected, and the sampling frequency is adjusted accordingly. During the processing of business requests, memory allocation calls are sampled at an adjusted sampling frequency to obtain memory allocation call information and call stack feature hash of business requests in the information system. The memory allocation call information includes memory allocation address and memory allocation value.

3. The risk warning method for an information system according to claim 2, characterized in that: The specific process for adjusting the sampling frequency is as follows: The memory allocation value of the business request is compared with the set memory allocation threshold. If the memory allocation value of the business request is less than or equal to the set memory allocation threshold, the memory allocation call sampling continues at the current sampling frequency. If the memory allocation value of the business request is greater than the set memory allocation threshold, the set sampling frequency supplement value is added to the current sampling frequency to obtain the sampling frequency target value, and the memory allocation call sampling is performed with the sampling frequency target value.

4. The risk warning method for an information system according to claim 1, characterized in that: The asynchronous release status check process for the sampled metadata table of the information system is as follows: Upon detecting the end of a business request, a background verification task is triggered, which reads the trace identifier of the business request from the memory storage of the current thread. Based on the trace identifier of the business request, a query is performed in the sampled metadata table of the information system to obtain the metadata records of all business requests containing the trace identifier. For each obtained metadata record of the business request, a memory status verification operation is performed.

5. The risk warning method for an information system according to claim 4, characterized in that: The specific process of performing the memory state verification operation is as follows: The memory status verification operation calls the debugging interface provided by the memory allocator to confirm whether the memory block pointed to by the memory allocation address recorded in the metadata record of the business request is still marked as allocated. If it is confirmed that the memory block is still marked as allocated, the metadata record of the business request is marked as a leakage point of the information system, and all marked metadata records are collected to form a leakage point set of the information system. If it is confirmed that the memory block has been marked as released, no marking is performed.

6. The risk warning method for an information system according to claim 1, characterized in that: The specific process for handling the anomaly detection of the leakage indicator value corresponding to the call stack feature hash of the information system is as follows: The risk results corresponding to the call stack feature hash of the information system include risky and risk-free; The leakage indicator value corresponding to the call stack feature hash of the information system is compared with the preset leakage indicator threshold. If the leakage indicator value corresponding to the call stack feature hash of the information system is higher than the preset leakage indicator threshold, the risk result corresponding to the call stack feature hash of the information system is marked as risky; otherwise, the risk result corresponding to the call stack feature hash of the information system is marked as risk-free.

7. The risk warning method for an information system according to claim 6, characterized in that: The specific process for providing risk warnings to information systems is as follows: If the risk result corresponding to the call stack feature hash of the information system is marked as risky, a risk warning will be issued to the information system and the risk warning information will be sent to the management personnel. If the risk result corresponding to the call stack feature hash of the information system is marked as risk-free, no risk warning will be issued to the information system.

8. A risk warning system for an information system, used to implement the risk warning method for an information system according to any one of claims 1-7, characterized in that, include: The tracking identifier module is used to deploy tracking units at the business request processing entry point of the information system. The tracking unit generates tracking identifiers for business requests, thereby obtaining the tracking identifiers of the business requests. The data recording module is used to sample memory allocation calls during the processing of business requests, obtain memory allocation call information of business requests in the information system, and then generate metadata records of business requests. The metadata records of business requests include the trace identifier of business requests, memory allocation call information, and call stack feature hash. The data storage module is used to store the metadata records of business requests in the information system, and obtain the sampled metadata table of the information system. The verification and processing module is used to perform asynchronous release status verification on the sampled metadata table of the information system when the business request is identified as ending, so as to obtain the set of leakage points of the information system. The risk warning module is used to analyze and process the set of leakage points of the information system within a preset time window, obtain the leakage index value corresponding to the call stack feature hash of the information system, perform anomaly judgment processing on the leakage index value corresponding to the call stack feature hash of the information system, obtain the risk result corresponding to the call stack feature hash of the information system, and then provide risk warning for the information system.

Images