Intelligent converged terminal micro application resource isolation method based on container technology

Abstract

The application relates to the technical field of container resource isolation, and discloses a kind of intelligent fusion terminal micro application resource isolation method based on container technology, comprising: setting sampling period and continuously collecting the running behavior data of each container in each sampling period;Based on the running behavior data, the running correlation model between containers is constructed;Based on the running behavior data, identify abnormal running containers and identify the abnormal correlation path of each abnormal running container based on the running correlation model;Based on the abnormal correlation path, divide the minimum state set for each abnormal running container;Based on the minimum state set, respectively, each abnormal running container is isolated from resources.The application accurately cuts off the abnormal propagation path at the state level, realizes the controllable isolation of container anomaly and the stable operation of business continuity.

Description

Technical Field

[0001] This application relates to the technical field of container resource isolation, specifically to a method for resource isolation of intelligent converged terminal micro-applications based on container technology. Background Technology

[0002] In intelligent converged terminals, multiple micro-applications run in parallel as containers, each undertaking different business functions such as data acquisition, event analysis, fault diagnosis, communication transmission, and image processing. To meet the needs of multi-service concurrency and rapid expansion, the terminal allows data interaction and collaborative processing between containers. However, in actual operation, complex operational dependencies are formed between micro-applications through shared data, event queues, and control commands. In this operating mode, when a micro-application enters an abnormal state due to resource anomalies, logical anomalies, or peripheral device blockages, its impact is often not limited to its own container but spreads to other micro-applications through data and state flows between containers, leading to cascading blockages, cascading restarts, or even complete system failure. Existing container-based resource isolation mechanisms mainly rely on resource quota restrictions or overall container restarts, making it difficult to identify anomaly propagation paths and unable to achieve fine-grained isolation without disrupting overall business continuity. In intelligent converged terminals with multiple containers running collaboratively, anomalies in a single micro-application can easily propagate to other containers through data dependencies, event calls, or control links, and existing isolation mechanisms cannot identify these propagation paths. Existing container isolation methods typically involve overall restriction or overall restart, which can cause unnecessary disruption to normal business operations during anomaly handling.

[0003] For example, Chinese patent application CN120277657A discloses a resource security isolation method in a containerized environment, including selecting a target container technology that meets the requirements for resource security isolation; obtaining a container isolation security policy based on the target container technology to achieve resource security isolation operations between containers; and real-time detection of abnormal behavior, periodic auditing, and risk assessment of containers to ensure the isolation between containers. By selecting a container technology that meets the current requirements for resource security isolation and generating a container isolation security policy in conjunction with the operating system environment, resource security isolation operations between containers are achieved; real-time detection of abnormal behavior, periodic auditing, and risk assessment of containers ensure the isolation between containers, effectively improving the security, stability, and reliability of the system, as well as optimizing resource utilization and management. However, this technical solution suffers from the problem mentioned in the background of this application: it cannot identify the path of abnormal propagation.

[0004] The information disclosed in this background section is intended only to enhance the understanding of the overall background of this application and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0005] The technical problem to be solved by this application is to overcome the defects of the prior art and provide a resource isolation method for intelligent converged terminal micro-applications based on container technology. By accurately cutting off the abnormal propagation path at the state level, it can achieve controllable isolation of container abnormalities and continuous and stable operation of business.

[0006] To solve the above-mentioned technical problems, this application provides the following technical solution:

[0007] A method for resource isolation of micro-applications in an intelligent converged terminal based on container technology includes the following steps:

[0008] Set the sampling period and continuously collect the operational behavior data of each container in each sampling period;

[0009] A model of operational association between containers is constructed based on the aforementioned operational behavior data;

[0010] Based on the operational behavior data, abnormal operating containers are identified, and based on the operational association model, abnormal association paths for each abnormal operating container are identified.

[0011] Based on the aforementioned abnormal association paths, a minimum state set is divided for each abnormal running container;

[0012] Resource isolation is performed on each abnormally running container based on the minimum state set.

[0013] As a preferred embodiment of the intelligent fusion terminal micro-application resource isolation method based on container technology described in this application, wherein: the running behavior data of any container includes resource access data and status read / write data;

[0014] The resource access data includes the container's blocking wait time during the sampling period; the state read / write data of any container includes the number of times the container writes to and reads each shared state during the sampling period.

[0015] The running association model includes model nodes and directed edges; the model nodes include container nodes, shared state nodes, and business result nodes;

[0016] The method for constructing the runtime association model between containers is as follows:

[0017] Each container is marked as a container node in the running association model; the shared state between any two containers is marked as a shared state node in the running association model; the business results generated by the running of any container are marked as business result nodes in the running association model; directed edges are added between model nodes to form a complete running association model.

[0018] As a preferred embodiment of the container-based intelligent fusion terminal micro-application resource isolation method described in this application, the step of adding directed edges between model nodes specifically includes:

[0019] If any container writes to any shared state, a directed edge is added between the corresponding container node and the shared state node, with the directed edge pointing from the container node to the shared state node.

[0020] If any container reads any shared state, a directed edge is added between the corresponding container node and the shared state node, with the directed edge pointing from the shared state node to the container node.

[0021] If any business result is output by any container, then a directed edge is added between the corresponding container node and the business result node, with the directed edge pointing from the container node to the business result node.

[0022] As a preferred embodiment of the container-based intelligent fusion terminal micro-application resource isolation method described in this application, the step of identifying abnormally running containers based on runtime behavior data specifically includes:

[0023] Set an anomaly determination period; calculate the total blocking waiting time of each container in each anomaly determination period and divide it by the length of the anomaly determination period to obtain the waiting percentage of each container; obtain the waiting percentage threshold of each container; if the waiting percentage of any container is greater than the corresponding waiting percentage threshold, the container is an abnormal running container in the corresponding anomaly determination period.

[0024] The method for identifying the abnormal association path of any abnormal running container based on the aforementioned runtime association model is as follows:

[0025] Identify valid edges and abnormal result nodes in the running association model; the abnormal result nodes are business result nodes where the business results are abnormal.

[0026] Starting from the container node corresponding to the abnormally running container, explore all paths along the valid edges that end at the abnormal result node to obtain the abnormal associated paths.

[0027] As a preferred embodiment of the container-based intelligent fusion terminal micro-application resource isolation method described in this application, the method for identifying the valid edges is as follows:

[0028] Mark any directed edge between a container node and a business result node as a valid edge; for any directed edge between a container node and a shared state node, count the total number of writes or reads between the corresponding container and the shared state within the exception determination period as the activation count of the corresponding directed edge; mark each directed edge with an activation count greater than 1 as a valid edge.

[0029] The method for identifying the abnormal result nodes is as follows:

[0030] For any business result, the average output interval and the number of consecutive failures within the current anomaly judgment period are statistically analyzed; if the average output interval is greater than a preset output interval threshold or the number of consecutive failures is greater than a preset failure number threshold, the corresponding business result node is marked as an abnormal result node.

[0031] As a preferred embodiment of the intelligent fusion terminal micro-application resource isolation method based on container technology described in this application, wherein: the minimum state set of any abnormally running container consists of all isolated state nodes of the abnormally running container; any isolated state node is a shared state node in the abnormal association path of the abnormally running container;

[0032] The method for dividing any abnormally running container into a minimal state set is as follows:

[0033] Filter isolation paths for abnormally running containers from the abnormal associated paths;

[0034] Calculate the impact factor for each shared state node in each isolated path;

[0035] Based on the influence factor of each shared state node, an optimization algorithm is used to explore the minimum state set for abnormally running containers, so that at least one shared state node in any isolation path is selected as an isolated state node in the minimum state set; the optimization objective of the optimization algorithm is to minimize the total number of isolated state nodes or minimize the sum of the influence factors of all isolated state nodes.

[0036] As a preferred embodiment of the container-based intelligent converged terminal micro-application resource isolation method described in this application, the method for selecting isolation paths for abnormally running containers from abnormal association paths is as follows:

[0037] Calculate the impact score for each abnormal association path; for any abnormal result node, if the number of abnormal association paths ending at the abnormal result node is greater than K, then retain the K abnormal association paths with the largest impact scores as isolation paths; K is a positive integer;

[0038] The method for calculating the influence factor of any shared state node is as follows: count the total number of container nodes connected to the shared state node in the running association model as the influence factor of the shared state node.

[0039] As a preferred embodiment of the container-based intelligent converged terminal micro-application resource isolation method described in this application, the method for calculating the impact score of any abnormal associated path is as follows:

[0040] Calculate the activity intensity of each valid edge in the abnormal association path;

[0041] Calculate the anomaly factor for each container node in the anomaly association path; for any container node, assign a value to the anomaly factor based on the waiting ratio of the corresponding container, and the waiting ratio is positively correlated with the anomaly factor;

[0042] The activity intensity of each valid edge and the anomaly factor of each container node are normalized and then multiplied together. The product is used as the influence score of the abnormal associated path.

[0043] As a preferred embodiment of the container-based intelligent fusion terminal micro-application resource isolation method described in this application, wherein: for any valid edge pointing from a container node to a shared state node, the sum of the number of times the container writes to the shared state in the current anomaly determination period in the abnormal association path is taken as the activity intensity of the valid edge; for any valid edge pointing from a shared state node to a container node, the sum of the number of times the container reads the shared state in the current anomaly determination period in the abnormal association path is taken as the activity intensity of the valid edge.

[0044] As a preferred embodiment of the intelligent fusion terminal micro-application resource isolation method based on container technology described in this application, the method for resource isolation of any abnormally running container is as follows: extract each isolation state node from the minimum state set of the abnormally running container, and mark the shared state corresponding to each isolation state node as a shared state to be isolated; perform resource isolation operations on each shared state to be isolated respectively.

[0045] Compared with the prior art, the beneficial effects achieved by this application are as follows:

[0046] This application can identify the specific path by which micro-application anomalies affect other containers from the system operation level, avoiding coarse-grained judgment based on resource utilization.

[0047] When an anomaly occurs, only the minimum set of states necessary for the propagation of the anomaly is isolated or frozen, limiting the scope of the anomaly's impact to the minimum necessary boundaries.

[0048] Without severing all communication between containers or restarting the entire container system, it achieves anomaly propagation suppression, significantly improving the overall stability and business continuity of intelligent converged terminals. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0050] Figure 1 A flowchart of the container-based intelligent converged terminal micro-application resource isolation method provided in this application;

[0051] Figure 2 This is a schematic diagram of the structure of a running association model provided in this application. Detailed Implementation

[0052] The technical solution of this application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments and specific features in the embodiments are detailed descriptions of the technical solution of this application, rather than limitations thereof. In the absence of conflict, the embodiments and technical features in the embodiments can be combined with each other.

[0053] This embodiment describes a resource isolation method for micro-applications in an intelligent converged terminal based on container technology, referring to... Figure 1 The method includes the following steps:

[0054] Set the sampling period and continuously collect the operational behavior data of each container in each sampling period;

[0055] The container is an isolated unit within the terminal operating system that provides an independent running environment for micro-applications. It includes independent process space, resource quotas, and access control rules, and is used to host specific business function modules. The sampling period refers to the time window during which the system statistically records and analyzes the container's operational behavior at fixed time intervals. Within each sampling period, operational behavior data is collected and statistically analyzed once to reflect changes in the container's operational status during that time period. Optionally, the sampling period length can be set to 1 second.

[0056] The runtime behavior data of any container includes resource access data and status read / write data;

[0057] The resource access data includes the container's blocking wait time during the sampling period; the blocking wait time represents the cumulative time that the container is in an inoperable state or waiting for external resources such as communication interfaces, shared queues, locks, etc. during the sampling period.

[0058] The state read / write data of any container includes the number of times the container writes to and reads each shared state within the sampling period;

[0059] The shared state refers to data or control objects accessed or read by two or more containers during terminal operation. Its content includes, but is not limited to, data cache, task queues, control parameters, and communication status. The shared state serves as an intermediary for data transfer or behavioral coordination between containers, enabling the results of one container's operation to be read or utilized by other containers, thus forming operational influence relationships. The write count refers to the number of times the container writes to the shared state during the sampling period, and the read count refers to the number of times the container reads the shared state during the sampling period.

[0060] In actual operation, any interaction or call between containers essentially involves request parameter caching, call context, and response caching. In this embodiment, any interaction or call between containers is abstracted as a shared state. For example, when container A initiates a call to container B, a call state record S(A, B) is generated; A writes the request content to S(A, B); B reads the request content from S(A, B), processes it, and then writes the response result back to S(A, B) for A to read. The call state record S(A, B) is a shared state, which can constitute a shared state node in the runtime association model.

[0061] Based on the aforementioned operational behavior data, an operational relationship model between containers is constructed;

[0062] The running association model includes model nodes and directed edges; the model nodes include container nodes, shared state nodes, and business result nodes;

[0063] The method for constructing the runtime association model between containers is as follows:

[0064] Each container is marked as a container node in the runtime association model; the shared state between any two containers is marked as a shared state node in the runtime association model; the business results generated by the operation of any container are marked as business result nodes in the runtime association model; directed edges are added between model nodes to form a complete runtime association model.

[0065] Business results refer to the business-meaning output generated after a container completes specific business processing. These can manifest as the generation of statistical data, the completion of an event log, or the successful execution of a control command. Business results correspond to the operational outcomes that the terminal can externally identify or evaluate, and are crucial for judging the system's operational status and the degree of impact of anomalies.

[0066] Adding directed edges between model nodes specifically includes:

[0067] If any container writes to any shared state, a directed edge is added between the corresponding container node and the shared state node, with the directed edge pointing from the container node to the shared state node.

[0068] If any container reads any shared state, a directed edge is added between the corresponding container node and the shared state node, with the directed edge pointing from the shared state node to the container node.

[0069] If any business result is output by any container, then a directed edge is added between the corresponding container node and the business result node, and the directed edge points from the container node to the business result node.

[0070] Based on the addition of the aforementioned model nodes and directed edges, the resulting operational association model is a directed operational influence graph, which can be used to determine anomaly propagation paths. Any two container nodes are associated through at least one shared state node; any business result node is connected to a container node. For example, refer to... Figure 2 Here are some specific examples of model nodes and directed edges:

[0071] Container node C2 corresponds to the automatic electricity meter reading container, which performs the task of reading electricity meters that have not been read on time; Container node C3 corresponds to the fault event uploading container, which uploads locally recorded power outage or abnormal events to the master station; Container node C4 corresponds to the image acquisition and analysis container, which acquires images of the power distribution station and performs anomaly identification; Container node C5 corresponds to the master station communication management container, and C6 corresponds to the fault detection container;

[0072] Shared status node S2 corresponds to the meter reading task queue. The master station communication management container corresponding to C5 writes to this shared status, and the automatic meter re-reading container corresponding to C2 reads this shared status. Shared status node S3 corresponds to the event sequence recording area. The fault detection container corresponding to C6 and the image acquisition and analysis container corresponding to C4 write to this shared status, and the fault event uploading container corresponding to C3 reads this shared status. Shared status node S4 corresponds to the communication module status flag. The master station communication management container corresponding to C5 writes to this shared status, and both the automatic meter re-reading container corresponding to C2 and the fault event uploading container corresponding to C3 read this shared status.

[0073] The business result node B2 corresponds to the meter reading completion mark, which is output by the automatic meter reading container corresponding to C2; the business result node B3 corresponds to the power outage event transmission, which is output by the fault event transmission container corresponding to C3; the business result node B4 corresponds to the image anomaly recognition result, which is output by the image acquisition and analysis container corresponding to C4.

[0074] Abnormal running containers are identified based on runtime behavior data, and abnormal association paths for each abnormal running container are identified based on the runtime association model.

[0075] The method of identifying abnormal running containers based on runtime behavior data specifically includes:

[0076] Set an anomaly determination period; in each anomaly determination period, calculate the total blocking waiting time of each container and divide it by the length of the anomaly determination period to obtain the waiting percentage of each container; obtain the waiting percentage threshold of each container; if the waiting percentage of any container is greater than the corresponding waiting percentage threshold, then the container is an abnormal running container in the corresponding anomaly determination period.

[0077] Optionally, the anomaly determination period is 20 consecutive sampling periods, which can smooth the instantaneous fluctuations within a single sampling period while ensuring the timeliness of the anomaly response, thereby obtaining a stable statistical determination result.

[0078] When the sampling period is 1s, an anomaly determination period is 20s. For any container, calculate the sum of its blocking waiting time within 20s, and further calculate its waiting percentage in the current anomaly determination period. Optionally, the waiting percentage threshold for any container can be set as follows: calculate the mean and standard deviation of the waiting percentage of the container in the most recent 50 consecutive anomaly determination periods, and set the waiting percentage threshold to the mean plus 3 times the standard deviation.

[0079] Optionally, based on the terminal's existing automatic anomaly reporting function, abnormal running containers are also marked. When any container is detected to have an abnormal state such as restart, storage exceeding limits, CPU utilization exceeding limits, or memory utilization exceeding limits, the corresponding container is marked as an abnormal running container.

[0080] The method for identifying the abnormal association path of any abnormal running container based on the aforementioned runtime association model is as follows:

[0081] Identify valid edges and abnormal result nodes in the running association model; the abnormal result nodes are business result nodes where the business results are abnormal.

[0082] Starting from the container node corresponding to the abnormal running container, explore all paths along the valid edges that end at the abnormal result node to obtain the abnormal associated paths;

[0083] In this embodiment, the starting point of any abnormal association path is the container node corresponding to the abnormal running container, and the ending point is an abnormal result node. Any two model nodes in the path summary are connected only through valid edges, thereby avoiding the misjudgment of paths that have not generated data interaction within the current abnormal judgment period as abnormal propagation paths.

[0084] The method for identifying the valid edges is as follows:

[0085] Mark any directed edge between a container node and a business result node as a valid edge; for any directed edge between a container node and a shared state node, count the total number of writes or reads between the corresponding container and the shared state within the exception judgment period, and use this count as the activation count of the corresponding directed edge; mark each directed edge with an activation count greater than 1 as a valid edge.

[0086] Specifically, if a directed edge points from a container node to a shared state node, its activation count is the sum of the write counts; if a directed edge points from a shared state node to a container node, its activation count is the sum of the read counts.

[0087] The method for identifying the abnormal result nodes is as follows:

[0088] For any business result, the average output interval and the number of consecutive failures within the current anomaly determination period are calculated. If the average output interval is greater than a preset output interval threshold, or the number of consecutive failures is greater than a preset failure number threshold, the corresponding business result node is marked as an abnormal result node.

[0089] The output interval is the time interval between two consecutive successful outputs of the same business result, used to characterize the actual output rhythm of the business result. When the output interval is significantly greater than the output interval during normal operation, it indicates that the business processing is affected by the propagation of anomalies. For example, for a certain business result, a valid upload is completed every 5 seconds under normal circumstances. If there is a failed upload between two consecutive successful uploads, the output interval is 10 seconds. The average output interval is the mean of the output intervals within the anomaly judgment period. The output interval threshold can be set based on the historical average output interval during normal operation of the business result, for example, set to 1.5 to 2 times the historical average output interval, to characterize the significant slowdown in the business output rhythm and reflect the impact of anomaly propagation from a time dimension.

[0090] The consecutive failure count is the maximum number of times the business result fails to be produced consecutively within the anomaly assessment period. The failure count threshold can be set by those skilled in the art based on actual needs, for example, set to 3 to 4 times, to distinguish between occasional failures and persistent anomalies, and to reflect the cumulative effect of anomalies through consecutive failures.

[0091] By limiting effective edges and abnormal result nodes, we avoid treating historical data interaction paths as current anomaly propagation channels and limit subsequent anomaly-related paths to those paths that actually cause business degradation, thus avoiding false isolation.

[0092] Based on the aforementioned abnormal association paths, a minimum state set is defined for each abnormal running container;

[0093] The minimum state set of any abnormally running container consists of all isolated state nodes of the abnormally running container; any isolated state node is a shared state node in the abnormal association path of the abnormally running container;

[0094] The method for dividing any abnormally running container into a minimal state set is as follows:

[0095] Filter isolation paths for abnormally running containers from the abnormal associated paths; the method is as follows:

[0096] Calculate the impact score for each abnormal association path; for any abnormal result node, if the number of abnormal association paths ending at the abnormal result node is greater than K, then retain the K abnormal association paths with the largest impact scores as isolation paths; K is a positive integer; optionally, K can be 1 or 2.

[0097] The method for calculating the impact score of any abnormal correlation path is as follows:

[0098] Calculate the activity intensity of each valid edge in the abnormal association path; for any valid edge pointing from a container node to a shared state node, the sum of the number of times the container writes to the shared state in the abnormal association path during the current abnormal judgment period is taken as the activity intensity of the valid edge; for any valid edge pointing from a shared state node to a container node, the sum of the number of times the container reads the shared state in the abnormal association path during the current abnormal judgment period is taken as the activity intensity of the valid edge.

[0099] Calculate the anomaly factor for each container node in the anomaly association path; for any container node, assign a value to the anomaly factor based on the waiting ratio of the corresponding container, and the waiting ratio is positively correlated with the anomaly factor;

[0100] Optionally, for any container node, if the waiting percentage of the corresponding container is less than or equal to the corresponding waiting percentage threshold, the anomaly factor is assigned a value of 1; otherwise, the ratio of the waiting percentage to the waiting percentage threshold is used as the anomaly factor.

[0101] The activity intensity of each valid edge and the anomaly factor of each container node are normalized and then multiplied together. The product is used as the influence score of the abnormal associated path.

[0102] In this embodiment, the higher the impact score, the more frequent the read / write behavior or the more obvious the node degradation in the corresponding path. The abnormal association path with the higher the impact score is, the more likely it is to be the main abnormal propagation channel. For any valid edge pointing from the container node to the business result node, the activity strength is set to 1.

[0103] Calculate the impact factor for each shared state node in each isolated path;

[0104] The method for calculating the influence factor of any shared state node is as follows: count the total number of container nodes connected to the shared state node in the running association model, and use this as the influence factor of the shared state node.

[0105] Based on the influence factor of each shared state node, an optimization algorithm is used to explore the minimum state set for abnormally running containers, so that at least one shared state node in any isolation path is selected as an isolated state node in the minimum state set; the optimization objective of the optimization algorithm is to minimize the total number of isolated state nodes, or to minimize the sum of the influence factors of all isolated state nodes.

[0106] Alternatively, a greedy cover algorithm can be used as an optimization algorithm, and the implementation is as follows:

[0107] Each time, an unselected isolation path is chosen, and the shared state nodes appearing within it are extracted as candidates. For each candidate shared state node, its coverage number is calculated, where the coverage number represents the number of unselected isolation paths the shared state node simultaneously appears in. The shared state node with the largest coverage number is prioritized. When coverage numbers are the same, the shared state node with the smallest impact factor is prioritized. The selected shared state node is added to the minimum state set, and all isolation paths containing that node are marked as selected. This process is repeated until all isolation paths are selected. The optimization objectives of the above algorithm have the following priorities: the first objective is to minimize the total number of isolated state nodes, and the second objective is to minimize the sum of impact factors when the total number of isolated state nodes is the same. This ultimately yields several isolated state nodes, which constitute the minimum set of nodes required for isolation or freezing while ensuring that the propagation paths of all degraded service results are cut off.

[0108] Based on the minimum state set, resource isolation is performed on each abnormally running container.

[0109] The method for resource isolation of any abnormally running container is as follows: extract each isolation state node from the minimum state set of the abnormally running container, and mark the shared state corresponding to each isolation state node as a shared state to be isolated; perform resource isolation operation on each shared state to be isolated.

[0110] The resource isolation operation involves freezing, access restriction, or isolation mapping of the corresponding shared state to cut off the anomaly propagation path. State freezing involves pausing writes to the selected shared state, thus breaking the anomaly propagation chain and restoring stability to downstream containers. This is suitable for data cache states and task queue states. Access restriction adds access rules to the state access layer, prohibiting downstream containers from reading updated versions from abnormally running containers. The state layer maintains write source identifiers; during reading, it filters data originating from abnormally running containers, thus preserving historically stable data and blocking data from abnormal sources. This is suitable for control or configuration states, such as communication status flags (e.g., link availability / unavailability indicators) or control policy parameters (e.g., voltage regulation control commands, switching policy switches).

[0111] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0112] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of protection of this application, and these forms are all within the protection scope of this application.

Claims

1. A method for isolating micro-application resources in an intelligent converged terminal based on container technology, characterized in that: Includes the following steps: Set the sampling period and continuously collect the operational behavior data of each container in each sampling period; A model of operational association between containers is constructed based on the aforementioned operational behavior data; Based on the operational behavior data, abnormal operating containers are identified, and based on the operational association model, abnormal association paths for each abnormal operating container are identified. Based on the aforementioned abnormal association paths, a minimum state set is divided for each abnormal running container; Based on the minimum state set, resource isolation is performed on each abnormally running container; The runtime behavior data of any container includes resource access data and status read / write data; The resource access data includes the container's blocking wait time during the sampling period; the state read / write data of any container includes the number of times the container writes to and reads each shared state during the sampling period. The running association model includes model nodes and directed edges; the model nodes include container nodes, shared state nodes, and business result nodes; The method for constructing the runtime association model between containers is as follows: Mark each container as a container node in the runtime association model; mark the shared state between any two containers as a shared state node in the runtime association model; mark the business results generated by the execution of any container as a business result node in the runtime association model; Add directed edges between model nodes to form a complete running associated model; The specific aspects of identifying abnormal running containers based on runtime behavior data include: Set an anomaly determination period; calculate the total blocking waiting time of each container in each anomaly determination period and divide it by the length of the anomaly determination period to obtain the waiting percentage of each container; obtain the waiting percentage threshold of each container; if the waiting percentage of any container is greater than the corresponding waiting percentage threshold, the container is an abnormal running container in the corresponding anomaly determination period. The method for identifying the abnormal association path of any abnormal running container based on the aforementioned runtime association model is as follows: Identify valid edges and abnormal result nodes in the running association model; the abnormal result nodes are business result nodes where the business results are abnormal. Starting from the container node corresponding to the abnormal running container, explore all paths along the valid edges that end at the abnormal result node to obtain the abnormal associated path; The method for identifying the valid edges is as follows: Mark any directed edge between a container node and a business result node as a valid edge; for any directed edge between a container node and a shared state node, count the total number of writes or reads between the corresponding container and the shared state within the exception judgment period as the activation count of the corresponding directed edge; mark each directed edge with an activation count greater than 1 as a valid edge. The method for identifying the abnormal result nodes is as follows: For any business result, the average output interval and the number of consecutive failures within the current anomaly judgment period are statistically analyzed; if the average output interval is greater than a preset output interval threshold or the number of consecutive failures is greater than a preset failure number threshold, the corresponding business result node is marked as an abnormal result node.

2. The method for isolating micro-application resources in a smart converged terminal based on container technology as described in claim 1, characterized in that: Adding directed edges between model nodes specifically includes: If any container writes to any shared state, a directed edge is added between the corresponding container node and the shared state node, with the directed edge pointing from the container node to the shared state node. If any container reads any shared state, a directed edge is added between the corresponding container node and the shared state node, with the directed edge pointing from the shared state node to the container node. If any business result is output by any container, then a directed edge is added between the corresponding container node and the business result node, with the directed edge pointing from the container node to the business result node.

3. The method for isolating micro-application resources in a smart converged terminal based on container technology as described in claim 2, characterized in that: The minimum state set of any abnormally running container consists of all isolated state nodes of the abnormally running container; any isolated state node is a shared state node in the abnormal association path of the abnormally running container; The method for dividing any abnormally running container into a minimal state set is as follows: Filter isolation paths for abnormally running containers from the abnormal associated paths; Calculate the impact factor for each shared state node in each isolated path; Based on the influence factor of each shared state node, an optimization algorithm is used to explore the minimum state set for abnormally running containers, so that at least one shared state node in any isolation path is selected as an isolated state node in the minimum state set; the optimization objective of the optimization algorithm is to minimize the total number of isolated state nodes or minimize the sum of the influence factors of all isolated state nodes.

4. The method for isolating micro-application resources in a container-based intelligent converged terminal as described in claim 3, characterized in that: The method for selecting isolation paths for abnormal running containers from the abnormal associated paths is as follows: Calculate the impact score for each abnormal association path; for any abnormal result node, if the number of abnormal association paths ending at the abnormal result node is greater than K, then retain the K abnormal association paths with the largest impact scores as isolation paths; K is a positive integer; The method for calculating the influence factor of any shared state node is as follows: count the total number of container nodes connected to the shared state node in the running association model as the influence factor of the shared state node.

5. The method for isolating micro-application resources in a container-based intelligent converged terminal as described in claim 4, characterized in that: The method for calculating the impact score of any abnormal correlation path is as follows: Calculate the activity intensity of each valid edge in the abnormal association path; Calculate the anomaly factor for each container node in the anomaly association path; for any container node, assign a value to the anomaly factor based on the waiting ratio of the corresponding container, and the waiting ratio is positively correlated with the anomaly factor; The activity intensity of each valid edge and the anomaly factor of each container node are normalized and then multiplied together. The product is used as the influence score of the abnormal associated path.

6. The resource isolation method for intelligent converged terminal micro-applications based on container technology as described in claim 5, characterized in that: For any valid edge pointing from a container node to a shared state node, the sum of the number of times the container writes to the shared state in the current exception determination period in the exception association path is taken as the activity intensity of the valid edge; for any valid edge pointing from a shared state node to a container node, the sum of the number of times the container reads the shared state in the current exception determination period in the exception association path is taken as the activity intensity of the valid edge.

7. The method for isolating micro-application resources in a smart converged terminal based on container technology as described in claim 6, characterized in that: The method for resource isolation of any abnormal running container is as follows: extract each isolation state node from the minimum state set of the abnormal running container, and mark the shared state corresponding to each isolation state node as the shared state to be isolated; Perform resource isolation operations on each shared state to be isolated.

Images