Hotspot data detection and protection method and apparatus

Abstract

The embodiment of the application provides a hotspot data detection and protection method and device, a novel annotation configuration system is designed, parameter management and dynamic adjustment are used, flexible protection control is realized, an interception processing mechanism is constructed, window statistics and distributed synchronization are combined, a reliable detection model is established, hierarchical protection is introduced, dependence analysis and strategy optimization are used, and the effectiveness of protection is ensured. The method effectively solves the problems of traditional technologies in configuration management, access statistics and protection control, and provides technical support for data security.

Description

Technical Field

[0001] This application relates to the field of data processing, specifically to a method and apparatus for detecting and protecting hotspot data. Background Technology

[0002] Existing methods for detecting and protecting against hotspot data have significant shortcomings. Traditional systems perform poorly in configuration management and threshold adjustment, failing to effectively adapt to changes in system load and thus impacting protection effectiveness.

[0003] Furthermore, existing technologies suffer from bottlenecks in access statistics and distributed synchronization. Most systems lack robust window counting mechanisms and node communication strategies, resulting in inaccurate statistical results.

[0004] The existing system has technical shortcomings in protection and control. It lacks in-depth analysis of request dependencies, making it difficult to achieve precise protection through policy optimization, thus impacting system stability. Solving these problems is crucial for improving data security. Summary of the Invention

[0005] To address the problems in existing technologies, this application provides a method and apparatus for hotspot data detection and protection, which can effectively solve the shortcomings of traditional technologies in configuration management, access statistics and protection control, and provide technical protection for data security.

[0006] To solve at least one of the above problems, this application provides the following technical solution: Firstly, this application provides a method for detecting and protecting hotspot data, including: Construct an application-layer annotation system, create method annotations for configuring protection parameters and parameter annotations for marking detection targets, write access threshold and time window configurations into the method annotations, write parsing rule configurations into the parameter annotations, deploy the method annotations and parameter annotations to business methods, collect system operation load data, construct a dynamic threshold adjustment model based on the load data, and generate method marking data containing annotation configurations and processing status. A segment-oriented interception processing framework is established. According to the method, the parameter values ​​and access timestamps are extracted from the labeled data. The parameter values ​​and access timestamps are written into the sliding window cache. The sub-window counters are divided based on the time window configuration. The access frequency is obtained by summing the values ​​of the sub-window counters. The access frequency is input into the dynamic threshold adjustment model to update the access threshold configuration. A distributed node communication network is established to synchronize the access statistics data of each node. Implement tiered protection control, write requests exceeding the access threshold configuration into a protection queue, construct a request dependency network, allocate processing resources according to the request dependency network, establish a protection result evaluation index system, collect request processing latency and business completion rate data, dynamically adjust protection strategy parameters based on the evaluation index system, and distribute the protection strategy parameters to each node through the distributed node communication network.

[0007] Furthermore, it also includes: constructing application layer method annotations, defining an attribute set containing access thresholds, time windows, and protection strategies, writing the attribute set into annotation metadata, establishing an annotation processing engine, generating a method annotation table containing attribute configuration and parsing rules, and loading the method annotation table into the application container; Construct application-layer parameter annotations, define processing rules including parameter parsing, type conversion, and data validation, write the processing rules into the annotation configuration, establish a parameter processing chain, generate a parameter annotation table containing parsing strategies and validation logic, and associate the parameter annotation table with the annotation processing engine.

[0008] Furthermore, it also includes: deploying method annotations and parameter annotations to the target business code, scanning the application context, reading annotation metadata, constructing a method index table containing business method identifiers, annotation types, and annotation attributes, writing the method index table into the annotation processor, collecting server processor utilization and memory usage data, and generating a system load matrix; Based on the system load matrix, load trend characteristics are calculated, a dynamic threshold adjustment model is constructed, the load trend characteristics are mapped to threshold adjustment coefficients, a labeled data table containing method identifiers, annotation configurations, processing statuses, and adjustment coefficients is generated, and the labeled data table is written into a distributed cache.

[0009] Furthermore, it also includes: constructing an aspect-oriented interception processing framework, loading a method tagging data table, extracting the parameter values ​​of the target method, recording the method call timestamp, constructing a call tracing table containing parameter identifiers, parameter values, and timestamps, and writing the call tracing table into a sliding window cache pool; Read the time window configuration parameters, perform time slicing on the sliding window cache pool, construct a sub-window counting matrix, map the data in the call trace table to the corresponding sub-window, generate a statistical data table containing window identifier, count value, and time range, and write the statistical data table into the statistical analysis module.

[0010] Furthermore, it also includes: reading the statistical data table, summarizing the count values ​​of each sub-window, calculating the total number of visits per unit time, inputting the total number of visits into the dynamic threshold adjustment model, generating a threshold configuration table containing the original threshold, adjustment coefficient, and update time, constructing an inter-node communication link, and broadcasting the threshold configuration table to the cluster nodes; The system receives access statistics data returned by cluster nodes, merges the count results of each node, constructs a global access frequency matrix, writes the global access frequency matrix into the shared storage space, generates a data synchronization table containing node identifiers, statistics data, and synchronization time, and updates the data consistency status between nodes.

[0011] Furthermore, it also includes: reading the global access frequency matrix, comparing it with the access threshold configuration table, marking requests that exceed the threshold, constructing a protection queue containing request identifiers, priorities, and resource requirements, analyzing the call chain relationship between requests, generating a request dependency network graph, and writing the request dependency network graph into the resource scheduler; Request processing weights are calculated based on the request dependency network graph, a resource allocation strategy is constructed, and processing resources are allocated to requests in the protection queue according to their weights. An evaluation index table containing request status, processing latency, and completion rate is generated and written to the monitoring center.

[0012] Furthermore, it also includes: reading the evaluation index table, collecting the processing delay time and completion status of each request, calculating the business processing performance index, constructing a performance evaluation matrix including response time, success rate, and throughput, and inputting the performance evaluation matrix into the policy optimizer to generate a protection policy adjustment scheme. According to the protection strategy adjustment scheme, update the protection parameter configuration, construct a protection rule table including rate limiting threshold, degradation strategy, and queue capacity, and broadcast the protection rule table to the cluster nodes through the node communication network to synchronously update the protection configuration status of each node.

[0013] Secondly, this application provides a hotspot data detection and protection device, comprising: The rule determination module is used to construct an application layer annotation system, create method annotations for configuring protection parameters and parameter annotations for marking detection targets, write access thresholds and time window configurations into the method annotations, write parsing rule configurations into the parameter annotations, deploy the method annotations and parameter annotations to business methods, collect system operation load data, construct a dynamic threshold adjustment model based on the load data, and generate method marking data containing annotation configurations and processing status. The hotspot detection module is used to establish an aspect-oriented interception and processing framework. It extracts parameter values ​​and access timestamps from the labeled data according to the method, writes the parameter values ​​and access timestamps into the sliding window cache, divides the sub-window counters based on the time window configuration, summarizes the sub-window counter values ​​to obtain the access frequency, inputs the access frequency into the dynamic threshold adjustment model, updates the access threshold configuration, establishes a distributed node communication network, and synchronizes the access statistics data of each node. The hotspot protection module is used to perform hierarchical protection control, write requests exceeding the access threshold configuration into the protection queue, construct a request dependency relationship network, allocate processing resources according to the request dependency relationship network, establish a protection result evaluation index system, collect request processing latency and business completion rate data, dynamically adjust protection strategy parameters based on the evaluation index system, and distribute the protection strategy parameters to each node through the distributed node communication network.

[0014] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the hotspot data detection and protection method.

[0015] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the hotspot data detection and protection method described above.

[0016] Fifthly, this application provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the hotspot data detection and protection method described above.

[0017] As can be seen from the above technical solution, this application provides a method and apparatus for detecting and protecting hotspot data. Through an innovative design of an annotation configuration system, flexible protection control is achieved through parameter management and dynamic adjustment. An interception processing mechanism is constructed, combining window statistics and distributed synchronization to establish a reliable detection model. Hierarchical protection is introduced, and the effectiveness of protection is ensured through dependency analysis and strategy optimization. This method effectively solves the shortcomings of traditional technologies in configuration management, access statistics, and protection control, providing technical assurance for data security. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the hotspot data detection and protection method in the embodiments of this application; Figure 2 This is a structural diagram of the hotspot data detection and protection device in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] The acquisition, storage, use, and processing of data in this application comply with relevant laws and regulations.

[0022] In view of the problems existing in the prior art, this application provides a method and apparatus for hotspot data detection and protection. Through an innovative design of an annotation configuration system, flexible protection control is achieved through parameter management and dynamic adjustment. An interception processing mechanism is constructed, combining window statistics and distributed synchronization to establish a reliable detection model. Hierarchical protection is introduced, and the effectiveness of protection is ensured through dependency analysis and strategy optimization. This method effectively solves the shortcomings of traditional technologies in configuration management, access statistics, and protection control, providing technical assurance for data security.

[0023] To effectively address the shortcomings of traditional technologies in configuration management, access statistics, and protection controls, and to provide technical safeguards for data security, this application provides an embodiment of a hotspot data detection and protection method. See [link to embodiment]. Figure 1 The hotspot data detection and protection method specifically includes the following: Step S101: Construct an application layer annotation system, create method annotations for configuring protection parameters and parameter annotations for marking detection targets, write access threshold and time window configurations into the method annotations, write parsing rule configurations into the parameter annotations, deploy the method annotations and parameter annotations to business methods, collect system operation load data, construct a dynamic threshold adjustment model based on the load data, and generate method marking data containing annotation configurations and processing status; This embodiment constructs an annotation system during the application startup phase, creating method annotations for configuring protection parameters. The construction process defines the metadata structure of the method annotations, declaring access threshold and time window attributes within this structure. The access threshold attribute sets the maximum number of requests allowed per unit time, and the time window attribute defines the start and end range of the statistical period. This embodiment writes protection strategy attributes into the method annotations, supporting the configuration selection of rate limiting, degradation, and queuing modes.

[0024] After the method annotations are constructed, this embodiment creates parameter annotations for marking the detection targets. The creation process defines parameter index attributes and parser attributes. The parameter index attribute points to the position number in the target method's parameter list, and the parser attribute specifies the parsing logic for complex objects. When the parameters of the business method are basic data types, this embodiment uses a built-in parser to directly obtain the parameter values. When the parameters of the business method are composite object types, this embodiment loads a custom parser according to the parser attribute and extracts key identifier fields from the composite object as statistical dimensions.

[0025] Accordingly, this embodiment deploys the method annotations and parameter annotations to the business methods. The deployment process scans component classes in the application context, identifies business methods annotated with method annotations, and extracts the signature information and annotation attribute values ​​of the business methods. This embodiment traverses the parameter list of the business methods, locates the positions of parameters annotated with parameter annotations, and reads the index attributes and parser attributes of the parameter annotations. Taking a product query method in an e-commerce scenario as an example, this embodiment deploys method annotations on the method and configures access thresholds and time windows, and deploys parameter annotations on the product identifier parameters and configures their index positions.

[0026] After the aforementioned annotations are deployed, this embodiment collects system load data to support dynamic threshold adjustments. The collection process reads server processor utilization and memory usage metrics, and records the timestamp of each collection point. This embodiment organizes load data from multiple collection cycles into a time-series sequence and calculates the trend characteristics of the load data. These trend characteristics reflect the growth rate and fluctuation amplitude of system resource consumption.

[0027] Based on the aforementioned load data, this embodiment constructs a dynamic threshold adjustment model to achieve adaptive threshold adjustment. The construction process divides the system load level into multiple intervals and sets corresponding adjustment coefficients for each interval. The dynamic threshold adjustment model is based on the formula Q=P. (1-m U)+nF calculates the adjusted access threshold, where Q represents the adjusted access threshold, P represents the original threshold configured in the method annotation, U represents the current system load rate (ranging from zero to one), F represents the smoothed value of historical access frequency, m represents the load influence weighting coefficient, and n represents the historical frequency correction weighting coefficient. The formula achieves dynamic threshold adjustment through a combination of load constraint terms and historical correction terms.

[0028] This embodiment integrates the aforementioned processing results into method tagging data, which includes annotation configuration information, processing status information, and adjustment coefficient information. The annotation configuration information records the attribute values ​​of method annotations and parameter annotations. The processing status information indicates whether the current method is in a protected active state. The adjustment coefficient information records the adjusted threshold output by the dynamic threshold adjustment model. This embodiment writes the method tagging data into a distributed cache for subsequent reading and calling when establishing the interception processing framework in step S102.

[0029] Step S102: Establish an aspect-oriented interception processing framework, extract parameter values ​​and access timestamps from the labeled data according to the method, write the parameter values ​​and access timestamps into the sliding window cache, divide the sub-window counters based on the time window configuration, summarize the sub-window counter values ​​to obtain the access frequency, input the access frequency into the dynamic threshold adjustment model, update the access threshold configuration, establish a distributed node communication network, and synchronize the access statistics data of each node. This embodiment establishes an aspect-oriented interception framework during application runtime, loading the method tagging data written to the distributed cache in step S101. The loading process iterates through the annotation configuration information in the method tagging data, extracting the signature identifier and protection parameter configuration for each business method. Based on the signature identifier, this embodiment constructs aspect-oriented interception rules and registers these rules with the dynamic proxy engine, enabling interception processing logic to be triggered when a business method annotated with method annotations is invoked.

[0030] After the interception processing framework is established, this embodiment extracts parameter values ​​and access timestamps based on method tag data. The extraction process involves obtaining the current system time as the access timestamp before the business method is called, and reading the actual parameter list from the method call context. This embodiment locates the target parameter position based on the index attribute configured in the parameter annotation. When the target parameter is a composite object type, the parser specified by the parser attribute is called to extract the key identifier value. The parameter value and the access timestamp are combined to form an access record entry, which is temporarily stored in the interception processing context.

[0031] Accordingly, this embodiment writes the parameter value and the access timestamp into the sliding window cache. During the writing process, a cache index is built using the parameter value as the key, and the access timestamp is appended to the time series corresponding to that key. This embodiment cleans up historical timestamp records that exceed the time window range before writing to maintain the timeliness of the cached data. The sliding window cache adopts a memory storage structure, supporting fast read and write operations in high-concurrency scenarios.

[0032] Based on the aforementioned cached data, this embodiment uses a time window configuration to divide sub-window counters for refined statistics. The division process reads the time window attribute values ​​configured in the method annotations and evenly divides the overall time window into several sub-window intervals. This embodiment assigns an independent counter to each sub-window interval; when an access timestamp falls within a sub-window interval, the counter value for that sub-window is incremented. This sub-window division method avoids statistical abrupt changes at fixed time window boundaries.

[0033] After the sub-window counters are updated, this embodiment summarizes the count values ​​of each sub-window to obtain the access frequency. The summarization process iterates through all sub-windows within the current time window range, accumulating the values ​​of the counters for each sub-window to obtain the total number of accesses for that parameter value. This embodiment divides the total number of accesses by the time window length to obtain the access frequency per unit time. The access frequency is written into the statistical result cache as a core indicator for hotspot determination.

[0034] In this embodiment, the access frequency is input into the dynamic threshold adjustment model constructed in step S101 above to update the access threshold configuration. The input process uses the current access frequency as the basis for updating the historical access frequency smoothing value F, and combines it with the real-time collected system load rate U, substituting it into the formula Q=P. (1-m U)+n F recalculates the adjusted threshold Q. In this embodiment, the updated threshold Q is written back to the adjustment coefficient information field of the method marker data, and the corresponding record in the distributed cache is updated synchronously.

[0035] After the aforementioned local statistics are completed, this embodiment establishes a distributed node communication network to achieve cross-node data synchronization. The establishment process involves building message communication links between application nodes and registering node discovery and heartbeat detection mechanisms. This embodiment encapsulates the access statistics data of the local node into a synchronization message, which is then broadcast to other nodes in the cluster via the communication link. Upon receiving the synchronization message, each node merges the remote statistics data with the local statistics data to construct a global access frequency view. This global access frequency view is written to shared storage space for subsequent reading and use during the execution of hierarchical protection control in step S103.

[0036] Step S103: Execute hierarchical protection control, write requests exceeding the access threshold configuration into the protection queue, construct a request dependency relationship network, allocate processing resources according to the request dependency relationship network, establish a protection result evaluation index system, collect request processing latency and business completion rate data, dynamically adjust protection strategy parameters based on the evaluation index system, and distribute the protection strategy parameters to each node through the distributed node communication network.

[0037] This embodiment reads the global access frequency view written to the shared storage space in step S102 above and executes hierarchical protection control logic. The reading process traverses each parameter value entry in the global access frequency view, extracting the access frequency value corresponding to each parameter value. This embodiment also loads the adjustment coefficient information field from the method marker data to obtain the access threshold Q calculated by the dynamic threshold adjustment model. The access frequency is compared with the access threshold Q, and parameters whose access frequencies exceed the threshold are marked as hotspot parameters.

[0038] After the hotspot parameter marking is completed, this embodiment writes requests exceeding the access threshold configuration to the protection queue. The writing process intercepts service requests carrying hotspot parameters, extracting the unique identifier of the request, request time, and service type information. This embodiment determines the request processing method based on the protection policy attributes configured in the method annotation: for requests in rate-limiting mode, a preset prompt message is returned directly; for requests in degradation mode, a preset degradation method is invoked; and for requests in queuing mode, they are written to the protection queue for scheduling. The protection queue uses a priority sorting structure to organize the requests to be processed.

[0039] Accordingly, this embodiment constructs a request dependency network to analyze the call relationships between requests. The construction process parses the call chain information of each request in the protection queue to identify upstream and downstream dependencies between requests. This embodiment treats each request as a network node and dependencies as directed edges to generate a request dependency network graph. Nodes with higher in-degree in the network graph represent critical requests depended upon by multiple downstream requests, while nodes with higher out-degree represent composite requests that depend on multiple upstream requests.

[0040] Based on the aforementioned dependency network, this embodiment allocates processing resources according to the request dependency network. The allocation process calculates the weight value of each request node in the network graph, taking into account the node's in-degree, out-degree, and request waiting time. This embodiment allocates available system processing resources to each request node according to their weight values, with requests having higher weight values ​​receiving more processing threads and memory quotas. The resource allocation results are written to the scheduler, driving the requests in the protection queue to be executed in priority order.

[0041] After resource allocation is completed, this embodiment establishes a protection result evaluation index system to quantify the protection effect. Three evaluation dimensions are defined: request processing latency, business completion rate, and system throughput. This embodiment sets baseline values ​​and allowable fluctuation ranges for each index and constructs evaluation index calculation rules. This evaluation index system provides a quantitative decision-making basis for subsequent adjustments to protection strategies.

[0042] This embodiment collects request processing latency and service completion rate data to populate the evaluation indicator system. During the collection process, the actual processing time is recorded when a request is completed, and the total latency from entering the protection queue to completion is calculated. This embodiment counts the number of successfully completed requests per unit time and the total number of requests, calculating the service completion rate percentage. The processing latency data and completion rate data are written to the evaluation indicator cache.

[0043] Based on the aforementioned evaluation index system, this embodiment dynamically adjusts the protection strategy parameters to adapt to changes in runtime status. The adjustment process compares the collected average processing latency and service completion rate with the benchmark values ​​of the evaluation indicators. When the average processing latency exceeds the allowable range, this embodiment reduces the request admission rate of the protection queue. When the service completion rate is lower than the benchmark value, this embodiment increases the trigger priority of the degradation mode. The adjustment results are updated in the protection strategy parameter configuration table.

[0044] In this embodiment, the protection strategy parameters are distributed to each node through the distributed node communication network established in step S102. During the distribution process, the updated protection strategy parameter configuration table is encapsulated into a synchronization message and broadcast to all nodes in the cluster via the node communication link. Upon receiving the synchronization message, each node updates its local protection strategy configuration, achieving consistency of the protection strategy across the cluster. The synchronous update of the protection strategy parameters ensures that all nodes in the distributed system execute unified hotspot protection logic.

[0045] As described above, the hotspot data detection and protection method provided in this application can achieve flexible protection control through innovative annotation configuration system design, parameter management, and dynamic adjustment. It constructs an interception processing mechanism, combining window statistics and distributed synchronization to establish a reliable detection model. It introduces hierarchical protection, ensuring the effectiveness of protection through dependency analysis and strategy optimization. This method effectively solves the shortcomings of traditional technologies in configuration management, access statistics, and protection control, providing technical assurance for data security.

[0046] In one embodiment of the hotspot data detection and protection method of this application, it may further include the following: Step S201: Construct application layer method annotations, define an attribute set including access threshold, time window, and protection strategy, write the attribute set into annotation metadata, establish an annotation processing engine, generate a method annotation table containing attribute configuration and parsing rules, and load the method annotation table into the application container. Step S202: Construct application layer parameter annotations, define processing rules including parameter parsing, type conversion, and data validation, write the processing rules into the annotation configuration, establish a parameter processing link, generate a parameter annotation table containing parsing strategies and validation logic, and associate the parameter annotation table with the annotation processing engine.

[0047] This embodiment constructs application-layer method annotations during the application initialization phase, defining annotation types for configuring hotspot protection parameters. The construction process declares that the method annotations are runtime visible, specifying that the annotations target method-level elements. This embodiment defines access threshold, time window, and protection policy attributes in the method annotations. The access threshold attribute is a positive integer, the time window attribute is a long integer in milliseconds, and the protection policy attribute is an enumeration type containing three enumeration values: rate limiting, degradation, and queuing.

[0048] After the method annotation attributes are defined, this embodiment writes the attribute set into the annotation metadata to support runtime parsing. The writing process sets default values ​​for each attribute; these default values ​​are used when the business method does not explicitly configure a certain attribute. In this embodiment, the default value for the access threshold attribute is set to the baseline threshold in the system's global configuration, the default value for the time window attribute is set to the baseline period in the system's global configuration, and the default value for the protection strategy attribute is set to rate limiting mode. The annotation metadata is compiled and embedded into the annotation information area of ​​the bytecode file.

[0049] Accordingly, this embodiment establishes an annotation processing engine to achieve runtime parsing and processing of method annotations. The establishment process involves creating an annotation scanner component and configuring the scanner's package path range and annotation type filtering conditions. This embodiment registers a processor implementation for method annotations in the annotation processing engine; this processor implementation is responsible for reading annotation metadata and converting it into an in-memory data structure. The annotation processing engine automatically activates the scanning and parsing process when the application starts.

[0050] Based on the aforementioned processing results, this embodiment generates a method annotation table to organize the parsed annotation configuration data. The generation process iterates through the parsing results output by the annotation processing engine, extracting the fully qualified name and annotation attribute values ​​of each business method. This embodiment uses the fully qualified name as the primary key and access thresholds, time windows, and protection strategies as attribute columns to construct the data structure of the method annotation table. The method annotation table also includes a parsing rule column, recording the data type and value constraint information of each attribute.

[0051] In this embodiment, the method annotation table is loaded into the application container for subsequent processing. During the loading process, the method annotation table is registered as a managed object of the application container, and the object's lifecycle is configured as a singleton. After the application container starts, a reference to the method annotation table can be obtained through dependency injection. The method annotation table is then read and called in subsequent step S202 when associating parameter annotations.

[0052] After the method annotation table is loaded, this embodiment constructs application-layer parameter annotations to mark hotspot parameters that need to be detected. The construction process declares that the parameter annotation retention strategy is runtime visible, and specifies that the annotation's target is method parameter-level elements. This embodiment defines parameter parsing attributes, type conversion attributes, and data validation attributes in the parameter annotations. The parameter parsing attributes specify the parameter value extraction logic, the type conversion attributes specify the parameter value format conversion rules, and the data validation attributes specify the parameter value validity verification conditions.

[0053] Accordingly, this embodiment writes the processing rules into the annotation configuration to support the parsing requirements of complex parameters. The writing process sets a parser type configuration item for the parameter parsing attribute; when the parameter is a basic data type, a built-in parser is used; when the parameter is a composite object type, a custom parser is used. This embodiment sets a converter type configuration item for the type conversion attribute, supporting mutual conversion between common types such as strings, numbers, and dates. A validator type configuration item is set for the data validation attribute, supporting validation logic such as non-empty validation, range validation, and format validation.

[0054] This embodiment establishes a parameter processing link to connect the various processing stages of parameter parsing. The establishment process arranges the parser component, converter component, and validator component sequentially into a processing link, configuring the input and output interfaces of each node in the link. In this embodiment, the raw parameter value is received at the entry point of the parameter processing link, sequentially passes through the parsing, conversion, and verification stages, and outputs a standardized parameter identifier value at the exit point. This parameter identifier value serves as the aggregation dimension for access statistics.

[0055] Based on the aforementioned processing chain, this embodiment generates a parameter annotation table to record the parsing configuration information of each parameter. The generation process extracts the attribute values ​​of the parameter annotations, the fully qualified name of the method to which they belong, and the parameter position index, combining them into data rows of the parameter annotation table. This embodiment writes the parsing strategy information and verification logic information into the corresponding columns of the parameter annotation table. The parameter annotation table is associated with the aforementioned annotation processing engine, which uniformly manages the access interfaces of the method annotation table and the parameter annotation table, allowing subsequent step S301 to read and construct the method index table.

[0056] In one embodiment of the hotspot data detection and protection method of this application, it may further include the following: Step S301: Deploy method annotations and parameter annotations to the target business code, scan the application context, read annotation metadata, construct a method index table containing business method identifiers, annotation types, and annotation attributes, write the method index table into the annotation processor, collect server processor utilization and memory usage data, and generate a system load matrix. Step S302: Calculate the load trend characteristics based on the system load matrix, construct a dynamic threshold adjustment model, map the load trend characteristics to threshold adjustment coefficients, generate a labeled data table containing method identifiers, annotation configurations, processing status, and adjustment coefficients, and write the labeled data table into a distributed cache.

[0057] This embodiment deploys the method annotations and parameter annotations generated in step S202 to the target business code. During deployment, method annotation markers are added to the declaration location of the business method, and the specific values ​​for the access threshold attribute, time window attribute, and protection strategy attribute are configured. In this embodiment, parameter annotation markers are added to the target parameters in the formal parameter list of the business method, and the processing rules for parameter parsing attributes, type conversion attributes, and data validation attributes are configured. These annotation markers are embedded in the business code declaratively without intruding on the business logic implementation.

[0058] After the annotations are deployed, this embodiment scans the application context to discover all annotated business methods. The scanning process obtains a component scanner instance from the application container and configures the scan scope to the package path where the business code is located. This embodiment traverses all class files within the scan scope and identifies method members annotated with method annotations. The scanning process also records the parameter list information of each method, providing context data for subsequent parameter annotation parsing.

[0059] Accordingly, this embodiment reads annotation metadata to extract configuration values ​​of annotation attributes. The reading process invokes the annotation processing engine established in step S202 above to obtain the data content of the method annotation table and the parameter annotation table. This embodiment extracts the access threshold, time window, and protection strategy configuration for each business method from the method annotation table, and extracts the parsing strategy and verification logic configuration for each parameter from the parameter annotation table. The annotation metadata is converted into a unified in-memory data structure to support subsequent index construction.

[0060] Based on the aforementioned metadata, this embodiment constructs a method index table to organize the mapping relationship between business methods and annotation configurations. The construction process uses the fully qualified name of the business method as the method identifier field, the annotation type name as the annotation type field, and the set of annotation attribute key-value pairs as the annotation attribute field. This embodiment writes the index records of each business method row by row into the method index table, establishing a fast query index between method identifiers and annotation configurations. The method index table supports retrieving corresponding annotation configuration information by method identifier.

[0061] In this embodiment, the method index table is written to the annotation processor for use in the runtime interception phase. The writing process registers the method index table as an internal data source for the annotation processor, configuring the data source's access interface and caching strategy. When the annotation processor receives a method call interception request, it queries the method index table based on the method identifier to obtain the corresponding annotation configuration information. The writing operation of the method index table is completed during the application startup phase; during the runtime phase, only a read-only query is performed.

[0062] After the method index table is written, this embodiment collects server processor utilization and memory usage data to monitor system operating status. The collection process calls the resource monitoring interface provided by the operating system to read the utilization percentage of each processor core and the number of bytes occupied in the memory heap. This embodiment performs the collection operation periodically at fixed time intervals, appending a timestamp to each collected data point before writing it to the collection buffer. The collected data reflects the real-time status of system resource consumption.

[0063] Accordingly, this embodiment generates a system load matrix to organize multi-dimensional load data. The generation process sorts the time-series data in the acquisition buffer according to timestamps, with rows representing acquisition times and columns representing load dimensions. This embodiment uses processor utilization as the first column, memory usage as the second column, and the acquisition timestamp as the third column to construct the data structure of the system load matrix. This system load matrix is ​​then read and called by the subsequent step S302 to calculate load trend characteristics.

[0064] This embodiment calculates load trend characteristics based on the system load matrix to identify the changing patterns of system load. The calculation process performs time-series analysis on the processor utilization and memory usage columns in the system load matrix, extracting the mean, variance, and slope of change for each column. This embodiment uses the mean as a baseline load level indicator, the variance as a load fluctuation amplitude indicator, and the slope as a load growth trend indicator. These three indicators are combined to form a load trend feature vector.

[0065] Based on the aforementioned trend characteristics, this embodiment constructs a dynamic threshold adjustment model to achieve adaptive adjustment of the access threshold. The construction process defines a mapping rule between load level and threshold adjustment coefficient: a larger adjustment coefficient is mapped when the load baseline level is in the low range, and a smaller adjustment coefficient is mapped when the load baseline level is in the high range. This embodiment uses the load fluctuation amplitude index as a correction factor for the adjustment coefficient; when the fluctuation amplitude is large, the adjustment coefficient is reduced to enhance protection. The dynamic threshold adjustment model receives the load trend feature vector as input and outputs the threshold adjustment coefficient.

[0066] This embodiment maps the load trend characteristics to threshold adjustment coefficients to drive the dynamic updating of the access threshold. The mapping process inputs the load trend feature vector into the dynamic threshold adjustment model and calculates the threshold adjustment coefficient for the current time step according to the mapping rules. This embodiment multiplies the threshold adjustment coefficient by the original access threshold configured in the method annotation to obtain the adjusted access threshold. The adjusted threshold reflects a reasonable access restriction level under the current system load condition.

[0067] Accordingly, this embodiment generates a tag data table to integrate method configuration and runtime status information. The generation process uses the method identifier as the primary key column, annotation configuration information as the configuration column, the current processing status as the status column, and the threshold adjustment coefficient as the coefficient column. This embodiment writes the annotation configuration from the method index table and the adjustment coefficients output by the dynamic threshold adjustment model row by row into the tag data table. The processing status column records whether each method is currently in a protected active state.

[0068] This embodiment writes the tagged data table to a distributed cache to support data sharing in a clustered environment. The writing process connects to the distributed cache service and serializes the tagged data table into a cache storage format. This embodiment configures the cache key name, expiration time, and update strategy for the tagged data table, and writes the serialized data into the distributed cache space. The tagged data table is read and called by subsequent steps in step S401 when building the interception processing framework; each cluster node obtains consistent method configuration information by accessing the distributed cache.

[0069] In one embodiment of the hotspot data detection and protection method of this application, it may further include the following: Step S401: Construct an aspect-oriented interception processing framework, load the method tag data table, extract the parameter values ​​of the target method, record the method call timestamp, construct a call tracing table containing parameter identifiers, parameter values, and timestamps, and write the call tracing table into the sliding window cache pool; Step S402: Read the time window configuration parameters, perform time slicing on the sliding window cache pool, construct a sub-window counting matrix, map the data in the call trace table to the corresponding sub-window, generate a statistical data table containing window identifier, count value, and time range, and write the statistical data table into the statistical analysis module.

[0070] This embodiment constructs an aspect-oriented interception processing framework during the application runtime phase, configuring the pointcut expression and around advice type of the aspect components. During the construction process, the pointcut expression is configured to match all business methods annotated with method annotations, enabling the interception processing framework to automatically intercept call requests to the target method for hotspot detection. This embodiment loads the tag data table written in step S302 of the aforementioned step into the distributed cache, extracting the method identifier, annotation configuration, and adjustment coefficient information for each business method.

[0071] When the interception processing framework receives a method call, this embodiment extracts the parameter values ​​of the target method and records the call timestamp. The extraction process obtains the current call's actual parameter group from the interception context and locates the target parameter position based on the index attribute configured in the parameter annotation. When the target parameter is a composite object type, this embodiment calls the parameter processing chain to output a standardized parameter identifier value. The recording process calls the system clock to obtain the current time's millisecond-level timestamp and associates the timestamp with the parameter value for storage.

[0072] Accordingly, this embodiment constructs a call tracing table to organize historical data of parameter access. The construction process uses the parameter identifier as the first column, the parameter value as the second column, and the timestamp as the third column, appending each call record row by row to the call tracing table. This embodiment writes the call tracing table into a sliding window cache pool, using the parameter identifier as the cache partition key, and configuring the partition's capacity limit and eviction policy.

[0073] After the call tracking table is written, this embodiment reads the time window configuration parameters from the tag data table and performs time sharding on the sliding window cache pool. The sharding process evenly divides the total length of the time window into several sub-window intervals, and calculates the time span of each sub-window according to the formula G=W / K, where G represents the time span of a single sub-window, W represents the total length of the time window, and K represents the number of sub-windows.

[0074] Based on the aforementioned sharding results, this embodiment constructs a sub-window counting matrix, using parameter identifiers as row indices and sub-window serial numbers as column indices. This embodiment iterates through each row of records in the tracking table, calculates the corresponding sub-window serial number based on the timestamp, and increments the corresponding matrix element value. After the mapping operation is completed, the sub-window counting matrix reflects the distribution of the number of times each parameter is accessed within each sub-window.

[0075] This embodiment generates a statistical data table to integrate the statistical results of the sub-window counting matrix, using window identifiers, count values, and time ranges as column structures. The generation process iterates through each column of the sub-window counting matrix, summing the column elements as the count value and using the start and end timestamps of the sub-windows as the time range. The statistical data table is written to the statistical analysis module for subsequent step S501 to calculate the access frequency per unit time.

[0076] In one embodiment of the hotspot data detection and protection method of this application, it may further include the following: Step S501: Read the statistical data table, summarize the count values ​​of each sub-window, calculate the total number of visits per unit time, input the total number of visits into the dynamic threshold adjustment model, generate a threshold configuration table containing the original threshold, adjustment coefficient, and update time, build an inter-node communication link, and broadcast the threshold configuration table to the cluster nodes. Step S502: Receive access statistics data returned by cluster nodes, merge the count results of each node, construct a global access frequency matrix, write the global access frequency matrix into the shared storage space, generate a data synchronization table containing node identifiers, statistics data, and synchronization time, and update the data consistency status between nodes.

[0077] This embodiment reads the statistical data table written to the statistical analysis module in step S402 above, and extracts the count values ​​and time range information of each sub-window. The reading process iterates through each row of records in the statistical data table, filtering sub-window data within the current time window range based on the window identifier. This embodiment temporarily stores the filtering results in the summary calculation buffer, preparing input data for subsequent total access calculation.

[0078] After the statistical data is read, this embodiment summarizes the count values ​​of each sub-window to calculate the total number of visits per unit time. The summarization process iterates through the records of each sub-window in the summarization calculation buffer, and adds up the count value field of each record to obtain the total number of visits within the time window. This embodiment divides the total number of visits by the length of the time window to obtain the access frequency per unit time, and the access frequency is used as the core indicator for hotspot determination.

[0079] Accordingly, this embodiment inputs the total number of visits into the dynamic threshold adjustment model constructed in step S302. The input process uses the current access frequency as the basis for updating the model's historical frequency smoothing value, and performs threshold adjustment calculations in conjunction with the real-time load rate in the system load matrix. This embodiment generates a threshold configuration table to record the adjustment results. The threshold configuration table includes an original threshold column, an adjustment coefficient column, and an update time column, respectively recording the baseline threshold configured in the method annotation, the adjustment coefficient output by the model, and the timestamp of this update.

[0080] Based on the aforementioned threshold configuration table, this embodiment constructs inter-node communication links to support data synchronization in a cluster environment. The construction process establishes long-lived connection channels between each application node and registers a node discovery service and heartbeat detection mechanism. This embodiment serializes the threshold configuration table into a transmission format and broadcasts it to all nodes in the cluster via the communication link. Each node updates its local threshold configuration cache upon receiving the broadcast message.

[0081] After the threshold configuration table is broadcast, this embodiment receives access statistics data returned by the cluster nodes. The receiving process involves monitoring response messages on the communication link and parsing the local statistics data table content reported by each node. This embodiment groups the statistics data of each node according to parameter identifiers to establish a data index for subsequent counting and merging operations.

[0082] This embodiment merges the counting results of each node to construct a global access frequency matrix. The merging process iterates through the sub-window counting data reported by each node, accumulating the count values ​​with the same parameter identifier and the same sub-window index. This embodiment uses the parameter identifier as the matrix row index, the sub-window index as the matrix column index, and the accumulated count value as the matrix element to construct the global access frequency matrix. The global access frequency matrix is ​​written to a shared storage space for each node to read.

[0083] Accordingly, this embodiment generates a data synchronization table to record the data exchange status between nodes. The generation process uses the node identifier as the first column, the summary of statistical data reported by the node as the second column, and the synchronization completion timestamp as the third column. This embodiment updates the data consistency status identifier between nodes based on the comparison between the data synchronization timestamps of each node and the update timestamps of the global access frequency matrix. The data synchronization table is then read by subsequent step S601 to perform hierarchical protection control.

[0084] In one embodiment of the hotspot data detection and protection method of this application, it may further include the following: Step S601: Read the global access frequency matrix, compare it with the access threshold configuration table, mark requests that exceed the threshold, construct a protection queue containing request identifiers, priorities, and resource requirements, analyze the call chain relationship between requests, generate a request dependency network graph, and write the request dependency network graph into the resource scheduler. Step S602: Calculate request processing weights based on the request dependency network graph, construct a resource allocation strategy, allocate processing resources to requests in the protection queue according to their weights, generate an evaluation index table containing request status, processing latency, and completion rate, and write the evaluation index table into the monitoring center.

[0085] This embodiment reads the global access frequency matrix written to the shared storage space in step S502 above, and extracts the access frequency value corresponding to each parameter identifier. The reading process iterates through each row of the global access frequency matrix, summarizing the count values ​​of each sub-window column to obtain the total number of accesses for that parameter within the current time window. This embodiment also loads the threshold configuration table to obtain the original threshold and adjustment coefficient information corresponding to each method.

[0086] After the data loading is complete, this embodiment compares the access threshold configuration table to mark requests exceeding the threshold. The comparison process compares the number of accesses in the global access frequency matrix with the thresholds in the threshold configuration table after adjustment. When the number of accesses exceeds the adjusted threshold, the corresponding parameter is marked as a hotspot parameter. This embodiment intercepts service requests carrying hotspot parameters and extracts the unique identifier of the request, along with the service type and resource requirement information.

[0087] Accordingly, this embodiment constructs a protection queue to organize the processing order of requests exceeding the threshold. The construction process defines the data structure of the protection queue using request identifier as the first column, priority as the second column, and resource requirement as the third column. This embodiment calculates priority values ​​based on the service type and waiting time of the request, and inserts each request exceeding the threshold into the protection queue in descending order of priority.

[0088] After the protection queue is constructed, this embodiment analyzes the call chain relationship between requests to identify request dependencies. The analysis process parses the call context information of each request and extracts the identifiers of the request initiator and the request receiver. This embodiment treats each request as a network node and the call relationship as a directed edge to generate a request dependency network graph. Nodes with higher in-degree in the network graph represent key nodes that are depended on by multiple downstream requests.

[0089] In this embodiment, the request-dependent network graph is written to the resource scheduler to support subsequent resource allocation decisions. The writing process serializes the network graph into a data format recognizable by the scheduler and registers it as the scheduler's input data source. The resource scheduler determines the request processing order and resource quotas based on the network graph's topology.

[0090] Based on the aforementioned request dependency network graph, this embodiment calculates request processing weights to quantify the resource demand of each request. The calculation process follows the formula Y=c D+d T calculates the processing weight of each request, where Y represents the request processing weight, D represents the in-degree value of the request in the dependency network graph, T represents the waiting time of the request in the protection queue, c represents the in-degree influence coefficient, and d represents the waiting time influence coefficient. Requests with higher weight values ​​receive higher processing priority.

[0091] Accordingly, this embodiment constructs a resource allocation strategy and allocates processing resources to requests in the protection queue according to their weights. The allocation process calculates the proportion of each request's weight to the total weight, and allocates the available processing threads and memory quotas proportionally. This embodiment generates an evaluation index table to record request processing results. The evaluation index table includes a request status column, a processing delay column, and a completion rate column. The evaluation index table is written to the monitoring center for subsequent step S701 to dynamically adjust the protection strategy parameters.

[0092] In one embodiment of the hotspot data detection and protection method of this application, it may further include the following: Step S701: Read the evaluation index table, collect the processing delay time and completion status of each request, calculate the business processing performance index, construct a performance evaluation matrix including response time, success rate and throughput, input the performance evaluation matrix into the policy optimizer, and generate a protection policy adjustment scheme. Step S702: Update the protection parameter configuration according to the protection strategy adjustment scheme, construct a protection rule table including rate limiting threshold, degradation strategy and queue capacity, and broadcast the protection rule table to the cluster nodes through the node communication network to synchronously update the protection configuration status of each node.

[0093] This embodiment reads the evaluation index table written to the monitoring center in step S602 above and extracts the processing status and latency data of each request. The reading process iterates through each row of the evaluation index table, filtering request entries with a processing status of "completed". This embodiment extracts the values ​​of the processing latency column and the identifiers of the completion status column from the filtering results, and temporarily stores the data in a performance calculation buffer.

[0094] After the evaluation data is read, this embodiment collects the processing latency and completion status of each request to calculate the business processing performance indicators. During the collection process, the average processing latency of all requests in the performance calculation buffer is used as the response time indicator; the proportion of requests with a successful completion status to the total number of requests is used as the success rate indicator; and the number of requests processed per unit time is used as the throughput indicator.

[0095] Accordingly, this embodiment constructs a performance evaluation matrix to organize multi-dimensional performance indicator data. The construction process defines the column structure of the performance evaluation matrix using response time as the first column, success rate as the second column, and throughput as the third column. In this embodiment, performance indicator data from each acquisition period are written into the performance evaluation matrix row by row in chronological order, establishing a time-series record of performance indicator changes.

[0096] Based on the aforementioned performance evaluation matrix, this embodiment inputs it into the policy optimizer to generate a protection policy adjustment scheme. The input process uses the most recent rows of data from the performance evaluation matrix as analysis samples for the optimizer, extracting the trend of response time changes, the fluctuation range of success rate, and the direction of increase or decrease in throughput. Based on the analysis results, this embodiment determines the adjustment direction of the protection policy: when the response time continues to rise, an adjustment scheme to tighten protection is generated; when the success rate continues to decline, an adjustment scheme to increase the downgrade priority is generated.

[0097] This embodiment updates the protection parameter configuration according to the protection strategy adjustment scheme. The update process parses the parameter modification instructions in the adjustment scheme and locates the configuration record of the corresponding method in the marker data table. This embodiment modifies the configuration values ​​of the access threshold and protection strategy attributes according to the adjustment direction and writes the modified configuration back to the distributed cache.

[0098] Accordingly, this embodiment constructs a protection rule table to integrate the updated protection configuration information. The construction process defines the column structure of the protection rule table using the rate limiting threshold as the first column, the degradation strategy as the second column, and the queue capacity as the third column. In this embodiment, the updated configuration of each method is written into the protection rule table row by row, establishing a mapping relationship between method identifiers and protection rules.

[0099] In this embodiment, the protection rule table is broadcast to the cluster nodes through the node communication network constructed in step S501. The broadcast process serializes the protection rule table into a transmission format and sends it to all nodes in the cluster via the communication link. Each node receives the broadcast message, parses the protection rule table content, updates its local protection configuration cache, and returns an acknowledgment message to the sending node after synchronization is complete. This embodiment updates the consistency status flag in the data synchronization table based on the acknowledgment messages from each node, ensuring the consistency of protection configurations across the cluster.

[0100] To effectively address the shortcomings of traditional technologies in configuration management, access statistics, and protection control, and to provide technical safeguards for data security, this application provides an embodiment of a hotspot data detection and protection device for implementing all or part of the aforementioned hotspot data detection and protection method. See [link to embodiment]. Figure 2 The hotspot data detection and protection device specifically includes the following components: The rule determination module 10 is used to construct an application layer annotation system, create method annotations for configuring protection parameters and parameter annotations for marking detection targets, write access thresholds and time window configurations into the method annotations, write parsing rule configurations into the parameter annotations, deploy the method annotations and parameter annotations to business methods, collect system operation load data, construct a dynamic threshold adjustment model based on the load data, and generate method marking data containing annotation configurations and processing status. Hotspot detection module 20 is used to establish an aspect-oriented interception and processing framework. It extracts parameter values ​​and access timestamps from the labeled data according to the method, writes the parameter values ​​and access timestamps into the sliding window cache, divides the sub-window counters based on the time window configuration, summarizes the sub-window counter values ​​to obtain the access frequency, inputs the access frequency into the dynamic threshold adjustment model, updates the access threshold configuration, establishes a distributed node communication network, and synchronizes the access statistics data of each node. The hotspot protection module 30 is used to perform hierarchical protection control, write requests exceeding the access threshold configuration into the protection queue, construct a request dependency relationship network, allocate processing resources according to the request dependency relationship network, establish a protection result evaluation index system, collect request processing latency and business completion rate data, dynamically adjust protection strategy parameters based on the evaluation index system, and distribute the protection strategy parameters to each node through the distributed node communication network.

[0101] As described above, the hotspot data detection and protection device provided in this application embodiment can achieve flexible protection control through innovative annotation configuration system design, parameter management, and dynamic adjustment. It constructs an interception processing mechanism, combining window statistics and distributed synchronization to establish a reliable detection model. It introduces hierarchical protection, ensuring the effectiveness of protection through dependency analysis and strategy optimization. This method effectively solves the shortcomings of traditional technologies in configuration management, access statistics, and protection control, providing technical assurance for data security.

[0102] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the hotspot data detection and protection method.

[0103] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described hotspot data detection and protection method.

[0104] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned hotspot data detection and protection method.

[0105] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting and protecting hotspot data, characterized in that, The method includes: Construct an application-layer annotation system, create method annotations for configuring protection parameters and parameter annotations for marking detection targets, write access threshold and time window configurations into the method annotations, write parsing rule configurations into the parameter annotations, deploy the method annotations and parameter annotations to business methods, collect system operation load data, construct a dynamic threshold adjustment model based on the load data, and generate method marking data containing annotation configurations and processing status. A segment-oriented interception processing framework is established. According to the method, the parameter values ​​and access timestamps are extracted from the labeled data. The parameter values ​​and access timestamps are written into the sliding window cache. The sub-window counters are divided based on the time window configuration. The access frequency is obtained by summing the values ​​of the sub-window counters. The access frequency is input into the dynamic threshold adjustment model to update the access threshold configuration. A distributed node communication network is established to synchronize the access statistics data of each node. Implement tiered protection control, write requests exceeding the access threshold configuration into a protection queue, construct a request dependency network, allocate processing resources according to the request dependency network, establish a protection result evaluation index system, collect request processing latency and business completion rate data, dynamically adjust protection strategy parameters based on the evaluation index system, and distribute the protection strategy parameters to each node through the distributed node communication network.

2. The hotspot data detection and protection method according to claim 1, characterized in that, The construction of the application layer annotation system involves creating method annotations for configuring protection parameters and parameter annotations for marking detection targets. Access thresholds and time window configurations are written into the method annotations, and parsing rule configurations are written into the parameter annotations, including: Construct application layer method annotations, define an attribute set including access threshold, time window, and protection strategy, write the attribute set into annotation metadata, establish an annotation processing engine, generate a method annotation table containing attribute configuration and parsing rules, and load the method annotation table into the application container; Construct application-layer parameter annotations, define processing rules including parameter parsing, type conversion, and data validation, write the processing rules into the annotation configuration, establish a parameter processing chain, generate a parameter annotation table containing parsing strategies and validation logic, and associate the parameter annotation table with the annotation processing engine.

3. The hotspot data detection and protection method according to claim 1, characterized in that, The process of deploying the method annotations and parameter annotations to business methods, collecting system runtime load data, constructing a dynamic threshold adjustment model based on the load data, and generating method tagging data containing annotation configurations and processing status includes: Deploy method annotations and parameter annotations to the target business code, scan the application context, read annotation metadata, construct a method index table containing business method identifiers, annotation types, and annotation attributes, write the method index table into the annotation processor, collect server processor utilization and memory usage data, and generate a system load matrix. Based on the system load matrix, load trend characteristics are calculated, a dynamic threshold adjustment model is constructed, the load trend characteristics are mapped to threshold adjustment coefficients, a labeled data table containing method identifiers, annotation configurations, processing statuses, and adjustment coefficients is generated, and the labeled data table is written into a distributed cache.

4. The hotspot data detection and protection method according to claim 1, characterized in that, The establishment of the aspect-oriented interception processing framework includes extracting parameter values ​​and access timestamps from the labeled data according to the method, writing the parameter values ​​and access timestamps into the sliding window cache, and configuring a sub-window counter based on the time window, including: Construct an aspect-oriented interception processing framework, load a method tagging data table, extract the parameter values ​​of the target method, record the method call timestamp, construct a call tracing table containing parameter identifiers, parameter values, and timestamps, and write the call tracing table into a sliding window cache pool; Read the time window configuration parameters, perform time slicing on the sliding window cache pool, construct a sub-window counting matrix, map the data in the call trace table to the corresponding sub-window, generate a statistical data table containing window identifier, count value, and time range, and write the statistical data table into the statistical analysis module.

5. The hotspot data detection and protection method according to claim 1, characterized in that, The access frequency is obtained by summarizing the sub-window counter values. This access frequency is then input into the dynamic threshold adjustment model to update the access threshold configuration. A distributed node communication network is established to synchronize the access statistics data of each node, including: Read the statistical data table, summarize the count values ​​of each sub-window, calculate the total number of visits per unit time, input the total number of visits into the dynamic threshold adjustment model, generate a threshold configuration table containing the original threshold, adjustment coefficient, and update time, build an inter-node communication link, and broadcast the threshold configuration table to the cluster nodes. The system receives access statistics data returned by cluster nodes, merges the count results of each node, constructs a global access frequency matrix, writes the global access frequency matrix into the shared storage space, generates a data synchronization table containing node identifiers, statistics data, and synchronization time, and updates the data consistency status between nodes.

6. The hotspot data detection and protection method according to claim 1, characterized in that, The implementation of tiered protection control involves writing requests exceeding the configured access threshold into a protection queue, constructing a request dependency network, allocating processing resources based on the request dependency network, and establishing a protection result evaluation index system, including: Read the global access frequency matrix, compare it with the access threshold configuration table, mark requests that exceed the threshold, construct a protection queue containing request identifiers, priorities, and resource requirements, analyze the call chain relationship between requests, generate a request dependency network graph, and write the request dependency network graph into the resource scheduler. Request processing weights are calculated based on the request dependency network graph, a resource allocation strategy is constructed, and processing resources are allocated to requests in the protection queue according to their weights. An evaluation index table containing request status, processing latency, and completion rate is generated and written to the monitoring center.

7. The hotspot data detection and protection method according to claim 1, characterized in that, The data on collection request processing latency and business completion rate are used to dynamically adjust protection strategy parameters based on the evaluation index system. These protection strategy parameters are then distributed to each node via the distributed node communication network, including: Read the evaluation index table, collect the processing latency and completion status of each request, calculate the business processing performance index, construct a performance evaluation matrix including response time, success rate and throughput, input the performance evaluation matrix into the policy optimizer, and generate a protection policy adjustment scheme. According to the protection strategy adjustment scheme, update the protection parameter configuration, construct a protection rule table including rate limiting threshold, degradation strategy, and queue capacity, and broadcast the protection rule table to the cluster nodes through the node communication network to synchronously update the protection configuration status of each node.

8. A hotspot data detection and protection device, characterized in that, The device includes: The rule determination module is used to construct an application layer annotation system, create method annotations for configuring protection parameters and parameter annotations for marking detection targets, write access thresholds and time window configurations into the method annotations, write parsing rule configurations into the parameter annotations, deploy the method annotations and parameter annotations to business methods, collect system operation load data, construct a dynamic threshold adjustment model based on the load data, and generate method marking data containing annotation configurations and processing status. The hotspot detection module is used to establish an aspect-oriented interception and processing framework. It extracts parameter values ​​and access timestamps from the labeled data according to the method, writes the parameter values ​​and access timestamps into the sliding window cache, divides the sub-window counters based on the time window configuration, summarizes the sub-window counter values ​​to obtain the access frequency, inputs the access frequency into the dynamic threshold adjustment model, updates the access threshold configuration, establishes a distributed node communication network, and synchronizes the access statistics data of each node. The hotspot protection module is used to perform hierarchical protection control, write requests exceeding the access threshold configuration into the protection queue, construct a request dependency relationship network, allocate processing resources according to the request dependency relationship network, establish a protection result evaluation index system, collect request processing latency and business completion rate data, dynamically adjust protection strategy parameters based on the evaluation index system, and distribute the protection strategy parameters to each node through the distributed node communication network.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the hotspot data detection and protection method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the hotspot data detection and protection method according to any one of claims 1 to 7.

Images