Interface abnormal fluctuation intelligent detection method and device and computer equipment

Abstract

The application relates to an interface abnormal fluctuation intelligent detection method and device and computer equipment. The method comprises the following steps: acquiring access records of accessing each interface in a current time window; obtaining high-dimensional feature vectors of each interface based on the access records of each interface; the high-dimensional feature vectors at least comprise a traffic density feature, a response time distribution feature, an error rate feature, a client distribution feature and a same-period fluctuation rate feature; determining first confidence degrees of each interface based on the traffic density feature and the error rate feature in each high-dimensional feature vector; outputting second confidence degrees of each interface through an isolation forest model based on each high-dimensional feature vector; and obtaining an abnormal fluctuation score of each interface based on the first confidence degrees and the second confidence degrees of each interface, so as to judge whether each interface has an abnormal fluctuation based on each abnormal fluctuation score. The method can improve the accuracy of abnormal detection.

Description

Technical Field

[0001] This application relates to the field of interface anomaly detection technology, and in particular to an intelligent detection method, device and computer equipment for interface anomaly fluctuations. Background Technology

[0002] With the development of internet technology and the continuous improvement of enterprise informatization, the deployment of systems based on microservice architecture is becoming increasingly popular. Business functions are broken down into multiple small service modules running in the service gateway. As the core gateway component, BWS carries almost all the call traffic between the front-end and back-end, and between services. Its interface performance and stability directly affect the availability and user experience of the entire system.

[0003] Traditional API monitoring methods mostly rely on static threshold detection or fixed-frequency manual log analysis. For example, anomalies are detected by setting fixed thresholds for metrics such as requests per second, response time, and error rate. However, with the cyclical changes in business traffic and the dynamic scaling of microservices, static thresholds often fail to effectively capture "sudden" anomalies or "trend-based" degradation issues, leading to errors in anomaly detection. Summary of the Invention

[0004] Therefore, it is necessary to provide an intelligent detection method, device, and computer equipment for interface anomaly fluctuations to address the aforementioned technical problems. This method can improve the accuracy of anomaly detection.

[0005] A method for intelligent detection of abnormal fluctuations in interfaces, the method comprising:

[0006] S1. Obtain the access records of each interface within the current time window;

[0007] S2. Based on the access records of each interface, obtain a high-dimensional feature vector for each interface; the high-dimensional feature vector includes at least traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features.

[0008] S3. Based on the traffic density feature and the error rate feature in each of the high-dimensional feature vectors, determine the first confidence level of each of the interfaces respectively; based on each of the high-dimensional feature vectors, output the second confidence level of each of the interfaces through the isolated forest model;

[0009] S4. Based on the first confidence level and the second confidence level of each interface, obtain the abnormal fluctuation score of each interface, and determine whether there is abnormal fluctuation in each interface based on each abnormal fluctuation score.

[0010] In this application, by introducing multi-dimensional high-dimensional feature vectors and combining the isolated forest algorithm with the traffic density feature and the error rate feature in the high-dimensional feature vectors to determine the abnormal fluctuation score, the detection dimension can be expanded from "quantity" to "quality", thereby achieving accurate capture of various abnormal scenarios, greatly reducing false detections caused by normal business fluctuations, and significantly improving the accuracy of anomaly detection.

[0011] In one embodiment, step S4 includes:

[0012] The weight corresponding to the target interval where the traffic density feature of the interface is located is determined as the first weight of the first confidence level; based on the first weight, the second weight of the second confidence level is determined.

[0013] The first confidence level, the second confidence level, the first weight, and the second weight of each interface are weighted and summed to obtain the abnormal fluctuation score of each interface, so as to determine whether there is abnormal fluctuation in each interface based on the abnormal fluctuation score.

[0014] In this application, the weight corresponding to the target interval where the traffic density characteristics of the interface are located is determined as the first weight of the first confidence level. Based on the first weight, the second weight of the second confidence level is determined. The first confidence level, the second confidence level, the first weight, and the second weight of each interface are weighted and summed to obtain the abnormal fluctuation score of each interface. The abnormal fluctuation score is used to determine whether there is abnormal fluctuation of the interface. In this way, the first weight of the first confidence level and the second weight of the isolated forest model can be dynamically adjusted according to the real-time traffic density characteristics of each interface. This can achieve the purpose of rapid response during the business stability period and the purpose of accurate determination of whether there is abnormal fluctuation during the business mutation period.

[0015] In one embodiment, the interface includes a core interface, a general interface, and a non-core interface, wherein a first anomaly detection threshold for the core interface is less than a second anomaly detection threshold for the general interface, and the second anomaly detection threshold is less than a third anomaly detection threshold for the non-core interface; the method further includes:

[0016] When the abnormal fluctuation score of the core interface is greater than the first abnormal judgment threshold, it is determined that the core interface has abnormal fluctuations.

[0017] When the abnormal fluctuation score of the general interface is greater than the second abnormal judgment threshold, it is determined that the general interface has abnormal fluctuations.

[0018] When the abnormal fluctuation score of the non-core interface is greater than the third abnormal judgment threshold, it is determined that there is abnormal fluctuation in the non-core interface.

[0019] In this application, when the abnormal fluctuation score of the core interface is greater than the first abnormal judgment threshold, it is determined that the core interface has abnormal fluctuation; when the abnormal fluctuation score of the general interface is greater than the second abnormal judgment threshold, it is determined that the general interface has abnormal fluctuation; and when the abnormal fluctuation score of the non-core interface is greater than the third abnormal judgment threshold, it is determined that the non-core interface has abnormal fluctuation. This differentiated threshold setting can find an optimal balance between "missed detection" and "false detection", significantly reducing the "false detection rate".

[0020] In one embodiment, the method further includes:

[0021] Obtain the preset conflict correction coefficient;

[0022] Based on the conflict correction coefficient ,pass The abnormal fluctuation scores of each interface are corrected to obtain a corrected score for each interface. final Based on each of the correction scores, it is determined whether there are abnormal fluctuations in each of the interfaces; As the first weight, S A As the first confidence level, As the second weight, S B This represents the second confidence level.

[0023] In this application, a preset conflict correction coefficient is obtained, and based on the conflict correction coefficient... ,pass The abnormal fluctuation scores of each interface are corrected to obtain the corrected score for each interface. final This improves the accuracy of judgment when determining whether there are abnormal fluctuations in the interface based on the correction score of each interface.

[0024] In one embodiment, step S2 includes:

[0025] The number of access records for each interface is determined, and the traffic density characteristics of each interface are obtained by dividing the number of access records by the length of the current time window.

[0026] Determine the response time in each access record of each of the aforementioned interfaces, and based on the response time of each of the aforementioned interfaces, through... Calculate the skewness of the response time for each of the aforementioned interfaces. ,pass Calculate the kurtosis of the response time for each of the aforementioned interfaces. The skewness and kurtosis corresponding to the interface are used as the response time distribution characteristics of the interface; X represents the response time in the access record of the interface. This is the average response time across all access records of the interface. The standard deviation of the response time in each access record of the interface, E[] is the expected value;

[0027] Based on the response status codes in the access records of each interface, the number of access failure records corresponding to each interface is determined; based on the result of dividing the number of access failure records corresponding to each interface by the number of access records, the error rate characteristics of each interface are obtained.

[0028] Based on the client identifier in the access record of each interface, the request percentage of each client corresponding to each interface is determined. Based on the request percentage of each client, the following steps are taken: Calculate the Shannon entropy H(X) for each of the interfaces, and use the Shannon entropy as the client distribution characteristic of the interface; M is the total number of clients requesting access to the interface, and P(xi) is the proportion of requests from the i-th client requesting access to the interface.

[0029] Based on the number of access records for each interface in the current time window and the number of first historical access records in the first historical time window, the year-on-year volatility characteristics of each interface are determined.

[0030] In this application, by determining the number of access records for an interface, the result of dividing the number of access records by the length of the current time window can be used to determine the traffic density characteristic of the interface. Furthermore, by determining the response time in each access record of the interface, the response time of the interface can be used to... skewness of the response time of the calculation interface ,pass kurtosis of the response time of the calculation interface The response time distribution characteristics of the interface are defined by its skewness and kurtosis. The number of failed access records is determined by analyzing the response status codes in the interface's access logs; this allows the error rate characteristic of the interface to be calculated by dividing the number of failed access records by the number of access records. The request percentage of each client requesting the interface is determined based on the client data in the interface's access logs; this allows for further analysis based on the request percentage of each client. Calculate the Shannon entropy H(X) of the interface, and use the Shannon entropy as the client distribution characteristic of the interface. By considering the number of access records of the interface in the current time window and the number of first historical access records in the first historical time window, the year-on-year volatility characteristic of the interface can be determined.

[0031] In one embodiment, the process of determining the first confidence level includes:

[0032] Obtain the number of second historical access records for each interface in multiple second historical time windows and the historical error rate of each interface in each second historical time window;

[0033] Based on the number of second historical access records in each second historical time window of each interface, calculate the historical access mean and historical access standard deviation for each interface; based on the historical error rate in each second historical time window of each interface, calculate the historical error rate mean and historical error rate standard deviation for each interface.

[0034] Based on the number of access records for each interface in the current time window, the historical access mean, and the historical access standard deviation, a first score is calculated for each interface; based on the error rate characteristics of each interface in the current time window, the historical error rate mean, and the historical error rate standard deviation, a second score is calculated for each interface.

[0035] When the first score and / or the second score are greater than the score threshold, the first confidence level is determined to be the first preset value;

[0036] When both the first score and the second score are less than or equal to the score threshold, the first confidence level is determined to be the second preset value.

[0037] In this application, by obtaining the number of second historical access records of the interface in multiple second historical time windows and the historical error rate of the interface in each second historical time window, the historical access mean and historical access standard deviation are calculated based on the number of second historical access records in each second historical time window; and the historical error rate mean and historical error rate standard deviation are calculated based on the historical error rate in each second historical time window. In this way, a first score of the interface can be calculated based on the number of access records, historical access mean, and historical access standard deviation of the interface in the current time window, and a second score of the interface can be calculated based on the error rate characteristics, historical error rate mean, and historical error rate standard deviation of the interface in the current time window. Thus, when the first score and / or the second score is greater than the score threshold, the first confidence level is determined to be a first preset value; when both the first score and the second score are less than or equal to the score threshold, the first confidence level is determined to be a second preset value.

[0038] In one embodiment, the process of determining the second confidence level includes:

[0039] The path length of the high-dimensional feature vector of the interface in each isolated tree is determined by the isolated forest model; the path length is the number of edges traversed from the root node to the leaf node.

[0040] Based on the path length of the high-dimensional feature vector in each isolated tree, through Calculate the average path length of the high-dimensional feature vector. ; k represents the total number of isolated trees in the isolated forest model. Let be the path length of the high-dimensional feature vector in isolated tree j;

[0041] pass Calculate the normalization factor ; The training set size for each isolated tree, Represents the harmonic number;

[0042] Based on the average path length and the normalization factor, through Calculate the second confidence level of the interface. .

[0043] In this application, the path length of the high-dimensional feature vector of the interface in each isolated tree is determined using an isolated forest model; the path length is the number of edges traversed from the root node to the leaf node. Based on the path length of the high-dimensional feature vector in each isolated tree, the path length is determined by... Calculate the average path length of high-dimensional feature vectors ,pass Calculate the normalization factor This allows us to base our calculations on the average path length and the normalization factor, through... The second confidence level of the computation interface .

[0044] In one embodiment, the method further includes:

[0045] For each of the high-dimensional feature vectors of the interfaces, the number of times each feature of the high-dimensional feature vector is selected as a segmentation feature in each isolated tree of the isolated forest model is counted.

[0046] The total number of times each feature is selected as a segmentation feature in each isolated tree is summed.

[0047] Based on the number of times each feature was selected as a segmentation feature and the total number of times, an importance value characterizing the importance of each feature is calculated, so as to determine the cause of abnormal fluctuations in the interface through the importance value;

[0048] or,

[0049] The values ​​of the target features in each of the high-dimensional feature vectors are randomly shuffled to obtain the perturbation feature vectors of each interface; the target feature is any one of the following: traffic density feature, response time distribution feature, error rate feature, client distribution feature, and year-on-year volatility feature;

[0050] The third confidence level of each of the perturbation feature vectors is output using the isolated forest model;

[0051] The difference between the second confidence level and the third confidence level of the same interface is calculated, and the ratio between the difference and the second confidence level of the interface is determined as an importance value characterizing the importance of the target feature, so as to determine the cause of abnormal fluctuations in the interface through the importance value.

[0052] In this application, by determining the importance value of each feature, the cause of abnormal fluctuations in the interface can be determined through the importance value.

[0053] An intelligent detection device for abnormal interface fluctuations, used to perform the above-described method, the device comprising:

[0054] The record acquisition module is used to acquire access records of each interface within the current time window;

[0055] The feature acquisition module is used to obtain a high-dimensional feature vector for each of the interfaces based on the access records of each interface; the high-dimensional feature vector includes at least traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features.

[0056] The confidence acquisition module is used to determine the first confidence of each interface based on the traffic density feature and the error rate feature in each of the high-dimensional feature vectors; and to output the second confidence of each interface through an isolated forest model based on each of the high-dimensional feature vectors.

[0057] The scoring module is used to obtain an abnormal fluctuation score for each interface based on the first confidence level and the second confidence level of each interface, so as to determine whether there is abnormal fluctuation for each interface based on each abnormal fluctuation score.

[0058] A computer device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0059] The aforementioned intelligent detection device and computer equipment for abnormal interface fluctuations acquire access records for each interface within the current time window. Based on these records, a high-dimensional feature vector is obtained for each interface. The first confidence level for each interface is determined based on the traffic density and error rate features within these high-dimensional feature vectors. A second confidence level for each interface is output using an isolated forest model based on these high-dimensional feature vectors. An abnormal fluctuation score is then obtained for each interface based on both the first and second confidence levels. This score is used to determine whether abnormal fluctuations exist for each interface. By introducing multi-dimensional high-dimensional feature vectors and combining them with the isolated forest algorithm and the traffic density and error rate features within these high-dimensional feature vectors to determine the abnormal fluctuation score, the detection dimension is expanded from quantitative to qualitative aspects. This enables accurate capture of various abnormal scenarios, significantly reducing false detections caused by normal business fluctuations and substantially improving the accuracy of anomaly detection. Attached Figure Description

[0060] Figure 1 This is an application environment diagram of the intelligent detection method for abnormal interface fluctuations in one embodiment;

[0061] Figure 2 This is a flowchart illustrating an intelligent detection method for abnormal interface fluctuations in one embodiment.

[0062] Figure 3 This is a structural block diagram of an intelligent detection device for abnormal interface fluctuations in one embodiment;

[0063] Figure 4 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0065] The intelligent detection method for abnormal interface fluctuations provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, terminal 102 interacts with server 104 via a wired / wireless channel. A data storage system stores the data that server 104 needs to process. The server obtains access records for each interface within the current time window; based on these access records, the server obtains a high-dimensional feature vector for each interface; the high-dimensional feature vector includes at least traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features; based on the traffic density and error rate features in each high-dimensional feature vector, the server determines the first confidence level for each interface; based on each high-dimensional feature vector, it outputs the second confidence level for each interface using an isolated forest model; based on the first and second confidence levels, the server obtains an abnormal fluctuation score for each interface, and uses this score to determine whether abnormal fluctuations exist for each interface. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, etc. Server 104 can be a single server, a server cluster consisting of multiple servers, or a cloud computing center consisting of multiple servers.

[0066] In one embodiment, such as Figure 2 As shown, an intelligent detection method for abnormal fluctuations in interfaces is provided, which is then applied to... Figure 1 Taking server 104 as an example, the following steps are included:

[0067] S1. Obtain the access records of each interface within the current time window;

[0068] Access records can be collected from the BWS (Backend Web Service) gateway. Access records include timestamps, interfaces, request methods, response status codes, response times, and client IPs. Based on the interfaces in each access record, multiple collected access records can be divided into access records for different interfaces. The format of the access records is shown in Table 1.

[0069] The current time window refers to a period of time at present. For example, the current minute.

[0070] Furthermore, the access records of each interface are formatted and filtered to eliminate invalid requests and non-business traffic, ensuring data quality, and steps S2, S3 and S4 are executed based on the formatted and filtered access records.

[0071] Table 1 Access Records

[0072]

[0073] S2. Based on the access records of each interface, obtain the high-dimensional feature vector of each interface; the high-dimensional feature vector shall include at least the traffic density feature, response time distribution feature, error rate feature, client distribution feature, and year-on-year volatility feature.

[0074] Among them, the high-dimensional feature vector of the interface is a multi-dimensional feature vector composed of traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features.

[0075] Traffic density characteristics are features that reflect the basic scale of interface traffic.

[0076] Response time distribution features capture changes in the pattern of interface response time distribution and identify long-tail latency characteristics.

[0077] Error rate is a feature that directly reflects the quality of interface services.

[0078] Client distribution characteristics are features used to identify concentrated attacks or crawler behaviors from a single client IP.

[0079] Year-over-year volatility is a feature used to capture relative changes compared to the same historical period.

[0080] The high-dimensional feature vector of an interface is obtained through the access records of that interface. For example, based on the access records of interface 1, the high-dimensional feature vector of interface 1 is obtained; based on the access records of interface 2, the high-dimensional feature vector of interface 2 is obtained.

[0081] S3. Based on the traffic density and error rate features in each high-dimensional feature vector, determine the first confidence level of each interface; based on each high-dimensional feature vector, output the second confidence level of each interface through the isolated forest model;

[0082] The first confidence level and the second confidence level can be calculated simultaneously through two different channels.

[0083] By inputting the high-dimensional feature vectors of each interface into a pre-trained isolated forest model, the second confidence level of each interface can be output.

[0084] S4. Based on the first and second confidence levels of each interface, obtain the abnormal fluctuation score for each interface, and determine whether there is abnormal fluctuation for each interface based on each abnormal fluctuation score.

[0085] Specifically, determining whether each interface has abnormal fluctuations based on each abnormal fluctuation score means determining whether the interface has abnormal fluctuations based on the abnormal fluctuation score.

[0086] Specifically, the first confidence level and the second confidence level of each interface are added together to obtain the abnormal fluctuation score of each interface.

[0087] Specifically, the first confidence level and the second confidence level of each interface are weighted and summed to obtain the abnormal fluctuation score of each interface.

[0088] Furthermore, when the abnormal fluctuation score of an interface determines that there is abnormal fluctuation, an alarm message is output. The alarm message includes the identifier of the interface with abnormal fluctuation, the time of the abnormal fluctuation, the abnormal fluctuation score, the main cause of the abnormality, and suggested investigation directions. The time of the abnormal fluctuation can be the time corresponding to the current time window.

[0089] Furthermore, determine the number of alarm prompts, the number of correct alarms, and the actual number of times anomalies are identified as abnormal fluctuations within the target time period; determine the alarm accuracy based on the ratio of correct alarms to alarm prompts; determine the alarm recall based on the ratio of correct alarms to actual alarms; calculate the F1 score using 2 × (alarm accuracy × alarm recall) / (alarm accuracy + alarm recall); calculate the delay time from the occurrence of abnormal fluctuations to the output of alarm prompts; and obtain the alarm performance evaluation results based on alarm accuracy, alarm recall, F1 score, and delay time.

[0090] In the above-mentioned intelligent detection method for abnormal fluctuations in interfaces, by introducing multi-dimensional high-dimensional feature vectors and combining the isolated forest algorithm with the traffic density feature and the error rate feature in the high-dimensional feature vectors to determine the abnormal fluctuation score, the detection dimension can be expanded from "quantity" to "quality", thereby achieving accurate capture of various abnormal scenarios, greatly reducing false detections caused by normal business fluctuations, and significantly improving the accuracy of abnormal detection.

[0091] In one embodiment, step S4 includes:

[0092] The weight corresponding to the target interval where the interface's traffic density feature is located is determined as the first weight for the first confidence level; based on the first weight, the second weight for the second confidence level is determined.

[0093] The first confidence level, second confidence level, first weight, and second weight of each interface are weighted and summed to obtain the abnormal fluctuation score of each interface. The abnormal fluctuation score is then used to determine whether there is abnormal fluctuation in each interface.

[0094] There are multiple target intervals, and each target interval corresponds to a preset weight.

[0095] The second weight is the difference between 1 and the first weight. The weighted summation formula for the abnormal fluctuation score of each interface is: Score = α × S A +(1-α)×S B Among them, S A The first confidence level of the interface, SB The second confidence level is represented by α, the first weight is represented by 1-α, and the score is the score for abnormal fluctuations.

[0096] Furthermore, the target interval includes a first interval, a second interval, and a third interval. The maximum value of the first interval is the minimum value of the second interval, and the maximum value of the second interval is the minimum value of the third interval. The minimum value of the third interval is determined based on the mean and standard deviation of the number of access records for each interface. The maximum and minimum values ​​of the first interval and the maximum value of the third interval can be preset. For example, the first interval is [X1, X2), the second interval is [X2, μ1+2σ1], and the third interval is (μ1+2σ1, X3], where μ1 is the mean of the number of access records for each interface, σ1 is the standard deviation of the number of access records for each interface, and X1, X2, and X3 are preset values. The weight corresponding to the first interval is 0.2, the weight corresponding to the second interval is 0.8, and the weight corresponding to the third interval is 0.5. Therefore, when the target interval for the traffic density feature is the first interval, the first weight is 0.2; when the target interval for the traffic density feature is the second interval, the first weight is 0.8; and when the target interval for the traffic density feature is the third interval, the first weight is 0.5.

[0097] In this embodiment, the weight corresponding to the target interval where the traffic density feature of the interface is located is determined as the first weight of the first confidence level. Based on the first weight, the second weight of the second confidence level is determined. The first confidence level, the second confidence level, the first weight, and the second weight of each interface are weighted and summed to obtain the abnormal fluctuation score of each interface. The abnormal fluctuation score is used to determine whether there is abnormal fluctuation of the interface. In this way, the first weight of the first confidence level and the second weight of the isolated forest model can be dynamically adjusted according to the real-time traffic density feature of each interface. This can achieve the purpose of rapid response during the business stability period and the purpose of accurate determination of whether there is abnormal fluctuation during the business mutation period.

[0098] In one embodiment, the interface includes a core interface, a general interface, and a non-core interface. The first anomaly detection threshold for the core interface is lower than the second anomaly detection threshold for the general interface, and the second anomaly detection threshold is lower than the third anomaly detection threshold for the non-core interface. The method further includes:

[0099] When the abnormal fluctuation score of the core interface is greater than the first abnormal judgment threshold, it is determined that there is abnormal fluctuation in the core interface;

[0100] When the abnormal fluctuation score of a general interface is greater than the second abnormal judgment threshold, it is determined that there is abnormal fluctuation in the general interface;

[0101] When the abnormal fluctuation score of a non-core interface exceeds the third abnormal judgment threshold, it is determined that there is abnormal fluctuation in the non-core interface.

[0102] Among them, core interfaces are relatively important interfaces, general interfaces are generally important interfaces, and non-core interfaces are unimportant interfaces.

[0103] The first, second, and third anomaly detection thresholds are all preset values. For example, the first anomaly detection threshold is 0.65, the second anomaly detection threshold is 0.7, and the third anomaly detection threshold is 0.75.

[0104] Furthermore, when the abnormal fluctuation score of the core interface is less than or equal to the first abnormal judgment threshold, it is determined that there is no abnormal fluctuation in the core interface; when the abnormal fluctuation score of the general interface is less than or equal to the second abnormal judgment threshold, it is determined that there is no abnormal fluctuation in the general interface; when the abnormal fluctuation score of the non-core interface is less than or equal to the third abnormal judgment threshold, it is determined that there is no abnormal fluctuation in the non-core interface.

[0105] Furthermore, when abnormal fluctuations are detected in core interfaces, general interfaces, or non-core interfaces, an alarm message is output.

[0106] In this embodiment, when the abnormal fluctuation score of the core interface is greater than the first abnormal judgment threshold, it is determined that the core interface has abnormal fluctuation; when the abnormal fluctuation score of the general interface is greater than the second abnormal judgment threshold, it is determined that the general interface has abnormal fluctuation; and when the abnormal fluctuation score of the non-core interface is greater than the third abnormal judgment threshold, it is determined that the non-core interface has abnormal fluctuation. This differentiated threshold setting can find an optimal balance between "missed detection" and "false detection", significantly reducing the "false detection rate".

[0107] In one embodiment, the method further includes:

[0108] Obtain the preset conflict correction coefficient;

[0109] Based on conflict correction coefficient ,pass The abnormal fluctuation scores of each interface are corrected to obtain the corrected score for each interface. final The correction score for each interface is used to determine whether there are abnormal fluctuations in each interface. As the first weight, S A As the first confidence level, As the second weight, S B This represents the second confidence level.

[0110] Furthermore, the interface includes a core interface, a general interface, and a non-core interface. The first anomaly detection threshold for the core interface is lower than the second anomaly detection threshold for the general interface, and the second anomaly detection threshold is lower than the third anomaly detection threshold for the non-core interface. The method also includes: determining that the core interface has abnormal fluctuations when the corrected score of the core interface is greater than the first anomaly detection threshold; determining that the general interface has abnormal fluctuations when the corrected score of the general interface is greater than the second anomaly detection threshold; and determining that the non-core interface has abnormal fluctuations when the corrected score of the non-core interface is greater than the third anomaly detection threshold.

[0111] In this embodiment, a preset conflict correction coefficient is obtained, and based on the conflict correction coefficient... ,pass The abnormal fluctuation scores of each interface are corrected to obtain the corrected score for each interface. final This improves the accuracy of judgment when determining whether there are abnormal fluctuations in the interface based on the correction score of each interface.

[0112] In one embodiment, step S2 includes:

[0113] Determine the number of access records for each interface, and obtain the traffic density characteristics of each interface by dividing the number of access records by the length of the current time window.

[0114] Determine the response time in each access record for each interface, and based on the response time of each interface, through... Calculate the skewness of the response time for each interface separately. ,pass Calculate the kurtosis of the response time for each interface separately. The skewness and kurtosis of the interface are used as the response time distribution characteristics of the interface; X represents the response time in the interface's access records. This is the average response time across all access records of the interface. The standard deviation of the response time in each access record of the interface, where E[] is the expected value;

[0115] Based on the response status codes in the access records of each interface, the number of access failure records corresponding to each interface is determined; based on the result of dividing the number of access failure records corresponding to each interface by the number of access records, the error rate characteristics of each interface are obtained.

[0116] Based on the client identifiers in the access records of each interface, the request percentage for each client corresponding to each interface is determined. Based on the request percentage of each client, the following steps are taken: Calculate the Shannon entropy H(X) for each interface, and use the Shannon entropy as the client distribution characteristic of the interface; M is the total number of clients requesting access to the interface, and P(xi) is the proportion of requests from the i-th client requesting access to the interface.

[0117] Based on the number of access records for each interface in the current time window and the number of first historical access records in the first historical time window, the year-on-year volatility characteristics of each interface are determined.

[0118] The number of access records refers to the number of access records for a specific interface. The number of first historical access records refers to the number of access records for a specific interface within the first historical time window.

[0119] The traffic density characteristics of each interface are determined separately. For example, the traffic density characteristics of interface 1 are determined by dividing the number of access records of interface 1 by the length of the current time window; the traffic density characteristics of interface 2 are determined by dividing the number of access records of interface 2 by the length of the current time window.

[0120] The response time distribution characteristics of each interface are determined separately. For example, the response time distribution characteristics of interface 1 are determined based on the response times of interface 1; the response time distribution characteristics of interface 2 are determined based on the response times of interface 2.

[0121] Response status codes reflect whether the access to a record was successful or failed. For example, a 4xx or 5xx status code indicates that the access to that record failed. The error rate characteristic is expressed as (number of failed access records) / number of access records.

[0122] The number of access failure records for each interface refers to the number of access records for that interface whose response status codes indicate access failure. The result of dividing the number of access failure records for each interface by the corresponding number of access records is the same as dividing the number of access failure records for that interface by the number of access records for that interface.

[0123] The error rate characteristics of each interface are determined separately. For example, the error rate characteristics of interface 1 are determined based on the number of failed access records for interface 1; and the error rate characteristics of interface 2 are determined based on the number of failed access records for interface 2.

[0124] The request percentage P(xi) of the i-th client requesting access to an interface refers to the percentage of the total number of access records requested by the i-th client to access a certain interface out of the total number of access records for that interface. For example, if the number of access records for accessing interface 1 is M1, and m of them are initiated by client n, then the request percentage of client n is m / M1.

[0125] The client identifier includes the client's IP address.

[0126] The year-on-year volatility characteristics of each interface are determined separately. For example, the year-on-year volatility characteristics of interface 1 are determined based on the number of access records of interface 1 in the current time window and the number of first historical access records in the first historical time window; the year-on-year volatility characteristics of interface 2 are determined based on the number of access records of interface 2 in the current time window and the number of first historical access records in the first historical time window.

[0127] The first historical time window can be a time window that falls within the same period as the current time window on the previous day, the previous week, or the previous month. For example, if the current time window is 10:15, then the first historical time window could be 10:15 on the previous day; if the current time window is 10:15 on Wednesday, then the first historical time window could be 10:15 on Wednesday of the previous week; if the current time window is 10:15 on day X of month Y, then the first historical time window could be 10:15 on day X of month Y-1.

[0128] Year-on-year volatility characteristic = (number of access records in the current time window - number of access records in the first historical time window) / number of access records in the first historical time window.

[0129] In this embodiment, by determining the number of access records for the interface, the result of dividing the number of access records by the length of the current time window can be used to determine the traffic density characteristic of the interface. Furthermore, by determining the response time in each access record of the interface, the interface's response time can be used to... skewness of the response time of the calculation interface ,pass kurtosis of the response time of the calculation interface The response time distribution characteristics of the interface are defined by its skewness and kurtosis. The number of failed access records is determined by analyzing the response status codes in the interface's access logs; this allows the error rate characteristic of the interface to be calculated by dividing the number of failed access records by the number of access records. The request percentage of each client requesting the interface is determined based on the client data in the interface's access logs; this allows for further analysis based on the request percentage of each client. Calculate the Shannon entropy H(X) of the interface, and use the Shannon entropy as the client distribution characteristic of the interface. By considering the number of access records of the interface in the current time window and the number of first historical access records in the first historical time window, the year-on-year volatility characteristic of the interface can be determined.

[0130] In one embodiment, the method further includes:

[0131] Based on the response time and response status code of the interface in the access records of the current time window, and the number of access records, determine the average response time, 95th percentile response time, error rate and traffic density characteristics of each interface, and obtain the historical average response time, historical 95th percentile response time, historical error rate and historical traffic density characteristics of the interface in multiple first historical time windows.

[0132] If the average response time of the interface is greater than the fourth preset value, or the error rate is greater than the fifth preset value, it is determined that the interface has abnormal fluctuations.

[0133] When the ratio of the interface's traffic density characteristics to the traffic density characteristics of the previous first historical time window is greater than the fifth preset value, or when the ratio of the interface's average response time to the average response time of the previous first historical time window is greater than the sixth preset value, it is determined that the interface has abnormal fluctuations.

[0134] Based on the average response time and historical average response time of the interface, a third score is determined by Z-Score, and when the third score is greater than the seventh preset value, it is determined that the interface has a response anomaly.

[0135] Based on the 95th percentile response time of the interface and each historical 95th percentile response time, the fourth score is determined by Z-Score, and when the fourth score is greater than the eighth preset value, it is determined that there is abnormal fluctuation in the interface.

[0136] Based on the error rate of the interface and the error rate of each history, the fifth score is determined by Z-Score, and when the fifth score is greater than the ninth preset value, it is determined that there is an abnormal fluctuation in the error rate of the interface.

[0137] Based on the interface's traffic density characteristics and historical traffic density characteristics, a sixth score is determined using Z-Score. When the sixth score is greater than the tenth preset value, it is determined that the interface has an abnormal traffic density.

[0138] Multiple first historical time windows can be time windows that coincide with the current time window within the previous n days, or within the previous n weeks, or within the previous n months. For example, if the current time window is 10:15, then the first historical time window can be every 10:15 of the previous n days; if the current time window is 10:15 on Wednesday, then the first historical time window can be every Wednesday at 10:15 of the previous n weeks; if the current time window is 10:15 on day X of month Y, then the first historical time window can be every day at 10:15 of month X of month Yn.

[0139] The average response time, 95th percentile response time, error rate, and traffic density characteristics of the interface are shown in Table 2.

[0140] Table 2. Average response time, 95th percentile response time, error rate, and traffic density characteristics of the interface.

[0141]

[0142] Furthermore, when abnormal fluctuations are detected in the interface, an alarm is triggered.

[0143] In one embodiment, the process of determining the first confidence level includes:

[0144] Get the number of second historical access records for each interface in multiple second historical time windows and the historical error rate of the interface in each second historical time window;

[0145] Based on the number of second historical access records in each second historical time window for each interface, calculate the historical access mean and historical access standard deviation for each interface; based on the historical error rate in each second historical time window for each interface, calculate the historical error rate mean and historical error rate standard deviation.

[0146] Based on the number of access records, historical average access rate, and historical standard deviation of each interface in the current time window, the first score of each interface is calculated; based on the error rate characteristics, historical average error rate, and historical standard deviation of each interface in the current time window, the second score of each interface is calculated.

[0147] When the first score and / or the second score are greater than the score threshold, the first confidence level is determined to be the first preset value;

[0148] When both the first score and the second score are less than or equal to the score threshold, the first confidence level is determined to be the second preset value.

[0149] The second historical time window is the time window preceding the current time window. For example, if the current time window is 10:15 (1 minute long), the second historical time window could be the time window corresponding to each minute in the two hours preceding 10:15, in which case the number of first historical windows would be 120.

[0150] Historical average visits The calculation formula is: Historical visit standard deviation The calculation formula is: The formula for calculating the first score Z1 is Z1=|x t1 -μ2| / σ2, where N is the number of the second historical time windows, x iLet x be the number of historical access records for the i-th interface in the second historical time window. t1 This represents the number of access records for the interface within the current time window.

[0151] Historical error rate average The calculation formula is: Historical error rate standard deviation The calculation formula is: The formula for calculating the second score Z2 is Z2=|x t2 -μ3| / σ3, y j Let x be the historical error rate for the i-th second historical time window. t2 This represents the error rate characteristic of the interface within the current time window.

[0152] In a specific application, when the first score and / or the second score are greater than the scoring threshold 3, the first confidence level is determined to be the first preset value 1; when both the first score and the second score are less than or equal to the scoring threshold 3, the first confidence level is determined to be the second preset value 0; when the first score and the second score are within a preset range, the observation state is entered, and the preset range is (the third preset value, the scoring threshold).

[0153] In this embodiment, by obtaining the number of second historical access records of the interface in multiple second historical time windows and the historical error rate of the interface in each second historical time window, the historical access mean and historical access standard deviation are calculated based on the number of second historical access records in each second historical time window; and the historical error rate mean and historical error rate standard deviation are calculated based on the historical error rate in each second historical time window. In this way, a first score of the interface can be calculated based on the number of access records of the interface in the current time window, the historical access mean, and the historical access standard deviation. A second score of the interface can be calculated based on the error rate characteristics of the interface in the current time window, the historical error rate mean, and the historical error rate standard deviation. Thus, when the first score and / or the second score is greater than the score threshold, the first confidence level is determined to be a first preset value; when both the first score and the second score are less than or equal to the score threshold, the first confidence level is determined to be a second preset value.

[0154] In one embodiment, the process of determining the second confidence level includes:

[0155] The path length of the high-dimensional feature vector of the interface in each isolated tree is determined by the isolated forest model; the path length is the number of edges traversed from the root node to the leaf node.

[0156] Based on the path length of the high-dimensional feature vector in each isolated tree, through Calculate the average path length of high-dimensional feature vectors ; k represents the total number of isolated trees in the isolated forest model. is the path length of the high-dimensional feature vector in the isolated tree j;

[0157] pass Calculate the normalization factor ; The training set size for each isolated tree, Represents the harmonic number;

[0158] Based on average path length and normalization factor, through The second confidence level of the computation interface .

[0159] In determining the path length, starting from the root node, each eigenvalue in the high-dimensional eigenvector is compared with the size of the split point. If the eigenvalue is less than the split point, the left subtree is entered; if the eigenvalue is greater than the split point, the right subtree is entered. The number of edges reaching the leaf node is recorded, thus obtaining the path length of the high-dimensional eigenvector in each isolated tree.

[0160] Furthermore, harmonic numbers .

[0161] In this embodiment, the path length of the high-dimensional feature vector of the interface in each isolated tree is determined using an isolated forest model; the path length is the number of edges traversed from the root node to the leaf node. Based on the path length of the high-dimensional feature vector in each isolated tree, the path length is determined by... Calculate the average path length of high-dimensional feature vectors ,pass Calculate the normalization factor This allows us to base our calculations on the average path length and the normalization factor, through... The second confidence level of the computation interface .

[0162] In one embodiment, the method further includes:

[0163] For each interface's high-dimensional feature vector, count the number of times each feature of the high-dimensional feature vector is selected as a segmentation feature in each isolated tree of the isolated forest model;

[0164] The total number of times each feature is selected as a segmentation feature in each isolated tree is summed.

[0165] Based on the number of times each feature was selected as a segmentation feature and the total number of times, the importance value representing the importance of each feature is calculated, so as to determine the cause of abnormal fluctuations in the interface through the importance value;

[0166] or,

[0167] Randomly shuffle the values ​​of the target features in each high-dimensional feature vector to obtain the perturbation feature vector of each interface; the target feature is any one of the following: traffic density feature, response time distribution feature, error rate feature, client distribution feature, and year-on-year volatility feature;

[0168] The third confidence level of each perturbation feature vector is output using the isolated forest model;

[0169] Calculate the difference between the second and third confidence levels of the same interface, and determine the ratio between the difference and the second confidence level of the interface as the importance value characterizing the importance of the target feature, so as to determine the cause of abnormal fluctuations in the interface through the importance value.

[0170] The formula for calculating the importance value of a feature is as follows: I q C represents the numerical value of the importance of feature q. q Let q be the number of times feature q is selected as a splitting feature in each isolated tree of the isolated forest model, and Q be the total number of features.

[0171] Furthermore, based on the characteristics corresponding to the highest importance value, the cause of abnormal fluctuations in the interface is determined.

[0172] In this embodiment, by determining the importance value of each feature, the cause of abnormal fluctuations in the interface can be determined through the importance value.

[0173] In one embodiment, the method further includes:

[0174] Taking any interface as the current interface, obtain the historical high-dimensional feature vectors of the current interface in multiple historical time windows, and determine the importance value of each historical feature in each historical high-dimensional feature vector; based on the time corresponding to each historical time window, construct the importance curves of various features through the importance values ​​of each feature of the current interface and the importance values ​​of each historical feature.

[0175] In the importance curves of various features, if the importance values ​​of both the traffic density feature and the error rate feature exceed the first threshold, and the current interface experiences abnormal fluctuations, the cause of these fluctuations is determined to be traffic density and error rate. If the peak time of the traffic density feature's importance value occurs earlier than the peak time of the error rate feature's importance value, and the cause of these fluctuations is determined to be a traffic surge. If the peak time of the traffic density feature's importance value occurs later than the peak time of the error rate feature's importance value, and the cause of these fluctuations is determined to be an internal system fault causing abnormal traffic. If the importance values ​​of the response time distribution feature are all greater than the second threshold, and the cause of these fluctuations is determined to be a response failure. If the duration for which the importance value of the frequency distribution feature is greater than the second threshold is less than the preset duration, and the current interface experiences abnormal fluctuations, the cause of the abnormal fluctuations is determined to be instantaneous network jitter. If the duration for which the importance value of the response time distribution feature is greater than the second threshold is greater than the preset duration, and the current interface experiences abnormal fluctuations, the cause of the abnormal fluctuations is determined to be service performance bottlenecks or resource exhaustion. If the importance values ​​of the error rate feature are all greater than the third threshold, and the importance curve corresponding to the traffic density feature shows an upward trend, and the current interface experiences abnormal fluctuations, the cause of the abnormal fluctuations is determined to be malicious traffic attacks. If the importance values ​​of the error rate feature are all greater than the third threshold, and the importance curve corresponding to the traffic density feature shows a stable trend, and the current interface experiences abnormal fluctuations, the cause of the abnormal fluctuations is determined to be a migration of the user group structure.

[0176] Among them, the historical high-dimensional feature vector includes traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features.

[0177] In one embodiment, the method further includes setting different alarm priorities for different interfaces based on their importance, business impact, and historical anomalies. For example, for core payment interfaces, a lower response time threshold and stricter error rate alarm standards can be set, while alarm conditions can be relaxed for non-critical interfaces.

[0178] In one embodiment, the method further includes: automatically merging the same anomaly that occurs repeatedly within a short period into a single anomaly fluctuation and outputting a single alarm notification. This avoids alarm storms causing fatigue and neglect among operations and maintenance personnel. Additionally, this embodiment can set an alarm suppression time window, within which the same anomaly will not be repeatedly pushed, improving the effectiveness and controllability of alarms.

[0179] In one embodiment, the method further includes: outputting alarm notifications through channels including but not limited to email, SMS, WeChat Work, DingTalk, and Lark, to ensure that alarm notifications are delivered to maintenance personnel at different levels and roles in a timely manner. Users can configure different alarm channels and recipients as needed to achieve flexible alarm distribution strategies.

[0180] In one embodiment, the method further includes automatically associating the device that outputs the alarm notification with the application system to which the interface belongs, the responsible team, and the person in charge. This allows alarm notifications to be directly delivered to the corresponding responsible person or team, improving the efficiency and accuracy of problem handling.

[0181] In one embodiment, the method further includes: managing and querying alarm history records to facilitate the operation and maintenance team in reviewing and analyzing abnormal events and continuously optimizing alarm strategies.

[0182] In one embodiment, if the target interface in each interface exhibits abnormal fluctuations within the current time window, the cause of the abnormal fluctuations is determined based on the high-dimensional feature vector of the target interface within the current time window. For example, taking the interface " / api / user / login" experiencing an anomaly at 10:15 on XX year YY month ZZ day, the average response time within this time window increases sharply from the historical average of 120ms to 280ms. The client IP distribution results for accessing the interface " / api / user / login" within this time window are shown in Table 3.

[0183] Table 3 Client IP Distribution Results

[0184]

[0185] Analysis revealed that two client IPs initiated an unusually large number of requests during the anomaly period, potentially indicating web scraping or malicious attacks. Secondly, during the anomaly period, POST requests accounted for 90% and GET requests for the " / api / user / login" interface accounted for 10%, while historically, the ratios are 70% and 30% respectively. This information suggests that the anomaly was primarily concentrated in login operations. Furthermore, the distribution of the interface's response status codes is shown in Table 4.

[0186] Table 4 Distribution of Interface Response Status Codes

[0187]

[0188] Among them, a large number of 500 and 429 errors indicate that the backend service may have performance bottlenecks or flow control restrictions.

[0189] This application also compares the anomaly time series with system change logs to determine if configuration adjustments or version releases caused the anomalies. For example, it was found that after a version release at 10:10, the interface response time began to increase. Combined with the release records, this indicated that the release may have introduced performance issues. Based on the above analysis, this application provides operations and maintenance personnel with accurate root cause information for anomalies, including the abnormal IP, abnormal request type, error type, and potential system change associations, helping to quickly locate and resolve faults.

[0190] This application supports multi-level alarm rule configuration. Users can set different alarm priorities and thresholds for different interfaces based on their importance, business impact, and historical anomalies. For example, for core payment interfaces, lower response time thresholds and stricter error rate alarm standards can be set, while alarm conditions can be relaxed for non-critical interfaces.

[0191] The intelligent detection method for abnormal interface fluctuations in this application is applicable to various business scenarios, including but not limited to: internet e-commerce platforms, resource payment systems, SaaS cloud service platforms, enterprise internal business middleware, and internet content delivery networks. Details are as follows:

[0192] During peak e-commerce promotional periods, API traffic surges, leading to significant fluctuations in response time and error rates. This application enables real-time monitoring of abnormal fluctuations in core transaction APIs, promptly identifying performance degradation caused by traffic spikes or backend failures, ensuring smooth transaction processes and a positive user experience.

[0193] Resource payment interfaces have extremely high requirements for response timeliness and stability. This application utilizes precise anomaly detection and alerting mechanisms to quickly identify abnormal transaction requests, interface timeouts, or service errors, preventing potential risks and ensuring fund security and business continuity.

[0194] In a multi-tenant environment, the API calls made by different customers vary significantly. This application uses an adaptive model and personalized thresholds to accurately capture API anomalies for each tenant, helping service providers to promptly identify and resolve performance bottlenecks and security vulnerabilities.

[0195] Internet content delivery network interfaces have high requirements for request volume and response speed. This application helps to detect cache failure, node abnormalities or traffic attacks in a timely manner through abnormal fluctuation monitoring, so as to ensure that content is distributed to users quickly and stably.

[0196] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0197] Based on the same inventive concept, this application also provides an intelligent interface anomaly fluctuation detection device for implementing the above-mentioned intelligent interface anomaly fluctuation detection method. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the intelligent interface anomaly fluctuation detection device provided below can be found in the limitations of the intelligent interface anomaly fluctuation detection method described above, and will not be repeated here.

[0198] In one embodiment, such as Figure 3 As shown, an intelligent detection device for abnormal interface fluctuations is provided, comprising:

[0199] The record acquisition module is used to acquire access records of each interface within the current time window;

[0200] The feature acquisition module is used to obtain a high-dimensional feature vector for each of the interfaces based on the access records of each interface; the high-dimensional feature vector includes at least traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features.

[0201] The confidence acquisition module is used to determine the first confidence of each interface based on the traffic density feature and the error rate feature in each of the high-dimensional feature vectors; and to output the second confidence of each interface through an isolated forest model based on each of the high-dimensional feature vectors.

[0202] The scoring module is used to obtain an abnormal fluctuation score for each interface based on the first confidence level and the second confidence level of each interface, so as to determine whether there is abnormal fluctuation for each interface based on each abnormal fluctuation score.

[0203] The modules in the aforementioned intelligent detection device for abnormal interface fluctuations can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0204] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores various types of data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements an intelligent detection method for abnormal interface fluctuations.

[0205] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0206] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0207] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0208] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0209] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0210] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0211] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0212] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for intelligent detection of abnormal fluctuations in an interface, characterized in that, The method includes: S1. Obtain the access records of each interface within the current time window; S2. Based on the access records of each interface, obtain a high-dimensional feature vector for each interface; the high-dimensional feature vector includes at least traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features. S3. Based on the traffic density feature and the error rate feature in each of the high-dimensional feature vectors, determine the first confidence level of each of the interfaces respectively; based on each of the high-dimensional feature vectors, output the second confidence level of each of the interfaces through the isolated forest model; S4. Based on the first confidence level and the second confidence level of each interface, obtain the abnormal fluctuation score of each interface, and determine whether there is abnormal fluctuation in each interface based on each abnormal fluctuation score.

2. The method according to claim 1, characterized in that, Step S4 includes: The weight corresponding to the target interval where the traffic density feature of the interface is located is determined as the first weight of the first confidence level; based on the first weight, the second weight of the second confidence level is determined. The first confidence level, the second confidence level, the first weight, and the second weight of each interface are weighted and summed to obtain the abnormal fluctuation score of each interface, so as to determine whether there is abnormal fluctuation in each interface based on the abnormal fluctuation score.

3. The method according to claim 1 or 2, characterized in that, The interface includes a core interface, a general interface, and a non-core interface. The first anomaly detection threshold of the core interface is less than the second anomaly detection threshold of the general interface, and the second anomaly detection threshold is less than the third anomaly detection threshold of the non-core interface. The method further includes: When the abnormal fluctuation score of the core interface is greater than the first abnormal judgment threshold, it is determined that the core interface has abnormal fluctuations. When the abnormal fluctuation score of the general interface is greater than the second abnormal judgment threshold, it is determined that the general interface has abnormal fluctuations. When the abnormal fluctuation score of the non-core interface is greater than the third abnormal judgment threshold, it is determined that there is abnormal fluctuation in the non-core interface.

4. The method according to claim 2, characterized in that, The method further includes: Obtain the preset conflict correction coefficient; Based on the conflict correction coefficient ,pass The abnormal fluctuation scores of each interface are corrected to obtain a corrected score for each interface. final Based on each of the correction scores, it is determined whether there are abnormal fluctuations in each of the interfaces; As the first weight, S A As the first confidence level, As the second weight, S B This represents the second confidence level.

5. The method according to claim 1, characterized in that, Step S2 includes: The number of access records for each interface is determined, and the traffic density characteristics of each interface are obtained by dividing the number of access records by the length of the current time window. Determine the response time in each access record of each of the aforementioned interfaces, and based on the response time of each of the aforementioned interfaces, through... Calculate the skewness of the response time for each of the aforementioned interfaces. ,pass Calculate the kurtosis of the response time for each of the aforementioned interfaces. The skewness and kurtosis corresponding to the interface are used as the response time distribution characteristics of the interface; X represents the response time in the access record of the interface. This is the average response time across all access records of the interface. The standard deviation of the response time in each access record of the interface, E[] is the expected value; Based on the response status codes in the access records of each interface, the number of access failure records corresponding to each interface is determined; based on the result of dividing the number of access failure records corresponding to each interface by the number of access records, the error rate characteristics of each interface are obtained. Based on the client identifier in the access record of each interface, the request percentage of each client corresponding to each interface is determined. Based on the request percentage of each client, the following steps are taken: Calculate the Shannon entropy H(X) for each of the interfaces, and use the Shannon entropy as the client distribution characteristic of the interface; M is the total number of clients requesting access to the interface, and P(xi) is the proportion of requests from the i-th client requesting access to the interface. Based on the number of access records for each interface in the current time window and the number of first historical access records in the first historical time window, the year-on-year volatility characteristics of each interface are determined.

6. The method according to claim 1, characterized in that, The process of determining the first confidence level includes: Obtain the number of second historical access records for each interface in multiple second historical time windows and the historical error rate of each interface in each second historical time window; Based on the number of second historical access records in each second historical time window of each interface, calculate the historical access mean and historical access standard deviation for each interface; based on the historical error rate in each second historical time window of each interface, calculate the historical error rate mean and historical error rate standard deviation for each interface. Based on the number of access records for each interface in the current time window, the historical access mean, and the historical access standard deviation, a first score is calculated for each interface; based on the error rate characteristics of each interface in the current time window, the historical error rate mean, and the historical error rate standard deviation, a second score is calculated for each interface. When the first score and / or the second score are greater than the score threshold, the first confidence level is determined to be the first preset value; When both the first score and the second score are less than or equal to the score threshold, the first confidence level is determined to be the second preset value.

7. The method according to claim 1, characterized in that, The process of determining the second confidence level includes: The path length of the high-dimensional feature vector of the interface in each isolated tree is determined by the isolated forest model; the path length is the number of edges traversed from the root node to the leaf node. Based on the path length of the high-dimensional feature vector in each isolated tree, through Calculate the average path length of the high-dimensional feature vector. ; k represents the total number of isolated trees in the isolated forest model. Let be the path length of the high-dimensional feature vector in isolated tree j; pass Calculate the normalization factor ; The training set size for each isolated tree, Represents the harmonic number; Based on the average path length and the normalization factor, through Calculate the second confidence level of the interface. .

8. The method according to claim 1, characterized in that, The method further includes: For each of the high-dimensional feature vectors of the interfaces, the number of times each feature of the high-dimensional feature vector is selected as a segmentation feature in each isolated tree of the isolated forest model is counted. The total number of times each feature is selected as a segmentation feature in each isolated tree is summed. Based on the number of times each feature was selected as a segmentation feature and the total number of times, an importance value characterizing the importance of each feature is calculated, so as to determine the cause of abnormal fluctuations in the interface through the importance value; or, The values ​​of the target features in each of the high-dimensional feature vectors are randomly shuffled to obtain the perturbation feature vectors of each interface; the target feature is any one of the following: traffic density feature, response time distribution feature, error rate feature, client distribution feature, and year-on-year volatility feature; The third confidence level of each of the perturbation feature vectors is output using the isolated forest model; The difference between the second confidence level and the third confidence level of the same interface is calculated, and the ratio between the difference and the second confidence level of the interface is determined as an importance value characterizing the importance of the target feature, so as to determine the cause of abnormal fluctuations in the interface through the importance value.

9. An intelligent detection device for interface abnormal fluctuations, used to execute the method according to any one of claims 1-8, characterized in that, The device includes: The record acquisition module is used to acquire access records of each interface within the current time window; The feature acquisition module is used to obtain a high-dimensional feature vector for each of the interfaces based on the access records of each interface; the high-dimensional feature vector includes at least traffic density features, response time distribution features, error rate features, client distribution features, and year-on-year volatility features. The confidence acquisition module is used to determine the first confidence of each interface based on the traffic density feature and the error rate feature in each of the high-dimensional feature vectors; and to output the second confidence of each interface through an isolated forest model based on each of the high-dimensional feature vectors. The scoring module is used to obtain an abnormal fluctuation score for each interface based on the first confidence level and the second confidence level of each interface, so as to determine whether there is abnormal fluctuation for each interface based on each abnormal fluctuation score.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images