Memory leakage early warning method and device, electronic equipment and computer readable storage medium

Abstract

The embodiment of the application discloses a memory leakage early warning method and device, electronic equipment and computer readable storage medium, relates to the technical field of memory leakage; the method comprises the following steps: collecting multi-source memory data of a target device, and collecting scene interaction data and running logs of the target device; analyzing and predicting the multi-source memory data based on a rule model to obtain a rule judgment result; performing semantic analysis on the multi-source memory data, the scene interaction data and the running logs based on a large language model to obtain a semantic analysis result; fusing the rule judgment result and the semantic analysis result to obtain a risk score; when the risk score is greater than a risk threshold, predicting a time window and an influence range of memory leakage, and generating early warning information according to the time window and the influence range. In this way, the present scheme can perform memory leakage early warning in advance.

Description

Technical Field

[0001] This application relates to the field of memory leak technology, specifically to a memory leak early warning method, device, electronic device, and computer-readable storage medium. Background Technology

[0002] Memory leaks frequently cause application performance degradation, stuttering, and even crashes. Related technologies obtain process memory usage metrics through built-in system command-line tools and use these metrics to determine if memory usage is abnormal. Users can use Android Profiler or MemoryProfiler to monitor and analyze memory usage in real time, but these methods rely on manual operation and cannot be automated. Furthermore, some open-source libraries can automate the detection of certain types of memory leaks, but their detection coverage is limited and their accuracy is low in complex scenarios. These related technical solutions generally suffer from problems such as delayed detection timing, missing contextual information, and lack of automatic reporting and early warning capabilities. Summary of the Invention

[0003] This application provides a memory leak early warning method, device, electronic device, and computer-readable storage medium, which can provide early warning of memory leaks.

[0004] In a first aspect, embodiments of this application provide a memory leak early warning method, including: Collect multi-source memory data from the target device, as well as scene interaction data and operation logs from the target device; The multi-source memory data is analyzed and predicted based on a rule model to obtain rule judgment results; Based on a large language model, semantic parsing is performed on the multi-source memory data, the scene interaction data, and the runtime log to obtain semantic parsing results; By combining the rule-based judgment results and the semantic parsing results, a risk score is obtained; When the risk score is greater than the risk threshold, the time window and scope of impact of memory leaks are predicted, and early warning information is generated based on the time window and scope of impact.

[0005] Secondly, embodiments of this application provide a memory leak early warning device, comprising: The acquisition module is used to acquire multi-source memory data of the target device, as well as scene interaction data and operation logs of the target device; The judgment module is used to analyze and predict the multi-source memory data based on the rule model to obtain the rule judgment result; The parsing module is used to perform semantic parsing on the multi-source memory data, the scene interaction data, and the running log based on a large language model to obtain semantic parsing results; The fusion module is used to fuse the rule judgment results and the semantic parsing results to obtain a risk score; The early warning module is used to predict the time window and scope of impact of memory leaks when the risk score is greater than the risk threshold, and generate early warning information based on the time window and scope of impact.

[0006] Thirdly, embodiments of this application also provide an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps in the memory leak warning method described above.

[0007] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the memory leak warning method described above.

[0008] Fifthly, embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described in embodiments of this application.

[0009] The embodiments of this application have the following beneficial effects: Multi-source memory data can provide comprehensive data support for subsequent analysis, avoiding misjudgments and missed detections caused by single memory data. Rule-based analysis and prediction of multi-source memory data allows for rapid determination of abnormal memory states through structured and quantifiable rules, yielding stable and reliable rule judgment results and ensuring detection efficiency and accuracy. Semantic parsing of multi-source memory data, scene interaction data, and runtime logs using a large language model leverages the semantic understanding capabilities of the large language model to mine log and scene information, thereby fully acquiring contextual information and identifying complex anomalies and hidden problems, improving the ability to identify complex memory leak scenarios. Integrating rule judgment results with semantic parsing results to obtain a risk score combines the stability of rules with the understanding capabilities of the large language model, achieving complementary advantages and improving the comprehensiveness and accuracy of anomaly assessment. Predicting the leakage time window and impact range and generating early warnings when the risk score exceeds the risk threshold allows for early prediction before memory problems worsen, supporting proactive warnings and rapid handling, reducing the risk of application lag and crashes. Thus, automated, multi-dimensional, and high-precision memory leak detection and early warning can be achieved, effectively improving application stability. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of the steps of a memory leak early warning method provided in an embodiment of this application; Figure 2 This is a schematic diagram of a memory leak early warning system provided in an embodiment of this application; Figure 3 This is a flowchart illustrating a memory leak early warning method provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a memory leak early warning device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] First, let's explain some of the terms: Memory leak: During program execution, due to logical errors or unreleased references, some objects cannot be garbage collected after their lifecycle expires, thus continuously occupying memory resources. Memory leaks will cause the available memory to decrease continuously, eventually leading to application performance degradation, lag, slow response, or even program crashes.

[0014] Garbage collection (GC) is a mechanism that automatically cleans up objects that are no longer in use to free up memory, but it cannot reclaim useless objects that are still referenced, which may lead to memory leaks.

[0015] Proportional Set Size (PSS): The memory usage of a process. The shared page space occupied by each process is allocated proportionally, which can more accurately reflect the true memory usage of a process.

[0016] Resident Set Size (RSS): The amount of resources that a process actually resides in in physical memory, including shared memory.

[0017] Unique Set Size (USS): The amount of memory exclusively used by a process, excluding the portion shared with other processes, truly reflecting dedicated memory usage.

[0018] Virtual Set Size (VSS): The total virtual memory space accessible to a process, including unused memory space.

[0019] Shared memory size (Ion Memory Manager, ION): refers to the size of shared physical memory used by the system for multimedia, hardware acceleration, and other scenarios.

[0020] Large Language Model (LLM): A natural language processing model with extremely large parameters based on the Transformer architecture. It has powerful natural language understanding and generation capabilities and can be used for data analysis, pattern recognition, prediction and reasoning.

[0021] Out of Memory (OOM): An exception caused by insufficient memory to meet allocation requests, often accompanied by application crashes.

[0022] Objects: Instances created in memory during application runtime, including entities such as pages, controls, and data structures. They should be reclaimed and released by the system after normal use.

[0023] Common memory leak detection and analysis tools include: Built-in system command tools, such as dumpsys meminfo, cat / proc / meminfo, slabinfo, and procrank, can output memory usage metrics for processes and determine whether memory usage is abnormal based on these metrics, thereby identifying whether there is a memory leak.

[0024] Android Profiler and Memory Profiler (built into Android Studio) can monitor and analyze memory usage in real time, but mainly rely on developers to manually trigger the analysis.

[0025] LeakCanary is an open-source library that can automatically detect some types of memory leaks, but its coverage is limited and its accuracy is insufficient in some complex scenarios (multi-threading, Binder calls, large caches).

[0026] These memory leak detection and analysis tools have significant shortcomings: Delayed detection timing: These tools mostly reproduce problems through manual analysis after they occur or are reported by users, and cannot provide early warnings in the production environment.

[0027] Limited data processing capabilities: The raw data output by the command-line tools is inconsistent in format, requiring manual parsing and comparison, and a lot of time is spent on data cleaning and formatting.

[0028] Missing contextual information: Tools typically only provide the leaked object and reference chain, lacking multi-dimensional analysis results that combine the running scenario and user usage path.

[0029] Insufficient prediction and proactive repair: Most tools focus on post-analysis and lack the ability to make predictions or automatically report based on historical data trends.

[0030] To solve or partially solve the above-mentioned technical problems, in one embodiment of this application, such as Figure 1As shown, a memory leak early warning method is provided. Although the logical order is illustrated in the step diagram, in some cases, the steps shown or described can be performed in a different order than that shown in the diagram. This memory leak early warning method can be applied to a target device, which may include a terminal or a server. The terminal may include, but is not limited to, one or more of smartphones, tablets, laptops, desktop computers, and in-vehicle computers. The server may be a physical server or a cloud server providing various cloud services. It is worth noting that this application does not limit the number of terminals or servers. Depending on the implementation needs, there can be any number of terminals or servers. For example, the server may be a single server or a server cluster composed of multiple servers, etc.

[0031] The following sections provide detailed descriptions of each example. It should be noted that the order in which the embodiments are described is not intended to limit the priority of the embodiments.

[0032] according to Figure 1 The memory leak early warning method shown includes at least steps S110 to S150, which are described in detail below: In step S110, multi-source memory data of the target device is collected, as well as scene interaction data and operation logs of the target device are collected.

[0033] Multi-source memory data refers to various metrics acquired from different collection channels and analysis dimensions, comprehensively reflecting the memory usage status of the Android system and application processes. Multi-source memory data may include, but is not limited to: object count, available memory, and memory usage values ​​of multiple modules. Calculating the memory usage values ​​of each module yields process-level overall memory statistics such as RSS, PSS, VSS, and ION.

[0034] Scene interaction data refers to the interactive operations and interface state data generated during application operation, which can be used to reconstruct the operational context when a memory exception occurs. Scene interaction data may include, but is not limited to: test scene name, interaction sequence, interface labels and / or summary description.

[0035] Runtime logs refer to the event records, exception information, and status messages output by a system or application during runtime. They can be used to reflect the program execution flow and runtime exceptions. Runtime logs may include, but are not limited to: critical lines, memory allocation and deallocation segments, and the first N levels of the call stack, where N is a positive integer.

[0036] The online status of the target device can be detected through the Android Debug Bridge (ADB) or other platform debugging interfaces, and device information can be read when the device is online. Device information may include, but is not limited to, model, system version, and total memory. The device status can be polled at fixed intervals (e.g., 500ms) using a preset detection script, and the device will automatically enter pause mode when it disconnects, ensuring the stability and continuity of the data collection process.

[0037] Collection parameters can be loaded from a JSON-formatted configuration file. These parameters are a collection of configuration items used to control memory data collection behavior, execution logic, and judgment conditions. They can be used to standardize collection commands, execution cycles, trigger thresholds, and script paths, ensuring a stable, accurate, and dynamically adjustable collection process. Collection parameters may include, but are not limited to: system command lists, execution cycles, event thresholds, and scenario script paths. These parameters can be dynamically modified via the operations and maintenance platform API, and updates can be automatically hot-loaded without requiring a restart of the collection process.

[0038] Collection tasks can be executed based on collection parameters. Collection tasks support two mechanisms: timed triggering and event triggering. Timed triggering executes collection according to a set period. Event triggering can start collection in advance when indicators such as memory usage rate exceed the collection threshold, so as to improve the timeliness of anomaly capture.

[0039] Executing data collection tasks can gather multi-source memory data, scene interaction data, and runtime logs from the target device. During collection, multi-source memory data can be obtained by calling system memory analysis commands, and the output multi-source memory data can be saved in text format with a timestamp. Automated testing frameworks (such as UIAutomator and Appium) can be used to execute interactive actions such as clicking, swiping, and background switching to reproduce various interaction scenarios, recording the test scenario name and interaction sequence. During interactive operations, UI interface images can be captured using the screenshot API, and runtime logs can be saved. The saved UI interface images can be parsed and categorized to determine interface tags. Automated testing frameworks can be used to parse the control attributes, page title, and / or layout structure of the current interface, and generate a summary description based on the interaction sequence. High-precision UTC timestamps can be uniformly added to the collected multi-source memory data, scene interaction data, and runtime logs and written to a local buffer to ensure that data from different sources are accurately aligned along the timeline.

[0040] To address the technical challenge of inconsistent raw data formats output by command-line tools, requiring manual parsing and comparison, and consuming significant time in data cleaning and formatting, one embodiment can automatically clean and standardize the collected data. Based on a pre-written data format parser, it can automatically convert multi-source memory data, scene interaction data, and runtime logs from the original command output into JSON or CSV structured data. Each standardized record contains at least core metadata such as data type, data source, timestamp, and numerical fields to achieve unified and standardized processing of multi-source heterogeneous data. Noise filtering and field cleaning can be performed on the structured data. Specifically, process information irrelevant to the target application can be removed using process identifier (PID) or application package name matching mechanisms; duplicate collection records and empty data blocks generated due to abnormal device status are automatically deleted to ensure data quality and validity. The units of multi-source memory data can be uniformly converted to MB or KB to avoid calculation errors caused by unit differences. Percentage data (such as memory usage) can be uniformly preserved with decimal precision (e.g., two decimal places) to achieve data standardization and ensure the accuracy of subsequent analysis and calculations.

[0041] In one embodiment, a hot and cold partitioning storage strategy can be used to manage the processed data. The hot partition stores data collected over the most recent days (e.g., 7 days), providing a low-latency access interface to support real-time analysis needs. The cold partition stores historical data and archives it by time range, effectively reducing long-term storage costs. The data ingestion process can employ a batch insertion mechanism to improve write performance and avoid performance bottlenecks caused by high-frequency single-row writes.

[0042] In step S120, the multi-source memory data is analyzed and predicted based on the rule model to obtain the rule judgment result.

[0043] The rule model is a structured judgment model built on knowledge of memory anomaly detection and preset judgment conditions. It can achieve quantitative identification and anomaly judgment of memory usage status by comparing thresholds and analyzing trends in memory data.

[0044] Based on rule-based models, threshold comparisons and trend analyses can be performed on multi-source memory data collected multiple times consecutively. According to preset memory anomaly detection conditions, issues such as abnormal memory growth rates, persistent memory leaks, and excessive memory usage can be identified, and rule-based judgment results can be output. These results are structured judgment information characterizing whether memory usage is abnormal and the degree of abnormality. Rule-based judgment results may include, but are not limited to: real-time anomaly detection results, anomaly trend prediction data, and structured analysis values. Structured analysis values ​​are used to quantify the risk of various memory indicators. The risk of a memory indicator represents the probability of a memory leak; the higher the risk of a memory indicator, the more likely a memory leak is to be detected based on that indicator.

[0045] In step S130, semantic parsing is performed on the multi-source memory data, the scene interaction data, and the running log based on a large language model to obtain semantic parsing results.

[0046] Large language models, leveraging semantic understanding and feature mining capabilities, can perform semantic parsing on multi-source memory data, scene interaction data, and runtime logs. This allows for the analysis of relationships between various indicators within the multi-source memory data, the interpretation of the logical meaning and interface state relationships within the scene interaction data, and the extraction of anomaly information, execution flow records, and key status prompts from the runtime logs. By integrating the semantic information from these sources, semantic parsing results are output, providing deep semantic support for subsequent risk scoring.

[0047] Semantic parsing results are structured information output by a large language model after semantic understanding, feature extraction, and correlation analysis of multi-source memory data, scene interaction data, and runtime logs. This information can be used to characterize application memory status, user interaction logic, system runtime information, and their inherent relationships, providing semantic-level data support for subsequent memory anomaly identification, problem localization, and decision analysis. Semantic parsing results may include, but are not limited to: diagnostic summaries, citation chain inferences, log keywords, root cause classification, and semantic parsing confidence scores. Semantic parsing confidence scores refer to the degree of confidence obtained by the large language model in the accuracy, reliability, and completeness of the output parsed content after semantic parsing of multi-source data. Semantic parsing confidence scores characterize the credibility of the large language model's parsing results and can serve as an important reference for subsequent memory anomaly judgment, problem localization, and analytical decision-making.

[0048] In step S140, the rule judgment result and the semantic parsing result are fused to obtain a risk score.

[0049] A risk score can be obtained by weighting the rule judgment results and semantic parsing results. The risk score is a quantitative indicator used to characterize the degree of application memory anomaly risk after a comprehensive quantitative calculation that integrates the rule judgment results and semantic parsing results.

[0050] In step S150, when the risk score is greater than the risk threshold, the time window and impact range of the memory leak are predicted, and early warning information is generated based on the time window and impact range.

[0051] A preset risk threshold can be obtained. When the risk score is greater than the risk threshold, it indicates that there is a risk of memory leakage in the future. Therefore, the time window when memory leakage will occur and the scope of the impact of memory leakage can be predicted based on time series models and / or deep learning models. Based on the event window and the scope of impact, early warning information can be generated and sent to relevant personnel to achieve early warning.

[0052] The technical solution adopted in this application provides comprehensive data support for subsequent analysis using multi-source memory data, avoiding misjudgments and missed detections caused by single memory data. Analysis and prediction of multi-source memory data based on rule models allows for rapid determination of abnormal memory states through structured and quantifiable rules, resulting in stable and reliable rule judgments and ensuring detection efficiency and accuracy. Semantic parsing of multi-source memory data, scene interaction data, and runtime logs using a large language model enables the mining of log and scene information based on the semantic understanding capabilities of the large language model, thereby fully acquiring contextual information and identifying complex anomalies and hidden problems, improving the ability to identify complex memory leak scenarios. The risk score obtained by fusing rule judgment results and semantic parsing results combines the stability of rules with the understanding capabilities of the large language model, achieving complementary advantages and improving the comprehensiveness and accuracy of anomaly assessment. Predicting the leakage time window and impact range and generating early warnings when the risk score exceeds the risk threshold allows for early prediction before memory problems worsen, supporting proactive warnings and rapid handling, reducing the risk of application lag and crashes. Thus, automated, multi-dimensional, and high-precision memory leak detection and early warning can be achieved, effectively improving application stability.

[0053] In one embodiment of this application, the memory leak early warning method can be implemented by a memory leak early warning system. Figure 2 This is a schematic diagram of a module of a memory leak early warning system provided in an embodiment of this application; as shown Figure 2As shown, this memory leak early warning system can include: a data acquisition module, a data cleaning and standardization module, an analysis engine module, an early warning and report generation module, and a work order submission and R&D linkage module. The data acquisition module is responsible for automatically executing Android memory analysis commands (dumpsysmeminfo, cat / proc / meminfo, slabinfo, procrank, etc.). While executing commands, it can simulate user interaction scenarios through automated page operations (Monkey, UIAutomator, etc.) and collect runtime logs to ensure that the collected data covers the actual runtime state. The data cleaning and standardization module converts the raw output of each command into a unified data structure and performs noise filtering, standardizes indicator units, and standardizes fields (such as unifying the numerical units of PSS, RSS, USS, and VSS), storing the processed data in a local or cloud-based analysis database. The analysis engine module includes a self-developed algorithm (based on rule matching and statistical trend analysis) and a large language model interface call submodule. It can perform full-stack analysis on structured data, automatically identify memory anomaly trends, leak objects, and leak locations, and generate natural language-level diagnostic summaries by calling LLM to perform semantic interpretation of the analysis results. The early warning and report generation module can build a risk scoring model, monitor memory usage trends in real time, and compare them with preset thresholds. Once the early warning conditions are met, an alarm signal is triggered. It can also automatically generate highly readable memory reports, including a list of leaked objects, a description of the reference chain, a leak size curve, a predicted impact range, and suggested remediation strategies. If the early warning conditions are not met, the system records the currently collected data as a trend baseline for the next round of analysis and continuous optimization of the anomaly detection model, enabling it to adapt to environmental and version changes. The work order submission and development linkage module can automatically package the generated reports and runtime contexts into a standardized work order format and submit them to the development task pool through the issue management interface, achieving automatic closure.

[0054] Based on the above technical solution, as an embodiment, the multi-source memory data includes the number of objects, available memory, and memory usage values ​​of multiple modules. The rule judgment results include: real-time anomaly judgment results, anomaly trend prediction data, and structured analysis values.

[0055] The analysis and prediction of multi-source memory data based on rule-based models yields rule-based judgment results, which may include: obtaining memory thresholds for each module; determining real-time anomaly judgment results based on whether the memory usage of a module exceeds its memory threshold; determining the changing trend of multi-source memory data collected consecutively; determining anomaly trend prediction data based on the changing trend; obtaining baseline values ​​for each memory indicator when the real-time anomaly judgment results or anomaly trend prediction data indicate anomaly risk; determining structured analysis values ​​based on the number of objects, available memory, memory usage, and their corresponding baseline values; and using the structured analysis values ​​to quantify the risk of each memory indicator.

[0056] It can obtain memory thresholds for each module, employing a differentiated configuration strategy rather than a uniform fixed value. Instead, it presets specific thresholds based on the functional characteristics and operational requirements of different modules, supporting configurable implementation. Memory thresholds for each module can be stored and loaded via external parameter files, database tables, or memory configuration mappings. The memory thresholds for each module can include the total memory usage threshold for a single module (e.g., 700MB or 1GB) and the percentage threshold of total memory usage for a specific module (e.g., 17% of RAM size), and are dynamically updated. It can automatically adjust the memory thresholds for each module based on recent (e.g., the last 14 days) historical operating data or real-time monitoring results, ensuring that the thresholds adapt to changes in device operating status and application scenarios.

[0057] The real-time anomaly determination result is determined based on the comparison between the memory usage of each module and its corresponding module threshold. When the memory usage of any module exceeds its memory threshold, a hard threshold anomaly determination is triggered, generating a real-time anomaly determination result indicating that a real-time anomaly exists in that module. If the memory usage of all modules does not exceed their corresponding thresholds, the real-time anomaly determination result indicates that there is no real-time anomaly. Optionally, when the memory usage of a module exceeds its memory threshold, leakage trend detection logic can be triggered in conjunction with it to further enhance the targeting of anomaly detection.

[0058] It can continuously collect multi-source memory data based on a preset collection cycle. The self-developed trend analysis algorithm determines the changing trend of the collected data over multiple consecutive times (default 3-5 times). It can focus on monitoring the changing patterns of various memory indicators such as RSS, PSS, VSS, and ION, as well as the available memory and the number of objects. If any memory indicator is detected to be rising continuously, available memory to be falling continuously, or the number of objects to be increasing continuously, it can output abnormal trend prediction data indicating the risk of abnormal memory trends. If no memory indicator is detected to be rising continuously, available memory to be falling continuously, or the number of objects to be increasing continuously, it can output abnormal trend prediction data indicating the absence of abnormal memory trends.

[0059] When real-time anomaly detection results indicate the presence of real-time anomalies, or when anomaly trend prediction data indicates a risk of memory anomalies, the system can automatically obtain baseline values ​​for various memory indicators. These baseline values ​​serve as the benchmark for anomaly detection and risk quantification. They can be calculated using recent (e.g., the last 14 days) application operation data. By combining the real-time collected object count, available memory, and memory usage of each module with the corresponding baseline values, the system comprehensively assesses the degree of anomaly for each memory indicator, ultimately determining the structured analysis value. This structured analysis value quantifies the risk of each memory indicator, characterizing the severity of anomalies in different memory indicators and providing accurate structured data support for subsequent risk scoring calculations and anomaly level determination.

[0060] Alternatively, the structured analysis value can be calculated using the following formula: ； in, This refers to the quantity of memory metrics (such as RSS, PSS, VSS, available memory, and number of objects). The weights corresponding to each memory metric; It is a positive integer. It is the first The current value of this memory metric. It is the first The baseline value of the memory metric corresponding to each memory metric; These are values ​​from the structured analysis.

[0061] Optionally, when both hard threshold and soft trend conditions determine the existence of memory anomalies, the anomaly level is increased.

[0062] By employing the technical solution of this application embodiment, precise judgment of memory anomalies can be achieved through module-differentiated thresholds and dynamic baseline models, avoiding misjudgments and missed judgments caused by uniform thresholds. Combining real-time hard threshold detection and continuous trend analysis, it is possible to quickly identify instantaneous exceeding anomalies and predict hidden problems such as slow leakage in advance. By establishing a baseline through historical normal data, the anomaly judgment can be made more in line with the actual operating environment, improving the objectivity and reliability of structured analysis values. In this way, memory indicator risks can be effectively quantified, providing stable and accurate quantitative support for anomaly warning, location and optimization.

[0063] Based on the above technical solution, as an embodiment, determining the changing trend of the multi-source memory data collected multiple times consecutively may include: smoothing the multi-source memory data collected multiple times consecutively to obtain smoothed multi-source memory data; calculating the growth rate of each of the smoothed multi-source memory data; determining that the multi-source memory data is trending upward when the growth rate of the multi-source memory data is greater than a positive threshold; and determining that the multi-source memory data is trending downward when the growth rate of the multi-source memory data is less than a negative threshold.

[0064] Smoothing can be applied to multi-source memory data collected multiple times consecutively to reduce the interference of single-collection fluctuations, instantaneous device jitter, and data noise on trend judgment, thereby improving the stability and accuracy of trend identification. Smoothing can employ methods such as moving average, weighted average, or exponential smoothing to numerically correct indicators such as RSS, PSS, VSS, ION, available memory, and the number of objects within adjacent periods, resulting in smoothed multi-source memory data that makes data changes more continuous and robust.

[0065] Alternatively, a moving average can be applied to each multi-source memory data using the following formula: ; in, It is the first after smoothing. One data point; It is the first The memory data of the next sample; The size of the smoothing window is recommended (3-5, consistent with the number of consecutive soft trend iterations). A positive integer representing the sampling sequence number of the summation traversal; It is the sampling number for which the smoothing value is to be calculated.

[0066] Based on multiple sets of smoothed continuous memory data, the growth rate of each memory indicator is calculated between adjacent collection periods. A unified growth rate calculation logic is used for different types of indicators to ensure consistent trend judgment standards.

[0067] Alternatively, the growth rate of multi-source memory data can be calculated using the following formula: ; in, It is the first after smoothing. Data.

[0068] When the growth rate of memory data exceeds a positive threshold, the memory data is considered to be on an upward trend; for example, indicators such as memory usage and the number of objects are continuously increasing. When the growth rate of memory data is less than a negative threshold, the memory data is considered to be on a downward trend; for example, available memory is continuously decreasing. This dual constraint of positive and negative thresholds effectively filters out small fluctuations and avoids misjudgments of trends caused by minor data jitter.

[0069] Define a direction counter (DirectionCount) to track the continuous direction of changes in memory data. If the growth rate of a memory data point is greater than a positive threshold, the direction counter is incremented by 1 to record an upward trend; if the growth rate is less than a negative threshold, the direction counter is decremented by 1 to record a downward trend. If the growth rate is between the positive and negative thresholds, the direction counter remains unchanged. Over multiple consecutive sampling periods, if the direction counter remains positive, the memory metric is considered to have an overall upward trend; if the direction counter remains negative, the overall trend is considered to be downward.

[0070] By employing the technical solution of this application embodiment, smoothing multi-source memory data collected over multiple consecutive periods can effectively filter out instantaneous jitter and data noise, improving the stability and anti-interference capability of trend recognition. Calculating the growth rate based on the smoothed data can more realistically reflect the changing patterns of indicators. Combining positive and negative thresholds to determine upward or downward trends can avoid misjudgments caused by minor fluctuations, accurately identify hidden anomalies such as slow leakage, and make trend judgment more reliable and robust, providing stable and accurate data support for soft trend anomaly detection and memory risk assessment.

[0071] Based on the above technical solution, as an embodiment, the memory leak early warning method may further include: recording the multi-source memory data when the risk score is not greater than the risk threshold; generating a new memory indicator baseline value based on the recorded multi-source memory data; and storing each memory indicator baseline value using a rolling time window.

[0072] When the risk score is not greater than the risk threshold, the current application is judged to be running normally. The system can automatically record the multi-source memory data collected this time, including the memory usage of each module, available memory, number of objects and various memory index values, and include it in the normal operation dataset for subsequent baseline model updates and iterations.

[0073] Based on the recorded multi-source memory data, the system can use a rolling update strategy to generate new memory metric baseline values. These baseline values ​​can be calculated based on recent (e.g., the last 14 days) normal operation data. By recalculating the mean and standard deviation of various memory metrics, the original baseline model is updated, enabling the baseline values ​​to dynamically adapt to application version iterations, changes in device environment, and adjustments in business load, ensuring that the anomaly judgment benchmark always matches the actual operating status.

[0074] The system can use a rolling time window mechanism to store baseline values ​​for various memory metrics, maintaining multiple sets of baseline data in chronological order. The window length is configurable, for example, it can be configured to be 7 days or 14 days. When a new baseline value is generated, the oldest historical baseline data in the window is automatically removed, and the new baseline value is added to the end of the window, thus achieving continuous updating of baseline data.

[0075] By adopting the technical solution of this application embodiment, the memory indicator baseline is dynamically updated through normal operation data, which can ensure that the baseline value always fits the actual operating state of the application and avoid misjudgment caused by a fixed baseline. By using a rolling time window to store the baseline value, sufficient historical data can be retained to ensure statistical reliability, while expired data can be removed in a timely manner to avoid redundancy and improve the timeliness of the model. This allows the anomaly detection benchmark to adaptively adjust with business iteration and environmental changes, significantly improving the accuracy and robustness of memory anomaly judgment and providing reliable support for stable and accurate risk assessment.

[0076] Based on the above technical solution, as an example, multi-source memory data may include the number of objects, available memory, and memory usage values ​​of multiple modules. The number of objects can characterize the cumulative memory allocation of instances during application operation, available memory can reflect the current remaining allocatable memory space of the device, and the memory usage values ​​of multiple modules correspond to the memory consumption of different business modules.

[0077] Scenario interaction data can include: test scenario name, interaction sequence, interface labels, and / or summary description. The test scenario name can be used to identify the type of business scenario currently running, the interaction sequence records the operation steps and triggering logic during the test, the interface labels can mark the UI page corresponding to the current interaction, and the summary description can summarize the core business logic and operation intent of the current scenario in natural language, providing complete scenario information for the large language model to understand the business context in which memory exceptions occur.

[0078] The runtime log can include: key lines, memory allocation and deallocation segments, and the first N levels of the call stack, where N is a positive integer. Key lines are the core log entries related to memory exceptions extracted from the logs. Memory allocation and deallocation segments record key code snippets of memory allocation and deallocation during application runtime. The first N levels of the call stack retain the function call chain information at the time of the memory exception, ensuring the integrity of the exception context while avoiding data redundancy caused by the full call stack, providing accurate log-level clues for locating the exception code in a large language model.

[0079] The semantic parsing results can include: diagnostic summary, reference chain inference, log keywords, root cause classification, and semantic parsing confidence score. The diagnostic summary summarizes the core manifestations of memory anomalies and their relevance to the context; reference chain inference analyzes the reference relationships between objects to locate potential paths to memory leaks; log keywords are high-frequency feature words related to the anomaly extracted from the runtime logs; and the semantic parsing confidence score quantifies the reliability of the above parsing results.

[0080] Semantic parsing is performed on multi-source memory data, scene interaction data, and runtime logs based on a large language model to obtain semantic parsing results. These results may include: obtaining diagnostic summaries, reference chain inferences, log keywords, and root cause classifications; determining the confidence levels of the diagnostic summaries and reference chain inferences based on their consistency with rule-based judgment results; determining the confidence levels of log keywords based on their hit rate with the anomaly pattern library; and determining the semantic parsing confidence level based on the confidence levels of the diagnostic summaries, reference chain inferences, and log keywords.

[0081] Based on a large language model, joint semantic parsing is performed on multi-source memory data, scene interaction data, and runtime logs to generate diagnostic summaries, reference chain inferences, log keywords, and root cause classifications. Specifically, the core information from multiple data sources can be integrated to analyze and describe the scenario, manifestation, and scope of impact of anomalies, resulting in a diagnostic summary. Reference chain inferences can be obtained by analyzing strong and weak reference relationships between objects based on object quantity and memory usage data, combined with call stack information. Log keywords can be obtained by filtering keywords highly relevant to memory anomalies from runtime logs through text mining and feature extraction. Finally, based on the domain knowledge of the large language model and relevant knowledge bases, the parsed anomaly features can be mapped to preset root cause categories to achieve automatic anomaly type identification, resulting in root cause classifications.

[0082] The confidence levels of the diagnostic summary and citation chain inference can be determined based on their consistency with the rule-based judgment results. The diagnostic summary and citation chain inference generated by the large language model are compared with the structured analysis results output by the rule model. If the abnormal scenarios and indicator performance described in the diagnostic summary highly match the rule-based judgment results, the diagnostic summary has a high confidence level. If the leakage path of the citation chain inference is consistent with the abnormal modules and indicator trends detected by the rule model, the citation chain inference has a high confidence level; otherwise, the corresponding confidence level is reduced, thus achieving semantic parsing result verification based on rule-based results.

[0083] The confidence level of log keywords is determined based on the hit rate between log keywords and the anomaly pattern library. A pre-built anomaly pattern library containing typical keywords for various memory anomalies is obtained. Log keywords extracted from the large language model are matched with the pattern library, and the ratio of the number of matched keywords to the total number of keywords is calculated. This ratio is determined as the confidence level of the log keywords. A higher hit rate indicates a stronger correlation between the log keywords and known anomaly patterns, and a higher reliability of the parsing results.

[0084] Obtain the preset weights for the diagnostic summary, citation chain inference, and log keywords. Optionally, the weight for the diagnostic summary is 0.4, the weight for citation chain inference is 0.35, and the weight for log keywords is 0.25. The confidence scores of the diagnostic summary and citation chain inference, as well as the confidence scores of the log keywords, are weighted and summed to obtain the semantic parsing confidence score. This semantic parsing confidence score can provide accurate semantic basis for subsequent risk scoring calculations and anomaly decisions.

[0085] The technical solution adopted in this application uses a large language model for joint semantic parsing, which can automatically generate diagnostic summaries, citation chain inferences, log keywords and root cause classifications, thereby improving the efficiency and intelligence level of anomaly analysis. By verifying the consistency with the rule judgment results, matching the anomaly pattern library and calculating the semantic parsing confidence level by weighted fusion, the reliability of the parsing results can be effectively guaranteed, providing strong support for accurate memory anomaly location, root cause analysis and intelligent early warning.

[0086] Based on the above technical solution, as an embodiment, step S140 may include: obtaining the structural analysis value in the rule judgment result and the semantic parsing confidence level in the semantic parsing result; obtaining the preset weights of the structural analysis value and the semantic parsing confidence level respectively; and performing a weighted summation of the structural analysis value and the semantic parsing confidence level according to their respective preset weights to obtain the risk score.

[0087] The system can obtain the structural analysis value from the rule judgment results and the corresponding semantic parsing confidence score from the semantic parsing results; it can also obtain the preset weights corresponding to the structural analysis value and the semantic parsing confidence score respectively. The structural analysis value and the semantic parsing confidence score are then weighted and summed according to these preset weights to obtain a risk score that characterizes the degree of memory anomaly risk.

[0088] After obtaining the risk score, it can be compared with the risk threshold. When the risk score exceeds the risk threshold, the memory anomaly warning process is automatically triggered. The warning threshold can be adaptively adjusted based on system operation data, historical anomaly trends, and detection results to improve the accuracy and applicability of anomaly identification.

[0089] In this way, the advantages of the structured and high-precision judgment of the rule model can be fully combined with the semantic understanding and contextual association advantages of the large language model, so as to achieve complementary advantages of the two types of analysis results and improve the accuracy and reliability of memory anomaly risk assessment.

[0090] Based on the above technical solution, as an embodiment, the prediction of the time window and impact range of memory leaks may include: modeling the multi-source memory data based on a time series model to obtain the future trend of the multi-source memory data; obtaining an anomaly threshold; marking the time window corresponding to the future trend of the multi-source memory data exceeding the anomaly threshold as an anomaly time window; inputting the multi-source memory data, structured analysis values, semantic parsing confidence, scene labels, and system load information into a deep learning model to obtain the anomaly occurrence prediction time and the affected module category; and fusing the anomaly time window, the anomaly occurrence prediction time, and the affected module category to determine the time window and impact range of the memory leak.

[0091] When the risk score is greater than the risk threshold, in order to prevent anomalies (such as crashes, restarts, system crashes, etc.) from occurring, the system can combine time series models and deep learning models to predict the future time window and scope of impact of anomalies.

[0092] Historical memory data can be modeled using models such as Prophet or Autoregressive Integrated Moving Average (ARIMA) to analyze periodic changes and trends, obtaining the future trends of multi-source memory data over a preset time period. A preset anomaly threshold is then obtained, and the future trends of the multi-source memory data are compared one by one with this threshold. Future trend segments exceeding the threshold are selected, and the time intervals corresponding to these segments are marked as abnormal time windows where memory leaks may occur.

[0093] By inputting multi-source memory data, structured analysis values, semantic parsing confidence scores, scene labels, and system load information into a pre-trained deep learning model, the deep learning model can learn the data features and anomaly correlations in historical memory leak cases, output the predicted time of memory leak anomaly occurrence, and the categories of modules that may be affected, thus achieving a preliminary determination of the scope of the leak's impact.

[0094] By fusing and analyzing the marked abnormal time windows, the predicted time of abnormal occurrence output by the deep learning model, and the categories of affected modules, and combining the time interval of the abnormal time window with the accurate prediction time to calibrate the specific time period of the leak, and integrating the correlation between the categories of affected modules, the time window and scope of the memory leak are finally determined. This provides accurate decision-making basis for subsequent memory leak early warning, targeted investigation and optimization, and improves the timeliness and effectiveness of memory anomaly handling.

[0095] By employing the technical solution of this application embodiment, trend prediction of multi-source memory data can identify abnormal growth and mark abnormal time windows in advance, thereby enabling early prediction of memory leaks. Combining deep learning models with multi-dimensional features, the system can accurately predict the time of anomaly occurrence and the affected modules, significantly improving localization efficiency. By fusing multi-source results to determine the time window and scope of impact, the system can reduce false alarms and missed alarms, and provide clear guidance for early warning, loss mitigation, and root cause analysis, thereby improving system stability and the level of intelligent operation and maintenance.

[0096] Based on the above technical solution, as an embodiment, generating early warning information according to the time window and scope of impact may include: obtaining risk event details, reference chain, memory curve, scope of impact, and remediation suggestions; integrating the risk event details, reference chain, memory curve, scope of impact, and remediation suggestions into a formatted report, the formatted report including visual charts and text descriptions; creating an early warning work order through the issue management interface, the early warning work order including the formatted report and data connection; the early warning work order is used to monitor the remediation progress.

[0097] The memory leak early warning method may further include: after receiving feedback that the repair is complete, collecting target device data under the same scenario for verification; when the verification result indicates that the memory leak has abnormally disappeared, turning off the early warning information and archiving it.

[0098] Information related to the predicted memory leak can be obtained, including risk event details, reference chains, memory curves, impact scope, and remediation suggestions. Risk event details can include the predicted time window of the memory leak, the anomaly level, related scenario tags, and system load background; the reference chain is the potential reference path of the memory leak obtained from semantic parsing, clearly defining the object and function call relationship associated with the anomaly; the memory curve is the historical trend and future prediction curve of multi-source memory data, intuitively presenting the memory growth pattern; the impact scope includes the module categories, business scenarios, and device range affected by the leak; remediation suggestions are based on the root cause classification results, combined with historical remediation cases, providing targeted code optimization, resource release, and other implementable solutions.

[0099] The acquired risk event details, referencing chains, memory curves, impact scope, and remediation suggestions are structured and integrated to generate a standardized report. The report combines visualization and text descriptions. Visual charts can include memory change trend graphs, affected module distribution diagrams, and referencing chain structure diagrams, allowing operations personnel to quickly and intuitively grasp the core information of the anomaly. The text descriptions can be logically divided into sections, clearly explaining the risk level, anomaly details, impact extent, and remediation steps, ensuring the report's readability and usability and meeting the viewing needs of different operations scenarios.

[0100] Early warning work orders are automatically created through a pre-defined issue management interface. These work orders can include the generated report format and also include raw data links for multi-source memory data, scenario interaction data, and runtime logs. This allows maintenance personnel to directly retrieve and process the raw data via these data links when handling early warnings. These work orders can be integrated into the system's issue management framework for real-time monitoring of the entire memory leak remediation process, including work order allocation, remediation implementation, and progress feedback, ensuring the orderly and traceable progress of the remediation work.

[0101] After the system receives feedback from operations and maintenance personnel that memory leak repair is complete, it can automatically trigger a verification process. This process collects multi-source memory data from the target device under the same test scenario and equipment configuration as the current leak, including core indicators such as memory usage, object count, and available memory for each module. The collected target device data undergoes anomaly detection and trend analysis, comparing changes in memory indicators before and after the repair. If the verification results indicate that memory leak-related anomalies have completely disappeared, memory indicators have returned to the normal baseline range, and there are no abnormal rebounds for multiple consecutive sampling periods, the repair is deemed effective. The system automatically disables early warning information and categorizes and archives the warning work order, formatted report, repair record, and verification data according to preset archiving rules, forming a closed loop for memory leak handling.

[0102] By adopting the technical solution of this application embodiment, the early warning information can be standardized and made more intuitive by generating a visual report, which greatly improves the efficiency of anomaly investigation; the early warning work order can be automatically created through the problem management interface, and the repair progress can be monitored throughout the process to form a closed-loop handling process; after the repair is completed, it is automatically verified in the same scenario to ensure that the memory leak is completely resolved, and finally the early warning is closed and archived, which improves the accuracy of early warning and the efficiency of handling, provides experience accumulation for subsequent similar problems, and ensures the stable operation of the system.

[0103] Figure 3 This is a flowchart illustrating a memory leak early warning method provided in an embodiment of this application; see also... Figure 3 It can execute memory analysis commands and coordinate with automated page operations to simulate the application's running state in real business scenarios, providing a stable testing environment for subsequent data collection. It collects runtime logs and UI records during application operation, obtaining multi-source raw data including memory allocation and release, function calls, and interface operations. The collected raw data is cleaned and standardized to remove invalid noise, unify data formats and field definitions, and store the processed data in the analysis database, providing a reliable data foundation for subsequent rule matching and semantic parsing. Based on the stored standardized data, rule matching and trend prediction are performed through a self-developed algorithm submodule, while semantic interpretation and leaked reference chain inference are completed through LLM interface calls, yielding structured analysis results and semantic parsing results respectively. The two types of results are merged, and a risk score is calculated according to preset weights to achieve a quantitative assessment of memory anomaly risks. If the risk score does not reach the preset threshold, the current memory indicator trend is recorded and monitoring continues in the next collection cycle. If the risk score reaches or exceeds the preset threshold, a diagnostic report is generated that includes risk details, reference chain, memory curve, scope of impact, and remediation suggestions. An early warning work order is submitted to the R&D platform through the interface. The R&D team receives the work order and carries out targeted remediation to complete the closed-loop handling of memory leak anomalies.

[0104] The technical solution adopted in this application can solve the problems of automated integration of multi-source memory data, inability to provide early warning, insufficient full-stack analysis capabilities, low readability and direct usability of diagnostic results, lack of automated closed loop from problem discovery to work order submission, long R&D response cycle, and impact on the timeliness of problem repair.

[0105] To facilitate better implementation of the memory leak early warning method of this application, this application also provides a memory leak early warning device based on the above-described memory leak early warning method. The meanings of the terms used are the same as in the memory leak early warning method described above, and specific implementation details can be found in the descriptions of the method embodiments.

[0106] Please see Figure 4 , Figure 4This is a schematic diagram of the memory leak early warning device provided in an embodiment of this application, wherein the memory leak early warning device includes: The acquisition module 401 is used to acquire multi-source memory data of the target device, as well as scene interaction data and operation logs of the target device; The judgment module 402 is used to analyze and predict the multi-source memory data based on the rule model to obtain the rule judgment result; Parsing module 403 is used to perform semantic parsing on the multi-source memory data, the scene interaction data and the running log based on a large language model to obtain semantic parsing results; The fusion module 404 is used to fuse the rule judgment result and the semantic parsing result to obtain a risk score; The early warning module 405 is used to predict the time window and impact range of memory leaks when the risk score is greater than the risk threshold, and generate early warning information based on the time window and impact range.

[0107] In one embodiment, the multi-source memory data includes the number of objects, available memory, and memory usage values ​​of multiple modules; the rule judgment results include: real-time anomaly judgment results, anomaly trend prediction data, and structured analysis values; The judgment module 402 is specifically used to perform: Obtain the memory threshold for each module; The real-time anomaly determination result is determined based on whether the memory usage value of the module is greater than the memory threshold of the module; Determine the changing trend of the multi-source memory data collected multiple times consecutively; Based on the aforementioned trend of change, the abnormal trend prediction data is determined; When the real-time anomaly determination result or anomaly trend prediction data indicates the presence of anomaly risk, the baseline values ​​of each memory indicator are obtained. The structured analysis value is determined based on the number of objects, the available memory, the memory usage, and the corresponding baseline values ​​of memory metrics; the structured analysis value is used to quantify the risk of each memory metric.

[0108] In one embodiment, determining the changing trend of the multi-source memory data collected multiple times consecutively includes: The multi-source memory data collected multiple times in succession is smoothed to obtain smoothed multi-source memory data; Based on the smoothed multi-source memory data, calculate the growth rate of each of the multi-source memory data. When the growth rate of the multi-source memory data is greater than a positive threshold, it is determined that the multi-source memory data is on an upward trend; When the growth rate of the multi-source memory data is less than a negative threshold, it is determined that the multi-source memory data is in a downward trend.

[0109] In one embodiment, the device further includes: The data recording module is used to record the multi-source memory data when the risk score is not greater than the risk threshold. The new baseline generation module is used to generate new memory metric baseline values ​​based on the recorded multi-source memory data; The baseline storage module is used to store baseline values ​​for various memory metrics using a rolling time window.

[0110] In one embodiment, the multi-source memory data includes the number of objects, available memory, and memory usage values ​​of multiple modules; the scene interaction data includes: test scene name, interaction sequence, interface tags, and / or summary description; the runtime log includes: key lines, memory allocation and release segments, and the first N levels of the call stack, where N is a positive integer; the semantic parsing results include: diagnostic summary, reference chain inference, log keywords, root cause classification, and semantic parsing confidence. The parsing module 403 is specifically used to perform: Based on the large language model, semantic parsing is performed on the multi-source memory data, the scene interaction data, and the running log to obtain diagnostic summaries, reference chain inferences, log keywords, and root cause classifications. Based on the consistency between the diagnostic summary and the reference chain inference and the rule judgment result, the confidence level of the diagnostic summary and the reference chain inference is determined respectively; The confidence level of the log keywords is determined based on the hit rate between the log keywords and the anomaly pattern library. The semantic parsing confidence is determined by inferring the confidence levels of the diagnostic summary and the citation chain, as well as the confidence levels of the log keywords.

[0111] In one embodiment, the early warning module 405 is specifically used to perform: The multi-source memory data is modeled based on a time series model to obtain the future trend of the multi-source memory data; Obtain the abnormal threshold; The time window corresponding to the future trend of the multi-source memory data that exceeds the abnormal threshold is marked as an abnormal time window. The multi-source memory data, structured analysis values, semantic parsing confidence scores, scene labels, and system load information are input into a deep learning model to obtain the anomaly occurrence prediction time and the affected module categories. By combining the abnormal time window, the predicted time of the abnormal occurrence, and the category of the affected modules, the time window and scope of the memory leak are determined.

[0112] In one embodiment, the fusion module 404 is specifically used to perform: Obtain the structural analysis value from the rule judgment result, and the semantic parsing confidence from the semantic parsing result; Obtain the preset weights for the structural analysis value and the semantic parsing confidence score, respectively. The risk score is obtained by weighting and summing the structural analysis value and the semantic analysis confidence score according to their respective preset weights.

[0113] In one embodiment, the early warning module 405 is specifically used to perform: Obtain details of the risk event, its citation chain, memory curve, scope of impact, and remediation suggestions; The details of the risk events, the reference chain, the memory curve, the scope of impact, and the remediation suggestions are integrated into a formatted report, which includes visual charts and text descriptions. An early warning work order is created through the problem management interface. The early warning work order includes the formatted report and data connection. The early warning work order is used to monitor the repair progress. The device further includes: The data verification module is used to collect data from the target device in the same scenario for verification after receiving feedback that the repair is complete. The early warning shutdown module is used to disable and archive the early warning information when the verification results indicate that the memory leak has disappeared.

[0114] The technical solution adopted in this application provides comprehensive data support for subsequent analysis using multi-source memory data, avoiding misjudgments and missed detections caused by single memory data. Analysis and prediction of multi-source memory data based on rule models allows for rapid determination of abnormal memory states through structured and quantifiable rules, resulting in stable and reliable rule judgments and ensuring detection efficiency and accuracy. Semantic parsing of multi-source memory data, scene interaction data, and runtime logs using a large language model enables the mining of log and scene information based on the semantic understanding capabilities of the large language model, thereby fully acquiring contextual information and identifying complex anomalies and hidden problems, improving the ability to identify complex memory leak scenarios. The risk score obtained by fusing rule judgment results and semantic parsing results combines the stability of rules with the understanding capabilities of the large language model, achieving complementary advantages and improving the comprehensiveness and accuracy of anomaly assessment. Predicting the leakage time window and impact range and generating early warnings when the risk score exceeds the risk threshold allows for early prediction before memory problems worsen, supporting proactive warnings and rapid handling, reducing the risk of application lag and crashes. Thus, automated, multi-dimensional, and high-precision memory leak detection and early warning can be achieved, effectively improving application stability.

[0115] For specific limitations regarding the memory leak warning device, please refer to the limitations of the memory leak warning method mentioned above, which will not be repeated here. Each module in the aforementioned memory leak warning device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the computer device in hardware form or independent of it, or they can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0116] In addition, this application also provides an electronic device, such as Figure 5 As shown, it illustrates the structural diagram of the electronic device involved in this application, specifically: The electronic device may include components such as a processor 501 with one or more processing cores and a memory 502 of one or more computer-readable storage media. Those skilled in the art will understand that... Figure 5 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein: The processor 501 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 502, and by calling data stored in the memory 502, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Optionally, the processor 501 may include one or more processing cores; preferably, the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 501.

[0117] The memory 502 can be used to store software programs and modules. The processor 501 executes various functional applications and data processing by running the software programs and modules stored in the memory 502. The memory 502 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 502 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 502 may also include a memory controller to provide the processor 501 with access to the memory 502.

[0118] In one embodiment, the electronic device further includes a power supply 503 that supplies power to the various components. Preferably, the power supply 503 can be logically connected to the processor 501 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 503 may also include one or more DC or AC power supplies, recharging systems, power equipment debugging circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0119] In one embodiment, the electronic device may further include an input unit 504, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0120] Although not shown, the electronic device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 501 in the electronic device loads the executable files corresponding to the processes of one or more applications into the memory 502 according to the following instructions, and the processor 501 runs the applications stored in the memory 502, thereby implementing the steps in any of the memory leak warning methods provided in the embodiments of this application.

[0121] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0122] In one embodiment, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the methods described in any embodiment of this application.

[0123] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described in any embodiment of this application.

[0124] In some embodiments, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the methods described in any embodiment of this application.

[0125] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0126] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0127] Therefore, this application provides a computer-readable storage medium storing a computer program that can be loaded by a processor to execute the steps in any of the memory leak warning methods provided in this application.

[0128] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0129] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0130] Since the instructions stored in the computer-readable storage medium can execute the steps in any of the memory leak warning methods provided in this application, the beneficial effects that any of the memory leak warning methods provided in this application can achieve can be realized, as detailed in the preceding embodiments, and will not be repeated here.

[0131] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0132] The foregoing has provided a detailed description of a memory leak early warning method, apparatus, electronic device, and computer-readable storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A memory leak early warning method, characterized in that, include: Collect multi-source memory data from the target device, as well as scene interaction data and operation logs from the target device; The multi-source memory data is analyzed and predicted based on a rule model to obtain rule judgment results; Based on a large language model, semantic parsing is performed on the multi-source memory data, the scene interaction data, and the runtime log to obtain semantic parsing results; By combining the rule-based judgment results and the semantic parsing results, a risk score is obtained; When the risk score is greater than the risk threshold, the time window and scope of impact of memory leaks are predicted, and early warning information is generated based on the time window and scope of impact.

2. The method according to claim 1, characterized in that, The multi-source memory data includes the number of objects, available memory, and memory usage values ​​of multiple modules; the rule judgment results include: real-time anomaly judgment results, anomaly trend prediction data, and structured analysis values; The analysis and prediction of the multi-source memory data based on the rule model to obtain the rule judgment result includes: Obtain the memory threshold for each module; The real-time anomaly determination result is determined based on whether the memory usage value of the module is greater than the memory threshold of the module; Determine the changing trend of the multi-source memory data collected multiple times consecutively; Based on the aforementioned trend of change, the abnormal trend prediction data is determined; When the real-time anomaly determination result or anomaly trend prediction data indicates the presence of anomaly risk, the baseline values ​​of each memory indicator are obtained. The structured analysis value is determined based on the number of objects, the available memory, the memory usage, and the corresponding baseline values ​​of memory metrics; the structured analysis value is used to quantify the risk of each memory metric.

3. The method according to claim 2, characterized in that, Determining the changing trend of the multi-source memory data collected multiple times consecutively includes: The multi-source memory data collected multiple times in succession is smoothed to obtain smoothed multi-source memory data; Based on the smoothed multi-source memory data, calculate the growth rate of each of the multi-source memory data. When the growth rate of the multi-source memory data is greater than a positive threshold, it is determined that the multi-source memory data is on an upward trend; When the growth rate of the multi-source memory data is less than a negative threshold, it is determined that the multi-source memory data is in a downward trend.

4. The method according to claim 2, characterized in that, The method further includes: When the risk score is not greater than the risk threshold, the multi-source memory data is recorded; Based on the recorded multi-source memory data, a new baseline value for memory metrics is generated; Use a rolling time window to store baseline values ​​for each memory metric.

5. The method according to claim 1, characterized in that, The multi-source memory data includes the number of objects, available memory, and memory usage values ​​of multiple modules; The scene interaction data includes: test scene name, interaction sequence, interface tags and / or summary description; The runtime log includes: key lines, memory allocation and deallocation segments, and the first N levels of the call stack, where N is a positive integer; The semantic parsing results include: diagnostic summary, citation chain inference, log keywords, root cause classification, and semantic parsing confidence. The semantic parsing of the multi-source memory data, the scene interaction data, and the runtime log based on the large language model yields semantic parsing results, including: Based on the large language model, semantic parsing is performed on the multi-source memory data, the scene interaction data, and the running log to obtain diagnostic summaries, reference chain inferences, log keywords, and root cause classifications. Based on the consistency between the diagnostic summary and the reference chain inference and the rule judgment result, the confidence level of the diagnostic summary and the reference chain inference is determined respectively; The confidence level of the log keywords is determined based on the hit rate between the log keywords and the anomaly pattern library. The semantic parsing confidence is determined by inferring the confidence levels of the diagnostic summary and the citation chain, as well as the confidence levels of the log keywords.

6. The method according to claim 1, characterized in that, The predicted time window and scope of impact for memory leaks include: The multi-source memory data is modeled based on a time series model to obtain the future trend of the multi-source memory data; Obtain the abnormal threshold; The time window corresponding to the future trend of the multi-source memory data that exceeds the abnormal threshold is marked as an abnormal time window. The multi-source memory data, structured analysis values, semantic parsing confidence scores, scene labels, and system load information are input into a deep learning model to obtain the anomaly occurrence prediction time and the affected module categories. By combining the abnormal time window, the predicted time of the abnormal occurrence, and the category of the affected modules, the time window and scope of the memory leak are determined.

7. The method according to claim 1, characterized in that, The risk score is obtained by fusing the rule judgment result and the semantic parsing result, including: Obtain the structural analysis value from the rule judgment result, and the semantic parsing confidence from the semantic parsing result; Obtain the preset weights for the structural analysis value and the semantic parsing confidence score, respectively. The risk score is obtained by weighting and summing the structural analysis value and the semantic analysis confidence score according to their respective preset weights.

8. The method according to claim 1, characterized in that, The step of generating early warning information based on the time window and the scope of impact includes: Obtain details of the risk event, its citation chain, memory curve, scope of impact, and remediation suggestions; The details of the risk events, the reference chain, the memory curve, the scope of impact, and the remediation suggestions are integrated into a formatted report, which includes visual charts and text descriptions. An early warning work order is created through the problem management interface. The early warning work order includes the formatted report and data connection. The early warning work order is used to monitor the repair progress. The method further includes: After receiving feedback that the repair is complete, data from the target device in the same scenario is collected for verification. Once the verification results indicate that the memory leak has disappeared, the early warning information is turned off and archived.

9. A memory leak early warning device, characterized in that, include: The acquisition module is used to acquire multi-source memory data of the target device, as well as scene interaction data and operation logs of the target device; The judgment module is used to analyze and predict the multi-source memory data based on the rule model to obtain the rule judgment result; The parsing module is used to perform semantic parsing on the multi-source memory data, the scene interaction data, and the running log based on a large language model to obtain semantic parsing results; The fusion module is used to fuse the rule judgment results and the semantic parsing results to obtain a risk score; The early warning module is used to predict the time window and scope of impact of memory leaks when the risk score is greater than the risk threshold, and generate early warning information based on the time window and scope of impact.

10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the memory leak warning method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the memory leak warning method as described in any one of claims 1 to 8.

Images