Configuration detection method for big model-based infrastructure cloud environment applications

Abstract

The application relates to the technical field of software configuration management, and discloses a configuration detection method for infrastructure cloud environment application programs based on a large model, which comprises the following steps: obtaining a configuration file of a cloud environment application program; inputting the configuration file into a pre-trained language model to obtain semantic information of multiple configuration items; generating a configuration item group graph based on the semantic information; for any function node, constructing a search condition based on semantic information corresponding to at least one target configuration node, and searching the configuration file based on the search condition to generate a constraint intermediate representation, wherein the constraint intermediate representation represents a constraint relationship of the target configuration node; and detecting the configuration file based on the constraint intermediate representation to obtain a configuration detection result.

Description

Technical Field

[0001] This invention relates to the field of software configuration management technology, and more specifically to a method and apparatus for configuration detection of applications in infrastructure cloud environments based on large models. Background Technology

[0002] Applications in cloud environments are typically deployed in virtual machines, containers, microservices, or distributed clusters, and their runtime parameters, such as ports, timeouts, thread counts, cache sizes, authentication methods, service addresses, feature switches, and protocol types, are configured through external configuration files. In addition to the format, type, or value range of individual configuration items, some configuration requirements also involve the combination of multiple configuration items.

[0003] In related technologies, preset rules are generally used to check whether the configuration is valid by checking field type, regular expression, numerical range and manually written configuration template. However, for new projects that lack templates, relevant personnel still need to perform manual analysis and supplementation, which makes it difficult to automatically adapt to different software projects. Summary of the Invention

[0004] This invention provides a configuration detection method for infrastructure cloud environment applications based on a large model, in order to solve the problems in related technologies where configuration detection relies on manual templates and it is difficult to obtain project-specific configuration constraints.

[0005] In a first aspect, the present invention provides a configuration detection method for applications in an infrastructure cloud environment based on a large model, the method comprising: Obtain the configuration file of the cloud environment application, which includes multiple configuration items; The above configuration file is input into a pre-trained language model to obtain semantic information of multiple configuration items. The semantic information includes the function, target, execution behavior and effective conditions of the above configuration items. Based on the above semantic information, a configuration item group graph is generated. The configuration item group graph includes at least one functional node representing the function of the application and at least one configuration node corresponding to the configuration item. The configuration node and the functional node are connected by an edge, and the edge represents the control relationship between the configuration node and the functional node. For any functional node, search conditions are constructed based on the semantic information corresponding to at least one target configuration node, and the above configuration file is searched based on the above search conditions to generate a constraint intermediate representation, which represents the constraint relationship of the above target configuration node. Based on the above constraints, the intermediate representation is used to detect the above configuration file, and the configuration detection result is obtained.

[0006] In an optional implementation, before constructing the retrieval conditions based on the semantic information corresponding to at least one target configuration node, the method further includes: For any functional node, the configuration category of the configuration node is determined based on the above configuration file, and there is a corresponding relationship between the configuration categories of at least two of the above configuration nodes; Based on the configuration categories of each of the above configuration nodes and the above configuration files, at least one target configuration node is determined from the multiple above configuration nodes.

[0007] In one optional implementation, the configuration file includes a configuration document, and determining at least one target configuration node from a plurality of configuration nodes based on the configuration categories of each configuration node and the configuration file includes: Determine the reference relationships between the configuration items corresponding to each configuration node and the components corresponding to each configuration item from the above configuration document; Based on the reference relationships corresponding to each configuration node, the above configuration documents, the components corresponding to each configuration node, and the configuration categories corresponding to each configuration node, the candidate priority of each configuration node is determined. Based on the candidate priority of each configuration node, the target configuration node is determined from the multiple configuration nodes mentioned above.

[0008] In one optional implementation, determining the configuration category of a configuration node based on the configuration file for any functional node includes: If the configuration item corresponding to the above configuration node is a boolean configuration item as represented in the above configuration file, then the configuration category of the above configuration node is set to a control item; If the configuration item corresponding to the above configuration node is an enumerated configuration item as indicated by the above configuration file, the configuration category of the above configuration node is set to a mode item; If the configuration item corresponding to the above configuration node is an integer type configuration item as indicated in the above configuration file, the configuration category of the above configuration node will be set to controlled item.

[0009] In one optional implementation, the above-mentioned configuration file is detected based on the above-mentioned constraint intermediate representation to obtain a configuration detection result, including: From the above configuration file, obtain the preset configuration value of the corresponding target configuration node represented by the constraint in the middle; Based on the above preset configuration values ​​and the above constraints, the above configuration detection results are determined.

[0010] In one optional implementation, the preset configuration value includes a first preset configuration value corresponding to the first target configuration node and a second preset configuration value corresponding to the second target configuration node. Determining the configuration detection result based on the preset configuration value and the constraint intermediate representation includes: The parameters of the first target configuration node are configured to the first preset configuration value, and the parameters of the second target configuration node are configured to the second preset configuration value, wherein the second target configuration node depends on the first target configuration node; Based on the above-mentioned constraint intermediate representation, the parameters of the first target configuration node and the parameters of the second target configuration node, the configuration detection result is determined. The configuration detection result indicates that the parameters of the second target configuration node depend on the parameters of the first target configuration node.

[0011] Secondly, the present invention provides a configuration detection device for infrastructure cloud environment applications based on a large model, the device comprising: The acquisition module is used to acquire the configuration files of cloud environment applications; The input module is used to input the above configuration file into the pre-trained language model to obtain the semantic information of multiple configuration items. The semantic information includes the function, target, execution behavior and effective conditions of the above configuration items. The generation module is used to generate a configuration item group graph based on the above semantic information. The configuration item group graph includes at least one functional node representing the function of the application and at least one configuration node corresponding to the configuration item. The configuration node and the functional node are connected by an edge, and the edge represents the control relationship between the configuration node and the functional node. The construction module is used to construct retrieval conditions for any functional node based on the semantic information corresponding to at least one target configuration node, and to search the configuration file based on the retrieval conditions to generate a constraint intermediate representation, which represents the constraint relationship of the target configuration node. The detection module is used to detect the above configuration file based on the above constraint intermediate representation and obtain the configuration detection result.

[0012] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the configuration detection method for a cloud environment application as described in the first aspect or any corresponding embodiment thereof.

[0013] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the configuration detection method for a cloud environment application according to the first aspect or any corresponding embodiment thereof.

[0014] Fifthly, the present invention provides a computer program product, including computer instructions for causing a computer to execute the configuration detection method for a cloud environment application described in the first aspect or any corresponding embodiment thereof.

[0015] According to embodiments of the present invention, by inputting the configuration file of a cloud environment application into a pre-trained language model, semantic information including the function, target, execution behavior, and effective conditions of configuration items is obtained. This allows for the construction of a configuration item graph, transforming scattered configuration rules into structured semantic information. Furthermore, for any functional node, retrieval conditions are dynamically generated based on the semantic information of its associated configuration items. The constraint logic related to that functional node is accurately located and extracted from the configuration file, forming an intermediate constraint representation. Finally, the configuration file is automatically detected using this intermediate constraint representation. This achieves the detection of deep logic such as dependencies between configuration items, condition triggering, and scope restrictions, rather than merely remaining at the syntactic surface level. It at least partially solves the problems of traditional configuration detection, such as difficulty in automatically adapting to different software projects and difficulty in cross-configuration item correlation analysis. This enables accurate and interpretable security detection at the functional granularity in dynamic and complex cloud environment deployment scenarios, significantly reducing false alarm rates and improving the level of operational automation. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is an application scenario diagram of the configuration detection method and apparatus for infrastructure cloud environment applications based on a large model according to an embodiment of the present invention; Figure 2 This is a flowchart of a configuration detection method for infrastructure cloud environment applications based on a large model according to an embodiment of the present invention; Figure 3 This is a flowchart of another configuration detection method for infrastructure cloud environment applications based on a large model according to an embodiment of the present invention; Figure 4 This is a structural block diagram of a configuration detection device for infrastructure cloud environment applications based on a large model according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0020] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0021] According to an embodiment of the present invention, a configuration detection method for an application in a large-scale infrastructure cloud environment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0022] Figure 1 This is an application scenario diagram of the configuration detection method and apparatus for infrastructure cloud environment applications based on a large model according to an embodiment of the present invention.

[0023] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0024] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0025] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0026] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0027] It should be noted that the configuration detection method for infrastructure cloud environment applications based on large models provided in this disclosure can generally be executed by server 105. Correspondingly, the configuration detection device for infrastructure cloud environment applications based on large models provided in this disclosure can generally be located in server 105. The configuration detection method for infrastructure cloud environment applications based on large models provided in this disclosure can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the configuration detection device for infrastructure cloud environment applications based on large models provided in this disclosure can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0028] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0029] This embodiment provides a configuration detection method for applications in an infrastructure cloud environment based on a large model. Figure 2This is a flowchart of a configuration detection method for infrastructure cloud environment applications based on a large model according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Obtain the configuration file of the cloud environment application.

[0030] The configuration file includes multiple configuration items. These configuration files can be in INI, YAML, JSON, XML, property files, environment variable files, or other files used to characterize application runtime parameters. The configuration file may include basic information such as configuration item names, configuration sections, configuration values, comments, file paths, and data types. The configuration file may also include configuration documents, source code, schemas, test cases, and version history.

[0031] After obtaining the configuration file, each configuration item can be parsed. For each configuration item, a unique identifier is generated, and the configuration item name, configuration section, description, data type, and current value are saved. The current configuration value in the configuration file can be saved to a configuration value mapping table for subsequent testing.

[0032] Step S202: Input the configuration file into the pre-trained language model to obtain the semantic information of multiple configuration items.

[0033] Semantic information includes the function of the configuration item, the target object, the execution behavior, and the conditions for it to take effect.

[0034] In one feasible embodiment of the present invention, the semantic information may further include configuration item identifiers, configuration item specifics including preliminary role clues of the configuration item in the function, material identifiers and material fragments supporting the semantic information, and semantic confidence level.

[0035] A pre-trained language model can retrieve content related to a configuration item from configuration files, official documentation, or other project materials by using the name, alias, configuration section, and description of multiple configuration items in the configuration file as query criteria. Based on the basic information of each configuration item in the configuration file and the retrieved materials, the pre-trained language model can generate semantic information for the configuration items according to a predetermined structure.

[0036] It is important to note that the semantic information described above is only used to describe the functionality of a single configuration item, and does not build dependencies between configuration items or determine whether the current configuration value is correct.

[0037] In one feasible embodiment of the present invention, it is further possible to verify whether the necessary fields of the semantic information are complete or whether the referenced materials exist. When the semantic information lacks necessary fields, the referenced materials do not exist, or the materials cannot support the meaning of the configuration item, the corresponding configuration item can be marked as having insufficient semantic evidence. Configuration items with insufficient semantic evidence will not be able to construct a constraint intermediate representation.

[0038] The semantic information includes the function, which describes the specific software mechanism in which the configuration item participates; the target, which represents the resource, component or running entity it affects; the execution behavior, which represents the actions such as enabling, selecting, restricting, setting or verifying; and the effective conditions, which represent the conditions under which the configuration item takes effect.

[0039] For example, for `use_auth_pool`, semantic information can characterize whether it is used to control whether the authentication connection pool is enabled; for `auth_pool_size`, semantic information can characterize whether it is used to set the capacity of the authentication connection pool. Configuration item function semantic cards can also be associated with supporting project material identifiers to avoid making judgments based solely on name similarity.

[0040] Step S203: Generate a configuration item group diagram based on semantic information.

[0041] The configuration item group diagram includes at least one functional node representing the application's function and at least one configuration node corresponding to the configuration item. The configuration node and the functional node are connected by edges, and the edges represent the control relationship between the configuration node and the functional node.

[0042] A configuration item graph is a bipartite graph consisting of functional nodes and configuration nodes. Functional nodes represent specific software functions or operating mechanisms, while configuration nodes represent configuration items. The edges between them represent the relationships in which configuration items participate in, control, or influence the corresponding functions. A configuration node can connect to multiple functional nodes.

[0043] In one feasible embodiment of the present invention, a configuration item group graph can be generated using a pre-trained language model. For example, semantic information can be input into the pre-trained language model, which then comprehensively compares the target of the configuration item, its configuration purpose, execution behavior, and effective conditions, thereby connecting configuration items participating in the same operating mechanism to the same functional node. Alternatively, a configuration item group graph can be generated based on preset rules; the present invention does not limit this approach.

[0044] It is important to note that functional nodes should represent specific mechanisms such as "custom authentication implementation selection" or "worker node heartbeat detection," and should not simply use broad categories such as "security" or "network." Furthermore, the identification of functional nodes needs to be based on the consistency of their operating mechanisms, and not solely on name similarity.

[0045] For example, `xxxx.security.authentication.type` is used to select the authentication mode: NOSASL (no authentication mode), SIMPLE (simple authentication mode), or CUSTOM (custom authentication mode). `xxxx.security.authentication.custom.provider.class` is used to specify the authentication implementation class used in CUSTOM mode. Both are involved in the "custom authentication implementation selection" function. Although `xxxx.security.authorization.permission.enabled` also includes "security", it controls file permission checks and is not included in the above functions because of its different target. "xxxx" can be any type of middleware name, which can be set according to the needs of those skilled in the art.

[0046] Step S204: For any functional node, construct retrieval conditions based on the semantic information corresponding to at least one target configuration node, and search the configuration file based on the retrieval conditions to generate a constraint intermediate representation.

[0047] Among them, the constraint middle represents the constraint relationship of the target configuration node.

[0048] In one feasible embodiment of the present invention, the above-mentioned search conditions may include the name, alias, function, target object, execution behavior, activation conditions, configuration category, or component information of the target configuration node. Materials that simultaneously involve the target configuration node can be searched in the configuration file, and the triggering conditions, constraints, operational relationships, and applicable scope can be recovered based on the materials.

[0049] Before generating the intermediate constraint representation, it is possible to check whether the parameters of the intermediate constraint representation come from the target configuration node, whether the retrieved materials and reference fragments are real and valid, and whether the conditions and requirements can be represented in a preset structured manner. The intermediate constraint representation is only generated when the materials can support the constraints. The aforementioned intermediate constraint representation may include a set of configuration items, relationship types, triggering conditions, constraint requirements, operators, scope of application, material references, and validation strategies.

[0050] Step S205: Detect the configuration file based on the constraint intermediate representation to obtain the configuration detection result.

[0051] According to embodiments of the present invention, by inputting the configuration file of a cloud environment application into a pre-trained language model, semantic information including the function, target, execution behavior, and effective conditions of configuration items is obtained. This allows for the construction of a configuration item graph, transforming scattered configuration rules into structured semantic information. Furthermore, for any functional node, retrieval conditions are dynamically generated based on the semantic information of its associated configuration items. The constraint logic related to that functional node is accurately located and extracted from the configuration file, forming an intermediate constraint representation. Finally, the configuration file is automatically detected using this intermediate constraint representation. This achieves the detection of deep logic such as dependencies between configuration items, condition triggering, and scope restrictions, rather than merely remaining at the syntactic surface level. It at least partially solves the problems of traditional configuration detection, such as difficulty in automatically adapting to different software projects and difficulty in cross-configuration item correlation analysis. This enables accurate and interpretable security detection at the functional granularity in dynamic and complex cloud environment deployment scenarios, significantly reducing false alarm rates and improving the level of operational automation.

[0052] According to an embodiment of the present invention, before constructing retrieval conditions based on semantic information corresponding to at least one target configuration node, the method further includes: for any functional node, determining the configuration category of the configuration node based on the configuration file, wherein at least two configuration categories of the configuration nodes have a corresponding relationship; and determining at least one target configuration node from the plurality of configuration nodes based on the configuration categories of each configuration node and the configuration file.

[0053] The number of target configuration nodes mentioned above can be, for example, 2 to 5. When there are many members, the configuration set can be split according to different dimensions such as control items, mode items, or selection items to reduce the management complexity of a single node. For nodes with duplicate functions, deduplication and merging can be performed based on the normalized function name and its contained member set; for candidate target configuration nodes with completely identical member sets, their generation reasons and project materials are merged, thereby effectively reducing redundant target configuration nodes while ensuring functional integrity.

[0054] Configuration nodes can be categorized according to their actual role within their corresponding functional nodes. There can be correspondences between configuration categories, meaning different configuration nodes within the same functional node can respectively perform complementary roles such as control, selection, mode limitation, resource constraint, or parameter control. Furthermore, at least two corresponding configuration nodes can be selected based on configuration categories to determine the target configuration node.

[0055] In one feasible embodiment of the present invention, a coverage check can be further performed to find configuration items that have not yet entered any target configuration node candidate group. For example, functional nodes that have a control category but lack a controlled category, as well as functional nodes corresponding to operating mechanisms that should be expressed by multiple configuration items but have been split, can be identified. These nodes are then supplemented by a pre-trained language model to improve the target configuration node candidate group and thus determine the target configuration node. It should be noted that the supplemented results still need to undergo member validity checks and duplicate set merging.

[0056] Configuration categories can be used to characterize the role of configuration items corresponding to configuration nodes in functional nodes. In a feasible embodiment of the present invention, a pre-trained language model can be used to combine data type, configuration purpose, trigger semantics, and project materials to determine the configuration category as a control item, mode item, selection item, threshold item, boundary item, resource item, credential item, endpoint item, or general participation item.

[0057] For example, when a Boolean configuration item's description explicitly indicates that the control item can be used to control the enabling of a certain function, the control category of the control item can be determined as a control item. For enumeration configuration items, when they are used to select an authentication method or execution path, they can be determined as a mode item; when they are used to set numerical ranges such as minimum value, maximum value, sending period, or check time limit, they can be bound as a threshold item or boundary item.

[0058] Documentation materials should involve target configuration items simultaneously in the same statement or relational description unit, and include relational expressions such as "must", "only if", "depends on", "greater than", or "less than" to determine that there is a correspondence between target configuration items. Simply being adjacent in a list cannot serve as evidence of a correspondence.

[0059] By using configuration nodes with complementary relationships in their configuration categories as candidate target configuration nodes (e.g., control items and controlled items, mode items and implementation items), the large number of configuration items that need to be retrieved within the same function can be reduced to the target configuration nodes that need to be retrieved.

[0060] Configuration categories cannot be determined solely by the name in the configuration document. Even if a configuration item name contains "enabled," it can only be bound as a control item if the configuration description or project materials indicate that it actually controls whether a certain function is executed. When materials are insufficient, its configuration category can be set to a general participation item or a low-confidence item.

[0061] It should be noted that the configuration item group diagram formed by combining functional nodes and configuration nodes is only used to determine the target configuration node, and cannot directly generate configuration constraints. For example, if the configuration type of authentication.type is an authentication mode item, and custom.provider.class is an implementation class item affected by the authentication mode, the two form a candidate target configuration node for binding mode item-implementation item. However, at this time, the triggering direction and specific requirements between custom and implementation class cannot be determined.

[0062] According to an embodiment of the present invention, the configuration file includes a configuration document. The method of determining at least one target configuration node from a plurality of configuration nodes based on the configuration category of each configuration node and the configuration file includes: determining the reference relationship between configuration items corresponding to each configuration node and the component corresponding to each configuration item from the configuration document; determining the candidate priority of each configuration node based on the reference relationship, the configuration document, the component corresponding to each configuration node, and the configuration category corresponding to each configuration node; and determining at least one target configuration node from a plurality of configuration nodes based on the candidate priority of each configuration node.

[0063] The candidate priority mentioned above can be determined by a multi-factor weighted ranking. In addition to the factors mentioned above, the name and description of the configuration item can also be included. Specifically, it determines whether the name and description of the configuration item have semantic overlap. Among the above factors, the reference relationship has the highest weight, followed by whether the functional nodes connected to the configuration node are consistent, and whether the configuration categories of multiple target configuration nodes are complementary. Belonging to the same component and having similar names have the lowest weight. In this invention, the candidate priority is only used to determine the retrieval order in the subsequent retrieval process and is not used as the basis for the constraint.

[0064] According to an embodiment of the present invention, the above-described determination of the configuration category of a configuration node based on the configuration file for any functional node includes: setting the configuration category of the configuration node to a control item when the configuration file indicates that the corresponding configuration item of the configuration node is a Boolean configuration item; setting the configuration category of the configuration node to a mode item when the configuration file indicates that the corresponding configuration item of the configuration node is an enumeration configuration item; and setting the configuration category of the configuration node to a controlled item when the configuration file indicates that the corresponding configuration item of the configuration node is an integer configuration item.

[0065] Control items are configuration items used to control whether the corresponding function is enabled or executed; mode items are configuration items used to select from multiple preset modes, protocols, authentication methods or implementation methods; controlled items are configuration items whose parameter values ​​are constrained by the effective conditions, numerical relationships or existence requirements of control items or mode items; enumerated configuration items can be used to select authentication methods, protocol types or execution implementations; integer configuration items can be used to set capacity, quantity, timeout time or resource limits.

[0066] It is important to note that when a configuration item is a Boolean type, its configuration category can be set as a control item. However, further verification is still required in conjunction with the configuration item description and project materials. The on / off state of Boolean type configuration items may differ in specific business contexts due to factors such as permission constraints, dependency chain effects, or exception rollback logic. Only by checking the semantic definitions in the configuration document, the related modules in the architecture diagram, and the default value settings in the initialization script can the accurate classification of the control item be ensured.

[0067] According to an embodiment of the present invention, the above-mentioned detection of the configuration file based on the above-mentioned constraint intermediate representation to obtain the configuration detection result includes: obtaining the preset configuration value of the target configuration node corresponding to the above-mentioned constraint intermediate representation from the above-mentioned configuration file; and determining the above-mentioned configuration detection result based on the above-mentioned preset configuration value and the above-mentioned constraint intermediate representation.

[0068] In one feasible embodiment of the present invention, the configuration value mapping table stores the relationship between configuration items and configuration values, so the preset configuration value corresponding to the target configuration node can be determined from the configuration value mapping table.

[0069] For a validated intermediate representation of constraints, trigger conditions can be parsed from the intermediate representation and further verified. If the trigger condition is not met, the configuration detection result can be that the target configuration item is not applicable to the current application. When the trigger condition is met, operations can be performed based on the relationship type. These operations may include, for example, Boolean value parsing, existence checks, unit normalization, numerical comparisons, value consistency comparisons, version comparisons, or combinational logic checks.

[0070] Assisted verification can also be performed using a pre-trained large model. This involves inputting the intermediate constraint representation, preset configuration values, and configuration file into the pre-trained large model, and requiring the large model to output the judgment results and reference criteria based solely on the provided intermediate constraint representation, preset configuration values, and configuration file.

[0071] The triggering conditions can be determined by the configuration file, which can further determine the triggering direction and triggering requirements between target configuration nodes.

[0072] For example, if the configuration file states that a custom authentication implementation class is only used when authentication.type is CUSTOM, the system can restore the conditional relationship that "when setting a custom implementation class, the authentication mode must be CUSTOM". Only when the material further clarifies that "the CUSTOM mode must be configured with an implementation class" can an existence constraint in the opposite direction be generated; it cannot be supplemented based on functional roles.

[0073] Candidate target configuration nodes are determined by parameters such as the correspondence between the configuration categories of functional nodes and configuration nodes, and the names of configuration nodes. Only candidate target configuration files supported by configuration files can be further transformed into constraint intermediate representations. This reduces the occurrence of unfounded rules caused by semantic relevance, name similarity, or accidental co-occurrence, thereby improving the accuracy of configuration detection results. Furthermore, by not generating semantic information and constraint intermediate representations based on the current configuration value, the constraint intermediate representations can be applied to different configuration instances, avoiding the reverse inference of rules based on abnormal configurations, thereby improving the independence and reusability of constraint intermediate representations.

[0074] In one feasible embodiment of the present invention, in cases where configuration values ​​are missing, type conversion fails, units cannot be unified, or materials are insufficient, configuration detection results that require manual review can be output instead of directly determining the configuration detection results as configuration errors.

[0075] The configuration detection results can include the detection status, the configuration items involved in the detection, the relationship types between configuration items, the judgment results of the trigger conditions between configuration items, the actual check values, failure constraints, project material references, and execution trajectory.

[0076] The default configuration value is the current configuration value of the target configuration node in the configuration file. Processing the current configuration value and the constraint intermediate representation in stages allows the current configuration value to be excluded from the formation of the aforementioned semantic information, configuration item group diagram and constraint intermediate representation, thereby enabling the constraint intermediate representation to be reused in different configuration instances.

[0077] According to an embodiment of the present invention, the preset configuration value includes a first preset configuration value corresponding to a first target configuration node and a second preset configuration value corresponding to a second target configuration node. Determining the configuration detection result based on the preset configuration value and the constraint intermediate representation includes: configuring the parameters of the first target configuration node to the first preset configuration value and configuring the parameters of the second target configuration node to the second preset configuration value, wherein the second target configuration node depends on the first target configuration node; determining the configuration detection result based on the constraint intermediate representation, the parameters of the first target configuration node, and the parameters of the second target configuration node, wherein the configuration detection result indicates that the parameters of the second target configuration node depend on the parameters of the first target configuration node.

[0078] In one feasible embodiment of the present invention, the LDAP authentication connection pool configuration in the existing open-source project OpenStack Keystone is used as an example to illustrate how the method provided by the present invention can discover and verify configuration errors where functionality is ineffective. Such configuration errors refer to situations where a configuration item, although set with a specific value, does not actually have any effect during runtime because the prerequisite configuration item controlling the corresponding function is not enabled.

[0079] The configuration file involved in this embodiment is the main configuration file of the Keystone project. This configuration file contains multiple configuration items. For ease of explanation, this embodiment focuses on two configuration items in the [LDAP] configuration section of this configuration file. Among them, use_auth_pool is a boolean configuration item used to control whether to enable the LDAP connection pool function used in the end-user authentication process; auth_pool_size is an integer configuration item used to set the maximum number of connections in the LDAP authentication connection pool.

[0080] According to the official configuration documentation of the Keystone project, the auth_pool_size configuration item is used to set the size of the authentication connection pool. However, this configuration item only takes effect when use_auth_pool is enabled, i.e., set to true. In the configuration sample file provided by the project, the default values ​​of the above two configuration items are use_auth_pool=true and auth_pool_size=100, respectively.

[0081] The configuration detection system executing the method of this embodiment first obtains the configuration file of the Keystone application. At this stage, the system does not read the specific values ​​of the two configuration items in the current configuration file. Instead, it inputs the names of each configuration item, their component information, configuration description text, and the configuration documentation provided by the project into a pre-trained language model. The pre-trained language model processes the input configuration file and related information of each configuration item, and outputs semantic information for each configuration item. This semantic information includes the function, target, execution behavior, and effective condition of each configuration item. Specifically, for the configuration item `use_auth_pool`, the language model interprets its function as enabling the LDAP authentication connection pool, identifies its target as the LDAP authentication connection pool management mechanism, its execution behavior as enabling or disabling the connection pool function, and its effective condition as being explicitly set. For the configuration item `auth_pool_size`, the language model interprets its function as setting the size of the LDAP authentication connection pool, identifies its target as the LDAP authentication connection pool, its execution behavior as configuring the maximum number of connections in the connection pool, and its effective condition as the connection pool function being enabled.

[0082] After obtaining the aforementioned semantic information, the system generates a configuration item group graph based on this information. In this embodiment, the system establishes a functional node corresponding to the function that both use_auth_pool and auth_pool_size participate in LDAP authentication connection pool management. The configuration nodes corresponding to use_auth_pool and auth_pool_size are connected to this functional node through edges. These edges represent that both configuration nodes are controlled by the LDAP authentication connection pool management functional node. Among them, use_auth_pool plays a mode control role, and auth_pool_size plays a resource parameter configuration role. Both configuration nodes belong to the [ldap] configuration section of the Keystone component.

[0083] After generating the configuration item group diagram, the system first determines the configuration category of any functional node based on the aforementioned configuration file. In this embodiment, the system determines the configuration category of each configuration node connected to the LDAP authentication connection pool management functional node: for the configuration item `use_auth_pool`, since it is a boolean configuration item, the system sets its configuration category to a control item; for the configuration item `auth_pool_size`, since it is an integer configuration item, the system sets its configuration category to a controlled item. The system further determines at least one target configuration node from multiple configuration nodes based on the configuration category of each configuration node and the aforementioned configuration file. In this embodiment, the configuration file contains thirty-two configuration items, resulting in a total of four hundred and ninety-six possible binary combinations of configuration items. When determining the target configuration node, the system identifies the reference relationships of the configuration items corresponding to each configuration node and the components corresponding to each configuration item from the aforementioned configuration document. Based on the reference relationships of each configuration node, the aforementioned configuration document, the components corresponding to each configuration node, and the configuration categories corresponding to each configuration node, the system determines the candidate priority of each configuration node. Based on the candidate priority of each configuration node, the system selects the aforementioned use_auth_pool and auth_pool_size as the preferred candidate combination from multiple configuration nodes. The candidate criteria include that both of them participate in the LDAP authentication connection pool function, belong to the same component and the same configuration section, the configuration categories are mutually controlling and controlled items, and there is an explicit reference relationship between the two configuration items in the project configuration description. After identifying the target configuration node, the system constructs search conditions based on the semantic information corresponding to at least one target configuration node for the aforementioned functional nodes. Specifically, the system constructs joint search conditions using the names, functional information, and configuration category information of the two configuration items, use_auth_pool and auth_pool_size, and searches the aforementioned configuration files based on the search conditions. The following relationship description text is retrieved from the Keystone project configuration documentation: auth_pool_size has no effect when use_auth_pool is not enabled.

[0084] The system generates an intermediate constraint representation based on the retrieved relation description text. This intermediate constraint representation characterizes the constraint relationship between the target configuration node. In this embodiment, the relation description text clarifies the constraint direction, namely, whether `use_auth_pool` controls the validity of `auth_pool_size`. To convert the above relationship into an executable error detection condition, the system normalizes the rule into the following intermediate constraint representation: parameter A is `auth_pool_size`, parameter B is `use_auth_pool`, the relation type is control dependency, the trigger condition is that `auth_pool_size` has been set, the constraint requirement is that `use_auth_pool` must be equal to `true`, the verification strategy is executable verification, and the evidence is that `auth_pool_size` has no effect when `use_auth_pool` is not enabled. The meaning of this intermediate constraint representation is: if `auth_pool_size` has been set, then `use_auth_pool` must be enabled, i.e., set to `true`. It should be noted that the generation process of this intermediate constraint representation does not read the actual values ​​in the current configuration file; therefore, the same intermediate constraint representation can be used to verify the constraint relationship between the above two configuration items in different configuration instances.

[0085] After generating the intermediate constraint representation, the system checks the configuration file based on this intermediate constraint representation to obtain the configuration check result. Specifically, the system retrieves the preset configuration value of the target configuration node corresponding to the intermediate constraint representation from the configuration file, and determines the configuration check result based on the preset configuration value and the intermediate constraint representation. For a correctly configured normal configuration instance, the settings in the configuration file are auth_pool_size=100 and use_auth_pool=true. The system configures the parameter of the configuration item auth_pool_size of the first target configuration node to the first preset configuration value of one hundred, and configures the parameter of the configuration item use_auth_pool of the second target configuration node to the second preset configuration value of true, where the configuration item use_auth_pool of the second target configuration node depends on the configuration item auth_pool_size of the first target configuration node. Subsequently, the system performs deterministic verification based on the intermediate constraint representation, the parameters of the first target configuration node, and the parameters of the second target configuration node: first, it performs a trigger condition judgment, i.e., whether auth_pool_size has been set, and the result is true; then, it performs a constraint requirement judgment, i.e., whether use_auth_pool is equal to true, and the result is also true. Therefore, the configuration detection result output by the system indicates that the parameters of the second target configuration node depend on the parameters of the first target configuration node, and the dependency relationship is valid, thus no constraint is violated. For a configuration violation instance with incorrect settings, such as `auth_pool_size=100` and `use_auth_pool=false` in the configuration file, the system performs the same verification process: the result for `auth_pool_size` being set is true, but the result for `use_auth_pool` being equal to true is false. Based on this, the system outputs the configuration detection result, indicating that the current configuration violates the constraint, and generates an error report stating that: `auth_pool_size` has been configured with a specific value, but because `use_auth_pool` is not enabled, the LDAP authentication connection pool function is not activated, and the `auth_pool_size` configuration item will not have any actual effect; this is a configuration error where the function is ineffective.

[0086] Figure 3 This is a flowchart of another configuration detection method for infrastructure cloud environment applications based on a large model according to an embodiment of the present invention.

[0087] like Figure 3As shown, the configuration detection method provided in this embodiment of the invention follows this process: First, the configuration file of the cloud environment application is obtained and input into a pre-trained language model. The pre-trained language model extracts the semantic information corresponding to each configuration item. Then, a configuration item graph is constructed based on the semantic information. This graph includes functional nodes and configuration nodes 1 and 2 connected to the functional nodes via edges. Based on this, a target configuration node is determined from the configuration nodes in the configuration item graph, and retrieval conditions are constructed based on the semantic information corresponding to the target configuration node. Then, a constraint intermediate representation is generated based on the retrieval results. Finally, the configuration file is detected and verified based on the constraint intermediate representation. If the configuration meets the constraint requirements, a configuration pass result is output; if the configuration violates the constraints, a violation report is output. The entire process, through semantic understanding and automatic constraint extraction, achieves intelligent detection of cloud environment application configuration files, eliminating the need for manual writing of configuration detection rules.

[0088] This embodiment provides a configuration detection device for infrastructure cloud environment applications based on a large model, such as... Figure 4 As shown, it includes: The acquisition module 401 is used to acquire the configuration file of the cloud environment application, which includes multiple configuration items; The input module 402 is used to input the above configuration file into the pre-trained language model to obtain the semantic information of multiple configuration items. The semantic information includes the function, target, execution behavior and effective conditions of the above configuration items. The generation module 403 is used to generate a configuration item group graph based on the above semantic information. The configuration item group graph includes at least one functional node representing the function of the application and at least one configuration node corresponding to the configuration item. The configuration node and the functional node are connected by an edge, and the edge represents the control relationship between the configuration node and the functional node. The construction module 404 is used to construct retrieval conditions for any functional node based on the semantic information corresponding to at least one target configuration node, and to search the configuration file based on the retrieval conditions to generate a constraint intermediate representation, which represents the constraint relationship of the target configuration node. The detection module 405 is used to detect the above configuration file based on the above constraint intermediate representation to obtain the configuration detection result.

[0089] The configuration detection device for infrastructure cloud environment applications based on a large model provided in this embodiment of the invention can execute the configuration detection method for infrastructure cloud environment applications based on a large model provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method. Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0090] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0091] The following is a detailed reference. Figure 5 The diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from memory 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the electronic device. The processor 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0092] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0093] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a memory 508, or installed from a ROM 502. When the computer program is executed by the processor 501, it performs the functions defined in the configuration detection method for a large-model-based infrastructure cloud environment application according to embodiments of the present invention.

[0094] Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0095] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium after being downloaded over a network. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the configuration detection method for infrastructure cloud environment applications based on large models shown in the above embodiments is implemented.

[0096] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0097] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A configuration detection method for applications in an infrastructure cloud environment based on a large model, characterized in that, The method includes: Obtain the configuration file of the cloud environment application, the configuration file including multiple configuration items; The configuration file is input into a pre-trained language model to obtain semantic information of multiple configuration items. The semantic information includes the function, target, execution behavior, and effective conditions of the configuration items. Based on the semantic information, a configuration item group graph is generated. The configuration item group graph includes at least one functional node representing the function of the application and at least one configuration node corresponding to the configuration item. The configuration node and the functional node are connected by an edge, and the edge represents the control relationship between the configuration node and the functional node. For any functional node, search conditions are constructed based on semantic information corresponding to at least one target configuration node, and the configuration file is searched based on the search conditions to generate a constraint intermediate representation, which represents the constraint relationship of the target configuration node. The configuration file is tested based on the constraint intermediate representation to obtain the configuration test result; The step of detecting the configuration file based on the constraint intermediate representation to obtain the configuration detection result includes: From the configuration file, obtain the preset configuration value of the constraint representing the corresponding target configuration node; The configuration detection result is determined based on the preset configuration value and the constraint intermediate representation. The preset configuration values ​​include a first preset configuration value corresponding to the first target configuration node and a second preset configuration value corresponding to the second target configuration node. Determining the configuration detection result based on the preset configuration values ​​and the constraint intermediate representation includes: The parameters of the first target configuration node are configured to the first preset configuration value, and the parameters of the second target configuration node are configured to the second preset configuration value, wherein the second target configuration node depends on the first target configuration node; Based on the constraint intermediate representation, the parameters of the first target configuration node, and the parameters of the second target configuration node, a configuration detection result is determined, wherein the configuration detection result indicates that the parameters of the second target configuration node depend on the parameters of the first target configuration node.

2. The method according to claim 1, characterized in that, Before constructing the retrieval conditions based on the semantic information corresponding to at least one target configuration node, the method further includes: For any functional node, the configuration category of the configuration node is determined based on the configuration file, and at least two configuration categories of the configuration nodes have a corresponding relationship; Based on the configuration category of each configuration node and the configuration file, at least one target configuration node is determined from the plurality of configuration nodes.

3. The method according to claim 2, characterized in that, The configuration file includes a configuration document. The step of determining at least one target configuration node from among the multiple configuration nodes based on the configuration categories of each configuration node and the configuration file includes: Determine the reference relationships between the configuration items corresponding to each configuration node and the components corresponding to each configuration item from the configuration document; Based on the reference relationships corresponding to each configuration node, the configuration document, the components corresponding to each configuration node, and the configuration category corresponding to each configuration node, the candidate priority of each configuration node is determined. Based on the candidate priority of each configuration node, at least one target configuration node is determined from the plurality of configuration nodes.

4. The method according to claim 2, characterized in that, For any functional node, determining the configuration category of the configuration node based on the configuration file includes: If the configuration configuration item corresponding to the configuration node is a boolean configuration item as indicated by the configuration file, the configuration category of the configuration node is set to a control item. If the configuration configuration item corresponding to the configuration node is an enumerated configuration item as indicated by the configuration file, the configuration category of the configuration node is set to a mode item. If the configuration configuration item corresponding to the configuration node is an integer type configuration item as indicated by the configuration file, the configuration category of the configuration node is set to a controlled item.

5. A configuration detection device for infrastructure cloud environment applications based on a large model, characterized in that, The device includes: The acquisition module is used to acquire the configuration file of the cloud environment application, the configuration file including multiple configuration items; The input module is used to input the configuration file into a pre-trained language model to obtain semantic information of multiple configuration items. The semantic information includes the function, target, execution behavior and effective conditions of the configuration items. A generation module is used to generate a configuration item group graph based on the semantic information. The configuration item group graph includes at least one functional node representing the function of the application and at least one configuration node corresponding to the configuration item. The configuration node and the functional node are connected by an edge, and the edge represents the control relationship between the configuration node and the functional node. The construction module is used to construct retrieval conditions for any functional node based on the semantic information corresponding to at least one target configuration node, and to search the configuration file based on the retrieval conditions to generate a constraint intermediate representation, wherein the constraint intermediate representation represents the constraint relationship of the target configuration node; The detection module is used to detect the configuration file based on the constraint intermediate representation and obtain the configuration detection result; The detection module includes: The configuration value acquisition submodule is used to obtain the preset configuration value of the constraint representing the corresponding target configuration node from the configuration file; The result determination submodule is used to determine the configuration detection result based on the preset configuration value and the constraint intermediate representation; The preset configuration values ​​include a first preset configuration value corresponding to the first target configuration node and a second preset configuration value corresponding to the second target configuration node. The result determination submodule includes: A configuration unit is used to configure the parameters of a first target configuration node to a first preset configuration value and configure the parameters of a second target configuration node to a second preset configuration value, wherein the second target configuration node depends on the first target configuration node; The detection result determination unit is used to determine the configuration detection result based on the constraint intermediate representation, the parameters of the first target configuration node and the parameters of the second target configuration node, wherein the configuration detection result indicates that the parameters of the second target configuration node depend on the parameters of the first target configuration node.

6. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the configuration detection method for a large-model-based infrastructure cloud environment application as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the configuration detection method for the infrastructure cloud environment application based on the large model as described in any one of claims 1 to 4.

8. A computer program product, characterized in that, Includes computer instructions for causing a computer to execute the configuration detection method for a large-model-based infrastructure cloud environment application as described in any one of claims 1 to 4.

Images