Method for monitoring the state of software execution based on multiple parameters

Abstract

The present application relates to the field of software running state monitoring, especially to a software running state monitoring method based on multiple parameters, the present application generates operation execution trace set and resource consumption time sequence by continuously collecting running data of target software, extracts distribution form feature and rhythm feature and carries out corresponding relation comparison, determines the matching degree between operation trace and resource consumption in the collection unit; based on the attenuation amount of matching degree in the subsequent collection unit, whether there is a running instability trend is evaluated, the instability inducing factor tendency is identified according to the attenuation direction of matching degree, and an instability prediction signal is sent out; the similarity of instability inducing factor tendency and running instability sample in historical instability case library is determined to extract the corresponding historical regulation record as auxiliary regulation suggestion. The present application realizes the early prediction of software running instability by tracking the matching condition between operation trace and resource consumption, and improves the initiative and intelligent level of software running state monitoring.

Description

Technical Field

[0001] This invention relates to the field of software operation status monitoring, and in particular to a method for monitoring software operation status based on multiple parameters. Background Technology

[0002] With the rapid iteration of information technology and the deep popularization of digital applications, various software systems such as office, business, industrial control, and Internet services have become the core carriers of digital operation in all walks of life. The stability, continuity and reliability of software operation are related to the normal progress of business processes, the secure flow of data information and the overall system operation efficiency.

[0003] In large-scale, high-concurrency, and long-term continuous application scenarios, the operating state of software systems is in a dynamic process and is easily affected by multiple factors such as user operation behavior, frequency of function module calls, hardware resource load, and system environment fluctuations, exhibiting complex dynamic operating characteristics.

[0004] Therefore, comprehensive, detailed, and time-series real-time monitoring of software operation status has become a core technical aspect for ensuring stable operation of software systems, avoiding operational failures, and ensuring business continuity.

[0005] For example, Chinese Patent Publication No. CN120123235A discloses a software stability assessment system for software development, comprising: a data acquisition and preprocessing module for collecting user behavior data and system performance indicators; a user behavior modeling module for modeling user behavior data based on psychological models; an abnormal behavior detection module for detecting abnormal user behavior and assessing its potential impact on system stability; a stress test generation and execution module for generating simulated data and executing stress tests; a causal relationship optimization module for optimizing the edge weights of the causal relationship graph using a genetic algorithm; a module ecosystem modeling and analysis module for establishing a resource competition and cooperation model between modules; a multi-objective optimization module for optimizing resource allocation strategies based on module health indices and balance requirements; and an interpretability and decision-making module for analyzing the decision-making process of the assessment model and generating a decision report. This invention optimizes the stability and fairness of software resource allocation in complex scenarios.

[0006] However, the following problems still exist in the existing technology. The use of single-dimensional indicators for software operation status monitoring is often insufficient to effectively correlate software operation behavior with resource consumption. It is difficult to capture the implicit and gradual instability trends during software operation, and it is impossible to accurately identify and predict the causes of software instability in advance. This results in low accuracy of software operation status monitoring, delayed fault warnings, and poor targeting of operation and maintenance control. Summary of the Invention

[0007] To address this, the present invention provides a multi-parameter-based software operation status monitoring method to overcome the problems in existing technologies that mostly use single-dimensional indicators for software operation status monitoring. These methods cannot effectively correlate software operation behavior with resource consumption, are difficult to capture implicit and gradual instability trends during software operation, and cannot accurately identify and predict software instability causes in advance. Consequently, they result in low accuracy of software operation status monitoring, delayed fault warnings, and poor targeting of operation and maintenance control.

[0008] To achieve the above objectives, the present invention provides a software operation status monitoring method based on multiple parameters, comprising: Continuously collect the target software's runtime data, generate an operation execution trace set and a resource consumption time series, and extract the distribution pattern characteristics of the operation traces and the rhythmic characteristics of resource consumption. The distribution morphology features and rhythm features within the same acquisition unit are compared to determine the degree of matching between operation traces and resource consumption within the acquisition unit. Based on the attenuation of the matching degree in subsequent acquisition units, assess whether the target software has a tendency to become unstable. If the target software shows a tendency to become unstable, the tendency to cause instability is identified based on the decay direction of the matching degree, and an instability prediction signal is issued. The similarity between the instability initiation tendency and the operational instability samples in the historical instability case library is determined, so as to extract the historical control records corresponding to the operational instability samples as auxiliary control suggestions.

[0009] Furthermore, the process of generating the operation execution trace set includes: Capture the call chain path information and dwell time information generated during the execution of each operation event; The call chain path information is associated with the dwell time information to form an operation execution trace entry; Using a predetermined time period as the collection unit, all operation execution trace entries falling within the same collection unit are aggregated to form the operation trace set of the collection unit.

[0010] Furthermore, the process of generating a resource consumption time series includes: Collect the resource consumption of the target software at a predetermined sampling frequency; Arrange the sampled values ​​within the same acquisition unit according to the time sequence to form the resource consumption time sequence of the acquisition unit; The resource consumption includes processor utilization, memory usage, and storage read / write speed.

[0011] Furthermore, the process of extracting the distribution morphological features of the operation traces includes: Based on the arrival time sequence of each operation trace within the acquisition unit, calculate the operation arrival dispersion of the arrival interval between adjacent traces; Based on the sequence of node dwell time of each operation trace in the acquisition unit, calculate the operation dwell time deviation. The uniformity of operation coverage is calculated based on the proportion of operation traces involving different functional modules within the acquisition unit. The operation arrival dispersion, the operation stay deviation, and the operation coverage uniformity are used as the distribution morphology features.

[0012] Furthermore, the process of extracting rhythmic features of resource consumption includes: The intensity of resource fluctuations is calculated based on the deviation sequence of resource occupancy at each time point from the average resource occupancy within the acquisition unit in the resource consumption time series. Extract the time interval between each adjacent peak in the resource consumption time series, determine the peak interval sequence, and calculate the distribution interval uniformity of the resource peaks; Based on the ratio of the duration of the rising segment to the falling segment in the resource consumption time series, calculate the symmetric ratio of resource consumption. The resource fluctuation intensity, the distribution interval uniformity, and the symmetry ratio of resource consumption are combined to form the rhythmic feature.

[0013] Furthermore, the process of determining the matching degree between operation traces and resource consumption within the acquisition unit includes: By placing distribution morphology features and rhythm features under the same comparison framework, the temporal overlap between each component of the distribution morphology features and each component of the rhythm features is calculated respectively. The matching degree is obtained by combining the overlap of each time domain factor. The temporal overlap degree is determined based on the time misalignment between the fluctuation times of the distribution morphology feature and the fluctuation times of the rhythm feature.

[0014] Furthermore, the process of assessing whether the target software exhibits a tendency towards operational instability includes: Obtain the matching degree of several consecutive acquisition units and construct a time series sequence of matching degree; Calculate the decrease between adjacent values ​​in the matching degree time series to obtain the matching degree decay sequence; If the decrease in the matching degree decay sequence is positive for a predetermined number of consecutive times, and the decrease increases successively, then the matching degree is determined to be in an accelerated decay state. If the matching degree is in an accelerated decay state and the current matching degree is lower than the preset matching degree, it is determined that the target software has a tendency to become unstable.

[0015] Furthermore, the process of identifying instability triggers includes: The changes of each component in the distribution morphology feature and each component in the rhythm feature within the continuous acquisition unit are compared. If the change in distribution morphology occurs before the change in rhythmic characteristics, and the magnitude of the change in distribution morphology is greater than the magnitude of the change in rhythmic characteristics, then the tendency of instability triggers is identified as an operational-side induced tendency. If the change in rhythmic characteristics precedes the change in distribution morphology characteristics, and the magnitude of the change in rhythmic characteristics is greater than the magnitude of the change in distribution morphology characteristics, then the tendency of instability triggers will be identified as a resource-side triggering tendency. If the changes of both occur synchronously and the magnitude of the changes is within the preset equilibrium range, then the tendency of the instability trigger will be identified as a bilateral synergistic triggering tendency. The change state includes the direction of change and the magnitude of change.

[0016] Furthermore, issuing instability prediction signals includes: Determine the type label of the instability prediction signal based on the tendency of instability triggers; The urgency level of the instability prediction signal is determined based on the deviation between the current matching degree and the preset matching degree; The type label and the emergency level are combined into an instability prediction signal set and then issued.

[0017] Furthermore, it also includes: Record the operation execution traces and resource consumption time sequence within several acquisition units before and after the moment the instability prediction signal is issued, forming an operational instability sample; The aforementioned operational instability samples will be included in the historical instability case library.

[0018] Compared with existing technologies, this invention continuously collects operational data of the target software, generates an operation execution trace set and a resource consumption time series, and extracts distribution morphology features and rhythmic features. It compares the distribution morphology features and rhythmic features within the same collection unit to determine the matching degree between operation traces and resource consumption within that unit. Based on the decay of the matching degree in subsequent collection units, it assesses whether the target software has a tendency to become unstable, identifies instability triggers based on the decay direction of the matching degree, and issues instability prediction signals. It determines the similarity between instability triggers and instability samples in a historical instability case library, and extracts historical control records corresponding to these instability samples as auxiliary control suggestions. This invention, by tracking the matching between operation traces and resource consumption, achieves early prediction of software instability, improving the initiative and intelligence level of software operation status monitoring.

[0019] In particular, this invention constructs a dual-domain coupled comparison framework based on operation traces and resource consumption. By continuously collecting the target software's runtime data, an operation execution trace set and a resource consumption time sequence are generated, incorporating user operation behavior and system resource status into the same framework for analysis. Furthermore, the distribution pattern characteristics of operation traces and the rhythmic characteristics of resource consumption are extracted. Based on the matching degree between these two types of features, the closeness of the correlation between the arrival rhythm and processing pattern of operation requests and the fluctuation pattern and change rhythm of system resources is quantified. In a healthy state, the two fluctuate and respond to each other; while in the early stages of instability, their pace is misaligned and their coordination is loose. The degree of change in the aforementioned coordinated state is quantified by the matching measure. A high matching degree indicates that the coordinated state of operation traces and resource consumption remains good, with resource consumption rising synchronously during periods of intensive operation and falling synchronously during periods of sparse operation, and no significant time misalignment or response lag between the two, indicating that the system's scheduling mechanism and resource management are operating effectively. Conversely, a low matching degree indicates a loosening of the coordination between operational traces and resource consumption, with significant time misalignment or response lag between the two. This may indicate anomalies such as resource contention, backlog, or imbalanced allocation within the system. Based on this, this invention establishes a dual-domain coupled comparison framework. This allows subsequent instability assessments to no longer rely on whether the absolute value of a single resource indicator exceeds the limit, but rather on whether the coordination between operational behavior and resource consumption is loosened to determine the system's health. This effectively reduces the false alarm rate caused by normal fluctuations in business load.

[0020] In particular, this invention associates the call path with the dwell time to generate an operation execution trace set. Each operation trace entry contains a complete call chain topology and dwell time information for each node, thus fully recording the service nodes traversed by the corresponding request after a user initiates a click or submit operation on the software interface, and the dwell time at each node. Based on this, this invention comprehensively evaluates the overall behavior pattern of the target software's operation traces within the collection unit from time, efficiency, and structural dimensions. In the time dimension, the operation arrival dispersion of the interval between adjacent traces quantifies the unevenness of the arrival times of each operation within the collection unit, reflecting the clustering characteristics of operations on the time axis. Low dispersion indicates uniform operation arrival, a stable rhythm, and relatively consistent intervals between operations, with requests arriving in a uniform flow pattern. High dispersion indicates a bursty clustering of operation arrivals, with dense arrivals in some periods and sparse or even idle arrivals in others, also exhibiting a bursty flow pattern. In the efficiency dimension, the deviation of the operation dwell time from the dwell time quantifies the degree of anomaly in the dwell time of operation events at each node of the system, reflecting the balance of operation processing time. Low deviation indicates that the processing time of all operations is relatively consistent, and the system's ability to handle various types of requests is stable. High deviation, on the other hand, indicates that the dwell time of some operations is significantly longer than the average level of similar operations; most operations complete quickly, but a few are abnormally slow, indicating a long tail in processing. Structurally, the uniformity of operation coverage quantifies the consistency of operation distribution across functional modules, reflecting the distribution characteristics of operations across different functional modules. High uniformity indicates that operations are widely distributed across various functional modules, and the system bears a diverse load; low uniformity indicates that operations are highly concentrated in a few functional modules, and the system bears a localized hotspot load. Abnormal changes in any of these dimensions can reflect a deterioration trend in the system's operating state, providing multi-faceted quantitative input for subsequent comparison with the rhythmic characteristics of resource consumption. This allows instability judgment to be based on a complete profile of operational behavior, improving the comprehensiveness and accuracy of monitoring.

[0021] In particular, this invention jointly characterizes the resource consumption behavior pattern of the target software from three dimensions: the intensity of resource consumption fluctuations, the degree of periodic stability, and the degree of morphological symmetry. First, the intensity of resource fluctuations in the deviation sequence quantifies the severity of resource usage deviating from its average level, reflecting the overall amplitude of resource consumption fluctuations. Lower fluctuation intensity indicates that resource usage is concentrated near the mean, with smaller deviations from the average level at different times, indicating stable and gradual resource consumption behavior and a stable system operation. Higher fluctuation intensity indicates frequent or significant deviations from the mean in resource usage, violent fluctuations in resource consumption behavior, and a tendency towards system instability. Second, the uniformity of the distribution intervals of resource peaks quantifies the regularity of the rhythm of resource consumption peaks, reflecting the stability of the periodic fluctuations in resource consumption. High uniformity indicates that resource consumption peaks recur at relatively fixed time intervals, indicating a stable periodic rhythm in system load changes. Low uniformity indicates that the intervals between resource consumption peaks vary in length, disrupting the periodic rhythm of system load changes and suggesting sudden load shocks or periodic task scheduling disorder. Third, the symmetry ratio of resource consumption is used to quantify the difference between the rates of increase and decrease in resource consumption, reflecting the symmetry of resource consumption changes. A symmetry ratio close to 1 indicates that the rates of increase and decrease in resource consumption are basically symmetrical, with the rate of increase in consumption roughly matching the rate of decrease in release. A symmetry ratio significantly greater than 1 indicates that resource consumption increases slowly but decreases rapidly, with resources gradually increasing over a long period but rapidly declining in a short period, exhibiting a typical pattern of slow rise and sudden fall. This tendency is a precursor to abnormalities on the resource supply side, such as slow resource acquisition, concentrated processing of long-term backlogged tasks, and overly conservative resource allocation strategies. A symmetry ratio significantly less than 1 indicates that resource consumption increases rapidly but decreases slowly, with resources increasing sharply in a short period but releasing slowly, exhibiting a typical pattern of sudden rise and slow fall. This tendency is a precursor to abnormalities in resource management, such as memory leaks, failure to reclaim connection pools in a timely manner, and blocking caused by lock resource contention. Abnormal fluctuations in any of the aforementioned dimensions may indicate a deterioration in the system's operating state, providing multi-dimensional quantitative input for subsequent calculations of the temporal overlap of the distribution characteristics of operational traces. This enables instability judgment to be based on a detailed characterization of resource consumption behavior, improving the sensitivity and accuracy of anomaly detection.

[0022] In particular, this invention constructs a matching degree determination mechanism between operation traces and resource consumption based on the pairing of fluctuation moment markers, enabling operation event streams and resource sampling streams with different collection frequencies and data formats to be collaboratively measured within a unified framework. This mechanism measures the consistency of fluctuation quantity and the synchronicity of fluctuation moments. First, it determines the coverage completeness of marker pairings to quantify the matching ratio of operation traces and resource consumption in terms of fluctuation quantity, assessing whether the two types of features fluctuate simultaneously. Second, it determines the temporal proximity of marker pairings to quantify the alignment tightness of operation traces and resource consumption in terms of fluctuation moments, assessing whether the fluctuations of the two types of features occur synchronously in time. Combining coverage completeness and temporal proximity yields the temporal overlap of corresponding components, comprehensively reflecting the collaborative state of the dual-domain features in terms of fluctuation quantity and temporal position. Furthermore, the temporal overlap of each component is normalized to obtain the overall matching degree. A higher matching degree indicates a better collaborative state between operation traces and resource consumption, indicating that the system's scheduling mechanism and resource management are operating effectively. In this state, the system can effectively respond to changes in operational load, and resource allocation and release are matched with operational needs. Therefore, the matching degree determination mechanism constructed in this invention uses the fluctuation pattern as a comparison benchmark, enabling two types of heterogeneous data to be collaboratively measured within a unified framework, which has good engineering applicability.

[0023] In particular, based on the determination that the target software exhibits a trend of operational instability, this invention further compares the direction and magnitude of change of each component of the distribution morphology feature and each component of the rhythm feature within the continuous acquisition unit to distinguish the specific source of the instability induction. The distribution morphology feature reflects the behavioral pattern changes of operational traces, while the rhythm feature reflects the fluctuation pattern changes of resource consumption. By comparing the temporal sequence and magnitude differences of these two changes, it is possible to determine whether the instability is caused by operational anomalies, resource degradation, or a combined deterioration of both. If changes in distribution patterns precede and are more significant than changes in rhythmic characteristics, it is identified as an operation-induced tendency, indicating an abnormal change in user operation patterns. System resources are passively bearing the brunt of this change. In this case, it is recommended to investigate for malicious operations or abnormal access patterns. If changes in rhythmic characteristics precede and are more significant than changes in distribution patterns, it is identified as a resource-induced tendency, indicating a deterioration at the system resource level, which affects operation execution. In this case, it is recommended to investigate for issues such as memory leaks, connection pool exhaustion, or inappropriate resource allocation strategies. If both changes occur simultaneously and are of similar magnitude, it is identified as a bilaterally coordinated induced tendency, indicating that operational behavior and resource status are mutually deteriorating. In this case, both the operation and resource sides need to be investigated simultaneously. The aforementioned instability trigger identification mechanism further refines the source of instability after the matching degree decay triggers the instability judgment. This allows maintenance personnel to initially locate the source of the problem when they learn that the system is approaching instability, solving the passive situation of passively waiting for alarms and then investigating layer by layer afterward in traditional monitoring.

[0024] In particular, this invention records the operation execution traces and resource consumption time-series sequences within several acquisition units before and after the instability prediction signal is issued as operational instability samples and incorporates them into a historical instability case library. Simultaneously, it records the actual adjustment operations performed by maintenance personnel for each instability event in a structured form within the corresponding samples. This transforms the complete context and adjustment experience of each instability event into searchable and reusable knowledge entries. Based on this, when an operational instability trend reappears, the current instability trigger tendency is matched with the historical samples in the case library for similarity. The historical control records associated with the sample with the highest similarity are extracted and output as auxiliary control suggestions to maintenance personnel. Through this mechanism, the adjustment experience of each instability event can be systematically transformed and reused subsequently. When similar events recur, reference control solutions can be directly provided, effectively shortening response and repair time and improving the stability and predictability of control efficiency. Furthermore, as the case library continues to grow, the matching coverage and accuracy are further improved, achieving self-enhancement and iterative optimization of auxiliary decision-making capabilities. Attached Figure Description

[0025] Figure 1 This is a schematic diagram illustrating the steps of a multi-parameter-based software runtime status monitoring method according to an embodiment of the invention. Figure 2 This is a logic block diagram for determining the time-domain overlap in an embodiment of the invention. Figure 3 This is a logic block diagram for evaluating whether the target software exhibits a tendency towards operational instability, as described in an embodiment of the invention. Figure 4 This is a logic block diagram for extracting historical control records corresponding to samples of operational instability, as shown in an embodiment of the invention. Detailed Implementation

[0026] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0027] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0028] Please see Figure 1 The diagram illustrates the steps of a multi-parameter-based software runtime status monitoring method according to an embodiment of the present invention. In this embodiment, the method includes: Step S1: Continuously collect the running data of the target software, generate an operation execution trace set and a resource consumption time sequence, and extract the distribution pattern characteristics of the operation traces and the rhythm characteristics of resource consumption. Step S2: Compare the distribution morphology features and rhythm features within the same acquisition unit to determine the matching degree between operation traces and resource consumption within the acquisition unit; Step S3: Based on the attenuation of the matching degree in subsequent acquisition units, assess whether the target software has a tendency to become unstable. Step S4: If the target software shows a tendency to become unstable, the tendency to cause instability is identified based on the decay direction of the matching degree, and an instability prediction signal is issued. Step S5: Determine the similarity between the instability instability tendency and the operational instability samples in the historical instability case library, so as to extract the historical control records corresponding to the operational instability samples as auxiliary control suggestions.

[0029] Specifically, the process of generating a set of operation execution traces includes: Capture the call chain path information and dwell time information generated during the execution of each operation event; The call chain path information is associated with the dwell time information to form an operation execution trace entry; Using a predetermined time period as the collection unit, all operation execution trace entries falling within the same collection unit are aggregated to form the operation trace set of the collection unit.

[0030] In this embodiment, the predetermined duration of the data acquisition unit is set to 1 minute. Furthermore, those skilled in the art can adjust this duration according to the actual operating characteristics of the target software. For example, for systems with low operating frequency, the duration of the data acquisition unit can be appropriately extended to 3-5 minutes to ensure sufficient data volume within each acquisition unit, thereby ensuring the stability of the feature statistics.

[0031] Specifically, associating the call chain path information with the dwell time information includes: Inject a unified tracing identifier into each node of the call chain under the same operation event; The entry / exit timestamps of each node are mapped and bound to the corresponding stage names to form an association between the call path and the dwell time.

[0032] Specifically, the process of generating a resource consumption time series includes: Collect the resource consumption of the target software at a predetermined sampling frequency; Arrange the sampled values ​​within the same acquisition unit according to the time sequence to form the resource consumption time sequence of the acquisition unit; The resource consumption includes processor utilization, memory usage, and storage read / write speed.

[0033] In this embodiment, the predetermined sampling frequency is once per second, meaning that relevant data of the target software is collected at 1-second intervals. Furthermore, those skilled in the art can adjust this frequency based on the actual operating characteristics of the target software. For example, for software with relatively stable resource fluctuations, the sampling frequency can be appropriately reduced to once every 3-5 seconds to reduce data storage pressure. Moreover, when the sampling frequency is reduced, if the duration of the acquisition unit remains unchanged, the number of sampling points within each acquisition unit will decrease accordingly. Therefore, it is necessary to ensure that the number of sampling points is not less than the minimum sample size required for statistical calculation, typically no less than 30 sampling points, to guarantee the reliability of the calculation.

[0034] Specifically, the process of extracting the distribution morphological features of the operation traces includes: Based on the arrival time sequence of each operation trace within the acquisition unit, calculate the operation arrival dispersion of the arrival interval between adjacent traces; In this embodiment, the dispersion of the operation arrival is determined by calculating the coefficient of variation of the arrival interval between adjacent traces; Based on the sequence of node dwell time of each operation trace in the acquisition unit, calculate the operation dwell time deviation. In this embodiment, the standard deviation of each difference is determined by calculating the difference between each dwell time and the average dwell time in the acquisition unit, and is used as the operation dwell deviation. The uniformity of operation coverage is calculated based on the proportion of operation traces involving different functional modules within the acquisition unit. In this embodiment, the proportion of operation traces is determined by calculating the ratio of the number of operation traces belonging to the same functional module within the acquisition unit to the total number of all operation traces within the acquisition unit. Then, the information entropy of the proportion distribution formed by the proportions of operation traces of all functional modules within the acquisition unit is calculated, and the ratio of the information entropy to the maximum entropy is determined as the uniformity of operation coverage.

[0035] The operation arrival dispersion, the operation stay deviation, and the operation coverage uniformity are used as the distribution morphology features.

[0036] The maximum entropy is the theoretical maximum value that the information entropy can reach when the operation traces are evenly distributed among the functional modules. The closer the ratio of information entropy to maximum entropy is to 1, the closer the distribution of operations among the functional modules is to a uniform distribution.

[0037] Specifically, the process of extracting rhythmic features of resource consumption includes: The intensity of resource fluctuations is calculated based on the deviation sequence of resource occupancy at each time point from the average resource occupancy within the acquisition unit in the resource consumption time series. In this embodiment, the difference between the resource occupancy at each time point and the average resource occupancy within the acquisition unit is used as the resource deviation, and the corresponding deviation sequence is determined. Then, the resource fluctuation intensity is determined by calculating the standard deviation of the deviation sequence.

[0038] Extract the time interval between each adjacent peak in the resource consumption time series, determine the peak interval sequence, and calculate the distribution interval uniformity of the resource peaks; The uniformity of the distribution interval is determined by calculating the coefficient of variation of the peak interval sequence.

[0039] Based on the ratio of the duration of the rising segment to the falling segment in the resource consumption time series, calculate the symmetric ratio of resource consumption. In this embodiment, based on the peak and trough positions in the resource consumption time series, the time period between a trough and an adjacent peak is taken as the rising segment, and the time period between a peak and an adjacent trough is taken as the falling segment. The duration of each rising segment and the duration of each falling segment are extracted respectively, and the ratio of the duration of the rising segment to the duration of the falling segment is calculated as the symmetrical ratio of resource consumption.

[0040] The resource fluctuation intensity, the distribution interval uniformity, and the symmetry ratio of resource consumption are combined to form the rhythmic feature.

[0041] It is understood that the resource consumption time series is multi-dimensional data, namely, the processor utilization rate, memory usage, and storage read / write rate recorded at each sampling time. When extracting rhythmic features, one item is selected from the multi-dimensional resource consumption time series as the primary monitoring indicator, and its value at each sampling time is extracted to form a single-dimensional resource consumption time series. The remaining resource consumption items are used as auxiliary monitoring indicators for cross-validation when the primary monitoring indicator is abnormal.

[0042] Among them, processor utilization refers to the percentage of processor resources used by the target software process or the entire system at the sampling time, reflecting the degree of software consumption of computing resources; memory usage refers to the amount of physical or virtual memory occupied by the target software process at the sampling time, reflecting the software's demand for storage resources; and storage read / write rate refers to the speed at which the target software performs read and write operations on storage devices at the sampling time, reflecting the software's input / output load. Based on the fact that the sensitivity of each resource consumption varies in different types of software systems, for example, compute-intensive systems, such as image processing and scientific computing software, are more sensitive to changes in processor utilization; memory-intensive systems, such as big data processing and caching service software, are more sensitive to changes in memory usage; and I / O-intensive systems, such as file services and database software, are more sensitive to changes in storage read / write rate. Therefore, the more sensitive resource consumption is used as the primary monitoring indicator to construct the corresponding resource consumption time series. Furthermore, those skilled in the art can flexibly determine the primary monitoring indicator based on the actual operating characteristics of the target software, and can also choose other resource indicators as supplements or substitutes, such as network bandwidth utilization, GPU utilization, etc.

[0043] Specifically, the process of determining the matching degree between operation traces and resource consumption within the acquisition unit includes: By placing distribution morphology features and rhythm features under the same comparison framework, the temporal overlap between each component of the distribution morphology features and each component of the rhythm features is calculated respectively. The matching degree is obtained by combining the overlap of each time domain factor. The temporal overlap degree is determined based on the time misalignment between the fluctuation times of the distribution morphology feature and the fluctuation times of the rhythm feature.

[0044] Please see Figure 2 As shown, it is a logic block diagram for determining the time-domain overlap degree according to an embodiment of the present invention. In this embodiment, the process of determining the time-domain overlap degree includes: Extract the sequence of fluctuation time markers from each component of the distribution morphology characteristics to form a morphology set; Extract the sequence of fluctuation time markers from each component of the rhythm features to form a rhythm set; Using the markers in the morphology set as anchors, identify the markers with the closest timestamps in the rhythm set to form marker pairings; For each pair of marker points, the absolute value of the difference between their timestamps is calculated as the time misalignment amount of the marker point pairing; The proportion of the number of successfully paired markers to the smaller of the total number of markers in the morphology set and the rhythm set is used as the coverage completeness of marker pairing. Based on the mean and standard deviation of the time misalignment of each successfully paired marker, 1 / (1+μ×σ) is taken as the time proximity of the marker pairing, where μ is the mean and σ is the standard deviation. Calculate the product of the first weight coefficient and the coverage completeness, and the product of the second weight coefficient and the temporal proximity, respectively. The sum of the two products is determined as the temporal overlap, wherein the sum of the first weight coefficient and the second weight coefficient is 1. The smaller value is selected as the total number of markers between the total number of markers in the morphology set and the total number of markers in the rhythm set.

[0045] Specifically, the first and second weighting coefficients are assigned equally by default, meaning that coverage completeness and temporal proximity have the same impact on temporal overlap. Based on this, the relative magnitudes of the weighting coefficients can be adjusted according to the varying sensitivities of the target software's application scenario to the degree of matching between operational and resource consumption fluctuations and the degree of time synchronization. If the application scenario is more sensitive to quantity matching, the first weighting coefficient is increased; if the application scenario is more sensitive to time synchronization, the second weighting coefficient is increased. Furthermore, those skilled in the art can determine the specific values ​​based on the actual operating characteristics of the target software, which will not be elaborated further here.

[0046] In this embodiment, the temporal proximity is determined by multiplying the mean and standard deviation. The smaller μ×σ is, the closer the temporal proximity is to 1, indicating a smaller overall temporal misalignment of paired markers and a more stable misalignment between pairs, i.e., tighter temporal alignment. Conversely, the larger μ×σ is, the smaller the temporal proximity is, indicating poorer temporal alignment. Therefore, temporal proximity is inversely related to μ×σ; the smaller μ×σ is, the higher the temporal proximity.

[0047] Specifically, the process of determining the matching degree includes: Extract the temporal overlap corresponding to operation arrival dispersion, operation dwell deviation, and operation coverage uniformity, respectively. The time-domain overlap is normalized, and the arithmetic mean of the normalized time-domain overlap is taken as the matching degree.

[0048] In this embodiment, the normalization process employs extreme value normalization, where the maximum and minimum values ​​are the maximum and minimum temporal overlap degrees corresponding to each component within the historical normal acquisition units, respectively. For example, temporal overlap degree data for each component of several consecutive acquisition units under the historical normal operating state of the target software are obtained, and the maximum value is taken as the maximum value, and the minimum value is taken as the minimum value. After normalization, the temporal overlap degrees corresponding to the three components are within the same numerical range, and the arithmetic mean of the normalized temporal overlap degrees is taken as the matching degree.

[0049] Please see Figure 3 The diagram shown is a logical block diagram for evaluating whether target software has a tendency to become unstable, according to an embodiment of the present invention. In this embodiment, the process of evaluating whether the target software has a tendency to become unstable includes: Obtain the matching degree of several consecutive acquisition units and construct a time series sequence of matching degree; Calculate the decrease between adjacent values ​​in the matching degree time series to obtain the matching degree decay sequence; If the decrease in the matching degree decay sequence is positive for a predetermined number of consecutive times, and the decrease increases successively, then the matching degree is determined to be in an accelerated decay state. If the matching degree is in an accelerated decay state and the current matching degree is lower than the preset matching degree, it is determined that the target software has a tendency to become unstable.

[0050] Understandably, in a matching degree decay sequence, a single decrease only indicates a decline in the matching degree between two adjacent acquisition units, which may stem from normal business fluctuations or momentary interference, and is insufficient to constitute a reliable basis for trend judgment. Two consecutive decreases begin to show a certain directionality, but the number of data points is still small, insufficient to rule out accidental factors, especially in scenarios where the matching degree itself fluctuates slightly, two consecutive decreases may still occur due to random fluctuations. Based on this, in this embodiment, the predetermined number of times is set to 3, achieving a better balance between false alarm rate control and prediction timeliness. Of course, those skilled in the art can flexibly adjust this based on the actual scenario.

[0051] In this embodiment, the preset matching degree is constructed by acquiring matching degree data from a series of consecutive data collection units under normal historical operating conditions of the target software. A statistical sample set of matching degrees is then built, and the lowest quantile of this statistical sample set is taken as the preset matching degree, for example, the 5th percentile or the 10th percentile. When sufficient historical data is lacking, the maintenance personnel can set an initial value based on experience and dynamically adjust it during software operation based on actual results. For example, if the false alarm rate is high, the preset matching degree can be appropriately reduced; if the false negative rate is high, the preset matching degree can be appropriately increased.

[0052] Specifically, the process of identifying instability triggers includes: The changes of each component in the distribution morphology feature and each component in the rhythm feature within the continuous acquisition unit are compared. If the change in distribution morphology occurs before the change in rhythmic characteristics, and the magnitude of the change in distribution morphology is greater than the magnitude of the change in rhythmic characteristics, then the tendency of instability triggers is identified as an operational-side induced tendency. If the change in rhythmic characteristics precedes the change in distribution morphology characteristics, and the magnitude of the change in rhythmic characteristics is greater than the magnitude of the change in distribution morphology characteristics, then the tendency of instability triggers will be identified as a resource-side triggering tendency. If the changes of both occur synchronously and the magnitude of the changes is within the preset equilibrium range, then the tendency of the instability trigger will be identified as a bilateral synergistic triggering tendency. The change state includes the direction of change and the magnitude of change.

[0053] In this embodiment, the starting time and magnitude of the change of the earliest changing component in the distribution morphology feature are respectively used as the starting time and representative magnitude of the overall change of the distribution morphology feature. The starting time and magnitude of the change in the earliest changing component in the rhythmic feature are used as the starting time and representative magnitude of the overall change in the rhythmic feature.

[0054] If the overall change in the distribution pattern characteristics begins earlier than the overall change in the rhythm characteristics, and the representative change amplitude of the distribution pattern characteristics is greater than the representative change amplitude of the rhythm characteristics, then the tendency of instability triggers will be identified as the operational-side triggering tendency. If the overall change in rhythmic characteristics begins earlier than the overall change in distributional characteristics, and the representative change amplitude of rhythmic characteristics is greater than the representative change amplitude of distributional characteristics, then the tendency of instability triggers will be identified as a resource-side induced tendency.

[0055] If the changes of the two start at the same acquisition unit and the ratio of their representative change amplitudes is within the preset equilibrium range, then the tendency of instability cause will be identified as a bilateral synergistic induced tendency.

[0056] Specifically, the balance between the amplitudes of distribution morphology and rhythmic characteristics is measured by the ratio of their variation amplitudes. If the upper limit is set too high, a situation where one side's amplitude is significantly dominant may be misjudged as being induced by bilateral coordination. When the actual instability is mainly driven by one side, the investigation direction may be scattered due to the misjudgment of bilateral coordination. Based on this, in this embodiment, the upper limit of the preset balance range is set to 1.5, and the ratio 1 obtained by equalizing the amplitudes of the two is taken as the lower limit of the preset balance range, i.e., the preset balance range is [1, 1.5]. Of course, those skilled in the art can flexibly adjust the upper limit of this range according to the normal fluctuation amplitude of the target software. For example, for systems with low noise levels, the range can be appropriately narrowed; for systems with large fluctuation amplitudes, the range can be appropriately widened.

[0057] Specifically, issuing instability prediction signals includes: Determine the type label of the instability prediction signal based on the tendency of instability triggers; The urgency level of the instability prediction signal is determined based on the deviation between the current matching degree and the preset matching degree; The type label and the emergency level are combined into an instability prediction signal set and then issued.

[0058] Specifically, it also includes: Record the operation execution traces and resource consumption time sequence within several acquisition units before and after the moment the instability prediction signal is issued, forming an operational instability sample; The aforementioned operational instability samples will be included in the historical instability case library.

[0059] Please see Figure 4 As shown, it is a logic block diagram for extracting historical control records corresponding to operational instability samples according to an embodiment of the present invention. In this embodiment, extracting the historical control records corresponding to the operational instability samples includes: If the instability similarity condition is met, the historical control records corresponding to the operational instability sample are extracted as auxiliary control suggestions. The instability similarity condition includes a similarity between the instability instability trigger and the operational instability samples in the historical instability case library that is greater than a preset similarity. If there are multiple unstable samples that meet the instability similarity conditions, the historical control record corresponding to the unstable sample with the highest similarity is selected as an auxiliary control suggestion.

[0060] In this embodiment, the process of determining the similarity includes: Obtain the type label of the current instability trigger tendency and the corresponding feature change data, and combine them into the current instability trigger tendency vector; Calculate the similarity between the current instability instability inclination vector and the instability inclination vector of each operational instability sample in the historical instability case library; The type labels include operation-side induced tendency, resource-side induced tendency, and bilateral collaborative induced tendency. The feature change data includes the direction and magnitude of change of each component of the distribution morphology feature and each component of the rhythm feature within the continuous acquisition unit. The similarity is determined based on the consistency of type labels, the consistency of the direction of change of each component, and the similarity of the magnitude of change.

[0061] If the type labels are different, it is determined that the current instability cause does not meet the similarity condition with the historical instability sample, and no further comparison is needed; If the type labels are the same, the consistency of the change direction of each component is compared. If the direction is the same, 1 point is awarded; if the direction is different, 0 points are awarded. The average score of each component is taken as the direction score. Determine the degree of closeness of the change range. If the degree of closeness is within a preset range, 1 point is awarded; if the degree of closeness is not within the preset range, 0 points are awarded. The average score of each component is taken as the closeness score. The similarity is defined as the arithmetic mean of the directional score and the scores of similarity.

[0062] The proximity is defined as the ratio of the change magnitude of each component corresponding to the historical operational instability sample to the change magnitude of each component corresponding to the current instability cause tendency.

[0063] Understandably, a higher preset similarity setting only outputs historical samples highly similar to the current instability trigger, resulting in more targeted recommendations. However, due to stringent conditions, suitable samples may not be matched. Conversely, a lower preset similarity setting outputs more historical samples, covering a wider matching range, but may lead to insufficient matching accuracy and reduced applicability of the recommendations. Therefore, in this embodiment, the preset similarity is set to 0.8. Furthermore, those skilled in the art can flexibly adjust the preset similarity based on the size of the historical case database, the richness of the cases, and the required matching accuracy.

[0064] In this embodiment, the preset proximity range is determined symmetrically with 1 as the center. If the range is too narrow, the current change amplitude must be highly consistent with the historical change amplitude, which may exclude substantially similar cases due to amplitude differences caused by normal fluctuations, thus reducing the matching rate. If the range is too wide, cases with significantly different amplitude differences may be misjudged as close, reducing the matching accuracy. Based on this, the preset proximity range is set to [0.5, 2.0] to reflect that when the current change amplitude differs from the historical change amplitude by no more than one time, they are considered to be at a similar order of magnitude, serving as an effective basis for similarity determination. Of course, those skilled in the art can flexibly adjust the upper and lower limits of the preset proximity range according to the typical fluctuation range of the change amplitude of each component.

[0065] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for monitoring software runtime status based on multiple parameters, characterized in that, include: Continuously collect the target software's runtime data, generate an operation execution trace set and a resource consumption time series, and extract the distribution pattern characteristics of the operation traces and the rhythmic characteristics of resource consumption. The distribution morphology features and rhythm features within the same acquisition unit are compared to determine the degree of matching between operation traces and resource consumption within the acquisition unit. Based on the attenuation of the matching degree in subsequent acquisition units, assess whether the target software has a tendency to become unstable. If the target software shows a tendency to become unstable, the tendency to cause instability is identified based on the decay direction of the matching degree, and an instability prediction signal is issued. The similarity between the instability initiation tendency and the operational instability samples in the historical instability case library is determined, so as to extract the historical control records corresponding to the operational instability samples as auxiliary control suggestions.

2. The software operation status monitoring method based on multiple parameters according to claim 1, characterized in that, The process of generating an operation execution trace set includes: Capture the call chain path information and dwell time information generated during the execution of each operation event; The call chain path information is associated with the dwell time information to form an operation execution trace entry; Using a predetermined time period as the collection unit, all operation execution trace entries within the same collection unit are aggregated to form the operation execution trace set of the collection unit.

3. The software operation status monitoring method based on multiple parameters according to claim 1, characterized in that, The process of generating a time-series sequence of resource consumption includes: Collect the resource consumption of the target software at a predetermined sampling frequency; Arrange the sampled values ​​within the same acquisition unit according to the time sequence to form the resource consumption time sequence of the acquisition unit; The resource consumption includes processor utilization, memory usage, and storage read / write speed.

4. The software operation status monitoring method based on multiple parameters according to claim 2, characterized in that, The process of extracting the distribution morphological features of operation traces includes: Based on the arrival time sequence of each operation trace within the acquisition unit, calculate the operation arrival dispersion of the arrival interval between adjacent traces; Based on the sequence of node dwell time of each operation trace in the acquisition unit, calculate the operation dwell time deviation. The uniformity of operation coverage is calculated based on the proportion of operation traces involving different functional modules within the acquisition unit. The operation arrival dispersion, the operation stay deviation, and the operation coverage uniformity are used as the distribution morphology features.

5. The software operation status monitoring method based on multiple parameters according to claim 3, characterized in that, The process of extracting rhythmic features of resource consumption includes: The intensity of resource fluctuations is calculated based on the deviation sequence of resource occupancy at each time point from the average resource occupancy within the acquisition unit in the resource consumption time series. Extract the time interval between each adjacent peak in the resource consumption time series, determine the peak interval sequence, and calculate the distribution interval uniformity of the resource peaks; Based on the ratio of the duration of the rising segment to the falling segment in the resource consumption time series, calculate the symmetric ratio of resource consumption. The resource fluctuation intensity, the distribution interval uniformity, and the symmetry ratio of resource consumption are combined to form the rhythmic feature.

6. The software operation status monitoring method based on multiple parameters according to claim 1, characterized in that, The process of determining the matching degree between operation traces and resource consumption within the acquisition unit includes: By placing distribution morphology features and rhythm features under the same comparison framework, the temporal overlap between each component of the distribution morphology features and each component of the rhythm features is calculated respectively. The matching degree is obtained by combining the overlap of each time domain factor. The temporal overlap degree is determined based on the time misalignment between the fluctuation times of the distribution morphology feature and the fluctuation times of the rhythm feature.

7. The software operation status monitoring method based on multiple parameters according to claim 6, characterized in that, The process of assessing whether the target software exhibits a tendency towards operational instability includes: Obtain the matching degree of several consecutive acquisition units and construct a time series sequence of matching degree; Calculate the decrease between adjacent values ​​in the matching degree time series to obtain the matching degree decay sequence; If the decrease in the matching degree decay sequence is positive for a predetermined number of consecutive times, and the decrease increases successively, then the matching degree is determined to be in an accelerated decay state. If the matching degree is in an accelerated decay state and the current matching degree is lower than the preset matching degree, it is determined that the target software has a tendency to become unstable.

8. The software operation status monitoring method based on multiple parameters according to claim 1, characterized in that, The process of identifying instability triggers includes: The changes of each component in the distribution morphology feature and each component in the rhythm feature within the continuous acquisition unit are compared. If the change in distribution morphology occurs before the change in rhythmic characteristics, and the magnitude of the change in distribution morphology is greater than the magnitude of the change in rhythmic characteristics, then the tendency of instability triggers is identified as an operational-side induced tendency. If the change in rhythmic characteristics precedes the change in distribution morphology characteristics, and the magnitude of the change in rhythmic characteristics is greater than the magnitude of the change in distribution morphology characteristics, then the tendency of instability triggers will be identified as a resource-side triggering tendency. If the changes of both occur synchronously and the magnitude of the changes is within the preset equilibrium range, then the tendency of the instability trigger will be identified as a bilateral synergistic triggering tendency. The change state includes the direction of change and the magnitude of change.

9. The software operation status monitoring method based on multiple parameters according to claim 8, characterized in that, Issuing instability prediction signals, including: Determine the type label of the instability prediction signal based on the tendency of instability triggers; The urgency level of the instability prediction signal is determined based on the deviation between the current matching degree and the preset matching degree; The type label and the emergency level are combined into an instability prediction signal set and then issued.

10. The software operation status monitoring method based on multiple parameters according to claim 1, characterized in that, Also includes: Record the operation execution traces and resource consumption time sequence within several acquisition units before and after the moment the instability prediction signal is issued, forming an operational instability sample; The aforementioned operational instability samples will be included in the historical instability case library.

Images