Anomaly detection method, apparatus, electronic device, and readable medium

Abstract

The application provides an anomaly detection method and device, electronic equipment and readable medium. The method comprises: obtaining a virtual document structure tree of a page to be detected, the virtual document structure tree comprising virtual structure nodes, and at least one of a structure dependency relationship and a business dependency relationship existing between the virtual structure nodes; for a component unloaded in the page to be detected, removing the structure dependency relationship of a virtual structure node associated with the component in the virtual document structure tree to obtain a business dependency relationship; selecting a node to be detected from the virtual structure node with the removed structure dependency relationship according to the business dependency relationship and constructing a topology to obtain a node to be detected topology; and performing memory leakage analysis on the corresponding virtual structure node in the page to be detected according to the node to be detected topology to obtain an anomaly detection result of the page to be detected. The method can reduce the number of interference nodes, reduce the difficulty of locating the leakage nodes, and improve the execution efficiency of anomaly detection.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an anomaly detection method, apparatus, electronic device, and readable medium. Background Technology

[0002] As front-end single-page applications handle more and more business, the page structure becomes increasingly complex. When a page memory leak occurs, the leaked objects can be very large. After prolonged use of the page, it can cause page lag or crashes, affecting business operations.

[0003] In related technologies, anomaly detection of page memory leaks is generally based on analyzing the nodes in the webpage structure using the browser kernel's memory structure. By examining the nodes on the page and the nodes in memory, leaking nodes can be found, thereby locating the memory leak location.

[0004] However, in the above scheme, since a large number of node caches, non-leaking nodes, and framework dependency nodes are usually stored in memory, the number of interfering nodes in the process of locating leaking nodes is much greater than the nodes that cause the leak, which increases the difficulty of locating leaking nodes and reduces the execution efficiency of anomaly detection. Summary of the Invention

[0005] This application provides an anomaly detection method, apparatus, electronic device, and readable medium to reduce the number of interfering nodes, lower the difficulty of locating leaking nodes, and improve the execution efficiency of anomaly detection.

[0006] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0007] According to one aspect of the embodiments of this application, an anomaly detection method is provided, comprising:

[0008] Obtain the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structure nodes, and there are at least one of structural dependency relationships and business dependency relationships among the virtual structure nodes.

[0009] For the components that have been uninstalled in the page to be detected, remove the structural dependencies of the virtual structure nodes associated with the components in the virtual document structure tree to obtain the business dependencies;

[0010] Based on the business dependencies, select nodes to be detected from the virtual structural nodes that have been decoupled from the structural dependencies and construct a topology to obtain the topology of the nodes to be detected. The topology of the nodes to be detected includes one or more of the following: isolated nodes, circular nodes, farthest recycled nodes and most recently recycled nodes.

[0011] Based on the topology of the node to be detected, memory leak analysis is performed on the corresponding virtual structure nodes in the page to be detected to obtain the anomaly detection results of the page to be detected.

[0012] According to one aspect of the embodiments of this application, an anomaly detection device is provided, comprising:

[0013] The structure tree acquisition module is configured to acquire the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structure nodes, and there are at least one of structural dependency relationships and business dependency relationships among the virtual structure nodes.

[0014] The relationship removal module is configured to remove the structural dependencies of virtual structure nodes associated with the component in the virtual document structure tree for the component that has been uninstalled in the page to be detected, thereby obtaining the business dependencies.

[0015] The topology building module is configured to select nodes to be detected from virtual structural nodes that have decoupled from the structural dependencies based on the business dependencies and build a topology to obtain the topology of the nodes to be detected. The topology of the nodes to be detected includes one or more of the following: isolated nodes, circular nodes, farthest recycled nodes and most recently recycled nodes.

[0016] The leakage analysis module is configured to perform memory leak analysis on the corresponding virtual structure nodes in the page to be detected based on the topology of the node to be detected, and obtain the abnormal detection results of the page to be detected.

[0017] In some embodiments of this application, based on the above technical solutions, the relationship removal module is specifically configured to: unload the virtual structure node corresponding to the page component from the page data of the page to be detected according to the state update of the page component in the page to be detected; and in response to the unloading operation of the virtual structure node, delete the structural dependency relationship associated with the virtual structure node from the virtual document structure tree of the page to be detected through a first tool.

[0018] In some embodiments of this application, based on the above technical solutions, the relationship removal module is further configured to: add the first tool to the page environment of the page to be detected; modify the environment variables in the page environment so that when the page component in the page to be detected is unloaded, the first tool is triggered to remove the structural dependency relationship associated with the virtual structure node.

[0019] In some embodiments of this application, based on the above technical solutions, the topology construction module is specifically configured to: obtain heap snapshot data of the page to be detected, wherein the heap snapshot data contains a virtual document structure tree that removes the structural dependency relationship; obtain, through a second tool, the virtual structure node containing a deletion mark from the virtual document structure tree in the heap snapshot data, as the node to be detected, wherein the deletion mark of the virtual structure node is added when removing the structural dependency relationship; and construct the topology of the node to be detected through the second tool based on the business dependency relationship associated with the node to be detected in the heap snapshot data.

[0020] In some embodiments of this application, based on the above technical solutions, the topology construction module is specifically configured to: obtain heap memory data of the page to be detected from the browser according to the heap snapshot acquisition instruction of the browser for the page to be detected; and obtain a heap snapshot file containing the heap memory data through the browser after the browser has collected the heap memory data.

[0021] In some embodiments of this application, based on the above technical solutions, the relationship removal module is further configured to: add a deletion mark to each virtual structure node in the virtual document structure tree when the page component in the page to be detected is unloaded; and remove the dependency relationship between the global node and the virtual structure node containing the deletion mark in the virtual document structure tree according to the business dependency relationship in the virtual document structure tree.

[0022] In some embodiments of this application, based on the above technical solutions, the topology construction module is specifically configured as follows: for each node to be detected, the second tool is used to obtain the business dependency relationship associated with the node to be detected; cyclic dependency detection is performed based on the obtained business dependency relationship to obtain the node to be detected with cyclic dependency, which is taken as a link point; based on the distance between each node to be detected and the root node, the node to be detected farthest from the root node is obtained as the farthest node; the node to be detected that has no business dependency relationship with other nodes is obtained as an isolated node; and the topology of the node to be detected is generated based on the isolated node, the farthest node, and the link point.

[0023] In some embodiments of this application, based on the above technical solutions, the leakage analysis module is specifically configured to: view the node metadata of each node in the topology of the node to be detected in the browser of the page to be detected according to the topology of the node to be detected; perform reserved path parsing and closure detection according to the reserved path and reference relationship of each node to obtain abnormal nodes with memory leaks.

[0024] In some embodiments of this application, based on the above technical solutions, the leakage analysis module is specifically configured to: obtain the code call information of the corresponding page component in the page to be detected according to the node metadata of the virtual structure node in the topology of the node to be detected, wherein the node metadata contains the call information of the corresponding page component; and map the call location information to the source code file according to the source mapping information to obtain the abnormal code, which is used as the abnormal detection result of the page to be detected.

[0025] In some embodiments of this application, based on the above technical solutions, the leakage analysis module is specifically configured to: perform feature matching between the abnormal code and the abnormal records in the abnormal code library, wherein the abnormal records contain features of the abnormal type and corresponding abnormal repair information; if the abnormal code exists in the abnormal record, then generate abnormal repair prompt information for the abnormal code based on the abnormal repair information in the abnormal record and the abnormal code.

[0026] According to one aspect of the embodiments of this application, an electronic device is provided, the electronic device comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform an anomaly detection method as described above by executing the executable instructions.

[0027] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the anomaly detection method as described above.

[0028] According to one aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the anomaly detection method provided in the various optional implementations described above.

[0029] In embodiments of this application, the anomaly detection device acquires the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structural nodes, and these virtual structural nodes have at least one of structural dependencies and business dependencies. For components that are unloaded in the page to be detected, the structural dependencies of the virtual structural nodes associated with the components in the virtual document structure tree are removed to obtain business dependencies. Then, based on the business dependencies, nodes to be detected are selected from the virtual structural nodes whose structural dependencies have been removed, and a topology is constructed to obtain the node topology. The node topology includes one or more of isolated nodes, circular nodes, furthest recycled nodes, and most recently recycled nodes. Finally, based on the node topology, memory leak analysis is performed on the corresponding virtual structural nodes in the page to be detected to obtain the anomaly detection result for the page to be detected. Through the above method, for the virtual document structure tree, the scheme first filters out unloaded nodes by removing structural dependencies, then selects nodes to be detected based on business dependencies, and finally performs memory leak analysis on the selected nodes. This filters the nodes to be analyzed before performing leak analysis, reducing the number of interfering nodes, lowering the difficulty of locating leaking nodes, and improving the execution efficiency of anomaly detection.

[0030] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0031] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0032] Figure 1 The anomaly detection method according to the embodiments of this application is applied to the network structure of a payment platform.

[0033] Figure 2 The overall flowchart of the anomaly detection scheme in the embodiments of this application is shown.

[0034] Figure 3 This is a flowchart of an anomaly detection method according to an embodiment of this application.

[0035] Figure 4 This is a schematic diagram illustrating an application scenario of an embodiment of this application.

[0036] Figure 5 This is a flowchart of an anomaly detection method according to an embodiment of this application.

[0037] Figure 6 This is a flowchart illustrating the anomaly detection process in one embodiment of this application.

[0038] Figure 7 This is a schematic diagram of the leakage node analysis process in an embodiment of this application.

[0039] Figure 8 This is a schematic diagram illustrating the topology diagram of the scenario in this application embodiment.

[0040] Figure 9 A schematic block diagram of the anomaly detection device in an embodiment of this application is shown.

[0041] Figure 10 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0042] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0043] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0044] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve the predetermined function, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0045] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0046] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0047] It should be understood that the solution proposed in this application can be applied to anomaly detection systems, specifically in the process of detecting memory leak nodes in front-end pages with memory leaks. A memory leak refers to the failure to promptly release allocated memory space after use during program execution, resulting in this memory being unusable. As the program runs, the leaked memory accumulates, potentially exhausting the system's available memory resources. Memory leaks can be caused by improperly released object references, untimely resource closing, or issues with event listeners or callback functions. In investigating the cause, manual inspection of memory data or analysis of memory snapshots is often required to identify unreleased memory blocks. Memory leak detection is involved in multiple scenarios. For example, in web application development, developers need to implement complex interactions and functions, such as the front-end pages of e-commerce platforms, where user actions like browsing products, adding items to the shopping cart, and switching pages frequently trigger web page events. Developers need to check the developed web pages for memory leaks to promptly identify and fix such issues. Another example is in web performance optimization scenarios, such as news and information websites that receive massive daily user visits. Website operators need to conduct regular performance audits of their web pages through memory leak detection to prevent memory leaks. For example, they need to prevent image resources from failing to release memory correctly, which could lead to increasing browser memory usage and slow page loading after a user has viewed multiple articles. In mobile internet scenarios, some mobile devices have relatively limited memory resources. Development teams need to detect and resolve memory leaks on mobile devices when adapting web pages for mobile use to ensure stable and efficient operation across different devices. For example, in travel booking mobile web pages, users perform multiple searches and filtering operations while searching for hotels and flights. Developers need to prevent memory leaks caused by timers not being cleared in time. In web game scenarios, web games have rich animation effects and real-time interactivity, resulting in complex memory usage. For example, strategy web games constantly create and destroy game objects such as buildings and soldiers. Game development requires monitoring memory usage during gameplay to promptly detect and fix memory leaks. This prevents players from experiencing noticeable lag and operational delays as gameplay progresses, ensuring smooth gameplay over extended periods and improving player immersion and satisfaction.

[0048] As front-end single-page applications (SPAs) handle increasingly complex business logic, their page structures become more intricate. When a page memory leak occurs, the amount of data leaked can be enormous, leading to page lag or crashes after prolonged use, impacting business operations. Current techniques for detecting page memory leaks typically rely on analyzing the browser kernel's memory structure to identify nodes within the webpage. This involves comparing on-page nodes with those in memory to pinpoint the leak. However, this approach is hampered by the fact that memory usually stores a large number of cached nodes, non-leaking nodes, and framework dependency nodes. The number of interfering nodes in the process of locating the leak far exceeds the number of nodes causing the leak, increasing the difficulty of locating the leak and reducing the efficiency of anomaly detection.

[0049] Based on this, the technical solution of this application proposes an anomaly detection scheme. Specifically, please refer to... Figure 1 The anomaly detection method according to embodiments of this application, applied to a website's network structure, can mainly include a terminal device 110, a network 120, and a server 130. The terminal device 110 can include smartphones, tablets, laptops, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The terminal device 110 typically has a client installed for accessing the website, such as an application or browser. The server 130 can be a website server providing web page browsing services. The terminal device 110 accesses the server 130 through the network 120 to browse the web pages provided by the server 130. Website developers can use the server 130 to analyze memory anomalies in the terminal device 110. Figure 1 As shown, terminal device 110 can provide services such as web browsing, memory snapshots, and tool execution, while server 130 provides services such as snapshot analysis and leak location. In some embodiments, terminal device 110 and server 130 can both be part of a website development environment. Specifically, they can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The communication link between terminal device 110 and server 130 is connected through various connection types of communication media in network 120, such as wired or wireless communication links.

[0050] Depending on the implementation requirements, the system architecture in this application embodiment can have any number of servers. For example, server 130 can be a server group composed of multiple server devices. Furthermore, the technical solutions provided in this application embodiment can be applied to a computing platform, or can be implemented jointly by various parts of the system; this application does not impose any special limitations on this.

[0051] Please see Figure 2 . Figure 2 A general flowchart of the anomaly detection scheme in an embodiment of this application is shown. Figure 2 As shown, during the browsing process of a page, as the user performs browsing operations, when page components are unloaded during the page browsing process, the processing tool provided by the webpage will dismantle the structural relationships related to the components. When memory leak checks are required, the terminal device can obtain a heap snapshot of the currently browsed page according to instructions in 220. The server, in 230, uses the processing tool provided by the terminal device to analyze the heap, identify suspicious nodes in the page that need to be checked, and then in 240, performs a detailed inspection of the code of these suspicious nodes to determine which nodes have memory leaks.

[0052] The implementation details of the technical solutions in the embodiments of this application are described in detail below: Figure 3 A flowchart of an anomaly detection method according to an embodiment of this application is shown. This anomaly detection method can be executed by a device with computing processing capabilities, such as a terminal device or server in a website development environment. The solution of this application can be applied to a website development environment or an operation and maintenance environment; this application will use a development environment as an example for description. (Refer to...) Figure 3 As shown, this anomaly detection method includes at least steps S310 to S340, which are described in detail below:

[0053] Step S310: Obtain the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structure nodes, and there are at least one of structural dependency relationship and business dependency relationship among the virtual structure nodes.

[0054] In this embodiment, the anomaly detection device can obtain the virtual document structure tree of the page to be detected from the browser. The page to be detected may contain a document structure tree and multiple virtual document structure trees. In the scheme of this application, each virtual document structure tree can be processed separately. The virtual document structure tree contains virtual structure nodes. The virtual structure nodes in the virtual document structure tree correspond to the nodes in the document structure tree, and the nodes in the document structure tree correspond to the page elements in the page to be detected. There are at least one of structural dependency relationships and business dependency relationships between the virtual structure nodes in the virtual document structure tree. Structural dependency relationships are usually the structural framework relationships used to construct the virtual document structure tree, which are usually established and maintained by the framework program that maintains the virtual document structure tree. Business dependency relationships are usually node relationships established according to business requirements. The relationships between nodes can be various suitable associations, such as call or reference relationships.

[0055] Step S320: For the components that have been uninstalled in the page to be detected, remove the structural dependencies of the virtual structure nodes associated with the components in the virtual document structure tree to obtain the business dependencies.

[0056] In this embodiment, components on the page to be detected can be unloaded for various reasons, such as page updates or parent node refreshes. When a component is unloaded, the anomaly detection device removes the structural dependencies of the virtual structural nodes associated with the component in the virtual document structure tree, thus obtaining the business dependencies. For example, if a component corresponds to a virtual structural node, when the component is unloaded, all structural dependencies associated with the virtual structural node will be removed. The removal operation can be performed by an application used to manage the virtual document structure tree, such as by calling the corresponding interface or modifying related attributes. It can be understood that for virtual structural nodes, after the structural dependencies are removed, the remaining relationships can be considered as business dependencies.

[0057] Step S330: Based on the business dependency relationship, select the node to be detected from the virtual structure nodes that have decoupled from the structural dependency relationship and construct the topology to obtain the topology of the node to be detected. The topology of the node to be detected includes one or more of the following: isolated nodes, circular nodes, farthest recycled nodes, and most recently recycled nodes.

[0058] After removing structural dependencies, the remaining relationships associated with virtual structural nodes can be considered business dependencies. Based on these business dependencies, the anomaly detection device can identify nodes to be detected. Virtual structural nodes are subsets of nodes removed from the virtual document structure tree due to being unloaded, while nodes to be detected are subsets of virtual structural nodes related to business dependencies. Based on these nodes and business dependencies, the topology of the nodes to be detected can be further constructed. It is understood that not all nodes to be detected are actually nodes to be detected. The anomaly detection device selects nodes that meet specific requirements as nodes to be detected, such as isolated nodes, circular nodes, furthest recycled nodes, and most recently recycled nodes. The furthest recycled node and most recently recycled node can be considered the node furthest from the recycled node and the closest node, respectively. Isolated nodes are nodes without related inbound or outbound edges in the business dependencies, while circular nodes are nodes that form circular dependencies in the business dependencies.

[0059] Step S340: Based on the topology of the node to be detected, perform memory leak analysis on the corresponding virtual structure nodes in the page to be detected to obtain the anomaly detection result of the page to be detected.

[0060] In the scheme of this application, the anomaly detection device can find the corresponding virtual structure node in the page to be detected based on the node to be detected in the topology of the node to be detected, and then perform memory leak analysis on the corresponding virtual structure node in the page to be detected, thereby finding the abnormal node where memory leaks occur, which is used as the anomaly detection result of the page to be detected. The memory leak analysis can be performed based on the node metadata of the virtual structure node and the source code of the corresponding component.

[0061] In embodiments of this application, the anomaly detection device acquires the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structural nodes, and these virtual structural nodes have at least one of structural dependencies and business dependencies. For components that are unloaded in the page to be detected, the structural dependencies of the virtual structural nodes associated with the components in the virtual document structure tree are removed to obtain business dependencies. Then, based on the business dependencies, nodes to be detected are selected from the virtual structural nodes whose structural dependencies have been removed, and a topology is constructed to obtain the node topology. The node topology includes one or more of isolated nodes, circular nodes, furthest recycled nodes, and most recently recycled nodes. Finally, based on the node topology, memory leak analysis is performed on the corresponding virtual structural nodes in the page to be detected to obtain the anomaly detection result for the page to be detected. Through the above method, for the virtual document structure tree, the solution first filters out unloaded nodes by removing structural dependencies, then selects nodes to be detected based on business dependencies, and finally performs memory leak analysis on the selected nodes. This filters the nodes to be analyzed before performing leak analysis, reducing the number of interfering nodes, lowering the difficulty of locating leaking nodes, and improving the execution efficiency of anomaly detection.

[0062] In some embodiments of this application, based on the technical solution of this application, during the process of removing the structural dependencies of virtual structural nodes associated with the components in the virtual document structure tree to obtain business dependencies for components uninstalled from the page to be detected, the anomaly detection device can uninstall the virtual structural nodes corresponding to the page components from the page data of the page to be detected according to the state update of the page components in the page to be detected. Then, in response to the uninstallation operation of the virtual structural nodes, the device deletes the structural dependencies associated with the virtual structural nodes from the virtual document structure tree of the page to be detected using a first tool. In this embodiment, during the process of removing structural dependencies, when the state update of the page components in the page to be detected triggers component uninstallation, the anomaly detection device uninstalls the virtual structural nodes corresponding to the page components from the page data of the page to be detected. During this uninstallation process, the components in the document structure tree of the page to be detected are usually modified accordingly. At the same time, the anomaly detection device disconnects the association between the uninstalled part of the virtual structural nodes and the corresponding document structure tree, so that the carried part of the virtual document structure tree can be processed independently. Subsequently, in response to the unloading operation of the virtual structural node, the anomaly detection device removes the structural dependencies associated with the virtual structural node from the virtual document structure tree of the page to be detected using a first tool. The first tool may be pre-deployed on the terminal device and automatically triggered when the browser triggers component unloading to begin the operation of removing structural dependencies. In some embodiments, the first tool also adds a deletion marker to the unloaded virtual structural node to indicate that it is a node that should be deleted. In this way, structural dependencies can be directly removed during page browsing using the first tool, ensuring that the deleted portion of the virtual document structure tree does not contain structural dependencies, reducing the amount of subsequent processing required and improving the efficiency of anomaly handling.

[0063] In some embodiments of this application, based on the technical solution of this application, the anomaly detection device can also add the first tool to the page environment of the page to be detected, and then modify the environment variables in the page environment so that when the page component in the page to be detected is unloaded, the first tool is triggered to release the structural dependency relationship associated with the virtual structural node. Specifically, when the development environment of the page to be detected is deployed, the first tool is added to the development environment and published along with the website. When the browser of the terminal device loads the page to be detected, it also downloads the first tool from the website while browsing the interface. The anomaly detection device modifies the environment variables of the development environment to start the first tool. The first tool is triggered to release the structural dependency relationship associated with the virtual structural node when the page component in the page to be detected is unloaded. In addition, for the virtual structural node of the unloaded page component, the first tool can also add a deletion mark to the virtual structural node after the page component is unloaded, so that the virtual structural node that should be deleted can be directly identified through the deletion mark in the subsequent process. It is understood that in this embodiment, the website can be started in development mode in the development environment, and the first tool may not be included in the actual website deployment. Please refer to Figure 4 . Figure 4 This is a schematic diagram illustrating an application scenario of an embodiment of this application. For example... Figure 4 As shown, assume the terminal device used by the development object and the server deploying the analysis logic with the memory processing solution are different devices. The server adds the first tool to the development environment and deploys it to the terminal device when the webpage is opened. In this application scenario, when the development object needs to analyze the location of memory leaks, it can send a memory snapshot file to the server via the terminal device so that the server can perform subsequent memory analysis steps. Of course, the terminal device used by the development object and the server deploying the analysis logic with the memory processing solution can also be the same device; in this implementation, the server can directly call the stored memory snapshot file in memory to obtain the memory snapshot file of the memory space. By embedding the tool in the environment to automatically decouple the components, the memory leak situation generated when building the virtual document structure tree can be resolved, simplifying the amount of data to be analyzed subsequently and improving the efficiency of node analysis.

[0064] In some embodiments of this application, based on the technical solution of this application, during the process of performing memory leak analysis on the corresponding virtual structure nodes in the page to be tested according to the topology of the nodes to be tested, the anomaly detection device can view the node metadata of each node in the topology of ... The above method provides a way to check for abnormal nodes in memory leaks. Abnormal nodes are identified by tracing the reverse reference chain, thus simplifying the process of checking abnormal nodes.

[0065] In some embodiments of this application, based on the technical solution of this application, during the process of performing memory leak analysis on the corresponding virtual structure nodes in the page to be detected according to the topology of the node to be detected, and obtaining the anomaly detection result of the page to be detected, the anomaly detection device can obtain the code call information of the corresponding page component in the page to be detected according to the node metadata of the virtual structure nodes in the topology of the node to be detected. The node metadata contains the call information of the corresponding page component. Then, according to the source mapping information, the call location information is mapped to the source code file to obtain the abnormal code, which is used as the anomaly detection result of the page to be detected. In this embodiment, the anomaly detection device can obtain the code call information of the corresponding page component in the page to be detected according to the node metadata of the virtual structure node. Specifically, the node metadata contains the call information of the corresponding page component. According to the call stack when the component is created, it can be associated with the specific file path in the node source code repository, which is used as the code call information. Subsequently, the anomaly detection device can perform reverse mapping according to the code call information. The source mapping information is the mapping relationship data between the actual deployed code and the source code constructed according to the source code. According to the source mapping information, the anomaly detection device can find the code content in the source code corresponding to the virtual structure node, which is used as the abnormal code. Using the above method, the abnormal code segment causing the memory leak can be directly located during anomaly detection without the need for manual code searching. This helps reduce the difficulty of the memory leak detection process and improves execution efficiency.

[0066] In some embodiments of this application, based on the technical solution of this application, after mapping the call location information to the source code file according to the source mapping information to obtain the abnormal code as the abnormal detection result of the page to be detected, the abnormal detection device can also perform feature matching between the abnormal code and the abnormal records in the abnormal code library. The abnormal records contain the features of the abnormal type and the corresponding abnormal repair information. If the abnormal code exists in the abnormal record that matches the abnormal code, the abnormal detection device can generate abnormal repair prompt information for the abnormal code based on the abnormal repair information in the abnormal record and the abnormal code. In this embodiment, the abnormal detection device will generate corresponding abnormal repair prompt information based on the found abnormal code to assist the abnormal correction process. Specifically, the abnormal detection device will first perform feature matching between the abnormal code and the abnormal records in the abnormal code library. The abnormal code library is a feature library built according to various memory leak patterns, such as unbound event listeners, uncancelled timers, and residual references in asynchronous callbacks. The abnormal code library contains feature data of various abnormalities, such as the topology, attributes, and dependencies of leaked nodes. When the abnormal code matches an exception in the exception code repository, corresponding exception repair suggestions can be generated based on the matched leakage pattern. These suggestions can include example repair methods, such as adding a cleanup function, unbinding an event, or unsubscribing. They can also highlight the code segment that caused the exception within the abnormal code. By providing repair suggestions after detecting abnormal code, the difficulty and efficiency of exception repair can be simplified.

[0067] In embodiments of this application, a method for... Figure 3 Other detailed embodiments of the technical solution shown in the example are as follows: Figure 5 As shown, in one embodiment of the virtual character control method of this application, the solution of this application may include the following steps:

[0068] Step S510: Obtain the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structure nodes, and there are at least one of structural dependency relationship and business dependency relationship among the virtual structure nodes.

[0069] Optionally, the implementation details of step S510 are the same as those of... Figure 3 The steps S310 shown are the same and will not be repeated here.

[0070] Step S520: For the components that have been uninstalled in the page to be detected, remove the structural dependencies of the virtual structure nodes associated with the components in the virtual document structure tree to obtain the business dependencies.

[0071] Optionally, the implementation details of step S520 are the same as those of... Figure 3The steps S320 shown are the same and will not be repeated here.

[0072] Step S530: Obtain the heap snapshot data of the page to be detected, wherein the heap snapshot data contains a virtual document structure tree that removes the structural dependency relationship;

[0073] Step S540: From the virtual document structure tree in the heap snapshot data, obtain the virtual structure node containing the deletion mark using the second tool, as the node to be detected, wherein the deletion mark of the virtual structure node is added when the structure dependency is released;

[0074] Step S550: Using the second tool, construct the topology of the node to be detected based on the business dependencies associated with the node to be detected in the heap snapshot data. The topology of the node to be detected includes one or more of the following: isolated nodes, circular nodes, farthest recycled nodes, and most recently recycled nodes.

[0075] In this embodiment, the anomaly detection device determines the nodes to be detected based on heap snapshot data. Specifically, the anomaly detection device first obtains the heap snapshot data of the page to be detected, which contains a virtual document structure tree with de-dependencies removed. The heap snapshot data can be obtained through a browser. Since the structural dependencies of the unloaded components have been removed when the components are unloaded, the heap snapshot data contains a virtual document structure tree with de-dependencies removed. It should be emphasized that for components currently displayed or in use on the page to be processed, the corresponding structural dependencies in the virtual document structure tree will not be removed; the components that have been unloaded are the ones whose dependencies are removed. For the virtual document structure tree in the heap snapshot data, the anomaly detection device obtains virtual structure nodes containing deletion markers using a second tool. The second tool can be pre-deployed on a server or development terminal. The anomaly detection device parses the heap snapshot data using the second tool to obtain virtual structure nodes containing deletion markers as nodes to be detected. It can be understood that these virtual structure nodes containing deletion markers are associated nodes of page components that have been deleted. Under normal circumstances, they should be deleted when the page components are unloaded. The fact that nodes marked with deletion still exist indicates that nodes that should be deleted have not yet been deleted. After acquiring these nodes, the anomaly detection device can construct a topology of nodes to be detected based on the business dependencies between the nodes. By using the above method to acquire nodes to be detected through heap snapshot data and constructing the topology, the number of nodes to be checked is reduced to the nodes within the topology, thus reducing the overall number of nodes requiring detailed inspection and improving the efficiency of anomaly detection.

[0076] Step S560: Based on the topology of the node to be detected, perform memory leak analysis on the corresponding virtual structure node in the page to be detected to obtain the abnormal detection result of the page to be detected.

[0077] Optionally, the implementation details of step S560 are the same as those of... Figure 3 The steps S340 shown are the same and will not be repeated here.

[0078] In embodiments of this application, the anomaly detection device acquires the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structural nodes, and these virtual structural nodes have at least one of structural dependencies and business dependencies. For components that are unloaded in the page to be detected, the structural dependencies of the virtual structural nodes associated with the components in the virtual document structure tree are removed to obtain business dependencies. Then, based on the business dependencies, nodes to be detected are selected from the virtual structural nodes whose structural dependencies have been removed, and a topology is constructed to obtain the node topology. The node topology includes one or more of isolated nodes, circular nodes, furthest recycled nodes, and most recently recycled nodes. Finally, based on the node topology, memory leak analysis is performed on the corresponding virtual structural nodes in the page to be detected to obtain the anomaly detection result for the page to be detected. Through the above method, for the virtual document structure tree, the solution first filters out unloaded nodes by removing structural dependencies, then selects nodes to be detected based on business dependencies, and finally performs memory leak analysis on the selected nodes. This filters the nodes to be analyzed before performing leak analysis, reducing the number of interfering nodes, lowering the difficulty of locating leaking nodes, and improving the execution efficiency of anomaly detection.

[0079] In some embodiments of this application, based on the technical solution of this application, during the process of obtaining the heap snapshot data of the page to be detected, the anomaly detection device can obtain the heap memory data of the page to be detected from the browser according to the heap snapshot acquisition instruction for the browser of the page to be detected. Then, after the browser has collected the heap memory data, the anomaly detection device obtains the heap snapshot file containing the heap memory data through the browser. In this embodiment, the anomaly detection device can initiate a heap snapshot acquisition instruction for the browser of the page to be detected, and the browser will take a snapshot of the current memory. Snapshot taking can be done through the browser's own function, or through third-party tools or plugins. After the browser has collected the heap memory data, it will provide the data to the anomaly detection device, thereby allowing the anomaly detection device to obtain the heap memory data of the page to be detected. Specifically, the heap memory data can be in the form of a file and transmitted to the anomaly detection device through the network. Alternatively, the heap memory data can be directly transmitted to the anomaly detection device, which will save it to a specified file. In this way, by obtaining the heap snapshot file through the browser, the computing resources of the terminal device can be used to complete the data acquisition process, without the server directly participating in the data collection process, reducing server resource consumption and improving server resource utilization efficiency.

[0080] In some embodiments of this application, based on the technical solution of this application, after removing the structural dependencies of virtual structural nodes associated with the component in the virtual document structure tree, the anomaly detection device can also add a deletion mark to each virtual structural node in the virtual document structure tree when the page component in the page to be detected is unloaded. Then, according to the business dependencies in the virtual document structure tree, the device removes the dependency between global nodes and virtual structural nodes with deletion marks in the virtual document structure tree. In this embodiment, the anomaly detection device can check the relationship between virtual structural nodes and other nodes after removing the structural dependencies of virtual structural nodes. If a node has no other dependencies with other nodes after removing the structural dependencies, it can be directly deleted. The anomaly detection device can add a deletion mark to the virtual structural node, and the browser or management service can decide the specific timing of the deletion. Then, for other nodes with business dependencies, the anomaly detection device will remove the dependency between global nodes and virtual structural nodes with deletion marks in the virtual document structure tree. Global nodes occupying memory is normal; therefore, they will not be considered as nodes to be checked during the anomaly detection process. In this way, nodes that can be deleted normally and nodes that can exist normally can be removed. Since structural and business dependencies are removed, these nodes will not be considered when selecting nodes to be tested later, thereby further reducing the amount of data to be processed and improving efficiency.

[0081] In some embodiments of this application, based on the technical solution of this application, during the process of constructing the topology of the node to be detected using the second tool according to the business dependencies associated with the node to be detected in the heap snapshot data, the anomaly detection device can obtain the business dependencies associated with each node to be detected using the second tool. The anomaly detection device can perform circular dependency detection based on the obtained business dependencies to obtain the nodes to be detected with circular dependencies, which are designated as link points. The anomaly detection device can also obtain the node to be detected farthest from the root node based on the distance between each node to be detected and the root node, which is designated as the farthest node. The anomaly detection device can also obtain the nodes to be detected that have no business dependencies with other nodes, which are designated as isolated nodes. Finally, the anomaly detection device can generate the topology of the node to be detected based on the isolated nodes, the farthest node, and the link points. In this embodiment, the anomaly detection device selects the nodes to be detected from the nodes with business dependencies. It is understood that not all nodes with business dependencies may have memory leaks. For example, the caller in a business dependency relationship may have a memory leak, but the callee may not be involved in a memory leak. Therefore, the anomaly detection device selects nodes that meet specific conditions, such as link nodes, farthest nodes, and orphaned nodes, as nodes to be detected. A link node contains multiple nodes that are interdependent and form a cycle, making them impossible to delete from memory. The farthest node is the node furthest from the root node in the reference tree. The root node could be, for example, the garbage collection root node. An orphaned node is a node that has no business dependencies on other virtual structure nodes. Such nodes may be those that occupy memory due to abnormal calls to global nodes or calls to other nodes not in the virtual document structure tree.

[0082] The technical solution of this application is described below with reference to specific embodiments. Please refer to... Figure 6 , Figure 6 This is a flowchart illustrating the anomaly detection process in one embodiment of this application. Figure 6As shown, the embodiments of this application are implemented using a first tool and a second tool. First, in step 610, the developer can replace the corresponding files in the original page framework using the first tool during the front-end project construction. Then, in step 620, the project is run in developer mode. The developer first defines environment variables, enables the function of completely separating the virtual document structure tree maintained by the framework and the relationships between document structure trees, and then starts the front-end project in local development mode. Subsequently, in step 630, the front-end interface is operated according to the normal business process. After a memory leak occurs, a browser tool is used to collect a heap snapshot. In step 640, the second tool of this application is used to analyze the saved heap snapshot file and output recommended nodes to be checked. Finally, in step 650, the browser is returned to view the variable references of each node to be checked, thereby finding the leaking node.

[0083] Please see Figure 7 , Figure 7 This is a schematic diagram of the leak node analysis process in an embodiment of this application. For example... Figure 7 As shown in Figure 710, a schematic diagram of the virtual document structure tree is presented. It can be understood that the nodes in 710 are nodes associated with the unloaded components. Nodes 1 to 10 are virtual structure nodes; solid lines represent structural relationships, and dashed lines represent business relationships. 710 also includes three global nodes and one other node. The first tool removes the structural relationships in this virtual document structure tree, resulting in the virtual document structure tree in the heap snapshot data, as shown in Figure 720. In 720, the structural relationships have been removed, leaving only the business relationships. Simultaneously, nodes 1, 3, 4, and 10, which are not associated with other nodes, are marked for deletion. The server uses a second tool to analyze the data in 720, resulting in the topology graph 730. In 730, the nodes marked for deletion (1, 3, 4, and 10), as well as the global node and other nodes, have been removed, and the nodes to be processed are marked in the topology graph, as shown in the boxes in 730. It should be noted that not all nodes in the topology graph are nodes to be processed; for example, node 6 is retained due to its association with node 5, which is also to be processed. Topology diagram 730 can be displayed to developers on terminal devices. Please refer to [link / reference]. Figure 8 , Figure 8 This is a schematic diagram illustrating a topology scenario in an embodiment of this application. For example... Figure 8 As shown, the topology diagram can be displayed on the terminal device through a graphical interface. Developers can click on the node to be processed in the topology diagram to further browse the relevant data of the node and continue to analyze whether there is a memory leak in the node.

[0084] It should be noted that although the steps of the method in this application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0085] The following describes the implementation of the apparatus of this application, which can be used to perform the anomaly detection method in the above embodiments of this application. Figure 9 A schematic block diagram illustrating the components of an anomaly detection device in an embodiment of this application is shown. For example... Figure 9 As shown, the anomaly detection device 900 mainly includes:

[0086] The structure tree acquisition module 910 is configured to acquire the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structure nodes, and there are at least one of structural dependency relationships and business dependency relationships among the virtual structure nodes.

[0087] The relationship removal module 920 is configured to remove the structural dependency relationship of the virtual structure node associated with the component in the virtual document structure tree for the component that is uninstalled in the page to be detected, so as to obtain the business dependency relationship;

[0088] The topology building module 930 is configured to select nodes to be detected from virtual structural nodes that have decoupled from the structural dependencies according to the business dependencies and build a topology to obtain the topology of the nodes to be detected. The topology of the nodes to be detected includes one or more of the following: isolated nodes, circular nodes, farthest recycled nodes and most recently recycled nodes.

[0089] The leakage analysis module 940 is configured to perform memory leak analysis on the corresponding virtual structure nodes in the page to be detected based on the topology of the node to be detected, and obtain the abnormal detection results of the page to be detected.

[0090] In some embodiments of this application, based on the above technical solutions, the relationship removal module 920 is specifically configured to: unload the virtual structure node corresponding to the page component from the page data of the page to be detected according to the status update of the page component in the page to be detected; and in response to the unloading operation of the virtual structure node, delete the structural dependency relationship associated with the virtual structure node from the virtual document structure tree of the page to be detected through a first tool.

[0091] In some embodiments of this application, based on the above technical solutions, the relationship removal module 920 is further configured to: add the first tool to the page environment of the page to be detected; modify the environment variables in the page environment so that when the page component in the page to be detected is unloaded, the first tool is triggered to remove the structural dependency relationship associated with the virtual structure node.

[0092] In some embodiments of this application, based on the above technical solutions, the topology construction module 930 is specifically configured to: obtain heap snapshot data of the page to be detected, wherein the heap snapshot data contains a virtual document structure tree that removes the structural dependency relationship; obtain, through a second tool, the virtual structure node containing a deletion mark from the virtual document structure tree in the heap snapshot data, as the node to be detected, wherein the deletion mark of the virtual structure node is added when removing the structural dependency relationship; and construct the topology of the node to be detected through the second tool according to the business dependency relationship associated with the node to be detected in the heap snapshot data.

[0093] In some embodiments of this application, based on the above technical solutions, the topology construction module 930 is specifically configured to: obtain heap memory data of the page to be detected from the browser according to the heap snapshot acquisition instruction of the browser for the page to be detected; and obtain a heap snapshot file containing the heap memory data through the browser after the browser has collected the heap memory data.

[0094] In some embodiments of this application, based on the above technical solutions, the relationship removal module 920 is further configured to: add a deletion mark to each virtual structure node in the virtual document structure tree when the page component in the page to be detected is unloaded; and remove the dependency relationship between the global node and the virtual structure node containing the deletion mark in the virtual document structure tree according to the business dependency relationship in the virtual document structure tree.

[0095] In some embodiments of this application, based on the above technical solutions, the topology construction module 930 is specifically configured as follows: for each node to be detected, the second tool is used to obtain the business dependency relationship associated with the node to be detected; cyclic dependency detection is performed based on the obtained business dependency relationship to obtain the node to be detected with cyclic dependency, which is taken as a link point; based on the distance between each node to be detected and the root node, the node to be detected farthest from the root node is obtained as the farthest node; the node to be detected that has no business dependency relationship with other nodes is obtained as an isolated node; and the topology of the node to be detected is generated based on the isolated node, the farthest node, and the link point.

[0096] In some embodiments of this application, based on the above technical solutions, the leakage analysis module 940 is specifically configured to: view the node metadata of each node in the topology of the node to be detected in the browser of the page to be detected according to the topology of the node to be detected; perform reserved path parsing and closure detection according to the reserved path and reference relationship of each node to obtain abnormal nodes with memory leaks.

[0097] In some embodiments of this application, based on the above technical solutions, the leakage analysis module 940 is specifically configured to: obtain the code call information of the corresponding page component in the page to be detected according to the node metadata of the virtual structure node in the topology of the node to be detected, wherein the node metadata contains the call information of the corresponding page component; and map the call location information to the source code file according to the source mapping information to obtain the abnormal code, which is used as the abnormal detection result of the page to be detected.

[0098] In some embodiments of this application, based on the above technical solutions, the leakage analysis module 940 is specifically configured to: perform feature matching between the abnormal code and the abnormal records in the abnormal code library, wherein the abnormal records contain features of the abnormal type and corresponding abnormal repair information; if the abnormal code exists in the abnormal record, then generate abnormal repair prompt information for the abnormal code based on the abnormal repair information in the abnormal record and the abnormal code.

[0099] It should be noted that the apparatus provided in the above embodiments and the method provided in the above embodiments belong to the same concept, and the specific way in which each module performs the operation has been described in detail in the method embodiments, and will not be repeated here.

[0100] Figure 10 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0101] It should be noted that, Figure 10 The computer system 1000 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0102] like Figure 10As shown, the computer system 1000 includes a Central Processing Unit (CPU) 1001, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 1002 or programs loaded from Storage Unit 1008 into Random Access Memory (RAM) 1003. The RAM 1003 also stores various programs and data required for system operation. The CPU 1001, ROM 1002, and RAM 1003 are interconnected via a bus 1004. An Input / Output (I / O) interface 1005 is also connected to the bus 1004.

[0103] The following components are connected to I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to I / O interface 1005 as needed. Removable media 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1010 as needed so that computer programs read from them can be installed into storage section 1008 as needed.

[0104] Specifically, according to embodiments of this application, the processes described in the various method flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by central processing unit (CPU) 1001, it performs various functions defined in the system of this application.

[0105] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0106] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0107] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0108] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0109] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0110] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. An anomaly detection method, characterized in that, include: Obtain the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structure nodes, and there are at least one of structural dependency relationships and business dependency relationships among the virtual structure nodes. For the components that have been uninstalled in the page to be detected, remove the structural dependencies of the virtual structure nodes associated with the components in the virtual document structure tree to obtain the business dependencies; Based on the business dependencies, select nodes to be detected from the virtual structural nodes that have been decoupled from the structural dependencies and construct a topology to obtain the topology of the nodes to be detected. The topology of the nodes to be detected includes one or more of the following: isolated nodes, circular nodes, farthest recycled nodes and most recently recycled nodes. Based on the topology of the node to be detected, memory leak analysis is performed on the corresponding virtual structure nodes in the page to be detected to obtain the anomaly detection results of the page to be detected.

2. The anomaly detection method according to claim 1, characterized in that, For the components that have been uninstalled in the page to be detected, the structural dependencies of the virtual structure nodes associated with the components in the virtual document structure tree are removed to obtain the business dependencies, including: Based on the status update of the page components in the page to be detected, the virtual structure node corresponding to the page component is unloaded from the page data of the page to be detected; In response to the unloading operation of the virtual structure node, the structural dependency relationship associated with the virtual structure node is deleted from the virtual document structure tree of the page to be detected by the first tool.

3. The anomaly detection method according to claim 2, characterized in that, The method further includes: Add the first tool to the page environment of the page to be detected; Modify the environment variables in the page environment so that when the page component in the page to be detected is unloaded, the first tool is triggered to release the structural dependency associated with the virtual structure node.

4. The anomaly detection method according to claim 1, characterized in that, The step of selecting the node to be detected from the virtual structural nodes that have been decoupled from the structural dependencies and constructing a topology based on the business dependencies, to obtain the topology of the node to be detected, includes: Obtain heap snapshot data of the page to be detected, wherein the heap snapshot data contains a virtual document structure tree that removes the structural dependencies; From the virtual document structure tree in the heap snapshot data, the second tool obtains the virtual structure nodes containing deletion marks as nodes to be detected, wherein the deletion marks of the virtual structure nodes are added when the structural dependency is released; The second tool is used to construct the topology of the node to be detected based on the business dependencies associated with the node in the heap snapshot data.

5. The anomaly detection method according to claim 4, characterized in that, The step of obtaining the heap snapshot data of the page to be detected includes: According to the heap snapshot acquisition instruction of the browser for the page to be detected, the heap memory data of the page to be detected is obtained from the browser; After the browser has collected the heap memory data, a heap snapshot file containing the heap memory data is obtained through the browser.

6. The anomaly detection method according to claim 4, characterized in that, The method further includes: For each virtual structure node in the virtual document structure tree, a deletion mark is added to the virtual structure node when the page component in the page to be detected is unloaded; Based on the business dependencies in the virtual document structure tree, the dependencies between global nodes and virtual structure nodes with deletion marks in the virtual document structure tree are removed.

7. The anomaly detection method according to claim 4, characterized in that, The step of constructing the topology of the node to be detected using the second tool based on the business dependencies associated with the node to be detected in the heap snapshot data includes: For each node to be detected, the second tool is used to obtain the business dependencies associated with the node to be detected. Based on the obtained business dependencies, perform circular dependency detection to identify nodes with circular dependencies, which are then used as link points. Based on the distance between each node to be detected and the root node, obtain the node to be detected that is farthest from the root node, and use it as the farthest node. Obtain nodes that have no business dependencies with other nodes and treat them as isolated nodes; The topology of the nodes to be detected is generated based on the isolated node, the farthest node, and the link point.

8. The anomaly detection method according to claim 1, characterized in that, The step involves performing memory leak analysis on the corresponding virtual structure nodes in the page to be detected based on the topology of the node to be detected, to obtain the anomaly detection results of the page to be detected, including: Based on the topology of the nodes to be detected, view the node metadata of each node in the topology of the nodes to be detected in the browser of the page to be detected; Based on the reserved paths and reference relationships of each node, reserved path parsing and closure detection are performed to identify abnormal nodes with memory leaks.

9. The anomaly detection method according to claim 1, characterized in that, The step involves performing memory leak analysis on the corresponding virtual structure nodes in the page to be detected based on the topology of the node to be detected, to obtain the anomaly detection results of the page to be detected, including: Based on the node metadata of the virtual structure nodes in the topology of the node to be detected, the code call information of the corresponding page components in the page to be detected is obtained, and the node metadata contains the call information of the corresponding page components; Based on the source mapping information, the call location information is mapped to the source code file to obtain the abnormal code, which serves as the abnormal detection result of the page to be detected.

10. The anomaly detection method according to claim 9, characterized in that, The step of mapping the call location information to the source code file based on the source mapping information to obtain the abnormal code, and then using it as the abnormal detection result of the page to be detected, includes: The exception code is matched with the exception records in the exception code library by feature matching. The exception records contain the characteristics of the exception type and the corresponding exception repair information. If an exception exists in a record that matches the exception code, then an exception repair prompt message is generated based on the exception repair information in the exception record and the exception code.

11. An anomaly detection device, characterized in that, include: The structure tree acquisition module is configured to acquire the virtual document structure tree of the page to be detected. The virtual document structure tree contains virtual structure nodes, and there are at least one of structural dependency relationships and business dependency relationships among the virtual structure nodes. The relationship removal module is configured to remove the structural dependencies of virtual structure nodes associated with the component in the virtual document structure tree for the component that has been uninstalled in the page to be detected, thereby obtaining the business dependencies. The topology building module is configured to select nodes to be detected from virtual structural nodes that have decoupled from the structural dependencies based on the business dependencies and build a topology to obtain the topology of the nodes to be detected. The topology of the nodes to be detected includes one or more of the following: isolated nodes, circular nodes, farthest recycled nodes and most recently recycled nodes. The leakage analysis module is configured to perform memory leak analysis on the corresponding virtual structure nodes in the page to be detected based on the topology of the node to be detected, and obtain the abnormal detection results of the page to be detected.

12. An electronic device, characterized in that, include: processor; Memory for storing the executable instructions of the processor; The processor is configured to execute the anomaly detection method according to any one of claims 1 to 10 by executing the executable instructions.

13. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the anomaly detection method according to any one of claims 1 to 10.

14. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium, a processor of a computer device reading the computer instructions from the computer-readable storage medium, and the processor executing the computer instructions to cause the computer device to perform the anomaly detection method as described in any one of claims 1 to 10.

Images