Single key ownership composite quota flow control and asynchronous recovery method and system

Abstract

The application discloses a single key attribution composite quota flow limiting and asynchronous recovery method and system, relates to the technical field of computers, and comprises the following steps: acquiring interface call frequency, bandwidth occupation values and calculation consumption capacity in a running process of a distributed system, establishing a unique attribution key for associating tenants and corresponding multi-dimensional resource quotas, and obtaining a multi-dimensional resource quota initial data set; the single key attribution composite quota flow limiting and asynchronous recovery method and system can take into account the correlation of multi-tenant composite quota management, the atomicity of batch adjustment process and the timeliness of abnormal recovery, and improve the stability of distributed system flow control process and resource utilization efficiency.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and specifically to a method and system for single-key-owned composite quota current limiting and asynchronous recovery. Background Technology

[0002] With the continuous expansion of internet business and the widespread application of distributed system architecture, the access traffic faced during system operation is characterized by large scale, high volatility, and diversified business types. In order to ensure stable system operation and improve the utilization efficiency of computing, network, and storage resources, it is usually necessary to limit and allocate system resources that different tenants or business objects can use through traffic control mechanisms. Among them, quota management is a common method of traffic control. By setting corresponding resource usage limits for different tenants, the impact of sudden traffic or abnormal access on the overall system operation can be reduced.

[0003] Existing quota management methods typically monitor resource usage such as API call frequency, bandwidth consumption, and computing resource consumption based on pre-set thresholds, rules, or policies, and perform rate limiting operations when resource usage reaches corresponding thresholds. In multi-tenant systems, a single tenant often corresponds to multiple resource dimensions, forming complex relationships between different tenants and different resource quotas. As the number of tenants and resource dimensions increases, accurately determining all resource quotas corresponding to a particular tenant and uniformly managing multiple interrelated resource quotas becomes a problem that needs to be considered in quota control. Furthermore, multiple resource dimensions in a distributed system are usually not independent of each other. For example, an increase in API call frequency may lead to a simultaneous increase in bandwidth consumption and computing resource consumption, and a change in the quota of one resource dimension may also affect the operating status of other resource dimensions. Therefore, adjusting only a single resource dimension independently may lead to an imbalance in the quota relationship between related resources. In actual operation and maintenance, operators need to consider the mutual influence between multiple resource dimensions and reasonably determine the adjustment range between different resource quotas so that the adjusted quotas can meet the overall resource constraints of the system. In scenarios involving business activities, sudden traffic surges, or system resource constraints, it may be necessary to simultaneously implement batch quota adjustments for multiple tenants. For example, it might be necessary to increase the resource usage limits of several key tenants within a short period, or uniformly reduce the resource quotas of some low-priority tenants. In such scenarios, modifying configurations item by item for different tenants and resource dimensions not only involves numerous steps but also involves potential differences in the execution sequence of different configuration items. This can result in some quotas being updated while others are not, leading to temporary inconsistencies in the system during the adjustment process. As the scale of batch adjustments increases, the risk of configuration omissions, duplicate modifications, or incorrect parameter settings may also increase. Furthermore, when multiple quota configuration items need to be updated in tandem, failure to update some configurations may leave the resource quotas of the same tenant or multiple tenants in an incomplete update state. Existing quota management methods typically require item-by-item checks of abnormal configurations and manual rollback or reconfiguration based on the quota status before the update. When anomalies involve multiple tenants and multiple resource dimensions, the process of fault location, state recovery, and data consistency maintenance becomes more complex. Recovery operations may also consume the normal quota adjustment process, thereby affecting the execution efficiency of subsequent traffic control operations. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for single-key-owned composite quota current limiting and asynchronous recovery, thereby solving the problems existing in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for composite quota limiting and asynchronous recovery based on single-key attribution, comprising: S1. Obtain the frequency of interface calls, bandwidth usage, and computational consumption during the operation of the distributed system, establish a unique ownership key to associate tenants with corresponding multi-dimensional resource quotas, and obtain the initial dataset of multi-dimensional resource quotas. S2. Process the initial dataset of multi-dimensional resource quotas, analyze the interaction between interface call frequency, bandwidth usage and computational capacity consumption, extract the dependency weights between each resource node, and obtain the resource dimension coupling relationship graph. S3. Based on the resource dimension coupling relationship diagram, perform feature classification on the dependency weights, identify the critical value that triggers a chain reaction when adjusting a single dimension, and determine the constraint conditions for composite quota adjustment. S4. Obtain batch adjustment requests for multiple tenants, determine multiple resource dimensions corresponding to each tenant based on the unique ownership key, and extract the target quota value from the batch adjustment request. If the target quota value meets the composite quota adjustment constraint, generate the first state change instruction set. S5. By parsing the first state change instruction set, extract the dependency order and resource locking range between instructions to obtain the atomic operation execution sequence; S6. Based on the atomic operation execution sequence, perform resource quota updates in a pre-established sandbox environment, record the state change trajectory during the update process, and obtain the second state change instruction set; S7. If the execution feedback of the second state change instruction set in the sandbox environment is no anomaly, determine the final resource quota distribution result; S8. If there is an anomaly in the execution feedback of the second state change instruction set in the sandbox environment or production environment, the abnormal resource quota will be asynchronously restored.

[0006] Preferably, step S1 includes obtaining the interface call frequency, bandwidth usage, and computational consumption during the operation of the distributed system; performing dimensional alignment processing on the interface call frequency, bandwidth usage, and computational consumption to obtain real-time consumption values; extracting tenant identification features based on the real-time consumption values; if tenant identification features are missing, completing them to obtain complete tenant identification features; fusing the complete tenant identification features with the quota identifier to determine a unique attribution key; and binding the real-time consumption values ​​with the unique attribution key to obtain a multi-dimensional resource quota initial dataset.

[0007] Preferably, step S2 includes extracting interface frequency, bandwidth usage, and computational consumption features from the initial multi-dimensional resource quota dataset and concatenating them to obtain resource node feature vectors; mapping the resource node feature vectors using a graph convolutional neural network to obtain an initial adjacency matrix; supplementing edge relationships if the initial adjacency matrix contains isolated nodes to obtain a connected adjacency matrix; updating the hidden state of the connected adjacency matrix to obtain node interaction features; extracting dependency weights based on the node interaction features, and constructing a resource dimension coupling relationship graph through the dependency weights.

[0008] Preferably, step S3 includes parsing the resource dimension coupling relationship graph to extract dependency weights and constructing a multi-dimensional feature vector set; using a random forest algorithm to classify the multi-dimensional feature vector set to obtain a set of classification decision trees, identifying the node splitting threshold of the set of classification decision trees as a critical value; performing dimensionality reduction mapping on the critical value to generate a boundary restriction interval; constructing a quota association matrix based on the boundary restriction interval and the critical value, and parsing the quota association matrix to determine the composite quota adjustment constraint conditions.

[0009] Preferably, step S4 includes obtaining a batch adjustment request for multiple tenants, the batch adjustment request carrying a unique attribution key and a target quota value; determining a resource occupancy baseline based on the unique attribution key, and calculating the difference between the target quota value and the resource occupancy baseline to obtain a quota increment value; classifying the quota increment value to obtain a composite quota adjustment constraint; if the target quota value meets the composite quota adjustment constraint, generating a state change sequence, and generating a first state change instruction set based on the state change sequence.

[0010] Preferably, step S5 includes obtaining a first state change instruction set, parsing the first state change instruction set to extract the dependency order and resource locking range; constructing a directed acyclic graph based on the dependency order and resource locking range, traversing the directed acyclic graph to identify a set of conflicting nodes; if there is resource contention in the set of conflicting nodes, assigning a transaction isolation level to the set of conflicting nodes to obtain an execution queue with transaction isolation characteristics; sorting the execution queue with transaction isolation characteristics to generate an atomic operation execution sequence.

[0011] Preferably, step S6 includes obtaining an atomic operation execution sequence, calculating a quota deduction amount based on the atomic operation execution sequence in a sandbox environment; performing a resource quota update based on the quota deduction amount, collecting data during the resource quota update to generate a state change trajectory; determining whether there is an inconsistency between the snapshot of the state change trajectory and the baseline snapshot, and extracting the snapshot comparison difference if there is an inconsistency; generating a difference compensation instruction based on the snapshot comparison difference, and recombining the difference compensation instruction and the atomic operation execution sequence to obtain a second state change instruction set.

[0012] Preferably, step S7 includes obtaining the execution feedback of the second state change instruction set in the sandbox environment; if the execution feedback is that there is no anomaly, synchronizing the second state change instruction set to the production environment and parsing to obtain resource quotas for multiple resource dimensions; matching the consumption rate of real-time business requests with the resource quotas for multiple resource dimensions to determine a composite quota rate limiting threshold; performing interception processing on real-time business requests according to the composite quota rate limiting threshold, calculating the remaining capacity, updating the resource pool according to the remaining capacity, and determining the final resource quota distribution result.

[0013] Preferably, step S8 includes obtaining execution feedback of the second state change instruction set; if the execution feedback contains an anomaly identifier, constructing a recovery task based on the state change trajectory and quota snapshot; attaching a locking mark to the recovery task and writing the recovery task with the locking mark into the asynchronous recovery queue; reading the recovery task from the asynchronous recovery queue, parsing the recovery task to obtain a rollback instruction; and using the rollback instruction to perform a reverse operation to asynchronously recover the abnormal resource quota based on the state before the resource quota update.

[0014] A single-key-owned composite quota rate limiting and asynchronous recovery system is provided for implementing the steps of the single-key-owned composite quota rate limiting and asynchronous recovery method. The system includes: The data acquisition module acquires the frequency of interface calls, bandwidth usage, and computing capacity consumption during the operation of the distributed system, extracts the real-time consumption values ​​of each dimension, and establishes a unique ownership key to associate tenants with corresponding multi-dimensional resource quotas, thereby obtaining the initial dataset of multi-dimensional resource quotas. The coupling analysis module processes the initial dataset of multi-dimensional resource quotas through graph neural networks, analyzes the degree of interaction between interface call frequency, bandwidth usage, and computational capacity consumption, extracts the dependency weights between each resource node, and obtains a resource-dimensional coupling relationship graph. The constraint determination module uses a random forest algorithm to classify the dependent weights based on the resource dimension coupling relationship graph, identifies the critical value that triggers a chain reaction when a single dimension adjustment is made, and determines the constraint conditions for composite quota adjustment. The instruction generation module obtains batch adjustment requests for multiple tenants, determines multiple resource dimensions corresponding to each tenant based on the unique attribution key, and extracts the target quota value from the batch adjustment request. If the target quota value meets the composite quota adjustment constraint, the first state change instruction set is generated. The sequence construction module parses the first state change instruction set, extracts the dependency order and resource locking range between instructions, constructs an execution queue with transaction isolation characteristics, and obtains the atomic operation execution sequence. The update execution module performs resource quota updates in a pre-established sandbox environment according to the atomic operation execution sequence, records the state change trajectory during the update process, and obtains the second state change instruction set; If the execution feedback of the second state change instruction set in the sandbox environment is without anomalies, the rate limiting module determines that the data consistency verification has passed, synchronizes the second state change instruction set to the production environment, and performs composite quota rate limiting on the business requests of the corresponding tenants based on the resource quotas of multiple resource dimensions after synchronization, and determines the final resource quota distribution result. The recovery module generates a recovery task based on the state change trajectory if the execution feedback of the second state change instruction set is abnormal in the sandbox environment or production environment. The recovery task is written into the asynchronous recovery queue, and the abnormal resource quota is asynchronously recovered based on the state before the resource quota update.

[0015] As can be seen from the above technical solution, the present invention has the following beneficial effects: This method and system for composite quota rate limiting and asynchronous recovery based on single-key attribution improves the accuracy of resource quota identification and unified management in multi-tenant scenarios by collecting multi-dimensional resource data such as interface call frequency, bandwidth usage, and computational capacity consumption in the distributed system, and establishing a unique attribution relationship between tenants and multi-dimensional resource quotas. By analyzing the coupling relationships between different resource dimensions and determining the critical values ​​that may trigger a chain reaction when adjusting a single dimension, the system helps reduce the risk of imbalance in other related resources due to changes in a single resource quota, thus improving the rationality of composite quota adjustments. Furthermore, by generating a state change instruction set for batch adjustment requests and constructing an atomic operation execution sequence with transaction isolation characteristics based on the dependency order and resource locking range between instructions, the system enables quota adjustments for multiple tenants and multiple resource dimensions to be synchronized. The system can process data according to defined execution relationships, thereby reducing the possibility of inconsistencies in intermediate states, configuration omissions, or duplicate modifications caused by step-by-step updates. By pre-executing resource quota updates and recording state change trajectories in the sandbox environment, consistency verification of the update process can be performed before formal synchronization to the production environment, reducing the possibility of abnormal configurations directly affecting the production environment. At the same time, when anomalies occur in the sandbox environment or production environment, recovery tasks are generated based on the state change trajectory and written to the asynchronous recovery queue. This allows for the recovery of abnormal resource quotas without continuously occupying the normal quota adjustment process, thereby improving the efficiency of anomaly handling and the consistency of resource quota states. Therefore, this invention can balance the relevance of multi-tenant composite quota management, the atomicity of batch adjustment processes, and the timeliness of anomaly recovery, improving the stability of distributed system traffic control processes and resource utilization efficiency. Attached Figure Description

[0016] Figure 1 This is a flowchart of the overall method of the present invention; Figure 2 This is a bar chart comparing the consistency index of batch quota adjustment in the experiment of this invention; Figure 3 This is a scatter plot showing the duration of the production environment being affected after abnormal injection in the experiment of this invention. Figure 4 This is a comparison diagram of abnormal recovery methods in the experiments of this invention; Figure 5 This is a line graph showing the fluctuation of the utilization rate of the associated dimension over time in the experiments of this invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1: like Figure 1 As shown, the present invention provides a technical solution: a method for composite quota limiting and asynchronous recovery based on single-key attribution, comprising: S1. Obtain the interface call frequency, bandwidth usage, and computational consumption during the operation of the distributed system, extract the real-time consumption values ​​of each dimension, and establish a unique ownership key to associate tenants with corresponding multi-dimensional resource quotas to obtain the initial dataset of multi-dimensional resource quotas. S2. Process the initial dataset of multi-dimensional resource quotas through graph neural networks, analyze the interaction between interface call frequency, bandwidth usage and computational capacity consumption, extract the dependency weights between each resource node, and obtain a resource dimension coupling relationship graph. S3. Based on the resource dimension coupling relationship diagram, the random forest algorithm is used to classify the dependent weights by feature, identify the critical value that triggers a chain reaction when a single dimension adjustment is made, and determine the constraint conditions for composite quota adjustment. S4. Obtain batch adjustment requests for multiple tenants, determine multiple resource dimensions corresponding to each tenant based on the unique ownership key, and extract the target quota value from the batch adjustment request. If the target quota value meets the composite quota adjustment constraint, generate the first state change instruction set. S5. By parsing the first state change instruction set, extracting the dependency order and resource locking range between instructions, constructing an execution queue with transaction isolation characteristics, and obtaining the atomic operation execution sequence; S6. Based on the atomic operation execution sequence, perform resource quota updates in a pre-established sandbox environment, record the state change trajectory during the update process, and obtain the second state change instruction set; S7. If the execution feedback of the second state change instruction set in the sandbox environment is without anomalies, the data consistency verification is deemed to have passed. The second state change instruction set is synchronized to the production environment. Based on the resource quotas of multiple resource dimensions after synchronization, composite quota rate limiting is performed on the business requests of the corresponding tenants to determine the final resource quota distribution result. S8. If there is an anomaly in the execution feedback of the second state change instruction set in the sandbox environment or production environment, a recovery task is generated according to the state change trajectory, the recovery task is written into the asynchronous recovery queue, and the abnormal resource quota is asynchronously recovered based on the state before the resource quota update.

[0019] In this embodiment, the distributed system uses tenants as the owners of resource quotas and performs unified collection, association and management of interface call resources, network bandwidth resources and computing resources.

[0020] Specifically, the resource collection cycle is set to one second, and resource status statistics are performed once every second. Within each collection cycle, the number of interface calls actually generated by the target tenant, the total number of bytes transmitted, and the processor execution time occupied by the computing tasks are counted. Among them, the number of interface calls is the total number of interface requests initiated and entered into the system by the target tenant in the current second; the bandwidth usage is the sum of the number of uplink data bytes and downlink data bytes generated by the target tenant in the current second; the computing capacity consumption is the cumulative processor execution time occupied by processing the target tenant's business tasks in the current second, with the processor execution time measured in milliseconds.

[0021] When each tenant is created, the tenant management module generates a 128-bit universally unique identifier, which is then used as the unique ownership key for that tenant.

[0022] Interface call quotas, bandwidth quotas, and computing capacity quotas are all bound to this unique ownership key. After the resource acquisition module completes one acquisition, it writes the unique ownership key, acquisition time, number of interface calls, total number of bytes transmitted, processor execution time, current interface call quota, current bandwidth quota, and current computing capacity quota into the same resource status record. The continuously generated resource status records constitute the initial dataset of multi-dimensional resource quotas.

[0023] To enable the analysis of API call counts, bandwidth usage, and computational capacity consumption on a unified data scale, the resource utilization of the three resource dimensions is calculated separately.

[0024] Specifically, the utilization level of interface call resources is obtained by dividing the actual number of interface calls in the current second by the current interface call quota; the utilization level of bandwidth resources is obtained by dividing the actual total number of bytes transmitted in the current second by the current bandwidth quota; the utilization level of computing resources is obtained by dividing the actual processor execution time in the current second by the current computing capacity quota; after each quota update takes effect, the updated quota value is used to calculate the corresponding resource utilization level starting from the next one-second collection cycle.

[0025] Subsequently, a resource node relationship structure is established for the same unique ownership key; this resource node relationship structure includes interface call resource nodes, bandwidth resource nodes, and computing capacity resource nodes; bidirectional connections are established between the three resource nodes, so that any resource node can receive the status information of the other two resource nodes.

[0026] In addition, each resource node uses three defined data points as node characteristics.

[0027] The first data is the resource utilization level corresponding to the current collection period; the second data is the change value obtained by subtracting the resource utilization level of the previous collection period from the resource utilization level of the current collection period; the third data is the arithmetic mean of the resource utilization level corresponding to the current collection period and the previous fifty-nine collection periods; the interface call resource nodes, bandwidth resource nodes and computing capacity resource nodes are all generated with corresponding node characteristics in the above manner.

[0028] Furthermore, the node features of the three resource nodes are input into a two-layer graph attention neural network.

[0029] The first layer of the graph attention neural network receives the initial node features of three resource nodes and enables each resource node to collect the node features of the other two resource nodes, generating the first resource node feature update result. The second layer of the graph attention neural network takes the first resource node feature update result as input and collects the state information of the other two resource nodes connected to the current resource node again to obtain the second resource node feature update result.

[0030] After completing two node feature updates, calculate the impact of interface call resources on bandwidth resources, the impact of interface call resources on computing resources, the impact of bandwidth resources on interface call resources, the impact of bandwidth resources on computing resources, the impact of computing resources on interface call resources, and the impact of computing resources on bandwidth resources.

[0031] The degree of influence mentioned above is obtained through the attention calculation process of the graph attention neural network.

[0032] Specifically, the node features of the current resource node after its second update are combined with the node features of another resource node after its second update. A linear transformation and attention scoring are performed on the combined node features. Then, the attention scores of the same resource node pointing to the other two resource nodes are normalized so that the sum of the two dependency weights corresponding to the same resource node is equal to one. The normalized value is used as the dependency weight between the two corresponding resource nodes.

[0033] The resource dimension coupling relationship diagram is formed by three resource nodes, the bidirectional connection relationship between resource nodes, and six dependency weights. This resource dimension coupling relationship diagram is used to represent the actual association state between interface call resources, bandwidth resources and computing resources, and serves as the data basis for subsequent composite quota constraint determination.

[0034] Furthermore, after obtaining the resource dimension coupling relationship graph, the training samples required for the random forest algorithm are extracted from the historical resource quota adjustment records.

[0035] Specifically, each quota adjustment for a single resource dimension corresponds to a training sample; the training sample includes the value before the resource quota adjustment, the value after the resource quota adjustment, the dependency weight between the adjusted resource and the other two resources, the resource utilization level of the other two resources when the quota is adjusted, and the category result of whether the quota adjustment produces a resource chain reaction.

[0036] For historical adjustment records of API call quotas, resource status is continuously collected for 60 seconds after the API call quota adjustment is completed. If, in any collection period within these 60 seconds, the actual bandwidth usage exceeds the current bandwidth quota, or the actual computational capacity consumption exceeds the current computational capacity quota, then the quota adjustment record is marked as having a cascading effect. If, for 60 consecutive collection periods, the actual bandwidth usage consistently does not exceed the current bandwidth quota, and the actual computational capacity consumption consistently does not exceed the current computational capacity quota, then the quota adjustment record is marked as not having a cascading effect.

[0037] In addition, the same processing method is used for bandwidth quota adjustment records, checking whether the interface call resources and computing resources exceed the corresponding resource quota within 60 seconds after the adjustment.

[0038] For the computing capacity quota adjustment records, check whether the interface call resources and bandwidth resources exceed the corresponding resource quota within 60 seconds after the adjustment; thus, the training samples and category results corresponding to the three types of resource quota adjustments are obtained respectively.

[0039] In this embodiment, the random forest is set to two hundred decision trees, and the Gini index is used to determine the node splitting conditions for each decision tree.

[0040] In the process of analyzing the adjustment of interface call quotas, the dependency weight of interface call resources on bandwidth resources, the dependency weight of interface call resources on computing resources, the ratio between the adjusted interface call quota and the original interface call quota, the current bandwidth resource utilization, and the current computing resource utilization are used as classification features.

[0041] In the bandwidth quota adjustment analysis, the dependency weights of bandwidth resources on interface call resources, bandwidth resources on computing resources, the ratio between the adjusted bandwidth quota and the original bandwidth quota, the current utilization level of interface call resources, and the current utilization level of computing resources are used as classification features.

[0042] In the process of analyzing the adjustment of computing capacity quota, the dependency weight of computing resources on interface call resources, the dependency weight of computing resources on bandwidth resources, the ratio between the adjusted computing capacity quota and the original computing capacity quota, the current utilization level of interface call resources, and the current utilization level of bandwidth resources are used as classification features.

[0043] Furthermore, each of the two hundred decision trees outputs one of the two categories: either a chain reaction occurred or no chain reaction occurred.

[0044] When at least 101 of the 200 decision trees produce a cascading reaction, the final classification result of the random forest is determined to have a cascading reaction; when the number of decision trees producing a cascading reaction is no more than 100, the final classification result is determined to have no cascading reaction.

[0045] For a resource dimension to be adjusted, the target quota value to be tested is changed step by step starting from the current quota value, and the target quota value and corresponding resource status of each level are input into the random forest for classification.

[0046] When the random forest classification result corresponding to the target quota value changes from never having a cascading reaction to having a cascading reaction, the target quota value corresponding to the category change is determined as the cascading reaction threshold value for that resource dimension; following the same processing procedure, the interface call quota threshold value, bandwidth quota threshold value, and computing capacity quota threshold value are obtained respectively.

[0047] As a preferred embodiment, a composite quota adjustment constraint is established based on the chain reaction critical values ​​of the three resource dimensions.

[0048] For API call quota adjustment requests, the target API call quota is first input into a random forest for classification. Only when the classification result indicates that no cascading reaction has occurred will the next step be performed. Subsequently, it is checked whether the target API call quota is not less than the number of API calls that have occurred in the current collection period. When both conditions are met, the API call quota passes the constraint check.

[0049] For bandwidth quota adjustment requests, first confirm that the random forest classification result has not caused a chain reaction, and then check whether the target bandwidth quota is not less than the total number of data transmission bytes generated in the current collection period; when both conditions are met, the bandwidth quota passes the constraint check.

[0050] For a request to adjust the computing capacity quota, first confirm that the random forest classification result has not caused a chain reaction, and then check whether the target computing capacity quota is not less than the processor execution time consumed in the current collection cycle; when both conditions are met, the computing capacity quota passes the constraint check.

[0051] When the same tenant adjusts two or three resource dimensions at the same time, the above-mentioned classification check and current consumption check are performed on each resource dimension to be adjusted.

[0052] When all resource dimensions to be adjusted pass the corresponding checks, it is determined that the target quota value corresponding to the tenant meets the composite quota adjustment constraint; when any resource dimension fails the check, no status change instruction corresponding to that resource dimension is generated.

[0053] Furthermore, after receiving a batch adjustment request for multiple tenants, the system reads the tenant identifier from each request record, queries the unique ownership key of the tenant through the tenant identifier, and then reads the interface call quota record, bandwidth quota record and computing capacity quota record one by one according to the unique ownership key; subsequently, it establishes a one-to-one correspondence between the target quota value in the batch adjustment request and the corresponding resource dimension, and performs a composite quota adjustment constraint check.

[0054] Resource quota adjustment requests that pass the composite quota adjustment constraint check generate a first state change instruction.

[0055] Each first-state change instruction records the batch identifier, unique ownership key, resource dimension type, quota value before update, target quota value, version number before update, preceding instruction identifier, and instruction execution sequence number.

[0056] When an update of one resource dimension must be based on an update of another resource dimension, the instruction identifier of the state change instruction to be executed first is written into the pre-instruction field of the state change instruction to be executed later; the pre-instruction field forms a definite execution relationship between state change instructions.

[0057] Specifically, when parsing the first state change instruction set, a directed execution relationship is established based on the preceding instruction identifier of each state change instruction record, and topological sorting is performed according to the rule that all preceding instructions precede their corresponding subsequent instructions; after the topological sorting is completed, a definite instruction execution order is obtained.

[0058] While determining the execution order, resource locks are set based on the unique ownership key. Interface call quotas, bandwidth quotas, and computing capacity quotas belonging to the same unique ownership key use the same resource lock; after a quota adjustment transaction acquires this resource lock, other quota adjustment transactions targeting the same unique ownership key cannot write to the three resource quota records of that tenant and enter a waiting state; different unique ownership keys use independent resource locks, so quota adjustment transactions targeting different tenants can be executed separately.

[0059] Furthermore, an execution queue with transaction isolation characteristics is constructed based on the topology sorting results and resource locking relationships.

[0060] The execution queue adopts the serialized transaction isolation level; state change instructions belonging to the same unique ownership key and having a sequential dependency relationship are executed one by one in a defined order. Each state change instruction corresponds to an indivisible resource quota write operation, thus forming an atomic operation execution sequence.

[0061] Before modifying resource quotas for the production environment, establish a sandbox environment isolated from the production environment.

[0062] The sandbox environment saves a complete snapshot of the production environment's resource quota data when the current batch adjustment request begins to be executed, and uses the same quota fields, unique ownership keys, version numbers, and composite quota constraint rules as the production environment; any modification to quota data in the sandbox environment does not directly change the resource quotas currently being used in the production environment.

[0063] In addition, the execution end performs resource quota updates one by one in the sandbox environment according to the atomic operation execution sequence.

[0064] Specifically, for each atomic operation, the current resource quota value and the current version number are first read and recorded as the state before the update; then the resource quota field is modified to the target quota value in the instruction, and the current version number is incremented by one; after the write is completed, the resource quota value and version number are read again, and the reading result is recorded as the state after the update.

[0065] Each atomic operation's corresponding state change trajectory record includes the batch identifier, unique ownership key, resource dimension type, instruction execution sequence number, quota value before update, target quota value, quota value after update, version number before update, version number after update, and execution result.

[0066] By continuously saving the above records according to the instruction execution sequence number, a complete state change trajectory can be obtained.

[0067] Furthermore, after the sandbox environment completes the atomic operation execution sequence, it combines the target change content in the first state change instruction with the actual execution result to form the second state change instruction set, and performs data consistency verification on the second state change instruction set.

[0068] In addition, data consistency verification uses five fixed rules.

[0069] The first rule is that all state change instructions are executed successfully; the second rule is that the resource quota value after each instruction is executed is completely consistent with the corresponding target quota value; the third rule is that the version number after each instruction is executed is equal to the version number before execution plus one; the fourth rule is that three resource quota records—interface call quota, bandwidth quota, and computing capacity quota—exist simultaneously under the same unique ownership key; the fifth rule is that after all updates are completed, the three resource quotas undergo a composite quota adjustment constraint check again and all checks pass.

[0070] When all five rules are met, the sandbox environment execution feedback will be determined to be without anomalies, and the data consistency verification will be deemed successful.

[0071] If any rule is not met, the sandbox environment execution feedback will be determined as abnormal, and the normal synchronization process of the second state change instruction set to the production environment will not be executed.

[0072] When the sandbox environment returns no abnormalities, the second set of state change instructions is sent to the production environment and executed in the same order as the sandbox environment.

[0073] Before executing each resource quota change instruction in the production environment, the current version number is first read from the database and compared with the previous version number recorded in the second state change instruction. When the two version numbers are completely consistent, the resource quota write is allowed, and the version number is incremented by one while writing the target quota value. When the two version numbers are inconsistent, the current quota write is not executed, and an abnormal execution result is returned immediately.

[0074] After all second-state change instructions are successfully executed, the resource quota adjustment transaction is submitted. After the transaction is submitted, the interface call quota, bandwidth quota, and computing capacity quota become the current effective resource quotas for the corresponding tenant and are used for composite rate limiting of subsequent business requests.

[0075] Furthermore, after a business request enters the production environment, the system reads the tenant identifier from the business request and determines a unique ownership key based on the tenant identifier.

[0076] Then, the tenant's currently active API call quota, bandwidth quota, and computing capacity quota are read using the unique ownership key.

[0077] In this embodiment, the rate limiting of interface calls is executed according to a one-second metering cycle.

[0078] Specifically, upon receiving a new API call request belonging to the tenant, the system first reads the number of API calls that have occurred in the current one-second metering period, increments this number by one, and compares it with the API call quota. If the number of API calls after the increment does not exceed the API call quota, the API call verification passes, and the API call counter is incremented by one. If the number of API calls after the increment exceeds the API call quota, the API call counter is not incremented, and rate limiting is applied to the current API call.

[0079] Furthermore, bandwidth limiting is also implemented on a one-second metering cycle.

[0080] Before each data transmission, obtain the number of bytes corresponding to the data to be transmitted and add it to the number of bytes of data transmitted in the current one-second metering period. If the number of bytes of data transmitted after the addition does not exceed the bandwidth quota, the data transmission is allowed to proceed and the number of bytes of data transmitted is added to the current bandwidth consumption count. If the number of bytes of data transmitted after the addition exceeds the bandwidth quota, the data transmission is not performed and the corresponding service request is marked as bandwidth-limited.

[0081] The computing capacity rate limit is executed when a computing task enters the task scheduling module.

[0082] Each business task has a defined computational consumption meter value before entering the computational execution unit. The task scheduling module adds this computational consumption meter value to the computational capacity consumption value already registered in the current one-second metering cycle. If the added computational capacity consumption value does not exceed the current computational capacity quota, the business task is allowed to enter the computational execution queue, and a corresponding computational capacity consumption record is added. If the added computational capacity consumption value exceeds the current computational capacity quota, the business task is not sent to the computational execution unit.

[0083] API call rate limiting, bandwidth rate limiting, and computing capacity rate limiting all use the same unique attribution key to read resource quotas, so the three resource dimensions always establish a unified attribution relationship with the same tenant.

[0084] If all resource dimensions involved in the current business request pass the corresponding resource quota check, the business request will continue to execute; if any resource dimension fails the quota check, the business request will be subject to the corresponding resource dimension restriction processing.

[0085] When an exception occurs during the execution of the second state change instruction set in the sandbox environment, all successfully executed state change records before the exception instruction are read from the state change trajectory; these records are arranged from back to front according to the original state change instruction execution sequence number, and a recovery task is generated for each record that has successfully modified resource quotas.

[0086] When the second state change instruction set has entered the production environment and an exception occurs during its execution in the production environment, read the state change records that have been successfully completed in the production environment for the current batch, match these state change records with the state change trajectories saved in the sandbox environment, and extract the quota value before the update for each resource dimension that has been changed, thereby generating a recovery task.

[0087] Each recovery task record includes the batch identifier, unique ownership key, target execution environment, resource dimension type, original status change instruction execution sequence number, current quota value, quota value before update, and current version number.

[0088] After generating a recovery task, the recovery task is written to the asynchronous recovery queue, and the processing scope of the recovery task is divided according to the unique ownership key.

[0089] Recovery tasks belonging to the same unique ownership key are processed sequentially from the end to the beginning according to the original state change instruction execution sequence number.

[0090] After the asynchronous recovery execution end reads a recovery task, it locates the corresponding resource quota record based on the unique ownership key and resource dimension type, and reads the current value of the resource quota.

[0091] When the current resource quota value read is exactly the same as the adjusted quota value recorded in the recovery task record, the current resource quota is written back to the original quota value before the update in the recovery task record, and the version number is updated synchronously. When the current resource quota value read is inconsistent with the adjusted quota value recorded in the recovery task record, the current resource quota is not directly overwritten. Instead, the recovery task is marked as having a state conflict to prevent asynchronous recovery operations from overwriting new quota states that have been generated by other legitimate transactions after the exception occurred.

[0092] Furthermore, after all recovery tasks in the same batch are completed, the quota, bandwidth quota, and computing capacity quota are read again through the unique ownership key interface. The current values ​​of the three resource quotas are compared item by item with the three quota values ​​recorded before the start of this resource quota adjustment. When all three current resource quota values ​​are completely consistent with the corresponding quota values ​​before the update, the batch is determined to be recovered. If any resource quota value is inconsistent, the corresponding resource dimension will continue to be kept in the pending recovery state.

[0093] Example 2: S1 includes obtaining the interface call frequency, bandwidth usage, and computational consumption during the operation of the distributed system; performing dimensional alignment processing on the interface call frequency, bandwidth usage, and computational consumption to obtain real-time consumption values; extracting tenant identification features based on real-time consumption values, and supplementing missing tenant identification features to obtain complete tenant identification features; fusing complete tenant identification features with quota identifiers to determine a unique attribution key; and binding real-time consumption values ​​with the unique attribution key to obtain a multi-dimensional resource quota initial dataset.

[0094] In this embodiment, the interface call frequency is collected by the interface gateway according to the call events generated when the business request enters, the bandwidth usage value is collected by the network metering node according to the data sending and receiving events generated by the business request, and the computing consumption capacity is collected by the computing task scheduling node according to the actual processor execution time occupied by the business task. All three types of collection records carry the collection time, request link identifier, and resource object identifier. The collection time is used to determine the time and location of resource consumption, the request link identifier is used to associate the resource consumption records generated by the same business request in the interface call, network transmission, and computing execution stages, and the resource object identifier is used to query the binding relationship between resources and tenants when the request link identifier cannot provide a tenant identifier.

[0095] When performing dimensional alignment on the collected interface call frequency, bandwidth usage, and computational capacity consumption, a continuous 1-second time interval is used as the unified statistical period, and the start time of each statistical period is used as the time marker for that period.

[0096] Interface call records are categorized into corresponding statistical periods based on the collection time. Each interface call event within the same statistical period increments the count by one, and the cumulative interface call frequency for that period is obtained at the end of the statistical period. Bandwidth collection records are grouped according to the same time interval, and the number of bytes generated by each data transmission and reception within that period is sequentially added together. The cumulative byte count is used as the bandwidth usage value for that period. Capacity consumption is calculated based on the cumulative processor usage time of the business task within the current statistical period. When the execution process of a business task spans two adjacent statistical periods, the execution time is divided by the boundary between the two statistical periods. The execution time before the boundary is counted in the previous statistical period, and the execution time after the boundary is counted in the next statistical period.

[0097] After the above processing, each statistical period generates one interface call frequency value, one bandwidth usage value, and one calculation consumption capacity value. The three values ​​use the same time stamp, thus obtaining the real-time consumption value with complete dimension alignment.

[0098] Furthermore, after the real-time consumption data is generated, the tenant identification features are extracted using the request link identifier and resource object identifier carried by the original collection records that participated in this aggregation.

[0099] Specifically, the interface gateway establishes a request context record when a business request first enters the distributed system, and stores the request link identifier, tenant identifier, request entry time, and request end time in the request context record; the resource allocation module establishes a resource binding record when establishing a tenant affiliation relationship between computing instances, network resources, or business resources, and stores the resource object identifier, tenant identifier, binding effective time, and binding invalidation time in the resource binding record; thus, the request context record and the resource binding record constitute the data source for tenant identifier completion.

[0100] Specifically, when the collection record participating in the real-time consumption value calculation already contains the tenant identifier, the tenant identifier is read directly, and the whitespace characters at the beginning and end of the tenant identifier are deleted. The identifier is then written into the tenant identifier field according to the unified character encoding to obtain the complete tenant identifier feature. When the tenant identifier in the collection record is empty, the request link identifier is read first. The request link identifier is used as the retrieval condition to query the request context record, and the collection time is compared with the request entry time and the request end time. When the collection time is within the time interval formed by the request entry time and the request end time, the tenant identifier in the request context record is read and written into the current real-time consumption record.

[0101] When the tenant identifier is empty and the current collection record has not obtained a valid request link identifier, read the resource object identifier and use the resource object identifier to query the resource binding record.

[0102] Specifically, during the query process, the collection time is compared with the binding effective time and binding invalid time. If the collection time is not earlier than the binding effective time and earlier than the binding invalid time, the resource binding record is in a valid state. The tenant identifier is read and written into the current real-time consumption record. For cases where the same resource object belongs to different tenants successively, the tenant identifier is determined according to the binding valid time interval to which the collection time belongs, thereby avoiding writing historical binding relationships or subsequently established binding relationships into the current resource consumption record. When writing data, the resource collection end verifies the request link identifier and the resource object identifier. At least one of the two identifiers is retained to ensure that there is a definite completion path when the tenant identifier is missing.

[0103] Furthermore, after obtaining the complete tenant identification characteristics, the resource quota records are queried based on the complete tenant identification characteristics.

[0104] Specifically, the resource quota record stores the tenant identifier, quota identifier, quota effective time, and quota expiration time. The statistical period start time of the current real-time consumption value is compared with the quota effective time and quota expiration time. If the statistical period start time is not earlier than the quota effective time but earlier than the quota expiration time, the quota identifier in the resource quota record is read to determine the quota identifier that actually took effect when the current resource consumption occurred.

[0105] The complete tenant identifier and quota identifier are merged using a length prefix method.

[0106] In specific processing, first, the byte length of the complete tenant identifier after conversion according to the unified character encoding is read, and this byte length is written into the header of the home key; then, the encoded content of the complete tenant identifier is written; next, the byte length of the quota identifier after conversion is read, and this byte length is written after the complete tenant identifier; finally, the encoded content of the quota identifier is written; continuous data is formed in a fixed order of tenant identifier length, tenant identifier content, quota identifier length, and quota identifier content, and this continuous data serves as the unique home key; since the tenant identifier content and the quota identifier content both have independent length boundaries, when parsing the unique home key, the two constituent fields can be accurately recovered according to the byte length of the record, and there will be no confusion of field boundaries due to the same character combination of the two identifiers.

[0107] Furthermore, after the unique ownership key is generated, the resource consumption record is located by combining the unique ownership key and the start time of the statistical period, and the interface call frequency, bandwidth usage value and computing capacity consumption of the completed dimension alignment are written into the record.

[0108] The frequency of API calls is written to the API call resource field, the bandwidth usage value is written to the bandwidth resource field, and the calculated capacity consumption is written to the calculation resource field. The same unique ownership key corresponds to only one resource consumption record in the same statistical period. Thus, the three resource dimensions belonging to the same tenant and subject to the same quota identifier establish a fixed ownership relationship through the unique ownership key.

[0109] Furthermore, after the binding is completed, the resource consumption records are grouped according to the unique ownership key, and within each group, the records are arranged from first to last according to the start time of the statistical period.

[0110] Specifically, each record stores at least a unique ownership key, tenant identifier, quota identifier, statistical period start time, interface call frequency, bandwidth usage value, and computing capacity consumption. Continuous statistical periods form resource consumption time-series data corresponding to the same unique ownership key, and resource consumption time-series data corresponding to different unique ownership keys together constitute a multi-dimensional resource quota initial dataset.

[0111] Example 3: S2 includes extracting interface frequency, bandwidth usage, and computational consumption features from the initial multi-dimensional resource quota dataset and concatenating them to obtain resource node feature vectors; mapping the resource node feature vectors using a graph convolutional neural network to obtain an initial adjacency matrix; supplementing edge relationships if isolated nodes exist in the initial adjacency matrix to obtain a connected adjacency matrix; updating the hidden state of the connected adjacency matrix to obtain node interaction features; extracting dependency weights based on node interaction features, and constructing a resource-dimensional coupling relationship graph through the dependency weights.

[0112] In this embodiment, based on the unique ownership key, the interface call frequency, bandwidth usage and computing capacity consumption of the same tenant for 60 consecutive statistical periods are read from the initial dataset of multi-dimensional resource quota, and interface frequency data sequence, bandwidth usage data sequence and computing capacity consumption data sequence are formed according to resource dimensions.

[0113] For the interface frequency characteristic, first divide the interface call frequency of the current statistical period by the currently effective interface call quota to obtain the interface resource occupancy ratio; then subtract the interface resource occupancy ratio of the previous statistical period from the interface resource occupancy ratio of the current statistical period to obtain the interface resource change; then add up the interface resource occupancy ratios of 60 consecutive statistical periods and divide the cumulative result by 60 to obtain the average interface resource occupancy value; arrange the interface resource occupancy ratio, interface resource change, and average interface resource occupancy value in a fixed order to form the interface frequency node characteristic.

[0114] Bandwidth usage characteristics are obtained according to the same data processing relationships.

[0115] Specifically, the bandwidth usage value for the current statistical period is divided by the currently effective bandwidth quota to obtain the bandwidth resource usage ratio; the bandwidth resource usage ratio for the current statistical period is subtracted from the bandwidth resource usage ratio for the previous statistical period to obtain the bandwidth resource change; the bandwidth resource usage ratios for 60 consecutive statistical periods are summed and then divided by 60 to obtain the average bandwidth resource usage value; and the bandwidth usage node characteristics are formed in the order of bandwidth resource usage ratio, bandwidth resource change, and average bandwidth resource usage value.

[0116] For computational consumption characteristics, the computational consumption capacity of the current statistical period is divided by the currently effective computational capacity quota to obtain the computational resource utilization ratio; the computational resource utilization ratio of the current statistical period is subtracted from the computational resource utilization ratio of the previous statistical period to obtain the computational resource change; and the computational resource utilization ratios of 60 consecutive statistical periods are summed and divided by 60 to obtain the average computational resource utilization value.

[0117] The characteristics of computing consumption nodes are formed in the order of computing resource occupancy ratio, computing resource change, and average computing resource occupancy.

[0118] Furthermore, after completing the above feature calculations, the interface frequency resource, bandwidth resource, and computing resource are each taken as one resource node. The features corresponding to the three nodes are written into the node feature data in the same field order, and then concatenated in the order of interface frequency resource node, bandwidth resource node, and computing resource node to obtain the resource node feature vector corresponding to the current unique attribution key.

[0119] By using resource utilization ratios instead of directly using interface counts, byte counts, and processor execution time, resource data from three different units of measurement are converted to the same numerical scale.

[0120] When using a graph convolutional neural network to process the feature vectors of resource nodes, the node feature mapping layer in the graph convolutional neural network is first used to process the three resource nodes respectively. The node feature mapping layer uses the same set of mapping parameters for each resource node to convert the resource occupancy ratio, resource change amount and average resource occupancy value into eight hidden feature values, so that the three resource nodes obtain mapping features with consistent dimensions.

[0121] Furthermore, after completing the node mapping, the feature similarity between interface frequency resource nodes and bandwidth resource nodes, interface frequency resource nodes and computing resource nodes, and bandwidth resource nodes and computing resource nodes are calculated respectively.

[0122] Specifically, when calculating the feature similarity of a set of resource nodes, the eight hidden feature values ​​at corresponding positions of the two resource nodes are multiplied together, and then the eight products are added together sequentially. At the same time, the eight hidden feature values ​​of the first resource node are squared and added together, and the square root operation is performed. The second resource node is processed in the same way. Finally, the accumulated result of the hidden feature product is divided by the product of the two square root results, and the result is used as the feature similarity between the two resource nodes.

[0123] In addition, the similarity of the three sets of features was compared with 0.5.

[0124] Specifically, when the feature similarity of a group of resource nodes is not less than 0.5, the adjacency relationship between the two resource nodes is recorded as 1; when the feature similarity is less than 0.5, the corresponding adjacency relationship is recorded as 0. The adjacency relationship between each resource node and itself is fixedly recorded as 1. According to the fixed arrangement order of interface frequency resource nodes, bandwidth resource nodes, and computing resource nodes, the above adjacency relationships are written into a 3-row, 3-column data structure to form an initial adjacency matrix. In the initial adjacency matrix, the row position represents the connection start point, the column position represents the connection end point, and the two symmetrical positions of the same group of resource nodes use the same value.

[0125] After obtaining the initial adjacency matrix, check each of the three resource nodes one by one.

[0126] When inspecting a resource node, read the two adjacent values ​​of the node's row excluding its own position; if both adjacent values ​​are 0, the resource node is determined to be an isolated node.

[0127] For isolated nodes, read the two feature similarities saved before generating the initial adjacency matrix, compare the isolated node with the feature similarities corresponding to the other two resource nodes, select the resource node with the largest feature similarity value to establish an edge relationship, and modify the two symmetrical positions in the initial adjacency matrix to 1; when the two feature similarity values ​​are the same, select the resource node with the first position in the order of interface frequency resource, bandwidth resource, and computing resource to establish an edge relationship; after completing the isolated node processing, check the three resource nodes again to ensure that each resource node has at least one edge relationship with another resource node in addition to its own connection, and obtain the connected adjacency matrix.

[0128] When updating the hidden state based on the connected adjacency matrix, the number of connections for each resource node is first counted. The number of connections is determined by the number of elements with a value of 1 in the row where the resource node is located, including the connections corresponding to the node itself.

[0129] Subsequently, a normalized connection coefficient is calculated for each valid connection in the connected adjacency matrix. The calculation process for the normalized connection coefficient is as follows: first, the number of connections of the resource nodes at both ends of the connection is multiplied, then the square root operation is performed on the multiplication result, and finally, 1 is divided by the square root result.

[0130] When performing the first hidden state update for the interface frequency resource node, the resource nodes connected to the interface frequency resource node in the connected adjacency matrix are read. The eight hidden feature values ​​of each connected node are multiplied by the corresponding normalized connection coefficient, and then accumulated according to the same feature position. After the accumulated result is processed by the feature transformation parameters of the graph convolutional neural network, the results less than 0 are set to 0, and the results not less than 0 are retained in their original values, thus obtaining the first hidden state of the interface frequency resource node. The bandwidth resource node and the computing resource node complete the first hidden state update in the same process.

[0131] Using the first hidden state as new input, perform another update according to the same adjacency relationship, normalized connection coefficient and hidden state accumulation method to obtain the second hidden state of the 3 resource nodes.

[0132] After two updates, the hidden state of each resource node includes its own resource consumption characteristics and the associated resource characteristics transmitted through the connected adjacency matrix. The second hidden state is determined as the node interaction characteristics.

[0133] Furthermore, after the node interaction features are formed, the dependency weights are calculated for each group of resource nodes with edge relationships in the connected adjacency matrix.

[0134] Specifically, for a set of resource nodes, the node interaction features at corresponding positions of the two nodes are multiplied together, and the multiplications at each position are accumulated. The sum of squares of all interaction feature values ​​of the two nodes is calculated, and the square root operation is performed on the two sums of squares. The node interaction similarity value is obtained by dividing the result of the accumulated multiplications by the product of the two square root results.

[0135] Since the value range of node interaction similarity includes negative values, the node interaction similarity is increased by 1, and the result is divided by 2 so that the converted value is between 0 and 1. The conversion result is then determined as the dependency weight between the corresponding two resource nodes.

[0136] When the node interaction features are completely identical, the dependency weight is 1; when the interaction similarity value corresponding to the node interaction features is 0, the dependency weight is 0.5; when the node interaction features are completely opposite, the dependency weight is 0.

[0137] Finally, interface frequency resources, bandwidth resources, and computing resources are used as three nodes in the resource dimension coupling graph. The nodes with a value of 1 in the connected adjacency matrix and located in positions other than themselves are used as edges in the graph, and the calculated dependency weights are written into the corresponding edges. This forms a resource dimension coupling graph that includes resource nodes, resource node connection relationships, and dependency weights.

[0138] Example 4: S3 includes parsing the resource dimension coupling relationship graph to extract dependency weights and constructing a multi-dimensional feature vector set; using the random forest algorithm to classify the multi-dimensional feature vector set to obtain a set of classification decision trees, and identifying the node splitting threshold of the set of classification decision trees as the critical value; performing dimensionality reduction mapping on the critical value to generate the boundary restriction interval; constructing the quota association matrix based on the boundary restriction interval and the critical value, and parsing the quota association matrix to determine the composite quota adjustment constraints.

[0139] In this embodiment, the resource dimension coupling relationship graph is read according to the unique affiliation key, and the dependency weights between interface call resources and bandwidth resources, between interface call resources and computing resources, and between bandwidth resources and computing resources are extracted respectively. Each dependency weight is then associated with the historical quota adjustment records at the same time position.

[0140] Each historical quota adjustment record should include at least the resource dimension that was adjusted, the quota before the adjustment, the quota after the adjustment, and the resource consumption records for 60 statistical periods after the adjustment.

[0141] For each historical quota adjustment record, first subtract the quota before adjustment from the adjusted quota to obtain the quota change amount, and then divide the quota change amount by the quota before adjustment to obtain the quota adjustment range.

[0142] Subsequently, the resource dependency weights, quota adjustment range, and resource occupancy ratios of the other two resource dimensions in the statistical period prior to the adjustment are combined in a fixed order to form a multidimensional feature vector.

[0143] At the same time, the classification result corresponding to this multidimensional feature vector is determined.

[0144] Specifically, taking the adjustment of interface call quota as an example, data for 60 consecutive statistical periods is read starting from the first statistical period after the quota adjustment takes effect. When the bandwidth usage value exceeds the effective bandwidth quota or the computing capacity consumption exceeds the effective computing capacity quota in any one of the 60 statistical periods, the record is identified as having a cascading effect. When the bandwidth usage value does not exceed the bandwidth quota and the computing capacity consumption does not exceed the computing capacity quota in any of the 60 statistical periods, the record is identified as not having a cascading effect. The historical adjustment records of bandwidth quota and computing capacity quota are classified using the same method. After completing the historical record processing, a set of multi-dimensional feature vectors with definite classification labels is formed.

[0145] The random forest consists of 200 classification decision trees. When training each decision tree, samples with replacement are drawn from the multidimensional feature vector set, with the same number of samples as the original training samples, as the training data for the current decision tree. Each decision node calculates a split threshold for the feature data contained in the current node.

[0146] The split threshold is determined as follows: First, all values ​​of the current candidate feature in the node are arranged in ascending order, and duplicate values ​​are removed; then, the sum of two adjacent different values ​​is performed, and the sum is divided by 2. The resulting values ​​are used as candidate split thresholds. For example, when the two adjacent dependency weights are 0.42 and 0.50, the sum of the two values ​​is 0.92, and the result is divided by 2 to get 0.46. 0.46 is used as the candidate split threshold corresponding to the adjacent value.

[0147] For each candidate splitting threshold, samples smaller than the threshold are assigned to the left child node, and samples not smaller than the threshold are assigned to the right child node. The number of samples that have a chain reaction and those that have not are counted in the left and right child nodes respectively, and the Gini index of the two child nodes is calculated.

[0148] Specifically, for a child node, the number of samples that have undergone a chain reaction is divided by the total number of samples in that child node to obtain the proportion of category 1; the number of samples that have not undergone a chain reaction is divided by the total number of samples in that child node to obtain the proportion of category 2; the proportions of the two categories are squared and summed, and then the sum of squares is subtracted from 1 to obtain the Gini index of that child node; subsequently, the proportion of the number of samples in the left child node to the total number of samples in the current node is multiplied by the Gini index of the left child node, and the proportion of the number of samples in the right child node to the total number of samples in the current node is multiplied by the Gini index of the right child node, and the two products are added together to obtain the weighted Gini index corresponding to the current candidate split threshold.

[0149] Furthermore, after performing the above calculations on all candidate features and all candidate split thresholds of the current node, the candidate split threshold with the smallest weighted Gini index is determined as the actual split threshold of the node.

[0150] When two candidate split thresholds have the same weighted Gini index, the candidate split threshold with the smaller value is selected first. When the split thresholds are still the same, the split feature is determined according to the field order of dependency weight, quota adjustment range, and resource usage ratio. Thus, each non-leaf node obtains a unique split feature and corresponding split threshold.

[0151] Train 200 decision trees sequentially using the method described above to form a set of classification decision trees.

[0152] Then, all non-leaf nodes in the classification decision tree set are traversed. The node splitting threshold with resource dependency weight as the splitting feature is extracted as the dependency critical value, and the node splitting threshold with quota adjustment range as the splitting feature is extracted as the adjustment critical value.

[0153] To exclude accidental splits that occur only in a single decision tree, a split threshold is counted for nodes with the same resource direction.

[0154] Specifically, the split thresholds corresponding to the same adjusted resource dimension and the same associated resource dimension are arranged in ascending order of value. When the difference between two split thresholds does not exceed 0.02, the two split thresholds are grouped into the same threshold group. The representative value of each threshold group is determined by the arithmetic mean of all split thresholds in the group, that is, by adding all the split thresholds in the group in sequence and then dividing by the number of split thresholds in the group.

[0155] Further statistics were collected on the number of decision trees that completed splitting using this threshold group and whose subsequent branches eventually pointed to the leaf nodes where a chain reaction occurred.

[0156] When the number reaches 101 out of 200 decision trees, the representative value of this threshold group is determined as the critical value of the corresponding resource relationship; if it does not reach 101 trees, this threshold group is not used as the critical value.

[0157] Therefore, the critical value is derived from the split position in the classification decision tree set where more than half of the decision trees have a consistent classification effect.

[0158] Furthermore, after obtaining the critical values ​​and adjusting the critical values, a dimensionality reduction mapping is performed on the critical values.

[0159] The dimensionality reduction process uses the adjusted resource dimension as a benchmark, transforming the original split path, which simultaneously includes resource dependency weights, quota adjustment ranges, and associated resource states, into a 1-dimensional constraint range corresponding to the quota adjustment range.

[0160] Specifically, the classification results are read to identify decision paths that trigger a chain reaction, and the quota adjustment range splitting conditions corresponding to the currently adjusted resource dimension on that path are selected. When the splitting condition indicates that the quota adjustment range is not less than a certain adjustment threshold value, the threshold value is recorded as the lower boundary candidate value. When the splitting condition indicates that the quota adjustment range is less than a certain adjustment threshold value, the threshold value is recorded as the upper boundary candidate value.

[0161] When there are two or more candidate values ​​for the lower boundary of the same decision path, the candidate value with the largest value is determined as the lower boundary of the path; when there are two or more candidate values ​​for the upper boundary, the candidate value with the smallest value is determined as the upper boundary of the path. The lower boundary and the upper boundary together form the boundary constraint interval corresponding to the decision path.

[0162] For example, if a decision path contains two lower boundary conditions (quota adjustment range not less than 0.15 and quota adjustment range not less than 0.22) and two upper boundary conditions (quota adjustment range less than 0.40 and quota adjustment range less than 0.35), then 0.22 is taken as the lower boundary and 0.35 is taken as the upper boundary, forming a boundary restriction interval from 0.22 to 0.35.

[0163] Merge boundary restriction intervals obtained from the same resource direction.

[0164] Specifically, when two boundary restriction intervals intersect, the minimum value of the two lower boundaries is taken as the merged lower boundary, and the maximum value of the two upper boundaries is taken as the merged upper boundary; when two boundary restriction intervals do not intersect, they are retained separately. Thus, the multidimensional splitting conditions distributed on each decision path in the random forest are mapped to boundary restriction intervals for interface call quotas, bandwidth quotas, and computing capacity quotas.

[0165] Furthermore, after obtaining the boundary restriction range, a 3x3 quota correlation matrix is ​​established.

[0166] Specifically, the matrix rows are arranged according to interface call resources, bandwidth resources, and computing resources, and the matrix columns adopt the same arrangement order; the rows represent the resources being adjusted, and the columns represent the related resources affected by the adjustment of the resource; the diagonal position corresponding to the same resource is used to store its own quota adjustment boundary, and the off-diagonal position stores the dependency critical value between resources and the corresponding boundary limit range.

[0167] Taking the matrix cell corresponding to the row of interface call resources and the column of bandwidth resources as an example, this cell is written with the critical value of the dependence of interface call resources on bandwidth resources, as well as the boundary limit range of the bandwidth resources caused by the interface call quota; the other resource combinations are written to the corresponding matrix positions in the same way to form a quota association matrix that can characterize the constraint relationship between resources.

[0168] Specifically, when processing a new quota adjustment request, the corresponding row of the quota association matrix is ​​read according to the dimension of the resource to be adjusted.

[0169] First, read the dependency weights in the current resource dimension coupling graph and compare them with the dependency critical values ​​stored in the matrix unit. Then, subtract the current quota from the target quota, divide the difference by the current quota to obtain the quota adjustment range, and determine whether the quota adjustment range falls within the boundary limit range recorded by the matrix unit.

[0170] If the current dependency weight is less than the dependency threshold value, the corresponding associated resource will not be included in this chain constraint; if the current dependency weight is not less than the dependency threshold value, but the quota adjustment range is outside the boundary restriction range, the restriction condition corresponding to the matrix unit will not be triggered; if the current dependency weight is not less than the dependency threshold value, and the quota adjustment range is within the boundary restriction range, the corresponding associated resource will be added to the scope of this composite quota verification.

[0171] Once an associated resource is added to the composite quota verification range, the corresponding row of that associated resource in the quota association matrix is ​​read, and the same judgment process is used to check its restriction relationship with the remaining resources.

[0172] After completing the analysis of all relevant matrix units, the resource dimensions that need to be satisfied simultaneously, the corresponding critical values ​​of dependence, and the limit range of quota adjustment boundaries are obtained, and these are used as composite quota adjustment constraints.

[0173] Example 5: S4 includes obtaining a batch adjustment request for multiple tenants, the batch adjustment request carrying a unique attribution key and a target quota value; determining the resource occupancy baseline based on the unique attribution key, and calculating the difference between the target quota value and the resource occupancy baseline to obtain the quota increment value; classifying the quota increment value to obtain a composite quota adjustment constraint; if the target quota value meets the composite quota adjustment constraint, generating a state change sequence, and generating a first state change instruction set based on the state change sequence.

[0174] In this embodiment, the quota management node receives batch adjustment requests submitted by multiple tenants and divides the quota adjustment records corresponding to the tenants according to the unique ownership key in the request.

[0175] Specifically, each quota adjustment record contains a unique attribution key, a resource dimension, and a target quota value. The resource dimension corresponds to interface call resources, bandwidth resources, or computing resources. Adjustment records belonging to the same unique attribution key are grouped into the same quota adjustment group so that the resource quotas involved in the same tenant can use the resource status data at the same point in time in subsequent constraint judgments.

[0176] Specifically, when determining the resource occupancy baseline based on the unique attribution key, the 60 most recent 1-second statistical cycles that have been completed before the arrival time of the batch adjustment request are read from the initial dataset of multi-dimensional resource quotas.

[0177] Specifically, for API call resources, the API call frequencies of 60 statistical periods are summed up sequentially, and the cumulative value is divided by 60. The resulting value is used as the baseline for API call resource usage. For bandwidth resources, the number of bytes of data transmission recorded in 60 statistical periods is summed up and divided by 60 to obtain the bandwidth resource usage baseline. For computing resources, the computing consumption capacity recorded in 60 statistical periods is summed up and divided by 60 to obtain the computing resource usage baseline. All three baselines use the same set of continuous statistical periods to ensure that subsequent quota judgments correspond to the same business runtime.

[0178] Furthermore, after obtaining the resource usage baseline, the target quota values ​​in the batch adjustment requests are processed one by one.

[0179] Specifically, for interface call resources, the incremental value of the interface call quota is obtained by subtracting the baseline of interface call resource usage from the target interface call quota; for bandwidth resources, the incremental value of the bandwidth quota is obtained by subtracting the baseline of bandwidth resource usage from the target bandwidth quota; for computing resources, the incremental value of the computing quota is obtained by subtracting the baseline of computing resource usage from the target computing capacity quota. Thus, the incremental value of the quota directly represents the resource capacity reserved by the target quota relative to the actual resource usage level before the adjustment.

[0180] Furthermore, when classifying quota increment values, 0 is used as the first classification boundary. When the quota increment value is less than 0, it indicates that the target quota is lower than the resource occupancy baseline formed in the most recent 60 statistical periods. This adjustment record is classified as baseline insufficiency, and the target quota is determined not to meet resource occupancy constraints. When the quota increment value is equal to 0, it is classified as baseline boundary; when the quota increment value is greater than 0, it is classified as baseline surplus. The baseline boundary and baseline surplus categories continue to be assessed for resource association constraints.

[0181] In this embodiment, the resource association constraint adopts the quota association matrix formed by S3.

[0182] Specifically, the matrix stores the critical dependency values ​​and boundary restriction intervals between corresponding resource dimensions. The critical dependency values ​​are derived from the node splitting thresholds of the random forest classification decision trees: the node splitting thresholds in the same resource association direction are sorted by value, and the splitting thresholds with a difference of no more than 0.02 are grouped into the same group. The representative value is obtained by adding the splitting thresholds in the group and dividing by the number of thresholds in the group. When there are no less than 101 decision trees in 200 classification decision trees that form a classification path pointing to the chain reaction category using the splitting position of this group, the representative value is determined as the critical dependency value of the corresponding resource association direction. The boundary restriction interval is determined according to the quota adjustment amplitude splitting condition on the classification decision path in S3. Its lower boundary is the maximum value among all lower boundary conditions of the same path, and its upper boundary is the minimum value among all upper boundary conditions.

[0183] In addition, when performing the association constraint judgment of the current adjustment request, the coupling relationship graph of the current resource dimension is first read according to the unique affiliation key, and then the dependency weights of the resource to be adjusted pointing to the other two resources are obtained. Each dependency weight is compared with the dependency critical value recorded at the corresponding position of the quota association matrix.

[0184] If the dependency weight is less than the corresponding dependency threshold value, the associated resource will not be included in the current quota adjustment verification scope; if the dependency weight is not less than the dependency threshold value, the target quota adjustment range judgment will continue.

[0185] As a preferred implementation, the target quota adjustment range is calculated based on the currently effective quota.

[0186] Specifically, the target quota value is first subtracted from the current effective quota value to obtain the quota change amount. Then, the quota change amount is divided by the current effective quota value, and the result is used as the target quota adjustment range. Subsequently, the target quota adjustment range is compared with the corresponding boundary restriction interval in the quota association matrix. When the target quota adjustment range is within the boundary restriction interval, the corresponding associated resources are included in the composite quota verification range. When the target quota adjustment range is outside the boundary restriction interval, the restriction conditions corresponding to the resource association direction are not triggered.

[0187] This forms the composite quota adjustment constraint condition corresponding to the current adjustment record.

[0188] The determination process includes: the quota increment value corresponding to the target quota must not be less than 0; when the current dependency weight reaches the dependency critical value and the target quota adjustment range enters the boundary restriction range, the corresponding associated resources must enter the quota verification at the same time; for the associated resources entering the quota verification, the target quota is calculated in the same way as the resource occupation baseline, quota increment value and quota adjustment range, and the baseline constraint and quota association matrix constraint are executed again; after all the resources to be verified belonging to the same unique affiliation key have passed the above judgment, it is determined that the target quota value of this group meets the composite quota adjustment constraint condition.

[0189] Furthermore, after the target quota meets the composite quota adjustment constraints, the currently effective quota and target quota of the resource to be adjusted are read respectively.

[0190] When the target quota is greater than the current effective quota, the corresponding status change will be determined as quota increase; when the target quota is less than the current effective quota, the corresponding status change will be determined as quota decrease; when the target quota is equal to the current effective quota, no quota write instruction will be generated for this resource dimension.

[0191] Determine the execution order of state changes that have a relationship with the same unique ownership key.

[0192] During quota increases, when the target resource increases and requires associated resources to provide corresponding resource capacity, the quota increase status of associated resources is arranged first, followed by the quota increase status of the target resource. During quota decreases, the quota decrease status of the triggering resource is arranged first, followed by the quota decrease status of associated resources that are allowed to be executed due to the decrease of the triggering resource. The resource statuses at the same execution level are arranged in the order of interface call resources, bandwidth resources, and computing resources. A status change sequence is formed according to the above relationships.

[0193] Furthermore, after the state change sequence is formed, the first state change instruction is generated one by one according to the execution position in the sequence.

[0194] Specifically, each first state change instruction records the batch identifier, unique ownership key, resource dimension, currently effective quota, target quota, quota increment value, execution sequence number, and preceding instruction sequence number. When there is a resource association relationship, the execution sequence number corresponding to the first executed state change is written into the preceding instruction sequence number field of the subsequent executed instruction. When there is no preceding state change, the preceding instruction sequence number field is recorded as 0. All state change instructions belonging to the same batch adjustment request and passing the composite quota constraint verification are arranged according to the execution sequence number to form the first state change instruction set.

[0195] Example 6: S5 includes obtaining the first state change instruction set, parsing the first state change instruction set to extract the dependency order and resource locking range; constructing a directed acyclic graph based on the dependency order and resource locking range, traversing the directed acyclic graph to identify the set of conflicting nodes; if there is resource contention in the set of conflicting nodes, assigning a transaction isolation level to the set of conflicting nodes to obtain an execution queue with transaction isolation characteristics; sorting the execution queue with transaction isolation characteristics to generate an atomic operation execution sequence.

[0196] In this embodiment, the first state change instruction set is generated by the previous processing stage. Each state change instruction includes at least a batch identifier, a unique ownership key, a resource dimension, a current quota value, a target quota value, an execution sequence number, a preceding instruction sequence number, and a resource location to be written. After obtaining the first state change instruction set, the state change instructions to be executed are first divided according to the batch identifier, and then the preceding instruction sequence number and the resource location to be written are read one by one according to the execution sequence number.

[0197] Prefix instruction numbers are used to determine the dependency order among state change instructions.

[0198] When the preceding instruction number of the current instruction is 0, it is determined that the instruction has no preceding state change; when the preceding instruction number of the current instruction is not 0, the corresponding state change instruction is located according to the number, and the located instruction is determined as the direct preceding instruction of the current instruction; when a state change instruction is simultaneously constrained by two or more state changes, all preceding instruction numbers are recorded in the instruction, and the completion of all preceding instructions is taken as the condition for the current instruction to enter the execution state; thus, the complete dependency order in the first state change instruction set is obtained.

[0199] In this embodiment, the resource locking range is determined based on the unique ownership key, resource dimension, and actual quota storage location.

[0200] For API call quotas, the quota record containing the unique owner key and the API call resource field is defined as the locking scope; for bandwidth quotas, the quota record containing the unique owner key and the bandwidth resource field is defined as the locking scope; for computing capacity quotas, the quota record containing the unique owner key and the computing resource field is defined as the locking scope; when quota storage uses the same tenant resource record to store three resource dimensions, changes in the status of the three types of resources under the same unique owner key will all define the tenant resource record as the common locking scope; when the three types of resources are stored in independent records, the resource record that is actually written to is used as the locking scope.

[0201] Furthermore, after the dependency order and resource locking range are extracted, a directed acyclic graph is constructed using each first state change instruction as a graph node.

[0202] A directed edge is established between two nodes with a direct preceding relationship, pointing from the node corresponding to the preceding state change instruction to the node corresponding to the subsequent state change instruction. During graph construction, directed edges are added one by one according to the instruction dependencies. Each time a directed edge is added, the traversal proceeds backward along the existing directed edge from the end node of that edge. If the starting node of the edge can be reached again, it means that the newly added edge will form a closed loop. In this case, the edge is not written into the directed acyclic graph, and the corresponding state change instruction is marked as a dependency exception. If no closed loop exists, the directed edge is retained. This ensures that the node relationships entering the subsequent execution process always remain acyclic.

[0203] Furthermore, after establishing the dependency edges, the resource locking range corresponding to each node is written into the node attributes, and the directed acyclic graph is traversed to identify conflicting nodes.

[0204] For any two state change nodes, first compare their unique ownership keys and resource locking ranges; if the locking ranges of the two nodes do not overlap, they are not identified as conflicting nodes; if the two nodes write to the same quota record or the fields they write belong to the same resource locking range, continue to check whether there is a definite sequential dependency path between the two nodes.

[0205] If the first node can reach the second node along a directed edge, or the second node can reach the first node along a directed edge, then the two nodes already have a definite execution order. They will be processed according to the existing dependency relationship and will not be added to the conflict node set again.

[0206] If the resource locking ranges of two nodes overlap and there is no dependency path between the two nodes in any direction, then both nodes are added to the conflict node set. After completing the pairwise checks of all nodes according to this rule, the conflict node set corresponding to this state change is obtained.

[0207] Further determine whether resource competition exists for the set of conflicting nodes.

[0208] The criteria for determining resource contention are: at least two conflicting nodes correspond to the same resource lock range, and at least one node needs to write to that resource lock range.

[0209] In this embodiment, the first state change instructions are all quota write instructions. Therefore, when two conflicting nodes correspond to the same locking range and there is no predetermined dependency order, it is determined that there is a resource contention.

[0210] Furthermore, upon detecting resource contention, conflicting nodes are grouped according to their resource lock range. Conflicting nodes within the same lock range are assigned to the same transaction group, and this transaction group is assigned a serializable transaction isolation level. Under the serializable transaction isolation level, any state change instruction within the same transaction group must acquire the corresponding resource lock before entering the write phase. While the resource lock is held by the current transaction, other state change instructions pointing to the same lock range remain in a waiting state. After the current transaction commits or rolls back, the resource lock is released, and the next state change instruction can then enter the write phase. This prevents the same resource quota from being rewritten simultaneously by two state change processes.

[0211] In addition, for state change instructions that do not belong to the set of conflicting nodes, they are directly added to the execution queue according to the dependency order in the directed acyclic graph; for state change instructions that belong to the set of conflicting nodes, serial execution relationships within the transaction group are added while maintaining the original dependencies; when there are more than two instructions without direct dependencies within a transaction group, they are sorted in order of unique ownership key, resource dimension, and original execution sequence number, where the resource dimension is determined in the order of interface call resources, bandwidth resources, and computing resources; the node that is sorted first is added as the predecessor node of the node that is sorted later, so that the write order within the same resource locking range is uniquely determined.

[0212] Furthermore, after completing the transaction isolation relationship supplementation, the execution queue is topologically sorted.

[0213] First, count the number of predecessor nodes that have not yet been executed for each node, and put nodes with 0 predecessor nodes into the execution area. When there are more than 2 nodes in the execution area, arrange them first according to the transaction group order, and then arrange the nodes that do not belong to the same transaction group according to the original execution sequence number in ascending order. Select the node that is ranked first and write it into the execution sequence, and remove the node and its directed edges from the directed acyclic graph. Then recalculate the number of predecessor nodes for the remaining nodes. Repeat the above process until all state change nodes are written into the execution sequence.

[0214] For each state change instruction in the execution sequence, resource lock acquisition, current quota reading, version verification, target quota writing, and version update are grouped into the same transaction operation unit.

[0215] After a transaction operation unit begins, it first acquires the corresponding resource lock, then reads the current quota value and the current version number. If the current version number matches the version number recorded in the first state change instruction, it writes the target quota and increments the version number by 1. After writing, it commits the transaction and releases the resource lock. If the current version number does not match the version number recorded in the instruction, it does not execute the target quota write, rolls back the current transaction, and returns an execution exception. Arrange the above transaction operation units in order according to the topological sorting result to obtain the atomic operation execution sequence.

[0216] Example 7: S6 includes obtaining the atomic operation execution sequence, calculating the quota deduction amount based on the atomic operation execution sequence in the sandbox environment; performing resource quota update based on the quota deduction amount, collecting data during the resource quota update to generate a state change trajectory; determining whether there is an inconsistency between the snapshot of the state change trajectory and the baseline snapshot, and extracting the snapshot comparison difference if there is an inconsistency; generating a difference compensation instruction based on the snapshot comparison difference, and recombining the difference compensation instruction and the atomic operation execution sequence to obtain a second state change instruction set.

[0217] In this embodiment, the sandbox environment receives the atomic operation execution sequence arranged according to dependency and transaction isolation order, and reads the interface call quota, bandwidth quota, computing capacity quota and version number of each resource quota under the corresponding unique ownership key before executing the first atomic operation, and saves the reading results as the initial execution state.

[0218] Each operation in the atomic operation execution sequence contains a unique ownership key, the resource dimension to be adjusted, the quota value before execution, the target quota value, the version number before execution, and the execution sequence number.

[0219] The quota deduction for each atomic operation is calculated sequentially according to the execution sequence number.

[0220] During calculation, the target quota value recorded by the atomic operation is subtracted from the current effective resource quota value in the sandbox environment, and the difference is used as the quota deduction amount. When the difference is greater than 0, it means that the target quota is lower than the current quota, and the difference itself is used as the quota value to be deducted this time. When the difference is less than 0, it means that the target quota is higher than the current quota, and the absolute value of the difference is used as the quota value to be increased. When the difference is equal to 0, it is determined that the quota value of this resource dimension does not need to be changed.

[0221] For example, if the current API call quota is 120 and the target quota is 90, subtracting 90 from 120 gives 30, and the quota reduction is 30. The updated API call quota is 90, which is 120 minus 30. If the current API call quota is 90 and the target quota is 120, subtracting 120 from 90 gives -30, which is determined as the increase value. The updated API call quota is 120, which is 90 plus 30. Thus, each atomic operation can determine a unique resource change value and change direction based on the current quota and the target quota.

[0222] Furthermore, after obtaining the quota reduction, the corresponding resource quota is updated in the sandbox environment.

[0223] When the quota reduction is positive, the quota reduction is subtracted from the current resource quota; when the quota reduction corresponds to an increase, its absolute value is added to the current resource quota; when the quota reduction is 0, the current resource quota remains unchanged; when a resource quota is written, the version number corresponding to the resource quota is incremented by 1 based on the original version number, and the original version number is maintained when no write occurs.

[0224] In addition, after each atomic operation is completed, the interface call quota, bandwidth quota, computing capacity quota, and version number of the three resources corresponding to the same unique ownership key are immediately reread. At the same time, the execution sequence number of this operation, the quota before the update, the quota deduction, the target quota, the actual quota after the update, and the execution result are recorded. The above data are continuously saved according to the execution order of the atomic operations, thus forming a state change trajectory. At each execution position in the state change trajectory, a snapshot of the resource state after the update is completed is saved, so that the target resource changes and non-target resource changes caused by an atomic operation can be determined by the snapshots before and after.

[0225] The baseline snapshot is generated before the actual writing to the sandbox begins.

[0226] During generation, the initial execution state obtained from the sandbox environment is used as the first baseline state, and then the execution sequence of atomic operations is deduced item by item. For the current atomic operation, the quota value of the resource to be adjusted is read from the previous baseline state, and the corresponding deduction or increase calculation is performed according to the already calculated quota deduction amount. The calculation result is written to the current resource dimension. The quota values ​​of the other two resource dimensions that are not adjusted by the current atomic operation are retained from the previous baseline state. When the quota is written in the current operation, the corresponding version number is incremented by 1, and the version numbers of the other resources remain unchanged. After processing all atomic operations in sequence, a baseline snapshot corresponding to each execution sequence number is obtained.

[0227] Furthermore, after the state change trajectory is formed, the actual state snapshot is compared with the corresponding baseline snapshot item by item according to the execution sequence number.

[0228] Specifically, the comparison includes the unique ownership key, interface call quota, bandwidth quota, computing capacity quota, and the version number corresponding to the three resources; when all field values ​​are consistent, there is no snapshot difference at this execution position; when any one resource quota or version number is inconsistent, the execution position is determined as the snapshot inconsistency position.

[0229] In addition, for locations with inconsistent snapshots, the actual snapshot value and the baseline snapshot value are extracted item by item, and the snapshot comparison difference is calculated. The resource quota difference is calculated by subtracting the baseline quota from the actual quota.

[0230] When the calculation result is greater than 0, it means that the actual quota exceeds the baseline quota, and the calculation result is the difference value to be deducted; when the calculation result is less than 0, it means that the actual quota is lower than the baseline quota, and the absolute value of the calculation result is taken as the difference value to be added; when the calculation result is equal to 0, there is no difference in the resource quota; the version number is determined by subtracting the baseline version number from the actual version number, and this difference and the corresponding resource quota difference are recorded together in the snapshot comparison difference record.

[0231] As a preferred embodiment, a difference compensation instruction is generated based on the snapshot comparison difference.

[0232] Specifically, when the actual quota is higher than the baseline quota, the difference compensation instruction records the current actual quota, the baseline quota, and the difference value to be deducted, and determines the baseline quota as the target value after compensation; when the actual quota is lower than the baseline quota, the absolute difference between the two is used as the increase value, and the baseline quota is also used as the compensation target; when the actual quota is the same as the baseline quota but the version number is different, the quota value is not changed, only the resource status is marked as a version difference, and the correction is completed in the sandbox environment according to the version status recorded in the baseline snapshot, so that the resource quota and version status after compensation are consistent with the baseline snapshot.

[0233] Specifically, when an atomic operation causes a snapshot difference between two resource dimensions, a difference compensation instruction is generated for each of the two resource dimensions.

[0234] Each difference compensation instruction records a unique ownership key, the corresponding atomic operation execution sequence number, the difference resource dimension, the quota before compensation, the target quota for compensation, the compensation value, and the version status after compensation, so that the compensation instruction can directly locate the execution location and resource record that caused the difference.

[0235] Furthermore, after the difference compensation instruction is generated, the difference compensation instruction and the atomic operation execution sequence are recombined.

[0236] Specifically, the original dependencies and order of the atomic operation execution sequence are kept unchanged. Then, each difference compensation instruction is inserted after the atomic operation that generates the corresponding snapshot difference and placed before the next atomic operation that depends on the result of this atomic operation. When one atomic operation corresponds to more than two difference compensation instructions, the compensation instructions are arranged in the order of interface call resources, bandwidth resources, and computing resources. The subsequent atomic operation is executed after all the compensation instructions at the execution position have been processed.

[0237] After the insertion is completed, all operations after the reorganization are renumbered consecutively according to their actual execution positions, and the preceding execution sequence number of each operation is recorded again.

[0238] Atomic operations without snapshot differences retain their original state change content; execution positions with snapshot differences consist of atomic operations and the following difference compensation instructions, forming a complete state change process; all state change operations are arranged according to the newly determined execution sequence number to obtain the second state change instruction set.

[0239] Example 8: S7 includes obtaining the execution feedback of the second state change instruction set in the sandbox environment; if the execution feedback is that there are no anomalies, synchronizing the second state change instruction set to the production environment and parsing the resource quotas of multiple resource dimensions; matching the consumption rate of real-time business requests with the resource quotas of multiple resource dimensions to determine the composite quota rate limiting threshold; intercepting real-time business requests according to the composite quota rate limiting threshold, calculating the remaining capacity, updating the resource pool according to the remaining capacity, and determining the final resource quota distribution result.

[0240] In this embodiment, the second state change instruction set is executed sequentially in the sandbox environment according to the instruction execution sequence number.

[0241] For each status change instruction executed, record the unique ownership key, resource dimension, quota value before execution, target quota value, actual quota value written, version number before execution, version number after execution, and execution result; after all instructions have been executed, verify each of the above records.

[0242] The evaluation of the feedback includes three aspects.

[0243] First, the actual quota value written is compared with the corresponding target quota value. If the two values ​​are the same, the quota verification is passed. Second, for instructions that have quota written, the version number after execution is subtracted from the version number before execution. If the result is equal to 1, the version verification is passed. Third, the actual execution order is checked according to the preceding execution sequence number in the instruction. If all preceding instructions are completed before subsequent instructions that depend on this instruction, the sequence verification is passed. When all instructions in the same second state change instruction set pass all three verifications, the execution feedback is determined to be without anomalies. If any one of them is inconsistent, the execution feedback is determined to be abnormal, and normal production environment synchronization is not performed.

[0244] When the execution feedback indicates no abnormalities, the second state change instruction set is sent to the production environment according to the execution sequence number verified in the sandbox environment.

[0245] In the production environment, the resource quota record for the corresponding tenant is located based on the unique ownership key. Before executing each instruction, the current version number is read and compared with the version number before execution carried by the instruction. If they are the same, the target quota value is written, and the version number is incremented by 1. If they are different, subsequent writing in the current batch is stopped, and an exception execution feedback is generated. After all instructions have been written, the quota change is submitted.

[0246] Furthermore, after the quota change is submitted, the currently effective interface call quota, bandwidth quota, and computing capacity quota are read using a unique ownership key.

[0247] The API call quota represents the number of API calls allowed within one second, the bandwidth quota represents the number of data bytes allowed to be transmitted within one second, and the computing capacity quota represents the computing capacity allowed to be used within one second; these three quotas serve as the rate limiting benchmarks for their respective resource dimensions.

[0248] For real-time business requests entering the production environment, a continuous 1-second cycle is used as the resource metering period.

[0249] Specifically, the interface call consumption rate is determined based on the number of interface calls accepted in the current second, that is, the number of requests that have passed the rate limiting verification in the current second; the bandwidth consumption rate is determined based on the cumulative number of data bytes sent and received in the current second; the computing consumption rate is determined based on the cumulative computing capacity allocated to business tasks in the current second; at the start of a new 1-second metering cycle, the cycle consumption records of the three resource dimensions are re-accumulated from 0.

[0250] Before the current business request enters the corresponding resource execution stage, calculate the pre-occupancy amount after the execution of this resource operation.

[0251] In the interface call phase, the number of interface calls already accepted within the current second is incremented by 1, and the resulting value is used as the pre-occupancy amount for the interface call after the current request is approved. In the network transmission phase, before each data to be transmitted is submitted, the number of bytes to be transmitted is read, and this number of bytes is added to the number of bytes already transmitted within the current second, and the resulting value is used as the pre-occupancy amount of bandwidth. Before a computing task enters the scheduling queue, the computing capacity requirement value already determined in the task scheduling record is read, and this computing capacity requirement value is added to the computing capacity already allocated within the current second, and the resulting value is used as the pre-occupancy amount of computing resources.

[0252] Subsequently, the pre-occupancy amount for each resource dimension is matched with the corresponding resource quota.

[0253] Specifically, the interface call pre-occupancy is divided by the interface call quota to obtain the interface call resource occupancy value; the bandwidth pre-occupancy is divided by the bandwidth quota to obtain the bandwidth resource occupancy value; the calculated resource pre-occupancy is divided by the calculated capacity quota to obtain the calculated resource occupancy value; all three calculations use the same processing relationship, so when a certain resource pre-occupancy is exactly the same as the resource quota, the corresponding resource occupancy value is equal to 1.

[0254] Furthermore, the three resource usage values ​​are compared, and the one with the largest value is taken as the composite resource usage value of the current business request, and 1 is determined as the composite quota rate limiting threshold.

[0255] The threshold is determined by the normalized relationship of the pre-occupancy of resources divided by the corresponding resource quota. When the composite resource occupancy value is not greater than 1, it means that the pre-occupancy of the three resource dimensions has not exceeded their respective resource quotas. When the composite resource occupancy value is greater than 1, it means that the pre-occupancy of at least one resource dimension has exceeded the currently effective resource quota of that resource dimension.

[0256] Specifically, when the composite resource occupancy value is no greater than 1, the current resource operation is allowed to continue, and the corresponding pre-occupied amount is written to the resource consumption record. When the composite resource occupancy value is greater than 1, the current business request is intercepted, and the resource dimension that has exceeded the limit is determined based on the three resource occupancy values; when the interface call resource occupancy value is greater than 1, the current request is not included in the interface call's already occupied capacity; when the bandwidth resource occupancy value is greater than 1, the current data to be transmitted is not submitted; when the computation resource occupancy value is greater than 1, the computation capacity required for the current task is not allocated to the computation execution queue; when two or more resource occupancy values ​​are simultaneously greater than 1, the corresponding resource dimension is simultaneously recorded as exceeding the limit.

[0257] Furthermore, after a business request passes the rate limiting verification, the resource consumption for the current metering period is updated based on the actual resource usage.

[0258] Specifically, after a request is allowed, the number of times an interface call resource has been used is increased by 1; the number of bytes used for bandwidth resources is increased according to the actual number of bytes transmitted; the number of computing resources used is increased according to the computing capacity already allocated to the task; and each resource consumption record is bound to a corresponding unique ownership key, so that the consumption of the three types of resources for the same tenant can be read from the same resource pool record.

[0259] Furthermore, the remaining capacity is calculated by subtracting the resource value already used in the current metering period from the currently effective resource quota.

[0260] Specifically, the remaining capacity of the interface call is obtained by subtracting the number of currently accepted interface calls from the interface call quota; the remaining bandwidth capacity is obtained by subtracting the current cumulative number of bytes transmitted from the bandwidth quota; the remaining computing capacity is obtained by subtracting the current cumulative allocated computing capacity from the computing capacity quota; since each resource occupation is subject to composite quota rate limiting judgment before writing, the occupied resources after writing do not exceed the corresponding resource quota, so the remaining capacity of all three items is not less than 0.

[0261] In addition, the resource pool stores the current valid quota, the current occupied capacity, and the current remaining capacity using a unique ownership key.

[0262] After each request is approved, data is transmitted, or computing capacity is allocated, the remaining capacity of the corresponding resource dimension is recalculated, and the resource pool is updated with the calculation result. When a request is blocked, the remaining capacity of the blocked resource dimension is not deducted. After the current 1-second metering period ends, the final consumption record of the period is saved. At the beginning of the next metering period, the three available capacities are restored to the currently effective interface call quota, bandwidth quota, and computing capacity quota, respectively, and then deducted again according to the new real-time business requests.

[0263] After the above processing, each unique ownership key finally corresponds to one set of currently valid interface call quota, bandwidth quota and computing capacity quota, as well as three items of occupied capacity and three items of remaining capacity. The resource status corresponding to each unique ownership key is written into the resource pool according to the currently effective quota and remaining capacity, thus obtaining the final resource quota distribution result in the production environment.

[0264] Example 9: S8 includes obtaining the execution feedback of the second state change instruction set; if the execution feedback contains an exception identifier, constructing a recovery task based on the state change trajectory and quota snapshot; attaching a lock mark to the recovery task and writing the recovery task with the lock mark into the asynchronous recovery queue; reading the recovery task from the asynchronous recovery queue, parsing the recovery task to obtain the rollback instruction; and using the rollback instruction to perform the reverse operation, asynchronously recovering the abnormal resource quota based on the state before the resource quota update.

[0265] In this embodiment, when the second state change instruction set is executed in a sandbox environment or a production environment, each execution of a state change instruction generates an execution feedback.

[0266] Specifically, the execution feedback record includes a unique ownership key, an abnormal batch identifier, resource dimension, instruction execution sequence number, quota value before execution, target quota value, actual quota value written, version number before execution, version number after execution, and execution result. When the actual quota value written is inconsistent with the target quota value, an abnormal identifier is written to the execution feedback. When the result of subtracting the version number before execution from the version number after execution is not equal to 1 after quota writing, an abnormal identifier is written. When the preceding instruction of the current instruction has not been completed but the current instruction has already been executed, an abnormal identifier is also written. If any of the above conditions are met, the recovery process for the corresponding abnormal batch is initiated.

[0267] When constructing the recovery task, the system first reads the status change records that have been written in this batch from the status change trajectory based on the abnormal batch identifier and unique ownership key, and then arranges them in ascending order according to the instruction execution sequence number.

[0268] Then, the quota snapshot saved before the start of this batch execution is read. The quota snapshot records the interface call quota, bandwidth quota, computing capacity quota and corresponding version number respectively. For each resource dimension that has been written, the current quota value in the status change trajectory is compared with the quota value before the update in the quota snapshot. If the difference between the current quota value and the quota value before the update is greater than 0, it indicates that the resource quota was increased before the anomaly occurred, and the difference is the value that needs to be rolled back. If the difference is less than 0, the absolute value of the difference is taken as the value that needs to be rolled back. If the difference is equal to 0, no quota value recovery operation is generated for the resource dimension.

[0269] In addition, recovery records are generated separately for resource dimensions where quota differences exist.

[0270] Specifically, each recovery record contains the abnormal batch identifier, unique ownership key, resource dimension, original instruction execution sequence number, current quota value, quota value before update, current version number, and version number before update. When there are more than two recovery records for the same abnormal batch, they are arranged in descending order according to the original instruction execution sequence number, so that the resource quota changes executed later are included in the recovery order first. The arranged recovery records together constitute the recovery task.

[0271] Furthermore, after a recovery task is created, a lock tag is attached to each recovery record.

[0272] Specifically, the locking marker is generated by concatenating the abnormal batch identifier, unique ownership key, and resource dimension in that order, so that the same resource dimension within the same abnormal batch corresponds to a unique locking marker. Before the recovery task is written to the asynchronous recovery queue, the incomplete tasks in the queue are queried according to the locking marker. If the same locking marker already exists, it is not written again. If the same locking marker does not exist, the recovery record and its locking marker are written to the asynchronous recovery queue. Thus, only one recovery record to be executed is retained for the same abnormal resource within one abnormal batch.

[0273] Furthermore, after the asynchronous recovery execution end reads the recovery task from the head of the queue, it first requests an exclusive lock on the corresponding resource quota record based on the locking flag.

[0274] After acquiring the exclusive lock, the unique ownership key, resource dimension, current quota value, quota value before update, current version number, and original instruction execution sequence number in the recovery record are parsed to generate a rollback instruction. The recovery target value in the rollback instruction is directly taken from the quota value before update corresponding to the quota snapshot, and the rollback direction is determined according to the relationship between the current quota value and the quota value before update.

[0275] When the current quota value is greater than the quota value before the update, the rollback deduction amount is obtained by subtracting the quota value before the update from the current quota value, and this rollback deduction amount is deducted from the current quota during execution; when the current quota value is less than the quota value before the update, the rollback increase amount is obtained by subtracting the current quota value from the quota value before the update, and this rollback increase amount is added to the current quota during execution; when the two values ​​are equal, the quota value is not written.

[0276] In addition, before executing the rollback command, the real-time quota value and real-time version number in the resource quota record are read again and compared with the current quota value and current version number saved in the recovery record.

[0277] If both data items are consistent, a rollback will be performed; if either item is inconsistent, it indicates that the resource quota has undergone a new state change after the anomaly occurred, which does not overwrite the current resource quota. In this case, the recovery record will be set to a state conflict and the exclusive lock will be released.

[0278] Furthermore, after the rollback verification passes, the reverse operation is performed according to the original instruction execution sequence number in the recovery task, from largest to smallest.

[0279] Specifically, when the original state change increases the interface call quota from 80 to 120, during restoration, 120 is subtracted from 80 to obtain 40, and 40 is deducted from the current interface call quota to restore the interface call quota to 80; when the original state change decreases the bandwidth quota from 200 to 150, during restoration, 200 is subtracted from 150 to obtain 50, and 50 is added to the current bandwidth quota to restore the bandwidth quota to 200; the calculation capacity quota is restored using the same calculation relationship.

[0280] For each rollback instruction completed, the corresponding resource quota value is reread and compared with the quota value before the update in the quota snapshot; if the two values ​​match, the recovery record is marked as complete and the corresponding exclusive lock is released; if the values ​​do not match, the recovery record is not deleted and is retained in the asynchronous recovery queue for re-execution.

[0281] Furthermore, after all rollback instructions for the same abnormal batch have been executed, the interface call quota, bandwidth quota, and computing capacity quota are reread based on the unique ownership key, and each is compared with the quota snapshot saved before the start of this batch. If all three resource quotas are consistent with their respective quota values ​​before the update, the recovery task is marked as complete. If any one of them is inconsistent, only the recovery record of the corresponding resource dimension is retained to continue asynchronous recovery.

[0282] Through the above processing, when an anomaly occurs in the second state change instruction set, the location of the anomaly is first determined based on the execution feedback. Then, the actual changed resource quota and recovery difference are calculated by combining the state change trajectory and quota snapshot. Finally, a rollback instruction is generated in reverse order of the original state change sequence to restore the abnormal resource quota to the quota state saved before this batch of updates.

[0283] Example 10: A single-key-owned composite quota rate limiting and asynchronous recovery system is also provided, used to implement the steps of the single-key-owned composite quota rate limiting and asynchronous recovery method, the system comprising: The data acquisition module acquires the frequency of interface calls, bandwidth usage, and computing capacity consumption during the operation of the distributed system, extracts the real-time consumption values ​​of each dimension, and establishes a unique ownership key to associate tenants with corresponding multi-dimensional resource quotas, thereby obtaining the initial dataset of multi-dimensional resource quotas. The coupling analysis module processes the initial dataset of multi-dimensional resource quotas through graph neural networks, analyzes the degree of interaction between interface call frequency, bandwidth usage, and computational capacity consumption, extracts the dependency weights between each resource node, and obtains a resource-dimensional coupling relationship graph. The constraint determination module uses a random forest algorithm to classify the dependent weights based on the resource dimension coupling relationship graph, identifies the critical value that triggers a chain reaction when a single dimension adjustment is made, and determines the constraint conditions for composite quota adjustment. The instruction generation module obtains batch adjustment requests for multiple tenants, determines multiple resource dimensions corresponding to each tenant based on the unique attribution key, and extracts the target quota value from the batch adjustment request. If the target quota value meets the composite quota adjustment constraint, the first state change instruction set is generated. The sequence construction module parses the first state change instruction set, extracts the dependency order and resource locking range between instructions, constructs an execution queue with transaction isolation characteristics, and obtains the atomic operation execution sequence. The update execution module performs resource quota updates in a pre-established sandbox environment according to the atomic operation execution sequence, records the state change trajectory during the update process, and obtains the second state change instruction set; If the execution feedback of the second state change instruction set in the sandbox environment is without anomalies, the rate limiting module determines that the data consistency verification has passed, synchronizes the second state change instruction set to the production environment, and performs composite quota rate limiting on the business requests of the corresponding tenants based on the resource quotas of multiple resource dimensions after synchronization, and determines the final resource quota distribution result. The recovery module generates a recovery task based on the state change trajectory if the execution feedback of the second state change instruction set is abnormal in the sandbox environment or production environment. The recovery task is written into the asynchronous recovery queue, and the abnormal resource quota is asynchronously recovered based on the state before the resource quota update.

[0284] In this embodiment, the data acquisition module first collects the frequency of interface calls, bandwidth usage, and computational capacity consumption generated during the operation of the distributed system, and completes resource data alignment according to a unified statistical period.

[0285] Subsequently, a unique attribution key is generated based on the tenant identifier and quota identifier. Each resource dimension corresponding to the same tenant is then bound to this unique attribution key to form a multi-dimensional resource quota initial dataset.

[0286] The coupling analysis module receives the initial dataset of multi-dimensional resource quotas, constructs interface call resources, bandwidth resources, and computing resources as resource nodes, propagates and updates the resource consumption characteristics of each resource node through a graph neural network, and calculates the dependency weights between resource nodes based on the updated node characteristics. The resource-dimensional coupling relationship graph is formed by the resource nodes, node connection relationships, and dependency weights.

[0287] The constraint determination module reads the dependency weights in the resource dimension coupling graph and combines them with historical quota adjustment data to input the random forest for classification.

[0288] The critical value corresponding to resource adjustment is determined by the node splitting threshold in the classification decision tree. Then, the composite quota adjustment constraint is determined based on the critical value and the correlation between resources. This constraint is used to limit the adjustment of a single resource quota from causing other resource dimensions to exceed the quota range.

[0289] The instruction generation module receives multi-tenant batch adjustment requests, queries the corresponding tenant's interface call quota, bandwidth quota, and computing capacity quota based on the unique ownership key carried in the request, and compares the target quota value with the composite quota adjustment constraints.

[0290] When all resources to be adjusted meet the constraints, a first state change instruction set is generated based on the target quota of each resource dimension.

[0291] The sequence construction module parses the preceding instruction relationships and resource locking range in the first state change instruction set, constructs each state change instruction into a directed acyclic graph node, and identifies conflicting nodes that access the same resource record.

[0292] When resource contention exists, transaction isolation relationships are set for the corresponding nodes, and then sorting is completed according to the dependency order and transaction execution order to obtain the atomic operation execution sequence.

[0293] The update execution module executes resource quota changes sequentially in the sandbox environment according to the atomic operation execution sequence. Before and after each change, it records the resource quota value, version status, and execution result to form a state change trajectory. Then, it compares the resource status formed by the actual execution with the baseline status, generates compensation instructions for the locations where differences occur, and rearranges the compensation instructions with the atomic operation execution sequence to obtain the second state change instruction set.

[0294] The rate limiting module obtains the execution feedback of the second state change instruction set in the sandbox environment.

[0295] When the target quota, actual write quota, version status, and execution order of each instruction all meet the verification conditions, it is determined that there is no abnormality in the execution feedback, and the second state change instruction set is synchronized to the production environment. After synchronization, the quotas of multiple currently effective resource dimensions are read according to the unique ownership key, and the interface call consumption, bandwidth consumption, and computing consumption corresponding to the real-time business request are compared with the corresponding resource quotas. When any resource dimension reaches the rate limiting condition, the current business request is intercepted. If the rate limiting condition is not reached, the business request is allowed to continue to execute, and the remaining capacity in the resource pool is updated according to the actual resource consumption to form the final resource quota distribution result.

[0296] The recovery module monitors the execution results of second-state change commands in the sandbox environment and the production environment.

[0297] When an anomaly is detected in the execution feedback, the resource dimension whose quota has changed is determined based on the status change trajectory, and the quota status saved before the resource quota update is read to generate a recovery task. After the recovery task is written to the asynchronous recovery queue, the recovery module generates and executes rollback instructions in reverse order of the original status change order to restore the abnormal resource quota to the quota status before this update.

[0298] Example 11: like Figure 1 and Figure 5 As shown, an experiment is designed to verify this application: Experimental environment and test bed: The testbed uses a small-scale real-world deployment rather than a simulation model, with the following specific configuration: Table 1 Experimental Environment Parameter Configuration

[0299] Control group settings: Two common practices in the industry are used as a reference: (1) Step-by-step adjustment: quotas are issued one by one according to the dimension, without transaction isolation and unified execution sequence; (2) Direct update: after the change is verified, it is directly written to the production environment without sandbox pre-execution; (3) Synchronous recovery: when an exception occurs, it is synchronously rolled back in the business thread; this method follows the process of S1-S8.

[0300] Experimental principles: All experiments were univariate comparisons, each experiment was repeated a sufficient number of times, and the data were taken as the average of multiple rounds to avoid the influence of a single fluctuation on the conclusions; no special configurations were made to the tested system that were unfavorable to the control group during the experiment.

[0301] Experiment 1: Consistency and Efficiency of Batch Quota Adjustment for Multi-Tenants Method: 50 rounds of batch adjustment requests were continuously submitted to the testbed. Each round included quota changes for 10 tenants and 3 resource dimensions per tenant (i.e., 30 change instructions per round). The control group distributed the changes step by step according to the dimensions. This method aggregated the dimensions of each tenant by unique ownership key to generate a state change sequence. After generating an atomic operation execution sequence through a transaction isolation execution queue, the changes were distributed uniformly. The final configuration state was checked round by round to see if it was consistent with the expected state. The number of rounds with inconsistent intermediate states, the number of repeated modifications, the number of configuration omissions, and the completion time were counted, as shown in Table 2.

[0302] Table 2. Consistency Comparison of Batch Quota Adjustments (50 rounds, 10 tenants per round × 3 dimensions)

[0303] like Figure 2 As shown in the bar chart, the horizontal axis represents the three types of consistency defects, and the vertical axis represents the number of times they occurred in 50 rounds of adjustments. The step-by-step adjustment resulted in 6 rounds of inconsistency in intermediate states, 4 instances of repeated modifications, and 3 instances of configuration omissions within 50 rounds. This was because quotas for multiple dimensions were written in batches, lacking a unified locking range and execution order between batches, allowing earlier and later instructions to be read concurrently within the time window. This method, however, had zero defects in all three types, indicating that aggregating dimensions by unique ownership keys and utilizing transaction-isolated execution queues can eliminate intermediate states generated by step-by-step updates.

[0304] This method reduces the number of three types of consistency defects from a total of 13 to 0, with an average completion time increase of only about 3.4ms (1.1%, which is within the normal range of network jitter), verifying the atomicity of batch adjustment without sacrificing latency.

[0305] Experiment 2: Anomaly Interception Effect of Sandbox Pre-execution Consistency Check Methods: Twenty quota adjustment changes were constructed, 17 of which involved artificially injected anomalies (target value out of bounds, ownership key conflicts, and unmet inter-dimensional constraints, etc.). The control group was directly written to the production environment after the change verification passed. This method first executed the change in a sandbox environment, collected the state change trajectory, and compared it with the baseline snapshot. Only when the comparison was consistent were the changes synchronized to the production environment. The number of times anomalies entered the production environment and the duration of the impact on the production environment were recorded, as shown in Table 3.

[0306] Table 3 Comparison of Sandbox Pre-Execution Consistency Verification (20 changes, 17 of which included anomalies)

[0307] like Figure 3 As shown in the scatter plot, the horizontal axis represents the injection sequence number of the 20 abnormal changes, and the vertical axis represents the duration of the impact of the change on the production environment. The red crosses (direct updates) show an impact duration of 20-80 seconds for 17 sequence numbers, totaling 958 seconds. All blue dots (this method) are near 0, indicating that the anomaly was intercepted in the sandbox stage and did not enter the production environment. The three sequence numbers in the figure that did not have anomalies implanted had no impact in either group and can be used as a benchmark.

[0308] This method, with a single sandbox validation overhead of 18ms, effectively intercepts all 17 abnormal configurations, cumulatively avoiding approximately 958 seconds of production environment impact, demonstrating a significant return on investment. Furthermore, it is evident that changes without implanted anomalies are unaffected by either method, indicating that sandbox validation does not inadvertently harm legitimate changes.

[0309] Experiment 3: Comparison of Timeliness and Non-blocking Nature of Anomaly Recovery Methods Methods: 30 exceptions (such as failure to write target tenant quota, inconsistent snapshot comparison, etc.) were injected during the quota update execution phase. Two recovery strategies were adopted respectively: (1) Synchronous recovery: the rollback was directly executed in the thread of the normal quota adjustment process; (2) This method: the recovery task was constructed based on the state change trajectory and quota snapshot, and after attaching a lock mark, it was written into the asynchronous recovery queue, which was read and executed by an independent consumer thread. The average recovery time, the average blocking time of the normal quota adjustment process during the recovery period and the recovery success rate were recorded as shown in Table 4.

[0310] Table 4 Comparison of anomaly recovery methods (30 anomaly injections)

[0311] like Figure 4 As shown, the left figure compares the average recovery time. The recovery actions of the two methods take similar times (87.0ms and 91.6ms, with the error bars representing the standard deviation of 30 observations), indicating that asynchronization does not sacrifice the execution efficiency of a single rollback. The right figure shows the blocking time of the normal quota adjustment process during recovery. Synchronous recovery has an average blocking time of 836.9ms, while this method only takes 8.6ms, a difference of about 97 times. This is the core difference in this experiment: synchronous recovery pushes the rollback action serially into the business path, causing normal adjustment requests to wait; this method transfers the recovery task to the asynchronous queue, and the normal process only needs to complete the enqueue action to continue.

[0312] This method reduces the blocking time of abnormal recovery on the normal quota adjustment process from 836.9ms to 8.6ms while maintaining a similar recovery time and a success rate of 100%. This verifies the beneficial effect of the asynchronous recovery queue not continuously occupying the normal adjustment process.

[0313] Experiment 4: Stability of the correlation dimension under composite quota adjustment constraints Methods: For the same group of tenants, the interface call frequency quota was adjusted in two ways: (1) Independent adjustment - without considering the dimensional coupling relationship, only the target value of the interface dimension was increased in one direction; (2) This method - based on the resource dimension coupling relationship diagram and the critical value, the composite quota adjustment constraint was determined, and the bandwidth and the calculated dimension quota were adjusted together. After the adjustment was completed, the bandwidth resource utilization rate was sampled every 2 minutes for 30 minutes. 80% was taken as the safe water level of the bandwidth dimension, and the standard deviation of the utilization rate and the number of samplings exceeding the safe water level were statistically analyzed. As shown in Table 5.

[0314] Table 5. Resource utilization sampling records based on associated bandwidth dimension

[0315] like Figure 5 As shown, the horizontal axis of the line graph represents the time after quota adjustment (0-30 min), and the vertical axis represents bandwidth resource utilization. The red square curve (independent adjustment) shows obvious periodic large swings, surging to 85.29% in the 6th minute, exceeding the 80% safety level, and then falling back to a low level of 44%-54% in the 14th-24th minute, with a standard deviation of 13.56%, reflecting the alternation of overshoot and idleness in the related bandwidth dimension caused by the unidirectional increase of the interface dimension; the blue circle curve (this method) runs in the 63%-75% range throughout, with a standard deviation of only 2.79%, and no over-limit sampling occurs; the gray dashed line in the figure represents the 80% safety level.

[0316] This method uses composite quota adjustment constraints to process related dimensions, reducing the standard deviation of bandwidth utilization from 13.56% to 2.79% (a reduction of approximately 79%) and the number of over-limit occurrences from 2 to 0. This verifies the control effect on the risk of chain reactions caused by single-dimensional adjustments, and also indirectly shows that the resource dimension coupling relationship diagram of S2 and the critical numerical constraints of S3 have usable guidance in actual operation.

[0317] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for composite quota current limiting and asynchronous recovery based on single-key attribution, characterized in that, include: S1. Obtain the frequency of interface calls, bandwidth usage, and computational consumption during the operation of the distributed system, establish a unique ownership key to associate tenants with corresponding multi-dimensional resource quotas, and obtain the initial dataset of multi-dimensional resource quotas. S2. Process the initial dataset of multi-dimensional resource quotas, analyze the interaction between interface call frequency, bandwidth usage and computational capacity consumption, extract the dependency weights between each resource node, and obtain the resource dimension coupling relationship graph. S3. Based on the resource dimension coupling relationship diagram, perform feature classification on the dependency weights, identify the critical value that triggers a chain reaction when adjusting a single dimension, and determine the constraint conditions for composite quota adjustment. S4. Obtain batch adjustment requests for multiple tenants, determine multiple resource dimensions corresponding to each tenant based on the unique ownership key, and extract the target quota value from the batch adjustment request. If the target quota value meets the composite quota adjustment constraint, generate the first state change instruction set. S5. By parsing the first state change instruction set, extract the dependency order and resource locking range between instructions to obtain the atomic operation execution sequence; S6. Based on the atomic operation execution sequence, perform resource quota updates in a pre-established sandbox environment, record the state change trajectory during the update process, and obtain the second state change instruction set; S7. If the execution feedback of the second state change instruction set in the sandbox environment is no anomaly, determine the final resource quota distribution result; S8. If there is an anomaly in the execution feedback of the second state change instruction set in the sandbox environment or production environment, the abnormal resource quota will be asynchronously restored.

2. The method for single-key attribution composite quota current limiting and asynchronous recovery according to claim 1, characterized in that: S1 includes: The frequency of interface calls, bandwidth usage, and computational consumption during the operation of the distributed system are obtained. The frequency of interface calls, bandwidth usage, and computational consumption are then aligned to obtain real-time consumption values. Tenant identification features are extracted based on real-time consumption values. If tenant identification features are missing, they are filled in to obtain complete tenant identification features. By integrating complete tenant identifier features with quota identifiers, a unique ownership key is determined; By binding real-time consumption values ​​with unique ownership keys, an initial dataset of multi-dimensional resource quotas is obtained.

3. The method for single-key attribution composite quota current limiting and asynchronous recovery according to claim 1, characterized in that: S2 includes: Based on the initial dataset of multi-dimensional resource quotas, the features of interface frequency, bandwidth usage and computational consumption are extracted and concatenated to obtain the feature vector of resource nodes. A graph convolutional neural network is used to map the feature vectors of resource nodes to obtain an initial adjacency matrix; If the initial adjacency matrix contains isolated nodes, then add edge relationships to obtain a connected adjacency matrix; The hidden state of the connected adjacency matrix is ​​updated to obtain the node interaction features; Dependency weights are extracted based on node interaction features, and a resource dimension coupling relationship graph is constructed using these dependency weights.

4. The method for composite quota current limiting and asynchronous recovery based on single-key attribution according to claim 1, characterized in that: S3 includes: Analyze the resource dimension coupling relationship graph to extract dependency weights and construct a multi-dimensional feature vector set; The random forest algorithm is used to classify the multidimensional feature vector set to obtain a set of classification decision trees. The node splitting threshold of the set of classification decision trees is identified as the critical value. Dimensional reduction mapping is performed on the critical values ​​to generate boundary constraint intervals; Construct a quota correlation matrix based on the boundary restriction interval and critical values, and analyze the quota correlation matrix to determine the composite quota adjustment constraints.

5. The method for composite quota current limiting and asynchronous recovery based on single-key attribution according to claim 1, characterized in that: S4 includes: Obtain batch adjustment requests for multi-tenants, wherein the batch adjustment requests carry a unique ownership key and a target quota value; The resource occupancy baseline is determined based on the unique attribution key, and the difference between the target quota value and the resource occupancy baseline is calculated to obtain the quota increment value. The quota increment values ​​are classified and processed to obtain composite quota adjustment constraints. If the target quota value meets the composite quota adjustment constraint, a state change sequence is generated, and a first state change instruction set is generated based on the state change sequence.

6. The method for composite quota current limiting and asynchronous recovery based on single-key attribution according to claim 1, characterized in that: S5 includes: Obtain the first state change instruction set, and parse the first state change instruction set to extract the dependency order and resource locking range; Construct a directed acyclic graph based on the dependency order and resource locking range, and traverse the directed acyclic graph to identify the set of conflicting nodes; If there is resource contention in the set of conflicting nodes, then a transaction isolation level is assigned to the set of conflicting nodes to obtain an execution queue with transaction isolation characteristics; The execution queue with transaction isolation characteristics is sorted to generate an atomic operation execution sequence.

7. The method for composite quota current limiting and asynchronous recovery based on single-key attribution according to claim 1, characterized in that: S6 includes: Obtain the atomic operation execution sequence, and calculate the quota deduction amount based on the atomic operation execution sequence in the sandbox environment; Resource quotas are updated based on quota deductions, and data during the resource quota update period is collected to generate a status change trajectory. Determine if there is any inconsistency between the snapshot of the state change trajectory and the baseline snapshot. If there is an inconsistency, extract the snapshot comparison difference. Based on the differences in the snapshot comparison, a difference compensation instruction is generated. The difference compensation instruction and the atomic operation execution sequence are recombined to obtain the second state change instruction set.

8. The method for composite quota current limiting and asynchronous recovery based on single-key attribution according to claim 1, characterized in that: S7 includes: Obtain execution feedback of the second state change instruction set in the sandbox environment; If the execution feedback is no error, the second state change instruction set is synchronized to the production environment, and resource quotas for multiple resource dimensions are parsed and obtained. The composite quota rate limiting threshold is determined by matching the consumption rate of real-time business requests with resource quotas across multiple resource dimensions. Real-time service requests are intercepted based on the composite quota rate limiting threshold, the remaining capacity is calculated, the resource pool is updated based on the remaining capacity, and the final resource quota distribution is determined.

9. The method for composite quota current limiting and asynchronous recovery based on single-key attribution according to claim 1, characterized in that: S8 includes: Obtain the execution feedback of the second state change instruction set. If the execution feedback contains an exception identifier, construct a recovery task based on the state change trajectory and quota snapshot. Attach a lock flag to the recovery task and write the recovery task with the lock flag to the asynchronous recovery queue; Read recovery tasks from the asynchronous recovery queue and parse the recovery tasks to obtain rollback instructions; A rollback instruction is used to perform a reverse operation, and the abnormal resource quota is asynchronously restored based on the state before the resource quota update.

10. A single-key-owned composite quota current limiting and asynchronous recovery system, used to implement the steps of the single-key-owned composite quota current limiting and asynchronous recovery method according to any one of claims 1-9, characterized in that, The system includes: The data acquisition module acquires the frequency of interface calls, bandwidth usage, and computing capacity consumption during the operation of the distributed system, extracts the real-time consumption values ​​of each dimension, and establishes a unique ownership key to associate tenants with corresponding multi-dimensional resource quotas, thereby obtaining the initial dataset of multi-dimensional resource quotas. The coupling analysis module processes the initial dataset of multi-dimensional resource quotas through graph neural networks, analyzes the degree of interaction between interface call frequency, bandwidth usage, and computational capacity consumption, extracts the dependency weights between each resource node, and obtains a resource-dimensional coupling relationship graph. The constraint determination module uses a random forest algorithm to classify the dependent weights based on the resource dimension coupling relationship graph, identifies the critical value that triggers a chain reaction when a single dimension adjustment is made, and determines the constraint conditions for composite quota adjustment. The instruction generation module obtains batch adjustment requests for multiple tenants, determines multiple resource dimensions corresponding to each tenant based on the unique attribution key, and extracts the target quota value from the batch adjustment request. If the target quota value meets the composite quota adjustment constraint, the first state change instruction set is generated. The sequence construction module parses the first state change instruction set, extracts the dependency order and resource locking range between instructions, constructs an execution queue with transaction isolation characteristics, and obtains the atomic operation execution sequence. The update execution module performs resource quota updates in a pre-established sandbox environment according to the atomic operation execution sequence, records the state change trajectory during the update process, and obtains the second state change instruction set; If the execution feedback of the second state change instruction set in the sandbox environment is without anomalies, the rate limiting module determines that the data consistency verification has passed, synchronizes the second state change instruction set to the production environment, and performs composite quota rate limiting on the business requests of the corresponding tenants based on the resource quotas of multiple resource dimensions after synchronization, and determines the final resource quota distribution result. The recovery module generates a recovery task based on the state change trajectory if the execution feedback of the second state change instruction set is abnormal in the sandbox environment or production environment. The recovery task is written into the asynchronous recovery queue, and the abnormal resource quota is asynchronously recovered based on the state before the resource quota update.

Images