CN110719200A

CN110719200A - Information identification method and device

Info

Publication number: CN110719200A
Application number: CN201910966338.5A
Authority: CN
Inventors: 刘曾超前; 董灵芝
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2019-10-12
Filing date: 2019-10-12
Publication date: 2020-01-21
Anticipated expiration: 2039-10-12
Also published as: CN110719200B

Abstract

The embodiment of the application discloses an information identification method and device. One embodiment of the method comprises: receiving target abnormal information; acquiring a target interface path of target abnormal information; searching a target interface path in a pre-constructed abnormal recognition tree, wherein the abnormal recognition tree is used for storing the mapping relation between the interface path and the service; and responding to the searching success, and identifying the target service to which the target abnormal information belongs based on the searched service stored by the node. The embodiment relates to the field of cloud computing, and realizes unified service identification of the abnormity based on an abnormity identification tree of a mapping relation between a storage interface path and the service.

Description

Information identification method and device

Technical Field

The embodiment of the application relates to the technical field of computers, in particular to an information identification method and device.

Background

Cloud services typically focus on user experience by monitoring and analyzing user anomalies. The abnormity received by the user comes from the cloud terminal. By performing anomaly collection at the cloud terminal, all anomalies of the user can be obtained at a low cost. However, the anomalies at the cloud terminal include anomalies of all services on the cloud, and the anomalies need to be classified into specific services, so that the subsequent anomalies can be conveniently checked and analyzed.

Currently, the common abnormality identification methods generally include the following three methods. First, each service collects exceptions of the respective service independently. That is, each service is required to develop functions of exception collection, exception handling, and the like. And secondly, adding a service identification field on each exception, and directly identifying the service to which the exception belongs after adding the service identification field. Thirdly, in the abnormal receiving service, various judgment rules are added to directly judge the abnormality.

Disclosure of Invention

The embodiment of the application provides an information identification method and device.

In a first aspect, an embodiment of the present application provides an information identification method, including: receiving target abnormal information; acquiring a target interface path of target abnormal information; searching a target interface path in a pre-constructed abnormal recognition tree, wherein the abnormal recognition tree is used for storing the mapping relation between the interface path and the service; and responding to the searching success, and identifying the target service to which the target abnormal information belongs based on the searched service stored by the node.

In some embodiments, the method further comprises: in response to the search failure, analyzing the target interface path based on a preset specification; and in response to the success of the analysis, identifying the target service to which the target abnormal information belongs based on the analyzed service.

In some embodiments, the method further comprises: and responding to the failure of the analysis, and outputting prompt information, wherein the prompt information is used for prompting that the target abnormal information belongs to the unknown service.

In some embodiments, the anomaly identification tree includes a plurality of layers, each layer including at least one node, the node of the first layer of the anomaly identification tree stores no information, the node of the second layer of the anomaly identification tree stores a domain name and a service of an interface path, the nodes of the third and subsequent layers of the anomaly identification tree store each level of the interface path and the service, the layer of the layer in the anomaly identification tree where the node of each level of the interface path is stored corresponds to the level of the interface path, and the node storing the level of the path is a child node of the previous level of the interface path in the storage interface path and a parent node of the next level of the path in the storage interface path, and the node of the last level of the storage interface path stores the service corresponding to the interface path.

In some embodiments, finding the target interface path in a pre-constructed anomaly recognition tree comprises: if the target interface path does not have the target domain name, updating the path to be matched based on the first-stage path of the target interface path, and updating the node set to be matched based on the child node set of the second-layer node with the empty domain name; the following matching steps are performed: matching the paths to be matched in the node set to be matched; and if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if so, finishing the matching.

In some embodiments, searching the target interface path in a pre-constructed abnormal recognition tree further includes: and in response to the determination that the path to be matched is not the last-stage path of the target interface path, updating the path to be matched based on the next-stage path of the path to be matched, updating the set of nodes to be matched based on the matched set of child nodes, and continuing to execute the matching step.

In some embodiments, searching the target interface path in a pre-constructed abnormal recognition tree further includes: if the target domain name exists in the target interface path, matching the target domain name in a second layer node of the abnormal recognition tree; if the matching is successful, determining whether the service stored in the matched second-layer node is empty; and if not, updating the cache service based on the service stored by the matched second-layer node.

In some embodiments, searching the target interface path in a pre-constructed abnormal recognition tree further includes: and in response to the target domain name being successfully matched in the second layer of nodes of the abnormal recognition tree, updating the path to be matched based on the first-level path of the target interface path, updating the node set to be matched based on the matched child node set of the second layer of nodes, and executing the matching step.

In some embodiments, the method further comprises: if the cache service is not empty, the search is successful, and the cache service is used as the target service to which the target abnormal information belongs; if the cache service is empty, the lookup fails.

In some embodiments, the preset specification satisfies the following condition: the interface path comprises two levels of paths, wherein the first level of path is an application programming interface, and the second level of path is a service corresponding to the interface path.

In a second aspect, an embodiment of the present application provides an information identification apparatus, including: a receiving unit configured to receive target abnormality information; an acquisition unit configured to acquire a target interface path of target abnormality information; the searching unit is configured to search the target interface path in a pre-constructed abnormal recognition tree, wherein the abnormal recognition tree is used for storing the mapping relation between the interface path and the service; and the first identification unit is configured to respond to the searching success and identify the target service to which the target abnormal information belongs based on the searched service stored by the node.

In some embodiments, the apparatus further comprises: an analysis unit configured to analyze the target interface path based on a preset specification in response to a search failure; and a second identification unit configured to identify, in response to the parsing being successful, a target service to which the target abnormality information belongs based on the parsed service.

In some embodiments, the apparatus further comprises: and an output unit configured to output prompt information in response to the parsing failure, wherein the prompt information is used for prompting that the target abnormal information belongs to the unknown service.

In some embodiments, the lookup unit comprises: the first updating subunit is configured to update the path to be matched based on a first-level path of the target interface path and update the node set to be matched based on a child node set of a second-layer node with an empty domain name if the target interface path does not have the target domain name; a first matching subunit configured to perform the following matching steps: matching the paths to be matched in the node set to be matched; and if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if so, finishing the matching.

In some embodiments, the lookup unit further comprises: and the second updating subunit is configured to respond to the determination that the path to be matched is not the last-stage path of the target interface path, update the path to be matched based on the next-stage path of the path to be matched, update the set of nodes to be matched based on the matched set of the sub-nodes, and continue to execute the matching step.

In some embodiments, the lookup unit further comprises: the second matching subunit is configured to match the target domain name in a second layer node of the abnormal recognition tree if the target domain name exists in the target interface path; if the matching is successful, determining whether the service stored in the matched second-layer node is empty; and if not, updating the cache service based on the service stored by the matched second-layer node.

In some embodiments, the lookup unit further comprises: and the third updating subunit is configured to respond to the successful matching of the target domain name in the second layer of nodes of the abnormal recognition tree, update the path to be matched based on the first-level path of the target interface path, update the set of the nodes to be matched based on the matched set of the child nodes of the second layer of nodes, and execute the matching step.

In some embodiments, the apparatus further comprises: the first determining unit is configured to find the cache service successfully if the cache service is not empty, and take the cache service as a target service to which the target abnormal information belongs; a second determining unit configured to fail the lookup if the cache service is empty.

In a third aspect, an embodiment of the present application provides an electronic device, including: one or more processors; a storage device having one or more programs stored thereon; when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method as described in any implementation of the first aspect.

In a fourth aspect, the present application provides a computer-readable medium, on which a computer program is stored, which, when executed by a processor, implements the method as described in any implementation manner of the first aspect.

According to the information identification method and the information identification device, firstly, under the condition that the target abnormal information is received, a target interface path of the target abnormal information is obtained; then searching the target interface path in a pre-constructed abnormal recognition tree; and finally, under the condition of successful searching, identifying the target service to which the target abnormal information belongs based on the service stored in the searched node. And realizing uniform service identification of the abnormity on the basis of the abnormity identification tree of the mapping relation between the storage interface path and the service. And each server is not required to independently collect and process the abnormity, so that the labor cost is saved. Moreover, the unified processing of the abnormity is realized, and the follow-up analysis and statistics are facilitated. The exception collection and identification are directly carried out through the exception collection service, the code of each service party is not required to be changed, and the code of the service party is not invasive. The identification of the abnormal service only needs to manage the mapping relation between the interface path and the service, add or delete the abnormal identification, only needs to modify the mapping relation, does not need to change codes, and is simple to modify and maintain.

Drawings

Other features, objects and advantages of the present application will become more apparent upon reading of the following detailed description of non-limiting embodiments thereof, made with reference to the accompanying drawings in which:

FIG. 1 is an exemplary system architecture to which the present application may be applied;

FIG. 2 is a flow diagram of one embodiment of an information identification method according to the present application;

FIG. 3 is a schematic diagram of a structure of an anomaly identification tree;

FIG. 4 is a flow chart of yet another embodiment of an information identification method according to the present application;

FIG. 5 is a flow diagram of another embodiment of an information identification method according to the present application;

FIG. 6 is a schematic diagram of the structure of one embodiment of an information-bearing device according to the present application;

FIG. 7 is a block diagram of a computer system suitable for use in implementing the electronic device of an embodiment of the present application.

Detailed Description

The present application will be described in further detail with reference to the following drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the relevant invention and not restrictive of the invention. It should be noted that, for convenience of description, only the portions related to the related invention are shown in the drawings.

It should be noted that the embodiments and features of the embodiments in the present application may be combined with each other without conflict. The present application will be described in detail below with reference to the embodiments with reference to the attached drawings.

Fig. 1 shows an exemplary system architecture 100 to which embodiments of the information identification method or information identification apparatus of the present application may be applied.

As shown in fig. 1, the system architecture 100 may include a cloud platform 101, a cloud terminal 102, a server 103, and networks 104, 105. The network 104 is used to provide a medium for a communication link between the cloud platform 101 and the cloud terminal 102. The network 105 is a medium to provide a communication link between the cloud terminal 102 and the server 103. The networks 104, 105 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

In the using process of the cloud platform 101, the abnormality that can be received by the user comes from the cloud terminal 102, and the server 103 may perform abnormality collection at the cloud terminal 102.

The server 103 may provide various services. For example, the server 103 may analyze and process the received data such as the target anomaly information and generate a processing result (for example, a target service to which the target anomaly information belongs).

The server 103 may be hardware or software. When the server 103 is hardware, it may be implemented as a distributed server cluster composed of a plurality of servers, or may be implemented as a single server. When the server 103 is software, it may be implemented as multiple pieces of software or software modules (e.g., to provide distributed services), or as a single piece of software or software module. And is not particularly limited herein.

It should be noted that the information identification method provided in the embodiment of the present application is generally executed by the server 103, and accordingly, the information identification apparatus is generally disposed in the server 103.

It should be understood that the number of cloud platforms, cloud terminals, servers, and networks in fig. 1 is merely illustrative. There may be any number of cloud platforms, cloud terminals, servers, and networks, as desired for implementation.

With continued reference to FIG. 2, a flow 200 of one embodiment of an information identification method according to the present application is shown. The information identification method comprises the following steps:

step 201, receiving target abnormal information.

In the present embodiment, the execution subject of the information identification method (e.g., the server 103 shown in fig. 1) may receive the target abnormality information.

Generally, during the use of a cloud platform (e.g., the cloud platform 101 shown in fig. 1), an online anomaly may occur due to a user operation problem, an input parameter problem, or a service on the cloud itself. The exception that the user can receive comes from a cloud terminal (e.g., the cloud terminal 102 shown in fig. 1) in communication connection with the cloud platform. The cloud terminal may send the exception information to the execution main body. The cloud terminal may include, but is not limited to, a browser and a gateway. The target exception information may be any exception information received by the execution subject from the cloud terminal.

Step 202, a target interface path of the target abnormal information is obtained.

In this embodiment, the execution subject may obtain a target interface path of the target exception information. In general, the exception information is from an interface, and the service to which the exception information belongs can be identified by identifying the service to which the interface from which the exception information belongs. Therefore, the execution subject may obtain a path of an interface from which the target exception information comes, that is, a target interface path.

And step 203, searching the target interface path in a pre-constructed abnormal recognition tree.

In this embodiment, the executing entity may search the target interface path in a pre-constructed exception recognition tree to determine whether the target interface path is successfully searched in the exception recognition tree. In case the lookup is successful, step 204 is performed.

Here, the anomaly identification tree may be used to store a mapping of interface paths to services. Therefore, the service to which the abnormal information belongs can be quickly located through tree retrieval.

For ease of understanding, fig. 3 shows a schematic structural diagram of an anomaly recognition tree. As shown in FIG. 3, the anomaly identification tree may include a plurality of levels, each of which may include at least one node.

In particular, the first level of the anomaly identification tree typically includes a root node that typically stores no information.

The second level of the anomaly identification tree typically includes a plurality of nodes, wherein one node of the second level typically stores no information and the other nodes of the second level typically store domain names and services for interface paths.

Nodes at the third and subsequent levels of the exception identification tree may store each level of path and services of the interface path. The level of the layer where the node of each level of the path of the storage interface path in the abnormal recognition tree is located corresponds to the level of the path in the interface path. Specifically, the node storing the level path is a child node of a previous level path of the level path in the storage interface path and a parent node of a next level path of the level path in the storage interface path. And storing the service corresponding to the interface path by the node of the last-stage path in the interface paths.

It should be appreciated that for a node at the second level of the anomaly identification tree, when multiple interface paths belonging to the same domain name correspond to different services, the service stored by the node may be empty. For nodes at the third and subsequent levels of the exception identification tree, when the node stores a path that is not the last level of the interface path, the service stored by the node may also be empty.

It should be noted that the mapping relationship between the interface path and the service may be updated continuously, and therefore, the anomaly identification tree may be updated periodically based on the mapping relationship between the interface path and the service, so as to add new data and delete old data.

And step 204, responding to the successful searching, and identifying the target service to which the target abnormal information belongs based on the searched service stored in the node.

In this embodiment, when the target interface path is successfully searched in the exception identification tree, the execution main body may identify the target service to which the target exception information belongs based on the service stored in the searched node. For example, the executing entity may obtain a service stored by a node on a path that is longest matched with the target interface path in the exception recognition tree, and use a service stored by a node whose last stored service on the path is not empty as a target service to which the target exception information belongs.

The information identification method provided by the embodiment of the application comprises the steps of firstly, acquiring a target interface path of target abnormal information under the condition that the target abnormal information is received; then searching the target interface path in a pre-constructed abnormal recognition tree; and finally, under the condition of successful searching, identifying the target service to which the target abnormal information belongs based on the service stored in the searched node. And realizing uniform service identification of the abnormity on the basis of the abnormity identification tree of the mapping relation between the storage interface path and the service. And each business party is not required to independently collect and process the abnormity, so that the labor cost is saved. Moreover, the unified processing of the abnormity is realized, and the follow-up analysis and statistics are facilitated. The exception collection and identification are directly carried out through the exception collection service, the code of each business party is not required to be changed, and the code of the business party is not invasive. The identification of the abnormal service only needs to manage the mapping relation between the interface path and the service, add or delete the abnormal identification, only needs to modify the mapping relation, does not need to change codes, and is simple to modify and maintain.

With further reference to FIG. 4, a flow 400 of yet another embodiment of an information identification method according to the present application is shown. The information identification method comprises the following steps:

step 401, receiving target exception information.

Step 402, obtaining a target interface path of the target abnormal information.

Step 403, determining whether the target interface path is successfully searched in the pre-constructed abnormal recognition tree.

And step 404, identifying the target service to which the target abnormal information belongs based on the searched service stored by the node.

In the present embodiment, the specific operations of

steps

401 and 404 have been described in detail in

step

201 and 204 in the embodiment shown in fig. 2, and are not described herein again.

Step 405, determining whether the target interface path is successfully analyzed based on the preset specification.

In this embodiment, in the case that the target interface path fails to be found in the anomaly identification tree, an execution subject of the information identification method (for example, the server 103 shown in fig. 1) may parse the target interface path based on a preset specification to determine whether the target interface path is successfully parsed. In case the target interface path is resolved successfully, step 306 is executed. In case the target interface path resolution fails, step 407 is performed.

Typically, interface paths that meet a preset specification can be resolved. The interface path meeting the preset specification usually meets the following conditions: the Interface path includes two levels of paths, where the first level of path is an Application Programming Interface (API), and the second level of path is a service corresponding to the Interface path.

For ease of understanding, table 1 shows a mapping table of interface paths to services. As shown in table 1, the interface paths with sequence numbers 1 and 2 satisfy the preset specification, and the interface paths with sequence numbers 3 and 4 do not satisfy the preset specification.

Serial number	Interface path	Belonging service
				1	/api/eip/*	Eip
2	/api/bcc/*	Bcc
			3	/api/bcc/dcc/*	Dcc
4	/bmr/v1/api/*	Bmr

TABLE 1

And 406, identifying the target service to which the target abnormal information belongs based on the analyzed service.

In this embodiment, in the case that the target interface path is successfully parsed, the execution subject may identify a target service to which the target exception information belongs based on the parsed service. For example, the execution subject may use the second-level path of the parsed target interface path as a target service to which the target exception information belongs.

Step 407, outputting the prompt information.

In this embodiment, the execution body may output a prompt message when the target interface path analysis fails. Wherein, the prompt message can be used to prompt that the target abnormal message belongs to the unknown service.

As can be seen from fig. 4, compared with the embodiment corresponding to fig. 2, the flow 400 of the information identification method in this embodiment adds a step of identifying the service by parsing the interface path in case of a failure in the lookup. Therefore, according to the scheme described in this embodiment, the target service to which the target abnormal information belongs is identified by analyzing the target interface path under the condition that the search fails, so that the successful identification rate of the target service to which the target abnormal information belongs is improved.

With further reference to fig. 5, a flow 500 of another embodiment of an information identification method according to the present application is shown. The information identification method comprises the following steps:

step 501, receiving target abnormal information.

Step 502, a target interface path of the target abnormal information is obtained.

In the present embodiment, the specific operations of steps 501-502 have been described in detail in step 201-202 in the embodiment shown in fig. 2, and are not described herein again.

Step 503, determine whether the target interface path has the target domain name.

In this embodiment, the execution subject of the information recognition method (e.g., the server 103 shown in fig. 1) may determine whether the target interface path has the target domain name. In the case where the target interface path does not have a target domain name, step 504 is performed. In the case where the target interface path has a target domain name, step 511 is performed.

And step 504, updating the path to be matched based on the first-level path of the target interface path, and updating the node set to be matched based on the child node set of the second-layer node with an empty domain name.

In this embodiment, in a case that the target interface path does not have the target domain name, the execution main body may update the path to be matched based on the first-level path of the target interface path, and update the node set to be matched based on the child node set of the second-level node whose domain name is empty; step 505 is then performed. For example, the execution subject may use a first-level path of the target interface path as a path to be matched, and use a child node set of the second-level node with a null domain name as a node set to be matched.

Step 505, determining whether the path to be matched is successfully matched in the node set to be matched.

In this embodiment, the executing body may match the path to be matched in the node set to be matched, so as to determine whether the path to be matched is successfully matched in the node set to be matched. And in case that the path to be matched is successfully matched in the node set to be matched, executing step 506. In case the matching of the path to be matched fails in the set of nodes to be matched, step 509 is executed.

At step 506, it is determined whether the services stored by the matching node are empty.

In this embodiment, when the path to be matched is successfully matched in the node set to be matched, the execution main body may determine whether the service stored in the matched node is empty. In case the service stored by the matching node is not empty, step 507 is performed. In the case where the service stored by the matching node is empty, step 508 is performed.

In step 507, the caching service is updated based on the service stored by the matched node.

In this embodiment, in a case that the service stored in the matched node is not empty, the executing entity may first update the cache service based on the service stored in the matched node; step 508 is then performed. For example, the execution agent may use the service stored by the matching node as a caching service. Wherein the initial cache service may be empty.

Step 508, determine whether the path to be matched is the last stage path of the target interface path.

In this embodiment, the execution body may determine whether the path to be matched is the last-stage path of the target interface path. In case the path to be matched is the last stage path of the target interface path, step 509 is performed. In case the path to be matched is not the last stage path of the target interface path, step 510 is performed.

In step 509, the matching is finished.

In this embodiment, when the path to be matched fails to be matched in the node set to be matched, or the path to be matched is the last-stage path of the target interface path, the matching is ended.

And step 510, updating the path to be matched based on the next-stage path of the path to be matched, and updating the node set to be matched based on the child node set of the matched node.

In this embodiment, in a case that the path to be matched is not the last-stage path of the target interface path, the execution main body may update the path to be matched based on the next-stage path of the path to be matched, and update the set of nodes to be matched based on the set of child nodes of the matched nodes; then returns to continue to step 505. For example, the execution subject may use a next-level path of the path to be matched as the path to be matched, and use a child node set of the matched node as the node set to be matched.

Step 511, determining whether the target domain name is successfully matched in the second layer node of the abnormal recognition tree.

In this embodiment, in a case that the target interface path has the target domain name, the execution subject may determine whether the target domain name is successfully matched in the second level node of the abnormal recognition tree. In case the target domain name is successfully matched in the second level node of the anomaly recognition tree, step 512 is performed. In case the target domain name is successfully matched in the second level node of the anomaly recognition tree, step 509 is performed.

Step 512, determine whether the service stored by the matched second level node is empty.

In this embodiment, in a case that the target domain name is successfully matched in the second level node of the abnormal recognition tree, the execution subject may determine whether the service stored in the matched second level node is empty. In case the service stored by the matching second level node is not empty, step 513 is performed. In the case where the service stored by the matching second tier node is empty, step 514 is performed.

Step 513, updating the cache service based on the matched service stored by the second layer node.

In this embodiment, in a case that the service stored in the matched second layer node is not empty, the executing entity may first update the cache service based on the service stored in the matched second layer node; step 514 is then performed. Specifically, the execution agent may use a service stored in the matching second layer node as a cache service.

And 514, updating the path to be matched based on the first-level path of the target interface path, and updating the node set to be matched based on the matched child node set of the second-layer node.

In this embodiment, when the target domain name is successfully matched in the second-level node of the abnormal recognition tree, the execution main body may update the path to be matched based on the first-level path of the target interface path, and update the set of nodes to be matched based on the matched set of child nodes of the second-level node; then returns to performing step 505.

In some optional implementations of this embodiment, in a case that the matching is ended, the execution subject may determine whether the cache service is empty. In the case that the cache service is not empty, the lookup is successful. At this time, the execution subject may use the cache service as a target service to which the target exception information belongs. In the case where the cache service is empty, the lookup fails.

Step 515, in response to the success of the search, identifying the target service to which the target abnormal information belongs based on the service stored in the searched node.

In this embodiment, the specific operation of step 515 has been described in detail in step 204 in the embodiment shown in fig. 2, and is not described herein again.

As can be seen from fig. 5, compared with the embodiment corresponding to fig. 2, the flow 500 of the information identification method in the present embodiment highlights the step of retrieving the anomaly identification tree. Therefore, the scheme described in this embodiment performs multi-level matching on each level of paths of the target interface path in the anomaly identification tree, thereby improving the accuracy of the target service to which the identified target anomaly information belongs.

With further reference to fig. 6, as an implementation of the methods shown in the above-mentioned figures, the present application provides an embodiment of an information identification apparatus, which corresponds to the method embodiment shown in fig. 2, and which is particularly applicable to various electronic devices.

As shown in fig. 6, the information recognition apparatus 600 of the present embodiment may include: a receiving unit 601, an obtaining unit 602, a searching unit 603 and a first identifying unit 604. Wherein, the receiving unit 601 is configured to receive the target abnormality information; an obtaining unit 602 configured to obtain a target interface path of the target exception information; a searching unit 603 configured to search a target interface path in a pre-constructed abnormal recognition tree, where the abnormal recognition tree is used to store a mapping relationship between the interface path and a service; a first identifying unit 604 configured to identify, in response to the search being successful, a target service to which the target anomaly information belongs based on the searched service stored by the node.

In the present embodiment, in the information recognition apparatus 600: the specific processing of the receiving unit 601, the obtaining unit 602, the searching unit 603 and the first identifying unit 604 and the technical effects thereof can refer to the related descriptions of step 201 and step 204 in the corresponding embodiment of fig. 2, which are not described herein again.

In some optional implementations of this embodiment, the information identifying apparatus 600 further includes: an analysis unit (not shown in the figure) configured to analyze the target interface path based on a preset specification in response to the search failure; and a second identifying unit (not shown in the figure) configured to identify, in response to the parsing being successful, a target service to which the target abnormality information belongs based on the parsed service.

In some optional implementations of this embodiment, the information identifying apparatus 600 further includes: and an output unit (not shown in the figure) configured to output prompt information in response to the non-parsing success, wherein the prompt information is used for prompting that the target abnormal information belongs to the unknown service.

In some optional implementations of this embodiment, the exception identification tree includes multiple layers, each layer includes at least one node, a node of a first layer of the exception identification tree stores no information, a node of a second layer of the exception identification tree stores a domain name and a service of an interface path, nodes of third and subsequent layers of the exception identification tree store each level of the interface path and the service, a layer of the layer where the node of each level of the interface path is stored in the exception identification tree corresponds to a level of the interface path, the node storing the level of the interface path is a child node of a previous level of the interface path in the storage interface path and a parent node of a next level of the path in the storage interface path, and the node storing a last level of the interface path stores the service corresponding to the interface path.

In some optional implementations of this embodiment, the searching unit 603 includes: a first updating subunit (not shown in the figure), configured to update the path to be matched based on a first-level path of the target interface path if the target interface path does not have the target domain name, and update the node set to be matched based on a child node set of the second-level node with an empty domain name; a first matching subunit (not shown in the figures) configured to perform the following matching steps: matching the paths to be matched in the node set to be matched; and if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if so, finishing the matching.

In some optional implementations of this embodiment, the searching unit 603 further includes: and a second updating subunit (not shown in the figure) configured to, in response to determining that the path to be matched is not the last-stage path of the target interface path, update the path to be matched based on a next-stage path of the path to be matched, update the set of nodes to be matched based on the set of child nodes of the matched node, and continue to perform the matching step.

In some optional implementations of this embodiment, the searching unit 603 further includes: a second matching subunit (not shown in the figure), configured to match the target domain name in a second layer node of the abnormal recognition tree if the target domain name exists in the target interface path; if the matching is successful, determining whether the service stored in the matched second-layer node is empty; and if not, updating the cache service based on the service stored by the matched second-layer node.

In some optional implementations of this embodiment, the searching unit 603 further includes: and a third updating subunit (not shown in the figure) configured to respond to the successful matching of the target domain name in the second layer node of the abnormal recognition tree, update the path to be matched based on the first-level path of the target interface path, update the set of nodes to be matched based on the matched set of child nodes of the second layer node, and execute the matching step.

In some optional implementations of this embodiment, the information identifying apparatus 600 further includes: a first determining unit (not shown in the figure), configured to find successfully if the cache service is not empty, and take the cache service as a target service to which the target abnormal information belongs; a second determining unit (not shown in the figure) configured to fail the lookup if the cache service is empty.

In some optional implementations of this embodiment, the preset specification satisfies the following condition: the interface path comprises two levels of paths, wherein the first level of path is an application programming interface, and the second level of path is a service corresponding to the interface path.

Referring now to FIG. 7, a block diagram of a computer system 700 suitable for use in implementing an electronic device (e.g., server 103 shown in FIG. 1) of an embodiment of the present application is shown. The electronic device shown in fig. 7 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.

As shown in fig. 7, the computer system 700 includes a Central Processing Unit (CPU)701, which can perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM)702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. In the RAM 703, various programs and data necessary for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input/output (I/O) interface 705 is also connected to bus 704.

The following components are connected to the I/O interface 705: an input portion 706 including a keyboard, a mouse, and the like; an output section 707 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 708 including a hard disk and the like; and a communication section 709 including a network interface card such as a LAN card, a modem, or the like. The communication section 709 performs communication processing via a network such as the internet. A drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that a computer program read out therefrom is mounted into the storage section 708 as necessary.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 709, and/or installed from the removable medium 711. The computer program, when executed by a Central Processing Unit (CPU)701, performs the above-described functions defined in the method of the present application.

It should be noted that the computer readable medium described herein can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for carrying out operations for aspects of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or electronic device. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in the embodiments of the present application may be implemented by software or hardware. The described units may also be provided in a processor, and may be described as: a processor includes a receiving unit, an obtaining unit, a searching unit, and a first identifying unit. Here, the names of these units do not constitute a limitation of the unit itself in this case, and for example, the receiving unit may also be described as a "unit that receives target abnormality information".

As another aspect, the present application also provides a computer-readable medium, which may be contained in the electronic device described in the above embodiments; or may exist separately without being assembled into the electronic device. The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: receiving target abnormal information; acquiring a target interface path of target abnormal information; searching a target interface path in a pre-constructed abnormal recognition tree, wherein the abnormal recognition tree is used for storing the mapping relation between the interface path and the service; and responding to the searching success, and identifying the target service to which the target abnormal information belongs based on the searched service stored by the node.

The above description is only a preferred embodiment of the application and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention herein disclosed is not limited to the particular combination of features described above, but also encompasses other arrangements formed by any combination of the above features or their equivalents without departing from the spirit of the invention. For example, the above features may be replaced with (but not limited to) features having similar functions disclosed in the present application.

Claims

1. An information identification method, comprising:

receiving target abnormal information;

acquiring a target interface path of the target abnormal information;

searching the target interface path in a pre-constructed abnormal recognition tree, wherein the abnormal recognition tree is used for storing the mapping relation between the interface path and the service;

and responding to the searching success, and identifying the target service to which the target abnormal information belongs based on the service stored in the searched node.

2. The method of claim 1, wherein the method further comprises:

in response to the search failure, analyzing the target interface path based on a preset specification;

and responding to the success of the analysis, and identifying the target service to which the target abnormal information belongs based on the analyzed service.

3. The method of claim 2, wherein the method further comprises:

and responding to the analysis failure, and outputting prompt information, wherein the prompt information is used for prompting that the target abnormal information belongs to unknown service.

4. The method of claim 1, wherein the anomaly recognition tree comprises a plurality of levels, each level comprising at least one node, nodes of a first level of the anomaly identification tree store no information, nodes of a second level of the anomaly identification tree store domain names and services of interface paths, nodes at the third and subsequent levels of the exception identification tree store each level of path and service of interface paths, the level of the layer where the node of each level of the interface path is stored in the abnormal recognition tree corresponds to the level of the interface path, and the node storing the level path is a child node of a previous level path of the level path in the storage interface path and a parent node of a next level path of the level path in the storage interface path, and the node of a last level path in the storage interface path stores services corresponding to the interface path.

5. The method of claim 4, wherein said looking up the target interface path in a pre-constructed anomaly recognition tree comprises:

if the target interface path does not have a target domain name, updating a path to be matched based on a first-stage path of the target interface path, and updating a node set to be matched based on a child node set of a second-layer node with an empty domain name;

the following matching steps are performed: matching the paths to be matched in the node set to be matched; if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, and determining whether the path to be matched is the last-stage path of the target interface path, if so, finishing the matching.

6. The method of claim 5, wherein said looking up the target interface path in a pre-constructed anomaly recognition tree further comprises:

and in response to determining that the path to be matched is not the last-stage path of the target interface path, updating the path to be matched based on the next-stage path of the path to be matched, updating the set of nodes to be matched based on the matched set of child nodes, and continuing to execute the matching step.

7. The method of claim 6, wherein said looking up the target interface path in a pre-constructed anomaly recognition tree further comprises:

if the target interface path has a target domain name, matching the target domain name in a second layer node of the abnormal recognition tree; if the matching is successful, determining whether the service stored in the matched second-layer node is empty; and if not, updating the cache service based on the service stored by the matched second-layer node.

8. The method of claim 7, wherein said looking up the target interface path in a pre-constructed anomaly recognition tree further comprises:

responding to the successful matching of the target domain name in the second layer node of the abnormal recognition tree, updating a path to be matched based on the first-level path of the target interface path, updating a node set to be matched based on the matched child node set of the second layer node, and executing the matching step.

9. The method of claim 8, wherein the method further comprises:

if the cache service is not empty, the cache service is searched successfully, and the cache service is used as the target service to which the target abnormal information belongs;

if the cache service is empty, the lookup fails.

10. The method of claim 2, wherein the preset specification satisfies the following condition:

the interface path comprises two levels of paths, wherein the first level of path is an application programming interface, and the second level of path is a service corresponding to the interface path.

11. An information identifying apparatus comprising:

a receiving unit configured to receive target abnormality information;

an acquisition unit configured to acquire a target interface path of the target anomaly information;

the searching unit is configured to search the target interface path in a pre-constructed abnormal recognition tree, wherein the abnormal recognition tree is used for storing the mapping relation between the interface path and the service;

and the first identification unit is configured to respond to the searching success and identify the target service to which the target abnormal information belongs based on the searched service stored by the node.

12. The apparatus of claim 11, wherein the apparatus further comprises:

an analysis unit configured to analyze the target interface path based on a preset specification in response to a search failure;

and the second identification unit is configured to respond to the analysis success and identify the target service to which the target abnormal information belongs based on the analyzed service.

13. The apparatus of claim 12, wherein the apparatus further comprises:

an output unit configured to output prompt information in response to a failure in the parsing, wherein the prompt information is used to prompt that the target abnormal information belongs to an unknown service.

14. The apparatus of claim 11, wherein the anomaly recognition tree comprises a plurality of layers, each layer comprising at least one node, nodes of a first level of the anomaly identification tree store no information, nodes of a second level of the anomaly identification tree store domain names and services of interface paths, nodes at the third and subsequent levels of the exception identification tree store each level of path and service of interface paths, the level of the layer where the node of each level of the interface path is stored in the abnormal recognition tree corresponds to the level of the interface path, and the node storing the level path is a child node of a previous level path of the level path in the storage interface path and a parent node of a next level path of the level path in the storage interface path, and the node of a last level path in the storage interface path stores services corresponding to the interface path.

15. The apparatus of claim 14, wherein the lookup unit comprises:

the first updating subunit is configured to update a path to be matched based on a first-level path of the target interface path and update a node set to be matched based on a child node set of a second-layer node with an empty domain name if the target interface path does not have the target domain name;

a first matching subunit configured to perform the following matching steps: matching the paths to be matched in the node set to be matched; if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, and determining whether the path to be matched is the last-stage path of the target interface path, if so, finishing the matching.

16. The apparatus of claim 15, wherein the lookup unit further comprises:

and the second updating subunit is configured to respond to the determination that the path to be matched is not the last-stage path of the target interface path, update the path to be matched based on the next-stage path of the path to be matched, update the set of nodes to be matched based on the matched set of the sub-nodes, and continue to execute the matching step.

17. The apparatus of claim 16, wherein the lookup unit further comprises:

the second matching subunit is configured to match the target domain name in a second layer node of the abnormal recognition tree if the target domain name exists in the target interface path; if the matching is successful, determining whether the service stored in the matched second-layer node is empty; and if not, updating the cache service based on the service stored by the matched second-layer node.

18. The apparatus of claim 17, wherein the lookup unit further comprises:

a third updating subunit, configured to respond to a successful matching of the target domain name in the second layer node of the abnormal recognition tree, update a path to be matched based on the first-level path of the target interface path, update a set of nodes to be matched based on the matched set of child nodes of the second layer node, and execute the matching step.

19. The apparatus of claim 18, wherein the apparatus further comprises:

a first determining unit, configured to find the cache service successfully if the cache service is not empty, and use the cache service as a target service to which the target abnormal information belongs;

a second determining unit configured to fail the lookup if the cache service is empty.

20. The apparatus of claim 12, wherein the preset specification satisfies the following condition:

21. An electronic device, comprising:

one or more processors;

a storage device having one or more programs stored thereon,

when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-10.

22. A computer-readable medium, on which a computer program is stored, wherein the computer program, when being executed by a processor, carries out the method according to any one of claims 1-10.