CN110719200B

CN110719200B - Information identification method and device

Info

Publication number: CN110719200B
Application number: CN201910966338.5A
Authority: CN
Inventors: 刘曾超前; 董灵芝
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2019-10-12
Filing date: 2019-10-12
Publication date: 2023-07-18
Anticipated expiration: 2039-10-12
Also published as: CN110719200A

Abstract

The embodiment of the application discloses an information identification method and device. One embodiment of the method comprises the following steps: receiving target abnormality information; acquiring a target interface path of target abnormal information; searching a target interface path in a pre-constructed abnormal identification tree, wherein the abnormal identification tree is used for storing the mapping relation between the interface path and the service; and in response to successful searching, identifying the target service to which the target abnormal information belongs based on the service stored by the searched node. The embodiment relates to the field of cloud computing, and realizes unified service identification of an abnormality based on an abnormality identification tree storing a mapping relation between an interface path and a service.

Description

Information identification method and device

Technical Field

The embodiment of the application relates to the technical field of computers, in particular to an information identification method and device.

Background

Cloud facilitators typically focus on user experience by monitoring and analyzing user anomalies. The anomalies that the user can receive come from the cloud terminal. By performing anomaly collection at the cloud terminal, all anomalies of the user can be obtained at a lower cost. However, the anomalies at the cloud terminal include anomalies of all services on the cloud, and the anomalies need to be categorized into specific services, so that the subsequent anomaly investigation and analysis are facilitated.

Currently, the commonly used abnormality recognition methods generally include the following three types. First, each service independently collects anomalies for the respective service. That is, each service is required to develop functions such as exception collection and exception handling. Secondly, a service identification field is added to each anomaly, and after the service identification field is added, the service to which the anomaly belongs can be directly identified. Thirdly, in the abnormal receiving service, a plurality of judging rules are added, and the abnormality is directly judged.

Disclosure of Invention

The embodiment of the application provides an information identification method and device.

In a first aspect, an embodiment of the present application provides an information identifying method, including: receiving target abnormality information; acquiring a target interface path of target abnormal information; searching a target interface path in a pre-constructed abnormal identification tree, wherein the abnormal identification tree is used for storing the mapping relation between the interface path and the service; and in response to successful searching, identifying the target service to which the target abnormal information belongs based on the service stored by the searched node.

In some embodiments, the method further comprises: responding to the searching failure, and analyzing a target interface path based on a preset specification; and identifying the target service to which the target abnormal information belongs based on the analyzed service in response to the analysis success.

In some embodiments, the method further comprises: and responding to the analysis failure, and outputting prompt information, wherein the prompt information is used for prompting that the target abnormal information belongs to the unknown service.

In some embodiments, the anomaly identification tree includes a plurality of levels, each level including at least one node, the nodes of the first level of the anomaly identification tree storing no information, the nodes of the second level of the anomaly identification tree storing domain names and services of the interface paths, the nodes of the third and subsequent levels of the anomaly identification tree storing each level of paths of the interface paths, the level of nodes of each level of paths of the anomaly identification tree corresponding to the level of paths in the interface paths, and the node storing the level of paths being a child node storing a node of a path above the level of paths in the interface paths and a parent node storing a node of a path below the level of paths in the interface paths, the node storing a node of a path below the level of paths in the interface paths storing services corresponding to the interface paths.

In some embodiments, looking up the target interface path in a pre-built anomaly identification tree includes: if the target interface path does not have the target domain name, updating the path to be matched based on the first-stage path of the target interface path, and updating the node set to be matched based on the sub-node set of the second-layer node with the domain name being empty; the following matching steps are performed: matching the paths to be matched in the node set to be matched; if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if yes, finishing the matching.

In some embodiments, searching the target interface path in the pre-constructed anomaly identification tree further comprises: in response to determining that the path to be matched is not the last level of the target interface path, updating the path to be matched based on the next level of the path to be matched, updating the set of nodes to be matched based on the set of child nodes of the matched nodes, and continuing to perform the matching step.

In some embodiments, searching the target interface path in the pre-constructed anomaly identification tree further comprises: if the target domain name exists in the target interface path, matching the target domain name in a second layer node of the anomaly identification tree; if the matching is successful, determining whether the service stored by the matched second layer node is empty; and if the service is not empty, updating the cache service based on the service stored by the matched second-layer node.

In some embodiments, searching the target interface path in the pre-constructed anomaly identification tree further comprises: in response to successful matching of the target domain name in the second level nodes of the anomaly identification tree, updating the path to be matched based on the first level path of the target interface path, updating the set of nodes to be matched based on the set of sub-nodes of the matched second level nodes, and performing the matching step.

In some embodiments, the method further comprises: if the cache service is not empty, searching is successful, and the cache service is used as a target service to which the target abnormal information belongs; if the cache service is empty, the lookup fails.

In some embodiments, the preset specification satisfies the following conditions: the interface path includes two stages of paths, and the first stage of path is an application programming interface and the second stage of path is a service corresponding to the interface path.

In a second aspect, an embodiment of the present application proposes an information identifying apparatus, including: a receiving unit configured to receive target abnormality information; an acquisition unit configured to acquire a target interface path of target abnormality information; the searching unit is configured to search the target interface path in a pre-constructed abnormal identification tree, wherein the abnormal identification tree is used for storing the mapping relation between the interface path and the service; and the first identifying unit is configured to identify the target service to which the target abnormal information belongs based on the service stored by the searched node in response to the successful searching.

In some embodiments, the apparatus further comprises: the analysis unit is configured to respond to the search failure and analyze the target interface path based on a preset specification; and a second identifying unit configured to identify, based on the analyzed service, a target service to which the target abnormality information belongs, in response to the analysis success.

In some embodiments, the apparatus further comprises: and the output unit is configured to respond to the analysis failure and output prompt information, wherein the prompt information is used for prompting that the target abnormal information belongs to an unknown service.

In some embodiments, the lookup unit includes: a first updating subunit configured to update the path to be matched based on the first level path of the target interface path and update the node set to be matched based on the sub-node set of the second layer node with the empty domain name if the target domain name does not exist in the target interface path; a first matching subunit configured to perform the matching steps of: matching the paths to be matched in the node set to be matched; if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if yes, finishing the matching.

In some embodiments, the lookup unit further comprises: and a second updating subunit configured to, in response to determining that the path to be matched is not the last-stage path of the target interface path, update the path to be matched based on the next-stage path of the path to be matched, update the set of nodes to be matched based on the set of sub-nodes of the matched nodes, and continue to perform the step of matching.

In some embodiments, the lookup unit further comprises: the second matching subunit is configured to match the target domain name in the second layer node of the anomaly identification tree if the target domain name exists in the target interface path; if the matching is successful, determining whether the service stored by the matched second layer node is empty; and if the service is not empty, updating the cache service based on the service stored by the matched second-layer node.

In some embodiments, the lookup unit further comprises: and a third updating subunit configured to update the path to be matched based on the first level path of the target interface path, update the set of nodes to be matched based on the set of sub-nodes of the matched second level node, and perform the matching step in response to the target domain name being successfully matched in the second level node of the anomaly identification tree.

In some embodiments, the apparatus further comprises: the first determining unit is configured to find success if the cache service is not empty and take the cache service as a target service to which the target abnormal information belongs; and the second determining unit is configured to fail the searching if the cache service is empty.

In a third aspect, an embodiment of the present application provides an electronic device, including: one or more processors; a storage device having one or more programs stored thereon; the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method as described in any of the implementations of the first aspect.

In a fourth aspect, embodiments of the present application provide a computer readable medium having stored thereon a computer program which, when executed by a processor, implements a method as described in any of the implementations of the first aspect.

The information identification method and the information identification device provided by the embodiment of the application firstly acquire a target interface path of target abnormal information under the condition that the target abnormal information is received; then searching a target interface path in a pre-constructed abnormal identification tree; and finally, under the condition that the searching is successful, identifying the target service to which the target abnormal information belongs based on the service stored by the searched node. And realizing unified service identification of the abnormality based on the abnormality identification tree storing the mapping relation between the interface path and the service. And each service side is not required to independently collect and process the anomalies, so that the labor cost is saved. And the unified processing of the abnormality is realized, and the subsequent analysis and statistics are convenient. The exception collection and recognition are directly carried out through the exception collection service, the service side does not need to change the code of the service side, and the code of the service side is not invasive. The service identification of the abnormality only needs to manage the mapping relation between the interface path and the service, the abnormality identification is newly added or deleted, the mapping relation only needs to be modified, the code does not need to be changed, and the modification and maintenance are simple.

Drawings

Other features, objects and advantages of the present application will become more apparent upon reading of the detailed description of non-limiting embodiments, made with reference to the following drawings, in which:

FIG. 1 is an exemplary system architecture in which the present application may be applied;

FIG. 2 is a flow chart of one embodiment of an information identification method according to the present application;

FIG. 3 is a schematic diagram of the structure of an anomaly identification tree;

FIG. 4 is a flow chart of yet another embodiment of an information identification method according to the present application;

FIG. 5 is a flow chart of another embodiment of an information identification method according to the present application;

FIG. 6 is a schematic diagram of the structure of one embodiment of an information recognition device according to the present application;

fig. 7 is a schematic diagram of a computer system suitable for use in implementing embodiments of the present application.

Detailed Description

The present application is described in further detail below with reference to the drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting of the invention. It should be noted that, for convenience of description, only the portions related to the present invention are shown in the drawings.

It should be noted that, in the case of no conflict, the embodiments and features in the embodiments may be combined with each other. The present application will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

Fig. 1 illustrates an exemplary system architecture 100 to which embodiments of the information recognition method or information recognition apparatus of the present application may be applied.

As shown in fig. 1, a cloud platform 101, a cloud terminal 102, a server 103, and networks 104, 105 may be included in a system architecture 100. The network 104 is a medium used to provide a communication link between the cloud platform 101 and the cloud terminal 102. The network 105 serves as a medium for providing a communication link between the cloud terminal 102 and the server 103. The networks 104, 105 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

During the use of the cloud platform 101, the anomalies that the user can receive come from the cloud terminal 102, and the server 103 can perform anomaly collection at the cloud terminal 102.

The server 103 may provide various services. For example, the server 103 may analyze the received data such as the target abnormality information and generate a processing result (for example, a target service to which the target abnormality information belongs).

The server 103 may be hardware or software. When the server 103 is hardware, it may be implemented as a distributed server cluster composed of a plurality of servers, or may be implemented as a single server. When the server 103 is software, it may be implemented as a plurality of software or software modules (for example, to provide distributed services), or may be implemented as a single software or software module. The present invention is not particularly limited herein.

It should be noted that, the information identifying method provided in the embodiment of the present application is generally executed by the server 103, and accordingly, the information identifying apparatus is generally disposed in the server 103.

It should be understood that the number of cloud platforms, cloud terminals, servers, and networks in fig. 1 are merely illustrative. There may be any number of cloud platforms, cloud terminals, servers, and networks, as desired for implementation.

With continued reference to FIG. 2, a flow 200 of one embodiment of an information identification method according to the present application is shown. The information identification method comprises the following steps:

in step 201, target anomaly information is received.

In the present embodiment, the execution subject of the information identifying method (e.g., the server 103 shown in fig. 1) may receive the target abnormality information.

Generally, during the use of a cloud platform (e.g., cloud platform 101 shown in fig. 1), an online anomaly may occur due to a user operation problem, an input parameter problem, or a service itself problem on the cloud, etc. The anomaly that the user can receive comes from a cloud terminal (e.g., cloud terminal 102 shown in fig. 1) that is communicatively coupled to the cloud platform. The cloud terminal may transmit the abnormality information to the execution subject. The cloud terminal may include, but is not limited to, a browser and a gateway. The target anomaly information may be any anomaly information received by the execution subject from the cloud terminal.

Step 202, a target interface path of target anomaly information is acquired.

In this embodiment, the execution body may acquire the target interface path of the target exception information. In general, the abnormality information is from an interface, and the service to which the abnormality information belongs can be identified by identifying the service to which the interface from which the abnormality information belongs. Therefore, the execution subject can acquire the path of the interface from which the target abnormality information comes, that is, the target interface path.

And 203, searching the target interface path in a pre-constructed anomaly identification tree.

In this embodiment, the execution body may search the target interface path in the anomaly identification tree constructed in advance, so as to determine whether the target interface path is successfully searched in the anomaly identification tree. In case the search is successful, step 204 is performed.

Here, the anomaly identification tree may be used to store the mapping relationship of the interface path to the service. Therefore, the service to which the abnormality information belongs can be quickly located by tree search.

For ease of understanding, fig. 3 shows a schematic diagram of the structure of the anomaly identification tree. As shown in FIG. 3, the anomaly identification tree may include multiple levels, each of which may include at least one node.

In particular, the first level of the anomaly identification tree typically includes a root node, which typically does not store information.

The second level of the anomaly identification tree typically includes a plurality of nodes, wherein one node of the second level typically does not store information and the other nodes of the second level typically store domain names and services of interface paths.

Nodes at the third and subsequent levels of the anomaly identification tree may store each level of path and service of the interface path. The level of the layer where the node of each level path of the storage interface path is located in the anomaly identification tree corresponds to the level of the level path in the interface path. Specifically, the node storing the level path is a child node storing a node of a path of the level above the level path in the interface path and a parent node storing a node of a path of the level below the level path in the interface path. The node storing the last stage path in the interface paths stores the service corresponding to the interface path.

It should be appreciated that for a node at the second level of the anomaly identification tree, when multiple interface paths belonging to the same domain name correspond to different services, the services stored by the node may be null. For nodes at the third and subsequent levels of the anomaly identification tree, the service stored by the node may also be null when the node stores a path other than the last level of the interface path.

It should be noted that, the mapping relationship between the interface path and the service may be updated continuously, so the anomaly identification tree may be updated periodically based on the mapping relationship between the interface path and the service, so as to implement addition of new data and deletion of old data.

And step 204, in response to successful searching, identifying the target service to which the target abnormal information belongs based on the service stored by the searched node.

In this embodiment, in the case that the target interface path is successfully found in the anomaly identification tree, the execution subject may identify the target service to which the target anomaly information belongs based on the service stored in the found node. For example, the execution body may acquire a service stored in a node on a path that matches the longest target interface path in the anomaly identification tree, and use a service stored in a node that is not empty in the last stored service on the path as the target service to which the target anomaly information belongs.

According to the information identification method provided by the embodiment of the application, firstly, under the condition that target abnormal information is received, a target interface path of the target abnormal information is obtained; then searching a target interface path in a pre-constructed abnormal identification tree; and finally, under the condition that the searching is successful, identifying the target service to which the target abnormal information belongs based on the service stored by the searched node. And realizing unified service identification of the abnormality based on the abnormality identification tree storing the mapping relation between the interface path and the service. And each business side is not required to independently collect and process the anomalies, so that the labor cost is saved. And the unified processing of the abnormality is realized, and the subsequent analysis and statistics are convenient. The anomaly collection and identification are directly carried out through the anomaly collection service, the service parties do not need to change the codes of the service parties, and the invasiveness to the codes of the service parties is avoided. The service identification of the abnormality only needs to manage the mapping relation between the interface path and the service, the abnormality identification is newly added or deleted, the mapping relation only needs to be modified, the code does not need to be changed, and the modification and maintenance are simple.

With further reference to fig. 4, a flow 400 of yet another embodiment of an information identification method according to the present application is shown. The information identification method comprises the following steps:

in step 401, target anomaly information is received.

Step 402, a target interface path of target anomaly information is acquired.

Step 403, determining whether the target interface path is successfully found in the pre-constructed anomaly identification tree.

And step 404, identifying the target service to which the target abnormal information belongs based on the service stored by the searched node.

In this embodiment, the specific operations of steps 401 to 404 are described in detail in steps 201 to 204 in the embodiment shown in fig. 2, and are not described herein.

Step 405, determining whether the target interface path is successfully parsed based on the preset specification.

In this embodiment, in the case that the target interface path fails to find in the anomaly identification tree, the execution subject of the information identification method (for example, the server 103 shown in fig. 1) may parse the target interface path based on a preset specification to determine whether the target interface path is successfully parsed. In case the target interface path resolution is successful, step 306 is performed. In case the target interface path resolution fails, step 407 is performed.

Typically, interface paths that meet the preset specification can be parsed. Wherein, the interface path meeting the preset specification generally meets the following conditions: the interface path includes two levels of paths, and the first level of path is an application programming interface (Application Programming Interface, API) and the second level of path is a service to which the interface path corresponds.

For ease of understanding, table 1 shows a mapping relationship table of interface paths and services. As shown in table 1, the interface paths with serial numbers 1 and 2 satisfy the preset specification, and the interface paths with serial numbers 3 and 4 do not satisfy the preset specification.

Sequence number	Interface path	Belonging to a service
			1	/api/eip/*	Eip
2	/api/bcc/*	Bcc
			3	/api/bcc/dcc/*	Dcc
4	/bmr/v1/api/*	Bmr

TABLE 1

And step 406, identifying the target service to which the target abnormality information belongs based on the analyzed service.

In this embodiment, when the target interface path analysis is successful, the execution body may identify the target service to which the target abnormality information belongs based on the analyzed service. For example, the execution body may use the second level path of the parsed target interface path as the target service to which the target abnormality information belongs.

Step 407, outputting prompt information.

In this embodiment, in the case that the target interface path analysis fails, the execution body may output a prompt message. The prompt information can be used for prompting that the target abnormal information belongs to an unknown service.

As can be seen from fig. 4, compared to the corresponding embodiment of fig. 2, the flow 400 of the information identifying method in this embodiment adds a step of identifying a service by parsing an interface path in case of a search failure. Therefore, in the scheme described in this embodiment, the target service to which the target abnormal information belongs is identified by analyzing the target interface path under the condition of failure in searching, so that the successful identification rate of the target service to which the target abnormal information belongs is improved.

With further reference to fig. 5, a flow 500 of another embodiment of an information identification method according to the present application is shown. The information identification method comprises the following steps:

in step 501, target anomaly information is received.

Step 502, a target interface path of target anomaly information is acquired.

In this embodiment, the specific operations of steps 501-502 are described in detail in steps 201-202 in the embodiment shown in fig. 2, and are not described herein.

Step 503 determines whether the target interface path has a target domain name.

In this embodiment, the execution subject of the information identifying method (e.g., the server 103 shown in fig. 1) may determine whether the target interface path has the target domain name. In the event that the target interface path does not have a target domain name, step 504 is performed. In case the target interface path has a target domain name, step 511 is performed.

Step 504, updating the path to be matched based on the first level path of the target interface path, and updating the node set to be matched based on the sub-node set of the second layer node with the domain name of empty.

In this embodiment, in the case where the target interface path does not have the target domain name, the execution body may update the path to be matched based on the first level path of the target interface path, and update the node set to be matched based on the sub-node set of the second level node with the domain name being empty; step 505 is then performed. For example, the execution body may take a first level path of the target interface path as a path to be matched, and take a child node set of the second level node with a domain name of null as a node set to be matched.

Step 505, determining whether the path to be matched is successfully matched in the node set to be matched.

In this embodiment, the execution body may match the paths to be matched in the node set to be matched to determine whether the paths to be matched are successfully matched in the node set to be matched. In case the paths to be matched are successfully matched in the set of nodes to be matched, step 506 is performed. In case the path to be matched fails to match in the set of nodes to be matched, step 509 is performed.

Step 506 determines if the service stored by the matching node is empty.

In this embodiment, in the case that the path to be matched is successfully matched in the node set to be matched, the execution body may determine whether the service stored in the matched node is empty. In case the service stored by the matching node is not empty, step 507 is performed. In the event that the service stored by the matching node is empty, step 508 is performed.

In step 507, the cache service is updated based on the services stored by the matched nodes.

In this embodiment, in the case where the service stored in the matched node is not empty, the execution body may update the cache service based on the service stored in the matched node first; step 508 is then performed. For example, the executing entity may use the service stored by the matched node as a cache service. Wherein the initial cache service may be empty.

Step 508, determining whether the path to be matched is the last stage path of the target interface path.

In this embodiment, the execution body may determine whether the path to be matched is the last stage path of the target interface path. In the case where the path to be matched is the last stage path of the target interface path, step 509 is performed. In case the path to be matched is not the last stage path of the target interface path, step 510 is performed.

Step 509, the matching is ended.

In this embodiment, in the case that the path to be matched fails to be matched in the node set to be matched, or the path to be matched is the last-stage path of the target interface path, the matching is ended.

Step 510, updating the path to be matched based on the next path of the path to be matched, and updating the node set to be matched based on the sub-node set of the matched nodes.

In this embodiment, in the case where the path to be matched is not the last path of the target interface path, the execution body may update the path to be matched based on the next path of the path to be matched, and update the node set to be matched based on the sub-node set of the matched nodes; and then returns to continue step 505. For example, the execution body may take a next-stage path of the path to be matched as the path to be matched, and take a sub-node set of the matched nodes as the node set to be matched.

Step 511 determines whether the target domain name successfully matches in the second level nodes of the anomaly identification tree.

In this embodiment, in the case where the target interface path has the target domain name, the execution body may determine whether the target domain name is successfully matched in the second-layer node of the anomaly identification tree. In the event that the target domain name matches successfully in the second level nodes of the anomaly identification tree, step 512 is performed. Step 509 is performed in the event that the target domain name matches successfully in the second level nodes of the anomaly identification tree.

Step 512 determines if the service stored by the matching second tier node is empty.

In this embodiment, in the case that the target domain name is successfully matched in the second-layer node of the anomaly identification tree, the execution body may determine whether the service stored in the matched second-layer node is empty. In case the service stored by the matching second tier node is not empty, step 513 is performed. In the event that the matched second tier node stores a service that is empty, step 514 is performed.

In step 513, the cache service is updated based on the services stored by the matched second tier nodes.

In this embodiment, in the case where the service stored in the matched second-tier node is not empty, the execution body may update the cache service based on the service stored in the matched second-tier node first; step 514 is then performed. Specifically, the execution body may use the service stored by the matched second-layer node as a cache service.

Step 514, updating the path to be matched based on the first level path of the target interface path, and updating the node set to be matched based on the sub-node set of the matched second level node.

In this embodiment, in the case that the matching of the target domain name in the second level node of the anomaly identification tree is successful, the execution body may update the path to be matched based on the first level path of the target interface path first, and update the node set to be matched based on the sub-node set of the matched second level node; and then returns to step 505.

In some optional implementations of this embodiment, in a case where the matching is ended, the executing entity may determine whether the cache service is empty. In case the cache service is not empty, the lookup is successful. In this case, the execution subject may use the cache service as the target service to which the target abnormality information belongs. In case the cache service is empty, the lookup fails.

In step 515, in response to the success of the search, the target service to which the target abnormality information belongs is identified based on the service stored by the searched node.

In this embodiment, the specific operation of step 515 is described in detail in step 204 in the embodiment shown in fig. 2, and will not be described herein.

As can be seen from fig. 5, the flow 500 of the information identifying method in this embodiment highlights the step of retrieving the anomaly identification tree, compared to the corresponding embodiment of fig. 2. Therefore, the scheme described in the embodiment improves the accuracy of the target service to which the identified target abnormality information belongs by performing multi-stage matching on each stage path of the target interface path in the abnormality identification tree.

With further reference to fig. 6, as an implementation of the method shown in the foregoing figures, the present application provides an embodiment of an information identifying apparatus, where an embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 2, and the apparatus may be specifically applied to various electronic devices.

As shown in fig. 6, the information identifying apparatus 600 of the present embodiment may include: a receiving unit 601, an acquiring unit 602, a finding unit 603 and a first identifying unit 604. Wherein the receiving unit 601 is configured to receive the target abnormality information; an acquisition unit 602 configured to acquire a target interface path of target abnormality information; a searching unit 603 configured to search the target interface path in a pre-constructed anomaly identification tree, where the anomaly identification tree is used for storing a mapping relationship between the interface path and the service; the first identifying unit 604 is configured to identify, in response to the success of the search, a target service to which the target abnormality information belongs based on the service stored by the searched node.

In the present embodiment, in the information identifying apparatus 600: the specific processing of the receiving unit 601, the obtaining unit 602, the searching unit 603 and the first identifying unit 604 and the technical effects thereof may refer to the relevant descriptions of steps 201 to 204 in the corresponding embodiment of fig. 2, and are not repeated herein.

In some optional implementations of the present embodiment, the information identifying apparatus 600 further includes: a parsing unit (not shown in the figure) configured to parse the target interface path based on a preset specification in response to a search failure; a second identifying unit (not shown in the figure) configured to identify, based on the analyzed service, a target service to which the target abnormality information belongs, in response to the analysis success.

In some optional implementations of the present embodiment, the information identifying apparatus 600 further includes: and an output unit (not shown in the figure) configured to output prompt information in response to the failure of the parsing, wherein the prompt information is used for prompting that the target abnormal information belongs to an unknown service.

In some optional implementations of this embodiment, the anomaly identification tree includes a plurality of layers, each layer includes at least one node, the node of the first layer of the anomaly identification tree does not store information, the node of the second layer of the anomaly identification tree stores domain names and services of interface paths, the nodes of the third and subsequent layers of the anomaly identification tree store each level of paths and services of interface paths, the level of the layer in which the node of each level of paths of the anomaly identification tree is stored corresponds to the level of paths in the interface path, and the node storing the level of paths is a child node of the upper level of paths in the storage interface path and a parent node of the lower level of paths in the storage interface path, and the node storing the last level of paths in the storage interface path stores the services of the interface paths.

In some optional implementations of the present embodiment, the search unit 603 includes: a first updating subunit (not shown in the figure) configured to update, if the target interface path does not have the target domain name, the path to be matched based on the first level path of the target interface path, and update the node set to be matched based on the sub-node set of the second level node with the domain name being empty; a first matching subunit (not shown in the figure) configured to perform the following matching steps: matching the paths to be matched in the node set to be matched; if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if yes, finishing the matching.

In some optional implementations of the present embodiment, the search unit 603 further includes: a second updating subunit (not shown in the figure) configured to, in response to determining that the path to be matched is not the last-stage path of the target interface path, update the path to be matched based on the next-stage path of the path to be matched, update the set of nodes to be matched based on the set of sub-nodes of the matched nodes, and continue to perform the matching step.

In some optional implementations of the present embodiment, the search unit 603 further includes: a second matching subunit (not shown in the figure) configured to match the target domain name in the second level node of the anomaly identification tree if the target domain name exists in the target interface path; if the matching is successful, determining whether the service stored by the matched second layer node is empty; and if the service is not empty, updating the cache service based on the service stored by the matched second-layer node.

In some optional implementations of the present embodiment, the search unit 603 further includes: a third updating subunit (not shown in the figure) configured to update the path to be matched based on the first level path of the target interface path, update the set of nodes to be matched based on the set of sub-nodes of the matched second level node, and perform the matching step in response to the target domain name being successfully matched in the second level node of the anomaly recognition tree.

In some optional implementations of the present embodiment, the information identifying apparatus 600 further includes: a first determining unit (not shown in the figure) configured to find success if the cache service is not empty, and to regard the cache service as a target service to which the target abnormality information belongs; a second determining unit (not shown in the figure) is configured to fail the lookup if the cache service is empty.

In some alternative implementations of the present embodiment, the preset specification satisfies the following conditions: the interface path includes two stages of paths, and the first stage of path is an application programming interface and the second stage of path is a service corresponding to the interface path.

Referring now to FIG. 7, there is illustrated a schematic diagram of a computer system 700 suitable for use in implementing an electronic device (e.g., server 103 shown in FIG. 1) of an embodiment of the present application. The electronic device shown in fig. 7 is only an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present application.

As shown in fig. 7, the computer system 700 includes a Central Processing Unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, ROM 702, and RAM 703 are connected to each other through a bus 704. An input/output (I/O) interface 705 is also connected to bus 704.

The following components are connected to the I/O interface 705: an input section 706 including a keyboard, a mouse, and the like; an output portion 707 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, a speaker, and the like; a storage section 708 including a hard disk or the like; and a communication section 709 including a network interface card such as a LAN card, a modem, or the like. The communication section 709 performs communication processing via a network such as the internet. The drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that a computer program read therefrom is mounted into the storage section 708 as necessary.

In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via the communication portion 709, and/or installed from the removable medium 711. The above-described functions defined in the method of the present application are performed when the computer program is executed by a Central Processing Unit (CPU) 701.

It should be noted that, the computer readable medium described in the present application may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present application, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for carrying out operations of the present application may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or electronic device. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units involved in the embodiments of the present application may be implemented by software, or may be implemented by hardware. The described units may also be provided in a processor, for example, described as: a processor includes a receiving unit, an obtaining unit, a finding unit, and a first identifying unit. The names of these units do not constitute a limitation of the unit itself in each case, and for example, the receiving unit may also be described as "a unit that receives the target abnormality information".

As another aspect, the present application also provides a computer-readable medium that may be contained in the electronic device described in the above embodiment; or may exist alone without being incorporated into the electronic device. The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: receiving target abnormality information; acquiring a target interface path of target abnormal information; searching a target interface path in a pre-constructed abnormal identification tree, wherein the abnormal identification tree is used for storing the mapping relation between the interface path and the service; and in response to successful searching, identifying the target service to which the target abnormal information belongs based on the service stored by the searched node.

The foregoing description is only of the preferred embodiments of the present application and is presented as a description of the principles of the technology being utilized. It will be appreciated by persons skilled in the art that the scope of the invention referred to in this application is not limited to the specific combinations of features described above, but it is intended to cover other embodiments in which any combination of features described above or equivalents thereof is possible without departing from the spirit of the invention. Such as the above-described features and technical features having similar functions (but not limited to) disclosed in the present application are replaced with each other.

Claims

1. An information identification method, comprising:

receiving a target abnormality information;

acquiring a target interface path of the target abnormal information;

searching the target interface path in a pre-constructed abnormal identification tree, wherein the abnormal identification tree is used for storing the mapping relation between the interface path and the service, each abnormal identification tree comprises a plurality of layers, each layer comprises at least one node, the nodes of the first layer of the abnormal identification tree do not store information, the nodes of the second layer of the abnormal identification tree store the domain name and the service of the interface path, the nodes of the third layer and the later layers of the abnormal identification tree store each level of path and the service of the interface path, the layer of each level of path of the abnormal identification tree in which the node of the interface path is stored corresponds to the level of the path in the interface path, the node storing the path is a child node storing the node of the path of the last level in the interface path and a father node storing the node of the path of the next level in the interface path, and the node storing the path of the last level in the interface path stores the service corresponding to the interface path;

In response to successful searching, identifying a target service to which the target abnormal information belongs based on the service stored by the searched node;

the searching the target interface path in the pre-constructed anomaly identification tree comprises the following steps:

if the target interface path does not have the target domain name, updating a path to be matched based on a first-stage path of the target interface path, and updating a node set to be matched based on a sub-node set of a second-layer node with a domain name being empty;

the following matching steps are performed: matching the paths to be matched in the node set to be matched; if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if yes, finishing the matching.

2. The method of claim 1, wherein the method further comprises:

responding to the searching failure, and analyzing the target interface path based on a preset specification;

and identifying the target service to which the target abnormal information belongs based on the analyzed service in response to the analysis success.

3. The method of claim 2, wherein the method further comprises:

And responding to the analysis failure, and outputting prompt information, wherein the prompt information is used for prompting that the target abnormal information belongs to an unknown service.

4. The method of claim 1, wherein the looking up the target interface path in a pre-built anomaly identification tree further comprises:

and in response to determining that the path to be matched is not the last-stage path of the target interface path, updating the path to be matched based on the next-stage path of the path to be matched, updating the node set to be matched based on the sub-node set of the matched nodes, and continuing to execute the matching step.

5. The method of claim 4, wherein said looking up the target interface path in a pre-built anomaly identification tree further comprises:

if the target domain name exists in the target interface path, matching the target domain name in a second layer node of the anomaly identification tree; if the matching is successful, determining whether the service stored by the matched second layer node is empty; and if the service is not empty, updating the cache service based on the service stored by the matched second-layer node.

6. The method of claim 5, wherein said looking up the target interface path in a pre-built anomaly identification tree further comprises:

And in response to successful matching of the target domain name in the second-layer nodes of the anomaly identification tree, updating a path to be matched based on a first-level path of the target interface path, updating a node set to be matched based on a sub-node set of the matched second-layer nodes, and executing the matching step.

7. The method of claim 6, wherein the method further comprises:

if the cache service is not empty, searching is successful, and the cache service is used as a target service to which the target abnormal information belongs;

if the cache service is empty, the search fails.

8. The method of claim 2, wherein the preset specification satisfies the following condition:

the interface path includes two stages of paths, and the first stage of path is an application programming interface and the second stage of path is a service corresponding to the interface path.

9. An information identifying apparatus, comprising:

a receiving unit configured to receive target abnormality information;

an acquisition unit configured to acquire a target interface path of the target abnormality information;

the system comprises a searching unit, a target interface path and a target interface path, wherein the target interface path is searched in a pre-built abnormal identification tree, the abnormal identification tree is used for storing the mapping relation between the interface path and the service, each abnormal identification tree comprises a plurality of layers, each abnormal identification tree comprises at least one node, the nodes of the first layer of the abnormal identification tree do not store information, the nodes of the second layer of the abnormal identification tree store the domain name and the service of the interface path, the nodes of the third layer and the later layers of the abnormal identification tree store each level of the interface path and the service, the layer of each level of the abnormal identification tree where the nodes of each level of the interface path are located corresponds to the level of the interface path, the node storing the level of the path is a child node storing the node of the upper level of the path of the level of the interface path and a father node storing the lower level of the path of the level of the interface path, and the nodes storing the service corresponding to the final level of the interface path;

A first identifying unit configured to identify, in response to success of the search, a target service to which the target abnormality information belongs based on a service stored by the searched node;

wherein the search unit includes:

a first updating subunit configured to update a path to be matched based on a first level path of the target interface path and update a node set to be matched based on a sub-node set of a second level node with a null domain name if the target interface path does not have a target domain name;

a first matching subunit configured to perform the matching steps of: matching the paths to be matched in the node set to be matched; if the matching is successful, determining whether the service stored by the matched node is empty, if not, updating the cache service based on the service stored by the matched node, determining whether the path to be matched is the last-stage path of the target interface path, and if yes, finishing the matching.

10. The apparatus of claim 9, wherein the apparatus further comprises:

the analysis unit is configured to respond to the search failure and analyze the target interface path based on a preset specification;

and a second identifying unit configured to identify, based on the analyzed service, a target service to which the target abnormality information belongs, in response to the analysis success.

11. The apparatus of claim 10, wherein the apparatus further comprises:

and the output unit is configured to respond to the analysis failure and output prompt information, wherein the prompt information is used for prompting that the target abnormal information belongs to an unknown service.

12. The apparatus of claim 9, wherein the lookup unit further comprises:

and a second updating subunit configured to, in response to determining that the path to be matched is not the last-stage path of the target interface path, update the path to be matched based on the next-stage path of the path to be matched, update the set of nodes to be matched based on the set of sub-nodes of the matched nodes, and continue to perform the matching step.

13. The apparatus of claim 12, wherein the lookup unit further comprises:

a second matching subunit configured to match, if a target domain name exists in the target interface path, the target domain name in a second-layer node of the anomaly identification tree; if the matching is successful, determining whether the service stored by the matched second layer node is empty; and if the service is not empty, updating the cache service based on the service stored by the matched second-layer node.

14. The apparatus of claim 13, wherein the lookup unit further comprises:

A third updating subunit configured to, in response to successful matching of the target domain name in the second level node of the anomaly identification tree, update a path to be matched based on the first level path of the target interface path, update a set of nodes to be matched based on a set of sub-nodes of the matched second level node, and perform the step of matching.

15. The apparatus of claim 14, wherein the apparatus further comprises:

the first determining unit is configured to find success if the cache service is not empty, and take the cache service as a target service to which the target abnormal information belongs;

and the second determining unit is configured to search for failure if the cache service is empty.

16. The apparatus of claim 10, wherein the preset specification satisfies the following condition:

17. An electronic device, comprising:

one or more processors;

a storage device having one or more programs stored thereon,

when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-8.

18. A computer readable medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the method of any of claims 1-8.