CN114936135A

CN114936135A - Abnormity detection method and device and readable storage medium

Info

Publication number: CN114936135A
Application number: CN202210741215.3A
Authority: CN
Inventors: 马青岷
Original assignee: Inspur Power Commercial Systems Co Ltd
Current assignee: Inspur Power Commercial Systems Co Ltd
Priority date: 2022-06-28
Filing date: 2022-06-28
Publication date: 2022-08-23

Abstract

The application discloses an anomaly detection method, an anomaly detection device and a readable storage medium, and relates to the field of information security. According to the abnormity detection method, the testing environment is configured, the LSpci tool is used for obtaining the BUS ID and the equipment information of the PCIE equipment in the server, the byte data in the configuration space of the PCIE equipment is read, whether the numerical value in the register of the PCIE equipment meets the preset standard or not is judged according to the byte data, if the numerical value does not meet the preset standard, the PCIE equipment abnormity is determined, whether the PCIE link is abnormal or not is judged by collecting the information of the register in the configuration space of the PCIE equipment, and the correctable errors are identified and corrected. The testing method is suitable for testing the universal server, improves the coverage of the reliability test of the PCIE equipment, and ensures that the test is more comprehensive and complete.

Description

Abnormity detection method and device and readable storage medium

Technical Field

The present application relates to the field of information security, and in particular, to an anomaly detection method and apparatus, and a readable storage medium.

Background

In recent years, with the development of information technology and the increase of information amount, the application of a high-speed serial computer extended bus (PCIE) device is increasing, and as a component of server core hardware, PCIE devices with different functions are directly related to services of an application layer, so that it is very important to operate reliably in a long-term working environment.

The existing reliability test method for the PCIE equipment mainly utilizes a tool to obtain the numerical values of a Link function Register (Link Capability Register) and a Link Status Register (Link Status Register) of a channel where the PCIE equipment is located, so that the inspection of the equipment bandwidth (Link width) and the connection speed (Link speed) is realized, whether the PCIE equipment is abnormal or not is judged by comparing the consistency of the initial state and the state values after the multi-round circulating test, the test item is single, more attention is paid to the two indexes of the equipment bandwidth and the speed, and the running state of the PCIE Link cannot be comprehensively inspected.

In view of the above-mentioned technologies, a more comprehensive anomaly detection method is an urgent problem to be solved by those skilled in the art.

Disclosure of Invention

The application aims to provide an abnormality detection method, an abnormality detection device and a readable storage medium, so as to solve the problem that whether a PCIE device is abnormal or not is judged by comparing consistency of an initial state and a state value after multi-round circulation test, a test item is single, more attention is paid to two indexes of device bandwidth and speed, and the operation state of a PCIE link cannot be comprehensively checked.

In order to solve the above technical problem, the present application provides an anomaly detection method, applied to a PCIE device, including:

configuring a test environment, and acquiring the BUS ID and equipment information of the PCIE equipment in the server by using an lspci tool;

reading byte data in a configuration space of the PCIE equipment;

judging whether the numerical value in the register of the PCIE equipment meets a preset standard or not according to the byte data;

and if the PCIE equipment does not meet the preset standard, determining that the PCIE equipment is abnormal.

Preferably, the reading of the device information includes a domain number, a bus number, a device number, and a function number.

Preferably, the determining whether the value in the register of the PCIE device meets a preset criterion includes:

judging whether the value of the bit corresponding to the error in the error correctable state register is 0 or not;

if the value of the bit corresponding to the error in the error correctable state register is 0, judging whether the value of the bit corresponding to the error in the uncorrectable state register is 0;

and if the numerical value of the bit corresponding to the error in the status register which cannot be corrected is not 0, the PCIE equipment is abnormal.

Preferably, if the value of the bit corresponding to the error in the error correctable status register is 1, the method further includes:

setting the bit corresponding to the error to be 0 through setpci, and returning to the step of reading the byte data in the configuration space of the PCIE device.

Preferably, the method further comprises the following steps:

and if the value of the bit corresponding to the error in the uncorrectable state register is 0, determining that the PCIE equipment is normal.

Preferably, the method further comprises the following steps:

generating a log of the abnormality detection job in progress, and storing the log in a storage device.

Preferably, the method further comprises the following steps:

and when the PCIE equipment is determined to be abnormal, alarming.

In order to solve the above problem, the present application further provides an abnormality detection device, including:

the configuration module is used for configuring a test environment and acquiring the BUS ID and the equipment information of the PCIE equipment in the server by utilizing an lspci tool;

the reading module is used for reading byte data in the configuration space of the PCIE equipment;

the judging module is used for judging whether the numerical value in the register of the PCIE equipment meets a preset standard or not according to the byte data, and if the numerical value does not meet the preset standard, the determining module is started;

a determining module, configured to determine that the PCIE device is abnormal.

In order to solve the above problem, the present application further provides an abnormality detection apparatus, including a memory for storing a computer program;

a processor for implementing the steps of the abnormality detection apparatus as described above when executing the computer program.

To solve the above problem, the present application further provides a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the steps of the abnormality detection method as described above.

According to the abnormity detection method, the testing environment is configured, the LSpci tool is used for obtaining the BUS ID and the equipment information of the PCIE equipment in the server, the byte data in the configuration space of the PCIE equipment is read, whether the numerical value in the register of the PCIE equipment meets the preset standard or not is judged according to the byte data, if the numerical value does not meet the preset standard, the PCIE equipment abnormity is determined, whether the PCIE link is abnormal or not is judged by collecting the information of the register in the configuration space of the PCIE equipment, and the correctable errors are identified and corrected. The testing method is suitable for testing the universal server, improves the coverage of the reliability test of the PCIE equipment, and ensures that the test is more comprehensive and complete.

The anomaly detection device and the computer-readable storage medium provided by the application correspond to the anomaly detection method, so the beneficial effects are the same as the above.

Drawings

In order to more clearly illustrate the embodiments of the present application, the drawings needed for the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings can be obtained by those skilled in the art without inventive effort.

Fig. 1 is a flowchart of an anomaly detection method according to an embodiment of the present application;

fig. 2 is a schematic diagram of an anomaly detection apparatus according to an embodiment of the present application;

fig. 3 is a structural diagram of an abnormality detection apparatus according to another embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present application without any creative effort belong to the protection scope of the present application.

The core of the application is to provide an anomaly detection method, an anomaly detection device and a readable storage medium, so as to solve the problem that whether a PCIE (peripheral component interface express) device is abnormal or not is judged by comparing consistency of an initial state and a state value after multi-round cycle test, a test item is single, more attention is paid to two indexes of device bandwidth and rate, and the running state of a PCIE link cannot be comprehensively checked.

In order that those skilled in the art will better understand the disclosure, the following detailed description will be given with reference to the accompanying drawings.

Fig. 1 is a flowchart of an anomaly detection method provided in an embodiment of the present application, which is applied to a PCIE device and includes:

s10: configuring a test environment, and acquiring the BUS ID and equipment information of PCIE equipment in a server by using an lspci tool;

s11: reading byte data in a configuration space of PCIE equipment;

PCI express (peripheral component interconnect express) is a high-speed serial computer expansion bus standard, originally named "3 GIO", intended to replace the old bus standard. PCIE belongs to high-speed serial point-to-point double-channel high-bandwidth transmission, connected equipment distributes independent channel bandwidth and does not share bus bandwidth, and the PCIE mainly supports functions of active power management, error reporting, end-to-end reliable transmission, hot plug, service quality and the like. lspci is a tool used to display all PCI bus devices in the system or all devices connected to the bus.

Bytes (Byte) is a unit of measure used by computer information technology to measure storage capacity, and also represents data types and language characters in some computer programming languages. One byte stores 8-bit unsigned numbers, with values in the range of 0-255. As with a word, a byte-wise variable needs to be stored in only one byte (8 bits) of memory space. In this embodiment, the specific length of the byte data is not limited, and the first 288 bytes of data in the PCIE configuration space of the PCIE device are generally selected to be read.

The Bus (Bus) is a common communication trunk line for transmitting information between various functional components of a computer, and is a transmission line bundle composed of wires, and the Bus of the computer can be divided into a data Bus, an address Bus and a control Bus according to the type of information transmitted by the computer, and is used for transmitting data, data addresses and control signals respectively. The bus is an internal structure, it is a common channel for transferring information by CPU, memory, input and output devices, all the components of the host computer are connected by means of bus, and the external device is connected with bus by means of correspondent interface circuit so as to form the computer hardware system. In a computer system, a common path for transferring information between components is called a bus, and a microcomputer is connected to each functional component in a bus structure.

S12: judging whether the numerical value in the register of the PCIE equipment meets the preset standard or not according to the byte data;

s13: determining that the PCIE device is abnormal.

It should be noted that the preset standard is to compare the state of the byte data acquired normally in advance with the currently detected byte data to determine whether the preset standard is met, and certainly, the preset standard may have a certain deviation from the normal data state, which is not specifically limited in this embodiment.

The method for detecting an abnormality provided in this embodiment obtains a BUS ID and device information of a PCIE device in a server by configuring a test environment, reads byte data in a configuration space of the PCIE device, determines whether a value in a register of the PCIE device meets a preset standard according to the byte data, and determines that the PCIE device is abnormal by collecting information of the register of the PCIE device configuration space to determine whether a PCIE link is abnormal if the value does not meet the preset standard, and identifies that a correctable error is corrected. The testing method is suitable for testing the universal server, improves the coverage of the reliability test of the PCIE equipment, and ensures that the test is more comprehensive and complete.

In the above embodiment, specific content of the PCIE device information is not limited, and a preferred scheme is provided herein, where the read device information includes a domain number, a bus number, a device number, and a function number.

The domain account is a server storing accounts in a domain, and is shared by all computers in the same domain. If the relative data of the domain account is needed to be changed, the account in the domain account server is directly changed, and other computers can immediately acquire the updated account data. The method has the advantages of simplicity, capability of being directly used without matching with an additional mechanism, and unsuitability for being applied to large-scale domain environment. If there are tens of computers in the domain and each computer must have the same account, if operating with the local account, then a user has to modify the password at the same time, which may make you mad.

First, each PCI bus has a bus number, the bus number of the main bus is 0, and the other buses are assigned by the CPU in the enumeration stage and are sequentially increased when a PCI bridge is detected.

Device number, main device number: to identify drivers associated with the device files. The secondary equipment number: for use by the kernel, the driver is used to distinguish which device file is manipulated to distinguish a particular device of the same type.

The bus number, device number, function number are actually addresses of PCI devices, and are generally abbreviated as BFD. The PCI/PCIe bus structure is actually a tree structure. The controller is used as a root node, and can be directly connected with common equipment or connected with bridge equipment such as a PCI bridge and a PCIE switch; the bridge equipment can continue to hook ordinary equipment and bridge equipment. Each time a bridge device is passed, the bus number is incremented by 1, starting with 0 or 1, and up to 32. The bus numbers of the devices hanging under the same bus are the same, but the device numbers are different, starting from 0 and being maximum 31. The same device can support a plurality of functional modules; the bus number of each module is the same as the device number, but functions differently, starting with 0 and a maximum of 7. A PCI functional module can be uniquely determined through the bus number, the equipment number and the function number.

In the foregoing embodiment, a preferable scheme is provided for determining whether the value of the PCIE device meets the determination criterion of the preset criterion and the condition is not limited, and determining whether the value in the register of the PCIE device meets the preset criterion includes:

if the value of the bit corresponding to the error in the status register is not 0, the PCIE device is abnormal.

It should be noted that the status register is also called a condition code register, and is a core component of the computer system, i.e. a part of the arithmetic unit, and the status register is used for storing two types of information: one is various state information (condition code) which reflects the execution result of the current instruction, such as whether carry exists (CF bit), whether overflow exists (OV bit), whether the result is positive or negative (SF bit), whether the result is zero (ZF bit), parity bit (P bit) and the like; the other is to store control information (PSW: program status word register), such as enable interrupts (IF bit), tracking flags (TF bit), etc. It will be appreciated that both error correctable and uncorrectable are then error correction permission states for the status registers.

In view of the modification to the general data problem, there is provided a preferable scheme, wherein if the value of the bit corresponding to the error in the error correctable status register is 1, the method further comprises:

setting the bit corresponding to the error to 0 through setpci, and returning to the step of reading the byte data in the configuration space of the PCIE device.

The setpci command is a utility for querying and configuring PCI devices. The numbers used in the command are all hexadecimal numbers. Since the setpci command requires modification of the configuration parameters of the hardware, it must have "root" user rights. Before the PCI device is generally configured by using the setpci command, in order to prevent the problem of an operating system, the operation process of the setpci command is always checked by using a 'setpci-vD' command. And normal correction of the error bit number is ensured by means of setpci.

In view of the fact that historical abnormality detection has important referential property for the abnormality detection judgment criteria thereafter, a preferred scheme is provided, which further comprises:

a log of an abnormality detection job in progress is generated, and the log is stored in a storage device.

Network equipment, a system, a service program and the like can generate an event record called log when in operation; each row of the log records the description of the date, time, user and action.

The Windows network operating System is designed with various log files, such as application log, security log, System log, service log, Domain Name System (DNS) server log, etc., which are different according to the services opened by your System. When we perform some operations on the system, these log files will usually record some relevant contents of our operations, which are quite useful for the system security staff. For example, if a person performs IPC detection on the system, the system will quickly record the IP, time, user name, etc. used by the detector in the security log. By means of log recording, historical abnormal state processing operation can be recorded, and subsequent adjustment and optimization can be carried out according to the historical records.

In view of the need to timely handle the abnormal state of the device, the present embodiment provides a preferable solution, further including:

and when the PCIE equipment is determined to be abnormal, alarming is carried out.

The specific manner of the alarm and the device used by the alarm are not limited, and for example, the alarm may be given by a buzzer, a warning lamp, or the like, or the alarm may be given by sending a warning command to the control terminal.

By adding the alarm under the abnormal state of the PCIE equipment, the timely processing of the abnormal state is ensured, and potential safety hazards such as data loss and the like caused by long-term unprocessed abnormity of the PCIE equipment are prevented.

In the above embodiments, the abnormality detection method is described in detail, and the present application also provides embodiments corresponding to the abnormality detection apparatus. It should be noted that the present application describes the embodiments of the apparatus portion from two perspectives, one from the perspective of the function module and the other from the perspective of the hardware.

Fig. 2 is a schematic diagram of an anomaly detection apparatus according to an embodiment of the present application, where the apparatus includes:

the configuration module 10 is configured to configure a test environment, and acquire a BUS ID and device information of PCIE devices in the server by using an lspci tool;

a reading module 11, configured to read byte data in a configuration space of a PCIE device;

the judging module 12 is configured to judge whether a numerical value in a register of the PCIE device meets a preset standard according to the byte data, and start the determining module if the numerical value does not meet the preset standard;

the determining module 13 is configured to determine that the PCIE device is abnormal.

Since the embodiment of the apparatus portion and the embodiment of the method portion correspond to each other, reference is made to the description of the embodiment of the method portion for the embodiment of the apparatus portion and the corresponding advantageous effects, which are not repeated herein.

The abnormity detection device comprises an initialization module, an authentication module, a scheduling module and an ending module, wherein a test environment can be configured through the lspci tool, the BUS ID and the equipment information of PCIE equipment in a server are obtained through the lspci tool, byte data in a configuration space of the PCIE equipment are read, whether the numerical value in a register of the PCIE equipment meets a preset standard or not is judged according to the byte data, if the preset standard is not met, the condition that whether the PCIE equipment is abnormal or not is judged through collecting the information of the space register configured by the PCIE equipment so as to judge whether a PCIE link has the abnormity or not is judged, and a correctable error is identified for correction. The testing method is suitable for testing the universal server, improves the coverage of the reliability test of the PCIE equipment, and ensures that the test is more comprehensive and complete.

Fig. 3 is a structural diagram of an abnormality detection apparatus according to another embodiment of the present application, and as shown in fig. 3, the abnormality detection apparatus includes: a memory 20 for storing a computer program;

a processor 21 for implementing the steps of the anomaly detection method as mentioned in the above embodiments when executing the computer program.

The abnormality detection device provided in this embodiment may include, but is not limited to, a smart phone, a tablet computer, a notebook computer, or a desktop computer.

The processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like. The Processor 21 may be implemented in at least one hardware form of Digital Signal Processor (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 21 may also include a main processor and a coprocessor, where the main processor is a processor for Processing data in an awake state, and is also called a Central Processing Unit (CPU); a coprocessor is a low power processor for processing data in a standby state. In some embodiments, the processor 21 may be integrated with a Graphics Processing Unit (GPU) which is responsible for rendering and drawing the content required to be displayed on the display screen. In some embodiments, the processor 21 may further include an Artificial Intelligence (AI) processor for processing computational operations related to machine learning.

Memory 20 may include one or more computer-readable storage media, which may be non-transitory. Memory 20 may also include high speed random access memory, as well as non-volatile memory, such as one or more magnetic disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used for storing the following computer program 201, wherein after being loaded and executed by the processor 21, the computer program can implement the relevant steps of the anomaly detection method disclosed in any one of the foregoing embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202, data 203, and the like, and the storage manner may be a transient storage manner or a permanent storage manner. Operating system 202 may include, among other things, Windows, Unix, Linux, etc. The data 203 may include, but is not limited to, data involved in the above-described anomaly detection methods, and the like.

In some embodiments, the anomaly detection device may further include a display 22, an input/output interface 23, a communication interface 24, a power supply 25, and a communication bus 26.

Those skilled in the art will appreciate that the configuration shown in fig. 3 does not constitute a limitation of the anomaly detection apparatus and may include more or fewer components than those shown.

The anomaly detection device provided by the embodiment of the application comprises a memory and a processor, wherein when the processor executes a program stored in the memory, the following method can be realized: the abnormality detection method referred to in the above embodiments.

Since the embodiment of the apparatus portion and the embodiment of the method portion correspond to each other, please refer to the description of the embodiment of the method portion for the embodiment of the apparatus portion and the corresponding beneficial effects, which is not repeated herein.

The abnormality detection device comprises a memory and an actuator, wherein when a program in the memory is executed by the actuator, the test environment can be configured, an lspci tool is used for acquiring the BUS ID and the equipment information of PCIE equipment in a server, byte data in a configuration space of the PCIE equipment is read, whether the numerical value in a register of the PCIE equipment meets a preset standard or not is judged according to the byte data, if the numerical value does not meet the preset standard, the PCIE equipment abnormality is determined, whether the PCIE link is abnormal or not is judged by collecting the information of the configuration space register of the PCIE equipment, and correctable errors are identified for correction. The testing method is suitable for testing the universal server, improves the coverage of the reliability test of the PCIE equipment, and ensures that the test is more comprehensive and complete.

Finally, the application also provides a corresponding embodiment of the computer readable storage medium. The computer-readable storage medium has stored thereon a computer program which, when being executed by a processor, carries out the steps as set forth in the above-mentioned method embodiments.

It is to be understood that if the method in the above embodiments is implemented in the form of software functional units and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application may be embodied in the form of a software product, which is stored in a storage medium and executes all or part of the steps of the methods described in the embodiments of the present application, or all or part of the technical solutions. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.

Since the embodiment of the readable storage medium portion and the embodiment of the method portion correspond to each other, please refer to the description of the embodiment of the method portion for the embodiment of the apparatus portion and the corresponding beneficial effects, which are not repeated herein.

When the stored content is executed, the computer-readable storage device can achieve the purpose that a test environment is configured, a lspci tool is used for obtaining a BUS ID and device information of a PCIE device in a server, byte data in a configuration space of the PCIE device is read, whether a numerical value in a register of the PCIE device meets a preset standard or not is judged according to the byte data, if the numerical value does not meet the preset standard, it is determined that the PCIE device is abnormal, whether a PCIE link is abnormal or not is judged by collecting PCIE device configuration space register information, and a correctable error is identified for correction. The testing method is suitable for testing the universal server, improves the coverage of the reliability test of the PCIE equipment, and ensures that the test is more comprehensive and complete.

The foregoing detailed description has provided an anomaly detection apparatus, circuit and device and readable storage medium. The embodiments are described in a progressive manner in the specification, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description. It should be noted that, for those skilled in the art, it is possible to make several improvements and modifications to the present application without departing from the principle of the present application, and such improvements and modifications also fall within the scope of the claims of the present application.

It is further noted that, in the present specification, relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

Claims

1. An anomaly detection method applied to a PCIE device includes:

configuring a test environment, and acquiring BUSID and equipment information of the PCIE equipment in the server by using an lspci tool;

reading byte data in a configuration space of the PCIE equipment;

2. The abnormality detection method according to claim 1, characterized in that said reading of said device information includes a domain number, a bus number, a device number, a function number.

3. The abnormality detection method according to claim 2, wherein said determining whether the numerical values in the registers of the PCIE device satisfy a preset criterion includes:

judging whether the numerical value of the bit corresponding to the error in the error correctable state register is 0 or not;

and if the value of the bit corresponding to the error in the status register is not 0, the PCIE equipment is abnormal.

4. The method of claim 3, wherein if the value of the bit corresponding to the error in the error correctable status register is 1, further comprising:

5. The abnormality detection method according to claim 3, characterized by further comprising:

6. The abnormality detection method according to any one of claims 1 to 5, characterized by further comprising:

7. The abnormality detection method according to claim 6, characterized by further comprising:

and when the PCIE equipment is determined to be abnormal, alarming.

8. An abnormality detection device characterized by comprising:

the configuration module is used for configuring a test environment and acquiring the BUSID and the equipment information of the PCIE equipment in the server by utilizing an lspci tool;

a determining module, configured to determine that the PCIE device is abnormal.

9. An anomaly detection apparatus comprising a memory for storing a computer program;

a processor for implementing the steps of the anomaly detection apparatus as claimed in any one of claims 1 to 7 when executing said computer program.

10. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, which computer program, when being executed by a processor, carries out the steps of the anomaly detection method according to any one of claims 1 to 7.