CN117076611A

CN117076611A - Information processing method, information processing device, electronic equipment and storage medium

Info

Publication number: CN117076611A
Application number: CN202311110618.9A
Authority: CN
Inventors: 周伟
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2023-08-30
Filing date: 2023-08-30
Publication date: 2023-11-17

Abstract

The disclosure provides an information processing method, an information processing device, electronic equipment and a storage medium; the technical field of design data processing, in particular to the field of big data, intelligent search and knowledge graph. The specific implementation scheme is as follows: acquiring a plaintext log of each module in a server; acquiring a link topological graph between modules based on a plaintext log; the nodes of the link topological graph are modules, and edges between the nodes indicate upstream and downstream relations between the nodes; and determining a source module of a return field in the plaintext log according to the link topology diagram. In the embodiment of the disclosure, the source modules of the return fields are confirmed based on the upstream and downstream relations among the modules by determining the upstream and downstream relations among the link topology map determining modules, so that the return fields can be quickly positioned to the corresponding source modules according to the abnormal return fields in the abnormal investigation, the investigation cost is reduced, and the abnormal investigation effect is improved.

Description

Information processing method, information processing device, electronic equipment and storage medium

Technical Field

The disclosure relates to the technical field of data processing, in particular to the fields of big data, intelligent search and knowledge graph, and especially relates to an information processing method, an information processing device, electronic equipment and a storage medium.

Background

The current server application tends to be micro-servitized, so analysis of field sources is an important research content of interaction analysis among modules, and the current modules have long links and have no complete request and return plaintext logs for analysis, so that the analysis cost of the field sources is high and the analysis effect is poor.

Disclosure of Invention

The disclosure provides an information processing method, an information processing device, electronic equipment and a storage medium.

According to a first aspect of the present disclosure, there is provided an information processing method including: acquiring a plaintext log of each module in a server; acquiring a link topology diagram between the modules based on the plaintext log; the nodes of the link topological graph are modules, and edges between the nodes indicate upstream and downstream relations between the nodes; and determining a source module of a return field in the plaintext log according to the link topology diagram.

According to a second aspect of the present disclosure, there is provided an information processing apparatus including: the first acquisition module is used for acquiring the plaintext logs of each module in the server; the second acquisition module is used for acquiring a link topological graph between the modules based on the plaintext log; the nodes of the link topological graph are modules, and edges between the nodes indicate upstream and downstream relations between the nodes; and the third acquisition module is used for determining a source module of a return field in the plaintext log according to the link topological graph.

According to a third aspect of the present disclosure, there is provided an electronic device comprising: at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of the first aspect.

According to a fourth aspect of the present disclosure, there is provided a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of the first aspect.

According to a fifth aspect of the present disclosure, there is provided a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method of the first aspect.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the disclosure, nor is it intended to be used to limit the scope of the disclosure. Other features of the present disclosure will become apparent from the following specification.

Drawings

The drawings are for a better understanding of the present solution and are not to be construed as limiting the present disclosure. Wherein:

Fig. 1 is a schematic flow chart of an information processing method according to an embodiment of the disclosure;

fig. 1A is an interaction schematic diagram of a server module provided in an embodiment of the disclosure;

FIG. 2 is a flow chart of another information processing method according to an embodiment of the present disclosure;

FIG. 3 is a flow chart of another information processing method according to an embodiment of the present disclosure;

FIG. 4 is a flow chart of another information processing method according to an embodiment of the present disclosure;

FIG. 5 is a flow chart of another information processing method according to an embodiment of the present disclosure;

FIG. 6 is a flow chart of another information processing method provided by an embodiment of the present disclosure;

fig. 7 is a schematic structural view of an information processing apparatus provided in an embodiment of the present disclosure;

fig. 8 is a block diagram of an electronic device for implementing an information processing method of an embodiment of the present disclosure.

Detailed Description

Exemplary embodiments of the present disclosure are described below in conjunction with the accompanying drawings, which include various details of the embodiments of the present disclosure to facilitate understanding, and should be considered as merely exemplary. Accordingly, one of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

Data Processing (Data Processing), which is the collection, storage, retrieval, processing, transformation and transmission of Data; the basic objective is to extract and derive data that is valuable and meaningful to some specific person from a large, possibly unorganized, and unintelligible, data.

Big Data, or macro Data, refers to Data that is so large in size that it cannot be retrieved, managed, processed, and consolidated in a reasonable time through the mainstream software tools, and becomes a more aggressive goal for helping business decisions. Big data includes structured, semi-structured and unstructured data, unstructured data becoming an increasingly important part of data.

Smart search (Intelligent Search), a new generation of searches incorporating artificial intelligence technology. Besides the functions of traditional quick retrieval, relevance sorting and the like, the functions of user role registration, automatic user interest identification, semantic understanding of content, intelligent informatization filtering, pushing and the like can be provided.

The Knowledge map (knowledgegraph), called Knowledge domain visualization or Knowledge domain mapping map in book condition report, is a series of different graphs showing Knowledge development process and structure relationship, describes Knowledge resources and their carriers by using visualization technology, digs, analyzes, builds, draws and displays Knowledge and the interrelation between them, and displays the complex Knowledge domain through data mining, information processing, knowledge metering and Graph drawing.

Fig. 1 is a flow chart of an information processing method according to an embodiment of the disclosure. As shown in fig. 1, the method includes:

s101, acquiring a plaintext log of each module in the server.

In some implementations, various modules are included in the server, such as a database module, a security module, a web module, a time module, a load balancing module, and the like. Because the functional positioning of each module in the server is different, such as a storage module and a processing module, in the interaction process between the client and the server, a plurality of modules may be triggered to coordinate to realize the need of the client, and interaction exists between the plurality of modules. As shown in fig. 1A, when the client interacts with the server module 1, the implementation of the interaction service may also depend on the module 2 and the module 3, where the module 2 has a dependency relationship with the module 4, and the module 3 has a dependency relationship with the module 5, the modules 6 and …, and the module n.

In some implementations, the data of interactions between modules is logged; the log may be in plain text format, i.e., the data interacted between the modules is a plain text log. In other implementations, the log may be in a binary format.

Optionally, the plaintext log may include the request data and return data for the module. The plaintext log of the module comprises fields in the request data and fields in the return data of the module, so that when abnormality investigation is performed based on the plaintext log of the module, all fields of the module provide a more accurate basis for the abnormality investigation. It will be appreciated that in some cases, the request data may be referred to as a request log and the return data may be referred to as a return log.

In some implementations, the plaintext log of the module may be stored in the server's own memory, i.e., the plaintext log of the module may be read from its own memory.

In some implementations, the plaintext log of the module may also be stored in an external storage device, i.e., the plaintext log of the module may be read from the external storage device.

In some implementations, a clear text log of the modules of the server may be obtained from a general log software development kit (Software Development Kit, SDK). The log SDK is a basic dependent SDK, and can provide the capabilities of unified log printing, log level control, log isolation of sub-modules and the like for the client, and can obtain the plaintext log of the module more efficiently.

In other implementations, the plaintext log of each module of the server may be obtained according to a preset middleware.

Optionally, the middleware may include: bridge netbridge, proxy, and open source tool Goreplay. And directly requesting the middleware service by the module, so that the middleware technology stores the request and returned plaintext logs of the module, and acquiring the plaintext logs of each module of the server from the middleware.

S102, acquiring a link topological graph between modules based on the plaintext logs.

The nodes of the link topological graph are modules, and edges between the nodes indicate upstream and downstream relations between the nodes.

In some implementations, when modules interact with each other, there may be an upstream-downstream relationship between the modules. It will be appreciated that from the perspective of the current module, each link depends on the link of its upstream module, and each downstream module adds further processing logic or flow to the current module. For example, the module C depends on the module B, the module B depends on the module a, where the module a is an upstream module of the module B, the module B is an upstream module of the module C, the module C imports all functions of the module B and the module a, and adds its own unique processing logic or flow, and the module C is a downstream module.

Alternatively, the request data and the return data of the module may be determined according to the plaintext log of the module, so that other modules that interact with the current module may be determined according to the request data and the return data. It is understood that other modules that interact with the current module may be modules upstream of the current module or modules downstream of the current module.

Further, after determining that other modules interact with the current module, a service internet protocol (Internet Protocol, IP) address corresponding to the module may be obtained, an upstream module and a downstream module in the service Internet Protocol (IP) address are determined according to the service IP address corresponding to the module, and the current module, the upstream module and the downstream module of the current module are associated based on the upstream and downstream relationships. It will be appreciated that the edges connecting the modules may indicate the upstream and downstream relationship between the modules, for example by determining whether the module is an upstream or downstream module by the direction of the arrow of the edge, i.e. the link topology is a directed graph from which the upstream and downstream relationship between the modules may be determined intuitively.

Optionally, all modules in the server side can be traversed, and the modules on the upstream and downstream of each traversed module are summarized to determine a link topology diagram between all the modules.

It will be appreciated that the link topology shows the upstream and downstream relationship between the different modules.

S103, determining a source module of a return field in the plaintext log according to the link topology diagram.

After determining the link topology diagram, determining the upstream-downstream interaction relationship between different modules, namely the dependency relationship between the modules, according to the link topology diagram; for any return field in the plaintext log, the source module of the return field may be determined based on whether the return field is in the plaintext log of the module.

It will be appreciated that the source module, i.e., the module that returns the return field; when the return field does not belong to the plaintext log of the current module, other associated modules of the current module can be determined according to the link topology diagram, and whether the return field belongs to other associated fields can be judged.

For example, assuming that for any return field of module a, it may be determined whether the return field is included in the plaintext log of module a, if so, the return field may be considered to originate from module a; correspondingly, if the plaintext log of the module A does not include the return field, determining one or more downstream associated modules of the module A according to the link topology diagram, judging whether the one or more downstream associated modules include the return field, and acquiring the downstream associated module including the return field as a source module of the return field.

Further, after determining the source module corresponding to each return field, if the return field is abnormal, the source module corresponding to the return field can be quickly positioned to the corresponding abnormal module according to the source module of the return field, so that the efficiency of module abnormality investigation is improved.

In the embodiment of the disclosure, the plaintext logs corresponding to all modules of the server are obtained, the plaintext logs of the modules are obtained according to the general log SDK or middleware, the efficiency of obtaining the plaintext logs is improved, and a more accurate basis is provided for subsequent exception checking based on the plaintext logs; according to the method, the link topology diagram among the modules is determined according to the plaintext logs corresponding to the modules, the upstream and downstream relation among the modules is determined intuitively, the source modules of the return fields are determined based on the link topology diagram among the modules, the specific abnormal modules can be determined according to the quick positioning of the abnormal return fields to the corresponding source modules in the abnormal investigation, the investigation cost is reduced, the problem that no complete plaintext log analysis exists at present is solved, and the abnormal investigation effect is better.

Fig. 2 is a flowchart of another information processing method according to an embodiment of the disclosure. As shown in fig. 2, the method includes:

s201, obtaining a plaintext log of each module in the server.

In some implementations, after the plaintext logs of each module are obtained, the plaintext logs can be preprocessed, the plaintext logs are screened, the screened plaintext logs are stored for subsequent analysis, reliability of analysis data is ensured, and accuracy of a final analysis result is improved.

In some implementations, a first key may be obtained; carrying out first keyword recognition on the plaintext log; taking a plaintext log comprising the first keyword as a target plaintext log; and acquiring a link topological graph between the modules based on the target plaintext log. That is, by setting the first keyword, the plaintext log including the first keyword is included as the target plaintext log, and the subsequent analysis is performed based on the target plaintext log.

In some implementations, a log white list may also be obtained; determining a target plaintext log in the plaintext logs according to the log white list; and acquiring a link topological graph between the modules based on the target plaintext log. That is, by setting the log white list, the plaintext log included in the log white list is taken as the target plaintext log; and acquiring a link topological graph between the modules based on the target plaintext log.

In some implementations, a unique identifier corresponding to the target plaintext log may also be obtained; determining a first module which has interaction with a module corresponding to the target plaintext log according to the request data and the return data in the target plaintext log; according to the unique identification, associating the target plaintext log with a first target plaintext log corresponding to the first module; and acquiring a link topological graph between the modules based on the associated target plaintext log.

Optionally, the unique identifier corresponding to the target plaintext log may be an identity identifier (Identity document, id) of the module corresponding to the target plaintext log, the request data and the return data in the target plaintext log reflect the first module having interaction with the module corresponding to the target plaintext log, and the first module having interaction is associated with the module corresponding to the target plaintext log based on the Id, so as to provide a basis for obtaining the link topology graph between the modules, and improve the efficiency of analyzing the link topology graph.

In the embodiment of the present disclosure, the implementation method of step S201 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S202, traversing the modules in the server by taking any module as a starting point.

It will be appreciated that each module may interact with one or more modules, which for module B may be a downstream module of module a or an upstream module of module C. Each module in the server is analyzed.

Optionally, any module can be used as a starting point to perform traversal analysis on each module in the server, so as to ensure that the analysis on the upstream and downstream relations of all the modules is complete, and a more reliable link topology graph is obtained.

S203, a first service identifier of a request downstream log in a plaintext log corresponding to a current traversal module is obtained.

In some implementations, a first service identification requesting a downstream log is obtained from a plaintext log of a current traversal module. Alternatively, the first service identification may be an ip address requesting a downstream log. It will be appreciated that the plaintext logs used for analysis at this time are all the target plaintext logs after screening.

It can be understood that the request downstream log is request data when the downstream service is requested, and according to the first service identifier of the request downstream log, a module corresponding to the first service identifier can be obtained, so that a downstream module corresponding to the current traversal module can be obtained.

S204, positioning the first downstream module according to the first service identifier, and marking the first downstream module as the downstream module of the current traversal module.

After the first service identifier of the request downstream log in the plaintext log of the current traversal module is obtained, a corresponding first downstream module, that is, a downstream module of the current traversal module, may be determined according to the first service identifier, that is, according to the ip address of the request downstream log.

Optionally, a relationship between the current traversal module and its corresponding downstream module is established, where the relationship includes an upstream-downstream relationship.

Traversing all the modules to obtain a first service identifier of a request downstream log in a plaintext log of each traversing module, and further determining a first downstream module according to the first service identifier to obtain the downstream module of each traversing module.

S205, determining a link topology diagram among the modules according to the downstream modules corresponding to the modules.

After the downstream modules corresponding to each module are obtained, the downstream modules of all the modules are summarized, so that a link topology diagram among the modules is determined. Each node in the link topology graph represents a module, and edges between nodes indicate upstream and downstream relationships between corresponding modules.

S206, determining a source module of a return field in the plaintext log according to the link topology diagram.

In the embodiment of the present disclosure, the implementation method of step S206 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

In the embodiment of the disclosure, the plaintext log is preprocessed to obtain the target plaintext log before being analyzed by using the plaintext log, and the link topology diagram is obtained based on the target plaintext log, so that the obtaining efficiency of the link topology diagram is improved; and (3) performing traversal analysis by taking any module as an initial point, positioning a first downstream module according to a first service identifier in a plaintext log of the current traversal module to obtain a downstream module of the current traversal module, traversing all modules to obtain the corresponding downstream modules, further forming a link topology graph among the modules, and obtaining the link topology graph which is more complete and reliable, more accurately reflects the upstream and downstream relation among the modules, and obtains a source module of a return field based on the more accurate link topology graph with higher accuracy.

Fig. 3 is a flowchart illustrating another information processing method according to an embodiment of the present disclosure. As shown in fig. 3, the method includes:

S301, obtaining a plaintext log of each module in the server.

In the embodiment of the present disclosure, the implementation method of step S301 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S302, acquiring a link topological graph between modules based on a plaintext log.

In the embodiment of the present disclosure, the implementation method of step S302 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S303, determining one or more second downstream modules of the corresponding modules of the plaintext logs according to the link topology graph.

It will be appreciated that the link topology includes an upstream-downstream relationship between the modules, so that all downstream modules corresponding to any one module can be determined based on the link topology.

In some implementations, a module corresponding to the plaintext log is determined, one or more second downstream modules corresponding to the module are obtained according to the link topology diagram, and whether the one or more second downstream modules are source modules of the return field is determined.

S304, determining a module corresponding to the request data.

In some implementations, the return field of the plaintext log may be derived from the requested data in the plaintext log, and thus the module corresponding to the requested data is obtained when the source module of the return field is determined.

In some implementations, the request data is request data in a plaintext log, and thus the module to which the request data corresponds is the module to which the plaintext log corresponds.

S305, determining a source module of the return field from the second downstream module and the module corresponding to the request data.

In some implementations, the return field may be the return field of the request data in the plain text log, and may also be the return field of the downstream module. Therefore, after determining the module corresponding to the request data and the second downstream module corresponding to the plaintext log, determining the source module of the return field from the second downstream module and the module corresponding to the request data.

In some implementations, if the return field is included in the request data, the module corresponding to the request data is the source module of the return field.

In other implementations, if the return field is included in the return data corresponding to the second downstream module, the second downstream module including the return field is a source module of the return field.

In the embodiment of the disclosure, after the link topology diagram between the modules is confirmed, one or more second downstream modules of the modules corresponding to the return field can be determined according to the link topology diagram, and further, the module for acquiring the request data, that is, the module for returning the plaintext log where the field is located, determines the source module of the return field from the module for requesting the data and the second downstream modules, thereby reducing the cost of checking the modules one by one and improving the efficiency and accuracy of determining the source module of the return field.

Fig. 4 is a flowchart of another information processing method according to an embodiment of the disclosure. As shown in fig. 4, the method includes:

s401, acquiring a plaintext log of each module in the server.

In the embodiment of the present disclosure, the implementation method of step S401 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S402, acquiring a link topological graph between modules based on a plaintext log.

In the embodiment of the present disclosure, the implementation method of step S402 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S403, determining one or more second downstream modules of the modules corresponding to the plaintext logs according to the link topology graph.

In the embodiment of the present disclosure, the implementation method of step S403 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S404, determining a module corresponding to the request data.

In the embodiment of the present disclosure, the implementation method of step S404 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S405, it is determined whether the return field is in the request data of the plain text log.

In some implementations, the plaintext logs corresponding to each module may be pre-formatted to make the data formats in the plaintext logs consistent, and optionally, the data in the plaintext logs may be serialized into a key value pair. For example, javaScript object notation (JavaScript Object Notation, JSON) string structures are serialized into key value key-value pairs. Wherein the JOSN string is a lightweight data exchange format.

It will be appreciated that a key value pair is a data structure consisting of a key and a corresponding value, and that the key and corresponding value are in a one-to-one relationship. In the key value, each key is unique, and the value corresponding thereto may be any data type, such as an integer, a character string, a boolean value, an object, etc.; the data in the plaintext log is converted into the form of key-value pairs to facilitate analysis of the data.

In some implementations, a key value pair corresponding to a return field is determined; and judging whether the return field is in the request data of the plaintext log according to the key value pair corresponding to the return field and the key value pair in the request data.

Alternatively, the determination may be made based on the key of the return field, traversing the keys in each key value pair in the request data of the plaintext log, and determining whether there is a key in the request data that is consistent with the key of the return field; if there is a key in the request data that is consistent with the key of the return field, the return field is in the request data of the plain log. Accordingly, if there is no key in the request data that is consistent with the key of the return field, the return field is not in the request data of the plain log.

S406, if the return field is in the request data, judging whether the request data includes the key value of the return field.

In some implementations, if the return field is determined to be in the request data, it is further determined whether a key value for the return field is included in the request data.

Alternatively, the key value of the return field may be the corresponding value in the key value pair of the return field. And judging whether the module of the request data is a source module of the return field more accurately according to whether the key value of the return field is included in the request data.

S407, when the key value of the return field is included in the response request data, determining that the module corresponding to the plaintext log is the source module of the return field.

When the key value of the return field is included in the request data, that is, the key of the return field is included in the request data and the corresponding value of the key in the request data is equal to the corresponding value of the return field, the source module of the return field is determined to be the module corresponding to the request data.

For example, assuming that the request data of the module a includes a key corresponding to the return field a, it is described that the return field a is included in the request data of the module a, and it is further determined whether the key value of the return field a is included in the module a, and if the return field a is included in the request data of the module a, and the corresponding value of the key of the return field a in the request data is equal to the corresponding value of the return field a, it is determined that the source module of the return field a is the module a.

S408, if the return field does not exist in the request data, the first similarity between the return field and the request data is obtained.

In some implementations, if it is determined that the return field does not exist in the request data, a first similarity between the return field and the request data is calculated, and if the first similarity has a larger value, a module corresponding to the request data is still used as a source module of the return field.

Alternatively, the first similarity may be calculated from the key-value pair of the return field and the key-value pair of the request data.

In some implementations, a third similarity of the key of the return field and the key in the request data may be obtained, alternatively, the third similarity may be obtained using a text similarity comparison algorithm, and a common text similarity comparison algorithm may be euclidean distance, hamming distance, column Wen Shentan or Gu Kade index, and the like.

In some implementations, a fourth similarity of the corresponding value of the return field and the corresponding value in the request data may also be obtained. That is, the key value pair of the return field is compared with the third similarity of the key in the key value pair of the request data and the fourth similarity of the corresponding value, respectively.

In the embodiment of the application, the third similarity and the fourth similarity are regarded as the first similarity. Alternatively, a sum of the third similarity and the fourth similarity may also be calculated as the first similarity.

S409, when the first similarity meets a first setting condition, determining that the module corresponding to the plaintext log is a source module of the return field.

After the first similarity is determined, the larger the first similarity value is, the more likely the return field is derived from the module corresponding to the plaintext log is indicated, so that a first setting condition is preset, and when the first similarity meets the first setting condition, the module corresponding to the plaintext log is determined to be the source module of the return field.

In some implementations, the first set condition may be that the third and fourth similarities are simultaneously greater than a similarity threshold, or that a sum of the third and fourth similarities is greater than a similarity sum threshold.

When the first similarity meets a first setting condition, the similarity of the key value pair of the return field and the key value pair of the request data is determined to be higher, and the source module of the return field is determined to be a module corresponding to the plaintext log.

In the embodiment of the disclosure, one or more second downstream modules of modules corresponding to a return field are determined according to a link topology diagram, a unified format is performed on data in the return field and a plaintext log to determine a key value pair, whether the return field is included in request data is determined according to keys in the key value pair, and further calculation under different conditions is performed according to whether the return field is included, so that whether the return field belongs to the request data can be judged when the key of the return field is included or not in the request data, and whether a key value is equal is directly judged when the return field is included in the request data, and whether a module corresponding to the request data is a source module of the return field is rapidly determined; when the request data does not comprise the return field, calculating the first similarity, judging whether the first similarity meets a preset condition, and when the first similarity meets the preset condition, determining whether a module corresponding to the request data is a source module of the return field, so that the accuracy of analyzing the source module of the return field is improved.

Fig. 5 is a flowchart illustrating another information processing method according to an embodiment of the present disclosure. As shown in fig. 5, the method includes:

s501, obtaining a plaintext log of each module in a server.

In the embodiment of the present disclosure, the implementation method of step S501 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S502, acquiring a link topological graph between modules based on a plaintext log.

In the embodiment of the present disclosure, the implementation method of step S502 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S503, determining one or more second downstream modules of the corresponding modules of the plaintext log according to the link topology graph.

In the embodiment of the present disclosure, the implementation method of step S503 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S504, determining a module corresponding to the request data.

In the embodiment of the present disclosure, the implementation method of step S504 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S505, judging whether the return field is in the request data of the plaintext log.

In the embodiment of the present disclosure, the implementation method of step S505 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S506, if the return field is in the request data, judging whether the request data comprises the key value of the return field.

In the embodiment of the present disclosure, the implementation method of step S506 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S507, if the return field does not exist in the request data, acquiring the first similarity between the return field and the request data.

In the embodiment of the present disclosure, the implementation method of step S507 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

And S508, judging whether the return field is in the return data corresponding to the second downstream module or not when the key value of the return field is not included in the request data or the first similarity does not meet the first setting condition.

In some implementations, if the key value of the return field is not included in the request data, determining that the module corresponding to the request data is not the source module of the return field; or the first similarity does not meet the first setting condition, and the module corresponding to the request data is determined not to be the source module of the return field.

Further, after determining that the module corresponding to the request data is not the source module of the return field, analyzing the second downstream module to determine whether the second downstream module of the module corresponding to the plaintext log is the source module of the return field.

In some implementations, it may be determined whether the return field is in return data corresponding to the second downstream module. Alternatively, the judgment can be performed according to the key value pair corresponding to the return field and the key value pair of the return data of any second downstream module.

Alternatively, the determination may be made based on the key of the return field, traversing the keys in each key value pair in the return data of the plaintext log of the second downstream module, and determining whether there is a key in the return data that is consistent with the key of the return field; if the key consistent with the key of the return field exists in the return data, the return field is in the return data corresponding to the second downstream module. Accordingly, if there is no key in the return data that is consistent with the key of the return field, the return field is not in the return data corresponding to the second downstream module.

S509, if the return field is in the return data, judging whether the return data includes the key value of the return field.

In some implementations, if it is determined that the return field is in the return data, it is further determined whether a key value of the return field is included in the return data.

Alternatively, the key value of the return field may be the corresponding value in the key value pair of the return field. And judging whether the second downstream module corresponding to the return data is a source module of the return field more accurately according to whether the return data comprises the key value of the return field.

And S510, determining that the second downstream module is a source module of the return field in response to the fact that the return data comprises the key value of the return field.

When the key value of the return field is included in the return data, that is, the key of the return field is included in the return data and the corresponding value of the key in the return data is equal to the corresponding value of the return field, the source module of the return field is determined to be the second downstream module corresponding to the return data.

For example, assuming that the return data of the second downstream module B includes a key corresponding to the return field a, it is described that the return field a is in the return data of the second downstream module B, and whether the return field B includes the key value of the return field a is further determined, if the return field a is in the return data of the second downstream module B, and the corresponding value of the key of the return field a in the return data is equal to the corresponding value of the return field a, it is determined that the source module of the return field a is the second downstream module B.

S511, if the return field does not exist in the return data, the second similarity between the return field and the return data is obtained.

In some implementations, if it is determined that the return field does not exist in the return data, a second similarity between the return field and the return data is calculated, and if the second similarity has a larger value, a second downstream module corresponding to the return data is still used as a source module of the return field.

Alternatively, the second similarity may be calculated from the key-value pair of the return field and the key-value pair of the return data.

In some implementations, a fifth similarity of the key of the return field and the key in the return data may be obtained, optionally, the fifth similarity may be obtained using a text similarity comparison algorithm, and a common text similarity comparison algorithm may be euclidean distance, hamming distance, column Wen Shentan or Gu Kade index, and the like.

In some implementations, a sixth similarity of the corresponding value of the return field and the corresponding value in the return data may also be obtained. That is, the fifth similarity of the key-value pair of the return field and the key in the key-value pair of the return data and the sixth similarity of the corresponding values are compared, respectively.

In the embodiment of the present application, the fifth similarity and the sixth similarity are regarded as the second similarity. Alternatively, a sum of the fifth similarity and the sixth similarity may also be calculated as the second similarity.

And S512, determining the second downstream module as the source module of the return field when the second similarity meets the second setting condition.

After the second similarity is determined, the larger the second similarity value is, the more likely the return field is derived from the second downstream module corresponding to the return data, so that a second setting condition is preset, and when the second similarity meets the second setting condition, the second downstream module corresponding to the return data is determined to be the source module of the return field.

In some implementations, the second set condition may be that the fifth similarity and the sixth similarity are simultaneously greater than a similarity threshold, or that a sum of the fifth similarity and the sixth similarity is greater than a similarity sum threshold.

When the second similarity meets a second setting condition, the similarity between the key value pair of the return field and the key value pair of the return data is higher, and the source module of the return field is determined to be a second downstream module corresponding to the return data.

In some implementations, if it is determined that the current second downstream module is not the source module of the return field, traversal analysis is performed on the other second downstream modules. It will be appreciated that the traversal ends when the source module of the return field is determined.

In some implementations, if neither the module corresponding to the plaintext log nor all of the second downstream modules are source modules of the return field, the return field is determined to be a special handling field of the module corresponding to the plaintext log, which may be generated by a code of the module of the plaintext log.

In some implementations, when the module traversing the trace-source is an entire link in the link topology, the results of the multiple modules may be correlated. For example, the module corresponding to the current plaintext log is a module a, the second downstream module corresponding to the module a is a module C and a module D, and the module a, the module C and the module D are just an entire link in the link topology diagram, so that the data of the module a, the module C and the module D can be integrated. Illustratively, assuming that the return field a in module a is derived from the return data of module C, which is derived from the return data of module D, the field a may be merged to be derived from the grandchild node module D of module a.

In some implementations, the source results between all the fields and the modules may be summarized to form a field tracing graph, where the nodes in the field tracing graph are modules, and the connection of the nodes in the field tracing graph indicates the source of each field in the module

In the embodiment of the disclosure, after determining that the module corresponding to the request data is not the source module of the return field, performing traversal analysis on the second downstream module of the module corresponding to the request data, judging whether one or more second downstream modules of the module corresponding to the request data are source modules of the return field, performing preliminary analysis based on whether the return field is included in the return data of the second downstream module, and determining different calculation modes based on whether the return field is included, so that when the return data includes or returns the key value of the field, whether the return field is from the second downstream module can be determined secondarily, and finally determining that the source module of the return field in the second downstream module is higher in accuracy; meanwhile, aiming at the modules in the whole link, the results can be combined when the source module is determined, so that errors and calculation cost of investigation of the source module of the return field are reduced, and the source module of the return field is more visual and accurate.

Fig. 6 is a flowchart illustrating another information processing method according to an embodiment of the present disclosure. As shown in fig. 6, the method includes:

s601, obtaining a plaintext log of each module in the server.

In the embodiment of the present disclosure, the implementation method of step S601 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S602, traversing the modules in the server with any module as a starting point.

In the embodiment of the present disclosure, the implementation method of step S602 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S603, a first service identifier of a request downstream log in a plaintext log corresponding to a current traversal module is obtained.

In the embodiment of the present disclosure, the implementation method of step S603 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described in detail.

S604, positioning to the first downstream module according to the first service identification, and marking the first downstream module as the downstream module of the current traversal module.

In the embodiment of the present disclosure, the implementation method of step S604 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S605, determining a link topological graph among the modules according to the downstream modules corresponding to the modules.

In the embodiment of the present disclosure, the implementation method of step S605 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described in detail.

S606, one or more second downstream modules of the corresponding modules of the plaintext log are determined according to the link topology graph.

In the embodiment of the present disclosure, the implementation method of step S606 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S607, determining the module corresponding to the request data.

In the embodiment of the present disclosure, the implementation method of step S607 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S608, it is determined whether the return field is in the request data of the plain text log.

In the embodiment of the present disclosure, the implementation method of step S608 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S609, if the return field is in the request data, judging whether the request data comprises the key value of the return field.

In the embodiment of the present disclosure, the implementation method of step S609 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

And S610, when the key value of the return field is included in the request data, determining that the module corresponding to the plaintext log is the source module of the return field.

In the embodiment of the present disclosure, the implementation method of step S610 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S611, if the return field does not exist in the request data, the first similarity between the return field and the request data is obtained.

In the embodiment of the present disclosure, the implementation method of step S611 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described in detail.

And S612, determining the module corresponding to the plaintext log as the source module of the return field when the first similarity meets a first set condition.

In the embodiment of the present disclosure, the implementation method of step S612 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not repeated herein

And S613, judging whether the return field is in the return data corresponding to the second downstream module or not when the key value of the return field is not included in the request data or the first similarity does not meet the first setting condition.

In the embodiment of the present disclosure, the implementation method of step S613 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described in detail.

S614, if the return field is in the return data, it is determined whether the return data includes the key value of the return field.

In the embodiment of the present disclosure, the implementation method of step S614 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S615, determining that the second downstream module is the source module of the return field in response to the return data including the key value of the return field.

In the embodiment of the present disclosure, the implementation method of step S615 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

S616, if the return field does not exist in the return data, the second similarity between the return field and the return data is obtained.

In the embodiment of the present disclosure, the implementation method of step S616 may be implemented in any manner of each embodiment of the present disclosure, which is not limited herein, and is not repeated herein.

S617, determining that the second downstream module is the source module of the return field in response to the second similarity satisfying the second set condition.

In the embodiment of the present disclosure, the implementation method of step S617 may be implemented in any manner in each embodiment of the present disclosure, which is not limited herein, and is not described herein again.

And S618, determining the return field as a special processing field in the module corresponding to the plaintext log in response to the return data not including the key value of the return field or the second similarity not meeting the second set condition.

In some implementations, if the return data does not include the key value of the return field, it may be determined that the second downstream module corresponding to the return data is not the source module of the return field, or if the second similarity does not satisfy the second setting condition, it is determined that the second downstream module corresponding to the return data is not the source module of the return field.

That is, after traversing all the second downstream modules of the corresponding modules of the plaintext log, if none of the second downstream modules is the source module of the return field, the return field is determined to be a special processing field of the corresponding module of the plaintext log, and the special processing field may be generated by a code of the module of the plaintext log.

S619, if any return field is abnormal, positioning an abnormal module according to the source module of any return field.

It can be understood that when any return field has an exception, the source module of the return field can be determined according to the field tracing diagram, so that the source module can be positioned as an exception module, and the investigation on the field exception is more efficient and accurate.

In the embodiment of the disclosure, the plaintext logs are acquired in multiple ways, the plaintext log acquisition efficiency is improved, each module is traversed, the upstream and downstream relation of the module is determined according to the first service identification, the source module of the return field is further determined according to the upstream and downstream relation, when the source module of the return field is determined, the source module of any return field is determined through judgment of multiple aspects of conditions, the accuracy of source module determination is ensured, a more reliable basis is provided for source investigation of subsequent abnormal fields, the specific abnormal module is determined according to quick positioning of the abnormal return field to the corresponding source module, the investigation cost is reduced, the problem that no complete plaintext log analysis is present is solved, and the abnormal investigation effect is better.

Fig. 7 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present disclosure, and as shown in fig. 7, the apparatus 700 includes:

The first obtaining module 701 is configured to obtain a plaintext log of each module in the server;

a second obtaining module 702, configured to obtain a link topology map between the modules based on the plaintext log; the nodes of the link topological graph are modules, and edges between the nodes indicate upstream and downstream relations between the nodes;

a third obtaining module 703, configured to determine a source module of the return field in the plaintext log according to the link topology map.

In some implementations, after the third acquisition module 703, further includes:

if any return field is abnormal, positioning an abnormal module according to the source module of any return field.

In some implementations, the second acquisition module 702 includes:

traversing the modules in the server by taking any module as a starting point;

acquiring a first service identifier of a request downstream log in a plaintext log corresponding to a current traversal module;

positioning to a first downstream module according to the first service identifier, and marking the first downstream module as a downstream module of the current traversal module;

and determining a link topological graph between the modules according to the downstream modules corresponding to the modules.

In some implementations, the plaintext log includes the requested data, and the second acquisition module 702 includes:

Determining one or more second downstream modules of the modules corresponding to the plaintext logs according to the link topology graph;

determining a module corresponding to the request data;

and determining a source module of the return field from the second downstream module and the module corresponding to the request data.

In some implementations, the second acquisition module 702 includes:

judging whether the return field is in the request data of the plaintext log or not;

if the return field is in the request data, judging whether the request data comprises a key value of the return field;

when the request data comprises the key value of the return field, determining that the module corresponding to the plaintext log is the source module of the return field;

in response to not including the key value of the return field in the request data, a source module of the return field is determined from the second downstream module.

In some implementations, the apparatus 700 further includes:

if the return field does not exist in the request data, acquiring a first similarity between the return field and the request data;

when the first similarity meets a first setting condition, determining a module corresponding to the plaintext log as a source module of a return field;

and determining a source module of the return field from the second downstream module in response to the first similarity not meeting the first set condition.

In some implementations, the plaintext log includes return data, and the apparatus 700 includes:

for any second downstream module, judging whether the return field is in the return data corresponding to the second downstream module;

if the return field is in the return data, judging whether the return data comprises a key value of the return field or not;

determining that the second downstream module is a source module of the return field in response to the return data including the key value of the return field;

in response to the return data not including the key value of the return field, the return field is determined to be a special handling field in the module corresponding to the plaintext log.

In some implementations, the apparatus 700 further includes:

if the return field does not exist in the return data, acquiring the second similarity between the return field and the return data;

determining that the second downstream module is the source module of the return field in response to the second similarity satisfying a second set condition;

and determining the return field as a special processing field in the module corresponding to the plaintext log in response to the second degree of similarity not satisfying the second set condition.

In some implementations, the second acquisition module 702 includes:

acquiring a first keyword;

carrying out first keyword recognition on the plaintext log; taking a plaintext log comprising the first keyword as a target plaintext log;

And acquiring a link topological graph between the modules based on the target plaintext log.

In some implementations, the second acquisition module 703 includes:

acquiring a log white list;

determining a target plaintext log in the plaintext logs according to the log white list;

In some implementations, the second acquisition module 702 includes:

acquiring a unique identifier corresponding to a target plaintext log;

determining a first module which has interaction with a module corresponding to the target plaintext log according to the request data and the return data in the target plaintext log;

according to the unique identification, associating the target plaintext log with a first target plaintext log corresponding to the first module;

and acquiring a link topological graph between the modules based on the associated target plaintext log.

In some implementations, the first acquisition module 701 includes:

acquiring a plaintext log of each module of a server according to a general log software development kit; or,

and acquiring a plaintext log of each module of the server according to the preset middleware.

In the embodiment of the disclosure, the plaintext logs corresponding to all modules of the server are obtained, and a more accurate basis is provided for subsequent exception checking based on the plaintext logs; according to the method, the link topology diagram among the modules is determined according to the plaintext logs corresponding to the modules, the upstream and downstream relation among the modules is determined intuitively, the source modules of the return fields are determined based on the link topology diagram among the modules, the specific abnormal modules can be determined according to the quick positioning of the abnormal return fields to the corresponding source modules in the abnormal investigation, the investigation cost is reduced, the problem that no complete plaintext log analysis exists at present is solved, and the abnormal investigation effect is better.

In the technical scheme of the disclosure, the acquisition, storage, application and the like of the related user personal information all conform to the regulations of related laws and regulations, and the public sequence is not violated.

According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

Fig. 8 illustrates a schematic block diagram of an example electronic device 800 that may be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the disclosure described and/or claimed herein.

As shown in fig. 8, the apparatus 800 includes a computing unit 801 that can perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM) 802 or a computer program loaded from a storage unit 808 into a Random Access Memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other by a bus 804. An input/output (I/O) interface 805 is also connected to the bus 804.

Various components in device 800 are connected to I/O interface 805, including: an input unit 806 such as a keyboard, mouse, etc.; an output unit 807 such as various types of displays, speakers, and the like; a storage unit 808, such as a magnetic disk, optical disk, etc.; and a communication unit 809, such as a network card, modem, wireless communication transceiver, or the like. The communication unit 809 allows the device 800 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

The computing unit 801 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of computing unit 801 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the respective methods and processes described above, for example, an information processing method. For example, in some embodiments, the information processing method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program may be loaded and/or installed onto device 800 via ROM 802 and/or communication unit 809. When a computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the information processing method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform the information processing method by any other suitable means (e.g., by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus such that the program code, when executed by the processor or controller, causes the functions/operations specified in the flowchart and/or block diagram to be implemented. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the internet.

The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server may be a cloud server, a server of a distributed system, or a server incorporating a blockchain.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps recited in the present disclosure may be performed in parallel, sequentially, or in a different order, provided that the desired results of the disclosed aspects are achieved, and are not limited herein.

The above detailed description should not be taken as limiting the scope of the present disclosure. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present disclosure are intended to be included within the scope of the present disclosure.

Claims

1. An information processing method, wherein the method comprises:

acquiring a plaintext log of each module in a server;

acquiring a link topology diagram between the modules based on the plaintext log; the nodes of the link topological graph are modules, and edges between the nodes indicate upstream and downstream relations between the nodes;

and determining a source module of a return field in the plaintext log according to the link topology diagram.

2. The method of claim 1, wherein the determining the source module of the return field in the plaintext log according to the link topology map further comprises:

3. The method of claim 1, wherein the obtaining a link topology graph between the modules based on the plaintext log comprises:

traversing the modules in the server by taking any module as a starting point;

4. The method of claim 3, wherein the plaintext log includes request data, the determining a source module for a return field in the plaintext log based on the link topology map, comprising:

Determining a module corresponding to the request data;

5. The method of claim 4, wherein the determining the source module of the return field from the second downstream module and the module corresponding to the request data comprises:

if the return field is in the request data, judging whether the request data comprises a key value of the return field or not;

when the key value of the return field is included in the request data, determining that a module corresponding to the plaintext log is a source module of the return field;

and determining a source module of the return field from the second downstream module in response to the key value of the return field not being included in the request data.

6. The method of claim 5, wherein the method further comprises:

determining a module corresponding to the plaintext log as a source module of the return field when the first similarity meets the first set condition;

And determining a source module of the return field from the second downstream module in response to the first similarity not meeting a first set condition.

7. The method of claim 6, wherein the plaintext log comprises return data, the determining a source module of the return field from the second downstream module comprising:

and determining the return field as a special processing field in a module corresponding to the plaintext log in response to the return data not including a key value for the return field.

8. The method of claim 7, wherein the method further comprises:

if the return field does not exist in the return data, acquiring a second similarity between the return field and the return data;

Determining that the second downstream module is the source module of the return field in response to the second similarity meeting a second set condition;

and determining the return field as a special processing field in a module corresponding to the plaintext log in response to the second similarity not satisfying the second set condition.

9. The method of any of claims 1-8, wherein prior to the obtaining a link topology graph between the modules based on the plaintext log, comprising:

acquiring a first keyword;

performing the first keyword recognition on the plaintext log; taking the plaintext log comprising the first keyword as a target plaintext log;

10. The method of any of claims 1-8, wherein prior to the obtaining a link topology graph between the modules based on the plaintext log, comprising:

acquiring a log white list;

11. The method of claim 9 or 10, wherein the obtaining a link topology graph between the modules based on the plaintext log comprises:

Acquiring a unique identifier corresponding to the target plaintext log;

according to the unique identification, the target plaintext log is associated with a first target plaintext log corresponding to the first module;

12. The method of claim 11, wherein the obtaining a plaintext log of each module at a server comprises:

13. An information processing apparatus comprising:

the first acquisition module is used for acquiring the plaintext logs of each module in the server;

the second acquisition module is used for acquiring a link topological graph between the modules based on the plaintext log; the nodes of the link topological graph are modules, and edges between the nodes indicate upstream and downstream relations between the nodes;

and the third acquisition module is used for determining a source module of a return field in the plaintext log according to the link topological graph.

14. The apparatus of claim 13, wherein the third acquisition module is followed by:

15. The apparatus of claim 13, wherein the second acquisition module comprises:

traversing the modules in the server by taking any module as a starting point;

16. The apparatus of claim 15, wherein the plaintext log comprises requested data, the second acquisition module comprising:

determining a module corresponding to the request data;

17. The apparatus of claim 16, wherein the second acquisition module comprises:

18. The apparatus of claim 17, wherein the apparatus further comprises:

19. The apparatus of claim 18, wherein the plaintext log comprises return data, the apparatus comprising:

20. The apparatus of claim 19, wherein the apparatus further comprises:

21. The apparatus of any of claims 13-20, wherein the second acquisition module comprises:

acquiring a first keyword;

22. The apparatus of any of claims 13-20, wherein the second acquisition module comprises:

acquiring a log white list;

23. The apparatus of claim 21 or 22, wherein the second acquisition module comprises:

acquiring a unique identifier corresponding to the target plaintext log;

24. The apparatus method of claim 23, wherein the first acquisition module comprises:

25. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-12.

26. A non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of any one of claims 1-12.

27. A computer program product comprising a computer program which, when executed by a processor, implements the steps of the method according to any of claims 1-12.