KR101997777B1 - Apparatus of detecting abnormality and operating method of the same - Google Patents

Abstract

Disclosed is an abnormality sensing apparatus. One embodiment of the present invention determines the present or absence of an abnormality on a game server based on at least one of performance index data of the game server and resource data of the game server and provides notification based on a determined result. Accordingly, the present invention is possible to improve work efficiency and accessibility.

Description

Technical Field [0001] The present invention relates to an abnormality sensing apparatus and an operation method thereof,

The following embodiments relate to anomaly detection.

Previously, when performance tests were performed before game opening, people manually monitored until the issue was brought out. In other words, it is difficult to detect whether an abnormality or a problem occurs in the performance unless the manager or the person in charge monitors it directly during the performance test before the game is opened. Also, after the performance test is finished, the person manually creates a report on the performance test.

Korean Patent Registration No. 10-1881804 entitled " Game Test Automation Device and Method, Applicant: Net Marble Inc. " The disclosed patent publication includes a database for storing test procedure information, which is a combination of game scripts to be tested in the game service, and a test program for testing the game build of the game service based on the test procedure information, And a test execution unit for generating game status information derived from a test execution process and a test report for the test.

The method comprising: determining whether the game server is abnormal based on at least one of performance indicator data of the game server and resource data of the game server; And performing a notification based on the determination result.

The performance indicator data includes a result of the game server operating based on a load applied for testing the game server, and the resource data includes a resource usage amount of the game server.

The method of operation of the anomaly detection device may further include receiving the performance indicator data and the resource data from a data pipeline.

The determining may include analyzing a correlation between the performance indicator data and the resource data to determine whether the abnormality is present.

The operation method of the abnormality sensing apparatus may further include generating a report for the test when the test is completed.

The generating of the report may include analyzing a log belonging to at least one of the performance indicator data and the resource data; And generating the report including a text representing the analysis result of the log in a natural language.

The generating of the report may include analyzing a log belonging to at least one of the performance indicator data and the resource data; Analyzing errors that occurred during the test; Analyzing resource usage of the game server at the time of occurrence of the error; And generating the report based on an analysis result of the log, an analysis result of the error, and an analysis result of the resource usage amount.

The method of operating the anomaly detection device may further include transmitting the generated report to a user's mail account.

The abnormality sensing device according to one side determines whether or not there is an abnormality in the game server based on at least one of the performance index data of the game server and the resource data of the game server, .

The performance indicator data includes a result of the game server operating based on a load applied for testing the game server, and the resource data includes a resource usage amount of the game server.

The controller may receive the performance indicator data and the resource data from a data pipeline.

The controller may analyze the correlation between the performance indicator data and the resource data to determine whether the abnormality is present.

The controller may generate a report for the test when the test is complete.

The controller may analyze the log belonging to at least one of the performance index data and the resource data and generate the report including the text representing the analysis result of the log in a natural language.

Wherein the controller analyzes the log belonging to at least one of the performance indicator data and the resource data, analyzes errors occurred during the test, analyzes the resource usage of the game server at the occurrence time of the error, As a result of the analysis, the report can be generated based on the analysis result of the error and the analysis result of the resource usage amount.

The controller can transmit the generated report to the user's mail account.

Embodiments can automatically transmit a notification to a manager or a person in charge when an abnormality or a problem occurs in a game server during a performance test of the game server, so that an abnormality or a problem can be solved within a short time and the work efficiency can be improved .

In addition, the embodiments can automatically generate a report on the performance test through data analysis, thereby improving work efficiency.

Further, the embodiments can implement the load tool in the Klaus system, and the accessibility can be improved.

1 is a flowchart illustrating a sensing system including an anomaly detection device according to an embodiment.
2 to 3 are diagrams for explaining abnormality detection and notification of the abnormality sensing apparatus according to an embodiment.
FIGS. 4 to 5 are diagrams for explaining report generation by the anomaly detection apparatus according to an embodiment.
6 to 7 are views for explaining a chatbot of the anomaly detection apparatus according to an embodiment.
8 is a flowchart illustrating an operation method of an anomaly detection apparatus according to an embodiment of the present invention.
9 is a block diagram for explaining an anomaly detection apparatus according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

Various modifications may be made to the embodiments described below. It is to be understood that the embodiments described below are not intended to limit the embodiments, but include all modifications, equivalents, and alternatives to them.

The terms used in the examples are used only to illustrate specific embodiments and are not intended to limit the embodiments. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this embodiment belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as ideal or overly formal in the sense of the art unless explicitly defined herein Do not.

In the following description of the present invention with reference to the accompanying drawings, the same components are denoted by the same reference numerals regardless of the reference numerals, and redundant explanations thereof will be omitted. In the following description of the embodiments, a detailed description of related arts will be omitted if it is determined that the gist of the embodiments may be unnecessarily blurred.

1 is a flowchart illustrating a sensing system including an anomaly detection device according to an embodiment.

1, a sensing system 100 according to one embodiment includes a plurality of load agents 110-1 through 110-n, a game server 120, a data pipeline (e.g., 130, an anomaly detection device 140, and a push server 150.

The load agents 110-1 through 110-n may be implemented by one or more physical devices (e.g., a computer).

The load agents 110-1 to 110-n provide a load to the game server 120. [ In other words, the load agents 110-1 through 110-n may test the performance of the game server 120. [ In one example, each of the load agents 110-1 through 110-n may generate a virtual user based on a script including the scenario, and may provide a load to the game server 120 based on the virtual user . As a more specific example, the virtual user of the load agent 110-1 may attempt to purchase items in the game in the game corresponding to the test object, and the virtual user of the load agent 110-2 may hunt in the game And the virtual user of the load agent 110-n can perform the quest in the game. At this time, the above-mentioned item purchase attempt, hunting performance, and quest performance may be a load on the game server 120.

The game server 120 transmits the performance indicator data corresponding to the load of each of the load agents 110-1 to 110-n to each of the load agents 110-1 to 110-n. In other words, each of the load agents 110-1 to 110-n may collect performance indicator data corresponding to the load applied to the game server 120 by itself. The performance indicator data may include, but is not limited to, at least one of, for example, transaction per second (TPS) and response time.

Each of the load agents 110-1 through 110-n transmits performance indicator data to the data pipeline 130. [ In other words, the data pipeline 130 receives the performance indicator data into each of the load agents 110-1 through 110-n.

The data pipeline 130 receives resource data from the game server 120. The resource data may include, but is not limited to, for example, at least one of CPU usage, memory usage, and log data (e.g., game engine / database log data).

The data pipeline 130 can visualize the performance test of the game server 120 for the tester to monitor.

The data pipeline 130 may also send performance indicator data and resource data to the anomaly detection device 140.

The anomaly detection device 140 determines whether there is an abnormality in the game server 120 based on at least one of the performance indicator data and the resource data. If the anomaly detection device 140 determines that the game server 120 is abnormal, it performs notification. For example, when the abnormality detection device 140 determines that the game server 120 is abnormal, the abnormality detection device 140 transmits a message indicating that there is an error to the administrator account or the mail account of the person in charge through the push server 150, A message indicating that there is an error can be transmitted.

When the performance test of the game server 120 is terminated, the anomaly detection device 140 may be requested to analyze data from an administrator or a person in charge. In this case, the anomaly detection device 140 can generate a report and transmit the report to the mail analyzer's mail account. Report generation will be described later.

In an embodiment, the anomaly detection device 140 may correspond to a Gaussian mixture model (GMM) model or a linear regression model, but is not limited thereto.

In an embodiment, the anomaly detection device 140 can be compatible with Unity (photon Cloud), Unreal (dedicated Server), Nosql, RDB, general game server, and Proud Net, and can have versatility and expandability.

In the past, it is difficult to detect whether an error or a problem occurs in the game server 120 unless the administrator or the person in charge monitors the performance of the game server 120 during the performance test. However, according to one embodiment, when an error or a problem occurs in the game server 120 during the performance test of the game server 120, a notification may be automatically sent to the manager or the person in charge, Can be solved and work efficiency can be improved.

In addition, when the performance test of the game server 120 is completed, an administrator or a person in charge has to prepare a report about the performance test. However, according to one embodiment, a report on the performance test can be automatically generated through data analysis, so that server verification can be performed quickly and work efficiency can be further improved.

Further, according to one embodiment, the load tool can be implemented in the Claus system, and accessibility can be improved.

2 to 3 are diagrams for explaining abnormality detection and notification of the abnormality sensing apparatus according to an embodiment.

Referring to FIG. 2, an anomaly detection apparatus 140 according to an embodiment receives data from a data pipeline 130. Data input to the abnormality sensing apparatus 140, that is, input data may include the above-described performance indicator data and resource data. For example, input data includes CPU usage, input / output operations per second (IOPS), memory usage, network bandwidth, TSP, response time, Vuser status count, game server active connection, game action log, and PVP matching time, or any combination thereof.

In the embodiment, the anomaly detection device 140 determines whether an error has occurred in the game server 120 based on the input data.

For example, the abnormality sensing device 140 may analyze the resource data of the game server 120 to determine whether an abnormality has occurred in the game server 120. 3, the abnormality sensing apparatus 140 applies a linear regression to various data 320-1 to 320-6 of the CPU usage amount y according to the memory usage x1 to determine a prediction function 310 can be derived. If the data 330-1 and the data 330-2 are out of a certain level in the prediction function 310, the abnormality sensing apparatus 140 may determine that an error has occurred in the game server 120. [ In other words, when the distance between the prediction function 310 and the data 330-1 is equal to or greater than threshold and the distance between the prediction function 310 and the data 330-2 is equal to or greater than threshold, It can be determined that an error has occurred in the game server 120. Here, the threshold may be corrected or adjusted by the abnormality sensing device 140. Depending on the implementation, the resource data may further include variables such as IOPS (x2), network bandwidth (x3), and the like. In this case, a multiple linear regression model can be applied. The anomaly detection device 140 may analyze the combination of variables (for example, x1 / x2), and may determine whether an error has occurred in the game server 120 based on the analysis result.

In another example, the abnormality sensing device 140 may analyze the correlation between the performance indicator data and the resource data to determine whether or not an abnormality has occurred in the game server 120. [ For example, the abnormality sensing apparatus 140 can determine the CPU usage amount and the TPS of a specific time zone, and determine that an abnormality has occurred in the game server 120 when the correlation between the CPU usage amount and the TPS in a specific time zone is not close to normal have.

The anomaly detection unit 140 notifies the game server 120 of an abnormality. In one example, the abnormality sensing device 140 can notify the manager or the person in charge through the push server 150 of the result of "abnormal ".

According to an embodiment, when an error or a problem occurs in the game server 120 during the performance test of the game server 120, a notification can be automatically sent to the manager or the person in charge, And work efficiency can be improved.

FIGS. 4 to 5 are diagrams for explaining report generation by the anomaly detection apparatus according to an embodiment.

4, the anomaly detection apparatus 140 includes a classifier 410, a log analyzer 420, an error analyzer 430, a resource analyzer 440, and a report generator 450.

When the performance test of the game server 120 is terminated, the anomaly detection device 140 may be requested to generate a report for the performance test from the administrator or the person in charge. In this case, the anomaly detection device 140 can generate a report using the result of analyzing the data of each analyzer. Here, the data includes, for example, CPU usage, IOPS, memory usage, network bandwidth, TSP, response time, log data, error count, error classification, game action log, PVP matching time, And game balance data, or a combination thereof. However, the present invention is not limited thereto. Report generation will be described in detail.

The classifier 410 can receive log data. The log data may include a user custom log (e.g., virtual user log, server log, etc.). For example, the log data may include, but is not limited to, a virtual user's game login log, a virtual user's hunting log, a virtual user's store item purchase log, and the like.

The classifier 410 performs classification (e.g., text classification) on the log data. For example, when the log of the hunting of the virtual user is input, the classifier 410 can classify the log as "hunting" through text classification, and when receiving the shop item purchase log of the virtual user, You can classify this log as "store".

The log analyzer 420 may analyze the categorized log and may pass the analysis results to the report generator 450. For example, the log analyzer 420 may analyze the log categorized as "store" and pass the analysis result of "the virtual user has attempted to purchase items at the store" to the report generator 450.

In an embodiment, an error may occur during the performance test, and if the performance test is terminated, the error analyzer 430 may analyze the error. For example, during a performance test, when a virtual user attempts to purchase items from a store but a purchase failure occurs, the error analyzer 430 may analyze the error by tracing the stack area.

The error analyzer 430 may forward the error analysis result to the report generator 450. [

The resource analyzer 440 may analyze the resource data. For example, the resource analyzer 440 may analyze CPU usage, memory usage, and the like at the time of occurrence of an error during the performance test. The resource analyzer 440 may communicate the analysis results to the report generator 450.

The report generator 450 may generate a report based on at least one of an analysis result of the log analyzer 420, an analysis result of the error analyzer 430, and an analysis result of the resource analyzer 440. The report generator 450 may generate a report containing text representing the combination of analysis results of each of the analyzers 420 to 440 in natural language. An example of the generated report is shown in Fig.

Referring to FIG. 5, the report includes a text 510 representing a combination of analysis results of each of the analyzers 420 to 440 in a natural language. In the past, when the performance test of the game server 120 is completed, an administrator or a person in charge directly creates a report for the performance test. However, according to one embodiment, A server verification can be performed quickly, and work efficiency can be further improved.

6 to 7 are views for explaining a chatbot of the anomaly detection apparatus according to an embodiment.

Referring to FIG. 6, the anomaly detection device 610 may have a report chatting function. More specifically, the anomaly detection device 610 may receive 610 a query for a report from a user terminal (e.g., a PC, a mobile terminal, etc.). In other words, the user can inquire the abnormality sensing device 610 for the report. For example, the user may select the result inquiry button 520 of the report shown in FIG. 5 to inquire the abnormality sensing device 610 for the report.

The anomaly detection device 610 may analyze the report 620 if the user is inquired, and may transmit the response to the user terminal 630.

7 shows an example of a chat window by report chatbot.

When the user selects the result inquiry button 520 of the report shown in Fig. 5, the dialog window 700 including the message 710 can be displayed on the display of the user terminal.

When the user inputs a message 720 to the user terminal, the user terminal may send the message 720 to the anomaly detection device 610. [

The anomaly detection device 610 may analyze the message 720 to determine which query the user has on the report, analyze the report, and send the message 730 to the user terminal.

8 is a flowchart illustrating an operation method of an anomaly detection apparatus according to an embodiment of the present invention.

8, the anomaly detection device 140 determines whether there is an error in the game server 120 based on at least one of the performance index data of the game server 120 and the resource data of the game server 120 (810). Here, the performance indicator data may include a result (e.g., TPS, response time, etc.) that the game server 120 operates based on the load applied for the test of the game server 120, And may include the resource usage of the server 120.

The anomaly detection unit 140 performs notification based on the determination result of step 810 (820). For example, when the anomaly detection device 140 analyzes at least one of the performance indicator data and the resource data during the performance test of the game server 120 and determines that an error has occurred in the game server 120, To the manager or the person in charge.

In an embodiment, the anomaly detection device 140 may generate a report for the test when the test is completed. For example, the anomaly detection apparatus 140 may analyze a log belonging to at least one of the performance index data and the resource data, and may generate a report including a text representing a result of analysis of the log in a natural language. Depending on the embodiment, an error may occur during the test. In this case, the anomaly detection device 140 can analyze the log belonging to at least one of the performance indicator data and the resource data, analyze the error occurred during the test, You can analyze resource usage. The anomaly detection device 140 can generate a report based on the analysis result of the log, the analysis result of the error, and the analysis result of the resource usage amount.

The anomaly detection device 140 can transmit the generated report to the user's mail account. Here, the user may correspond to the above-mentioned manager or person in charge.

1 through 7 can be applied to the matters described with reference to FIG. 8, detailed description thereof will be omitted.

9 is a block diagram for explaining an anomaly detection apparatus according to an embodiment.

Referring to FIG. 9, the anomaly detection apparatus 140 includes a communication unit 910 and a controller 920.

The communication unit 910 allows the anomaly detection device 140 to be connected to the push server 150 and the data pipeline 130 in a wired or wireless manner.

The controller 920 performs the overall operation of the abnormality sensing device 140. [ More specifically, the controller 920 determines whether there is an abnormality in the game server 120 based on at least one of the performance index data of the game server 120 and the resource data of the game server 120, Performs notifications as a basis.

1 through 8 can be applied to the matters described with reference to FIG. 9, so that a detailed description will be omitted.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (14)

Determining whether there is an error in the game server based on at least one of performance indicator data of the game server and resource data of the game server; And
Performing a notification based on the determination result
Lt; / RTI >
Wherein the performance indicator data includes a result that the game server operates based on a load applied for testing the game server, the resource data includes a resource usage amount of the game server,
Wherein the determining comprises analyzing a correlation between the performance indicator data and the resource data to determine whether the abnormality is present.
A method of operating an anomaly detection device.
The method according to claim 1,
Receiving the performance indicator data and the resource data from a data pipeline
≪ / RTI >
A method of operating an anomaly detection device.
delete The method according to claim 1,
If the test is completed, generating a report for the test
≪ / RTI >
A method of operating an anomaly detection device.
5. The method of claim 4,
Wherein generating the report comprises:
Analyzing a log belonging to at least one of the performance indicator data and the resource data; And
Generating the report including the text representing the analysis result of the log in a natural language
/ RTI >
A method of operating an anomaly detection device.
5. The method of claim 4,
Wherein generating the report comprises:
Analyzing a log belonging to at least one of the performance indicator data and the resource data;
Analyzing errors that occurred during the test;
Analyzing resource usage of the game server at the time of occurrence of the error; And
Generating the report based on an analysis result of the log, an analysis result of the error, and an analysis result of the resource usage amount
/ RTI >
A method of operating an anomaly detection device.
5. The method of claim 4,
Transmitting the generated report to the user's mail account
≪ / RTI >
A method of operating an anomaly detection device.
Determining whether there is an abnormality in the game server based on at least one of the performance index data of the game server and the resource data of the game server and analyzing a correlation between the performance indicator data and the resource data, A controller for determining whether to make a decision based on the determination result,
Lt; / RTI >
Wherein the performance indicator data includes a result that the game server operates based on a load applied for testing the game server, and the resource data includes a resource usage amount of the game server,
Abnormality sensing device.
9. The method of claim 8,
The controller receiving the performance indicator data and the resource data from a data pipeline,
Abnormality sensing device.
delete 9. The method of claim 8,
Wherein the controller generates a report for the test when the test is completed,
Abnormality sensing device.
12. The method of claim 11,
The controller comprising:
Analyzing a log belonging to at least one of the performance index data and the resource data, and generating the report including a text expressed as a natural language analysis result of the log,
Abnormality sensing device.
12. The method of claim 11,
The controller comprising:
Analyzing a log belonging to at least one of the performance indicator data and the resource data, analyzing an error occurred during the test, analyzing a resource usage amount of the game server at the occurrence time of the error, And generating the report based on the analysis result of the error and the analysis result of the resource usage amount,
Abnormality sensing device.
12. The method of claim 11,
The controller sends the generated report to the user's mail account,
Abnormality sensing device.

Images