WO2020119627A1 - 应用于分布式容器云平台的异常检测与定位方法及装置 - Google Patents

应用于分布式容器云平台的异常检测与定位方法及装置 Download PDF

Info

Publication number
WO2020119627A1
WO2020119627A1 PCT/CN2019/123989 CN2019123989W WO2020119627A1 WO 2020119627 A1 WO2020119627 A1 WO 2020119627A1 CN 2019123989 W CN2019123989 W CN 2019123989W WO 2020119627 A1 WO2020119627 A1 WO 2020119627A1
Authority
WO
WIPO (PCT)
Prior art keywords
component
abnormal
container
delay information
status
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/123989
Other languages
English (en)
French (fr)
Inventor
叶可江
卢澄志
须成忠
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Institute of Advanced Technology of CAS
Original Assignee
Shenzhen Institute of Advanced Technology of CAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Institute of Advanced Technology of CAS filed Critical Shenzhen Institute of Advanced Technology of CAS
Publication of WO2020119627A1 publication Critical patent/WO2020119627A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/22—Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines

Definitions

  • the invention relates to the field of container cloud platforms, and in particular to an abnormality detection and positioning method and device applied to a distributed container cloud platform.
  • Cloud computing as a new type of service delivery method has won the favor of industry and academia.
  • the key technology of cloud computing is virtualization technology.
  • virtualization technology By virtualizing all kinds of resources, cloud computing service providers can easily customize and deliver all kinds of resources to users, and many applications have gradually begun to migrate to cloud computing clusters.
  • Traditional virtualization technologies include KVM, Xen, etc.
  • Container technology is a lightweight operating system-level virtualization technology. Compared with the traditional virtualization technology for the virtualization of the hardware layer, container virtualization stays at the operating system layer, making it very convenient to create, modify, or migrate.
  • Container technology is quickly used by various cloud computing service providers. Due to these characteristics of containers, users often run each component in an independent container when deploying their applications, so as to conveniently and quickly maintain applications, which results in a complicated internal structure of the container cloud. At the same time, the characteristics of the weak isolation of the containers also lead to serious interference between the containers. Once an abnormality occurs in a container, the abnormality will quickly spread. In turn, it affects different application components. Cloud service providers need a method that can abnormally locate the application clusters with complex structures established by containers.
  • an application deployed on a container cloud is often composed of hundreds or thousands of components, and components depend on each other to form a complex graph with components as nodes. Utilizing the relevant knowledge of graph theory can locate the root cause of anomalies from this complex graph. That is, a cloud computing platform based on container technology is usually composed of thousands of physical machines, and each physical machine usually runs dozens of containers. Therefore, a cloud computing platform based on container technology is more complicated than a traditional cloud computing platform. Compared with traditional virtual machines, container isolation is worse, and the interference between containers is more serious. Therefore, compared to traditional virtual machines, containers are also more likely to affect each other.
  • Nguyen et al. in Chapter 3 of "Insight: in-situ online service failure path inference production in computing infrastructures” proposed an online black box abnormal location system to locate abnormal components.
  • the system uses the virtual machine performance index to construct a normal fluctuation model of the performance index, to determine abnormally changing data points, and to locate abnormal components by combining the time information of the changed data points and the dependencies between the components.
  • the system can detect and locate anomalies, because it uses performance indicators for anomaly detection and judgment, for complex distributed container cloud platforms, the overhead of monitoring performance indicators will be huge.
  • the embodiments of the present invention provide an abnormality detection and positioning method and device applied to a distributed container cloud platform, to at least solve the technical problem that the traditional single-component-based abnormality detection method cannot be applied to a distributed container cloud.
  • an anomaly detection and location method applied to a distributed container cloud platform including the following steps:
  • the TCP delay information of each container component is analyzed to obtain the status information of each component and generate component status information key-value pairs;
  • TCP delay information of each container component is analyzed through sliding window accumulation and anomaly detection algorithms to obtain status information of each component and generate component status information key-value pairs including:
  • the component abnormal subgraph constructed by the component state information key value pair includes:
  • the independent component node is a component node that does not depend on other component nodes and does not depend on any other component node. Delete this type of component node to construct a component abnormal subgraph G' .
  • locating the container component node where the abnormality occurs according to the component abnormality subgraph includes:
  • the method further includes:
  • obtaining TCP delay information of each container component includes:
  • an anomaly detection and positioning device applied to a distributed container cloud platform including:
  • the delay information obtaining unit is used to obtain TCP delay information of each container component
  • the state information acquisition unit is used to analyze the TCP delay information of each container component through the sliding window accumulation and anomaly detection algorithm, obtain the state information of each component and generate component state information key value pairs;
  • Component abnormal subgraph construction unit which is used to construct component abnormal subgraph through key value pairs of component state information
  • the abnormal location unit is used to locate the container component node where the abnormality occurs according to the component abnormal subgraph.
  • the device further includes:
  • the abnormality determination unit is used to determine whether the MIDs of the abnormal root nodes are the same. If they are the same, it is determined that the physical machine whose number is MID has an abnormality.
  • a storage medium stores a program file capable of implementing any of the above methods for anomaly detection and positioning applied to a distributed container cloud platform.
  • a processor is used to run a program, wherein, when the program is running, any one of the foregoing abnormality detection and positioning methods applied to a distributed container cloud platform is executed.
  • the abnormality detection and positioning method and device applied to the distributed container cloud platform in the embodiments of the present invention use TCP delay information for abnormal state judgment, reduce the overhead of data collection, and improve the accuracy and real-time nature of abnormal state judgment.
  • a component anomaly subgraph is proposed to represent the propagation of the abnormal state, which improves the accuracy of abnormal location.
  • FIG. 1 is a flowchart of an anomaly detection and positioning method applied to a distributed container cloud platform according to the present invention
  • FIG. 2 is a preferred flowchart of an anomaly detection and positioning method applied to a distributed container cloud platform according to the present invention
  • FIG. 3 is a block diagram of an anomaly detection and positioning device applied to a distributed container cloud platform according to the present invention
  • FIG. 4 is a preferred module diagram of an anomaly detection and location method applied to a distributed container cloud platform of the present invention.
  • container cloud the cloud computing system based on container technology
  • container cloud Due to the light weight of containers, the deployment of containers is more convenient. Therefore, the internal composition of the container cloud is more complicated than traditional cloud computing platforms.
  • the isolation of the system resources by the container is weaker than that of the virtual machine.
  • the interference between the containers is relatively strong. Therefore, once a container in the container cloud becomes abnormal, the exception It will spread quickly and affect the entire cluster.
  • the traditional single-component-based anomaly detection method is no longer suitable for distributed container cloud environments.
  • Existing technologies use performance indicators to analyze anomalies, which increases the cost of data collection. At the same time, a normal fluctuation model needs to be constructed. For frequent and complex container cloud platforms, the accuracy rate is low and lacks real-time.
  • the invention provides an abnormality detection and positioning method and device applied to a distributed container cloud platform for a container cloud platform.
  • the method and the device can perform abnormal location and detection on a more complicated distributed container cloud platform, and at the same time improve the accuracy rate of abnormal location through its component abnormal sub-graph.
  • an anomaly detection and positioning method applied to a distributed container cloud platform includes the following steps:
  • S102 Analyze the TCP delay information of each container component through a sliding window accumulation and anomaly detection algorithm, obtain status information of each component, and generate component status information key-value pairs;
  • S104 Locate the container component node where the abnormality occurs according to the component abnormality subgraph.
  • the method uses TCP delay information for abnormal state judgment, reduces the cost of data collection, and improves the accuracy and real-time nature of abnormal state judgment.
  • a component anomaly subgraph is proposed to represent the propagation of the abnormal state, which improves the accuracy of abnormal location.
  • the TCP delay information of each container component is analyzed by a sliding window accumulation and anomaly detection algorithm to obtain status information of each component and generate component status information key-value pairs including:
  • the component abnormal subgraph constructed by the key value pair of component state information includes:
  • the independent component node is a component node that does not depend on other component nodes and does not depend on any other component nodes, and delete such component nodes to construct a component abnormal subgraph G'.
  • locating the container component node where the abnormality occurs according to the component abnormality subgraph includes:
  • the method further includes:
  • S105 Determine whether the MIDs of the abnormal root nodes are the same. If they are the same, determine that the physical machine with the MID number is abnormal.
  • obtaining TCP delay information of each container component includes:
  • An abnormality detection and positioning method applied to a distributed container cloud platform includes the following steps:
  • the service management program submits an abnormal location request to the service agent program
  • the service agent After receiving the abnormal location request, the service agent uses software tcprstat to collect TCP delay information of the component.
  • the software tcprstat is a free and open source tcp layer analysis tool.
  • the response time of the statistical analysis request can be used for temporary analysis, and it can also be used for information collection at regular tasks;
  • the TCP delay information of the component collected by the service agent is analyzed to obtain the status information of the component and generate the component status information key value pair ⁇ CID:MID:Status>;
  • the service agent submits the component status information key-value pair ⁇ CID:MID:Status> to the service management program;
  • an anomaly detection and positioning device applied to a distributed container cloud platform including:
  • the delay information obtaining unit 201 is used to obtain TCP delay information of each container component
  • the state information obtaining unit 202 is configured to analyze the TCP delay information of each container component through a sliding window accumulation and anomaly detection algorithm, obtain the state information of each component and generate component state information key-value pairs;
  • the component abnormal subgraph construction unit 203 is configured to construct a component abnormal subgraph through key value pairs of component state information
  • the abnormal location unit 204 is configured to locate the container component node where the abnormality occurs according to the component abnormal subgraph.
  • the abnormality detection and positioning device of the distributed container cloud platform adopts TCP delay information for abnormal state judgment, reduces the cost of data collection, and improves the accuracy and real-time nature of abnormal state judgment.
  • a component anomaly subgraph is proposed to represent the propagation of the abnormal state, which improves the accuracy of abnormal location.
  • the device further includes:
  • the abnormality determination unit 205 is used to determine whether the MIDs of the abnormal root nodes are the same. If they are the same, it is determined that the physical machine with the MID number is abnormal.
  • a storage medium stores a program file capable of implementing any of the above methods for anomaly detection and positioning applied to a distributed container cloud platform.
  • a processor is used to run a program, wherein, when the program is running, any one of the foregoing abnormality detection and positioning methods applied to a distributed container cloud platform is executed.
  • the disclosed technical content may be implemented in other ways.
  • the system embodiments described above are only schematic.
  • the division of units may be a division of logical functions.
  • there may be another division manner for example, multiple units or components may be combined or integrated into Another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, units or modules, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above integrated unit may be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present invention essentially or part of the contribution to the existing technology or all or part of the technical solution can be embodied in the form of a software product, the computer software product is stored in a storage medium , Including several instructions to enable a computer device (which may be a personal computer, server, network device, etc.) to perform all or part of the steps of the methods of the various embodiments of the present invention.
  • the aforementioned storage media include: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Quality & Reliability (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种应用于分布式容器云平台的异常检测与定位方法及装置，该方法及装置先获取各容器组件的TCP延迟信息（S101）；通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对（S102）；通过组件状态信息键值对构造组件异常子图（S103）；将检测结果传输至后台服务器，并接受后台服务器计算得出的该检测结果相对应的病理风险及解决方案数据，并将该数据传输至用户的手机APP上或通过医疗站点进行显示输出（S104）。该方法及装置采用TCP延迟信息进行异常状态判断，降低了数据采集的开销，提高了异常状态判断的准确性与实时性。同时考虑到各组件之间，物理机与组件之间的干扰，提出了组件异常子图用以表示异常状态的传播，提高了异常定位的准确性。

Description

应用于分布式容器云平台的异常检测与定位方法及装置 技术领域
本发明涉及容器云平台领域，具体而言，涉及一种应用于分布式容器云平台的异常检测与定位方法及装置。
背景技术
云计算作为一种新型服务提供方式，获得了产业界和学术界的青睐。云计算的关键技术就是虚拟化技术，通过将各类资源进行虚拟化，云计算服务提供商能够很便捷的将各类资源进行定制交付给用户使用，众多应用也逐渐开始迁移到云计算集群内。传统的虚拟化技术包括KVM，Xen等。但是传统的虚拟化技术由于过于笨重，对于应用集群内某个组件进行创建，修改以及迁移操作都十分的复杂，因此云计算服务提供商需要更加轻量级的虚拟化技术。容器技术是一种轻量级的操作系统级的虚拟化技术。相较于传统的虚拟化技术对于硬件层的虚拟化，容器的虚拟化停留在操作系统层，使其无论是创建、修改还是迁移都十分的便捷。容器技术很快的被各类云计算服务提供商使用。由于容器的这些特点，用户在部署其应用的时候往往会将每个组件运行在独立的容器内，以便方便快捷的对应用进行维护，这造成了容器云复杂的内部结构。同时容器的弱隔离性的特点也导致了容器之间相互干扰较为严重。一旦某个容器出现了异常，异常将会迅速传播。进而影响到不同的应用组件。云服务提供商需要一种能够对通过容器建立的结构复杂的应用集群进行异常定位的方法。
通常而言，一个部署在容器云上的应用往往由成百上千的组件构成，而组件与组件之间相互依赖，构成了一张复杂的由组件作为节点的图。利用图论的相关知识能够从这个复杂的图中定位到异常发生的根源。即基于容器技术的云计算平台通常由上千台物理机组成，每台物理机上通常运行数十个容器，因而基于容器技术的云计算平台相较于传统的云计算平台更加复杂。相比于传统的 虚拟机，容器隔离性更差，容器与容器之间干扰更加严重。因而相比于传统虚拟机，容器也更容易相互影响。同时由于容器部署在运行状态下的操作系统上，因而物理机的异常也会引起部署在其上的容器发生异常。现有的异常检测定位方案缺少对于组件之间，组件与物理机之间关联性的分析，同时现有的异常检测定位方案利用性能指标数据进行异常检测与定位，带来极大的存储和传输开销，因而不能很好的适应干扰严重的分布式容器云平台环境。
Nguyen等人在《Insight:in-situ online service failure path inference in production computing infrastructures》的第三章提出在线黑盒异常定位系统定位异常组件。该系统利用虚拟机性能指标构造性能指标的正常波动模型，判断异常变化的数据点，同时结合发生变化的数据点的时间信息和组件之间的依赖关系定位异常组件。虽然该系统能够对异常进行检测和定位，但是由于其采用性能指标进行异常检测和判断，对于复杂的分布式容器云平台，监控性能指标带来的开销将会非常巨大。
发明内容
本发明实施例提供了一种应用于分布式容器云平台的异常检测与定位方法及装置，以至少解决传统基于单组件的异常检测方法无法适用于分布式容器云的技术问题。
根据本发明的一实施例，提供了一种应用于分布式容器云平台的异常检测与定位方法，包括以下步骤：
获取各容器组件的TCP延迟信息；
通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对；
通过组件状态信息键值对构造组件异常子图；
根据组件异常子图定位出异常发生的容器组件节点。
进一步地，通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对包括：
初始化组件的滑动窗口[L 0，L k]，输入TCP延迟信息直到滑动窗口内TCP延迟的数据个数达到k，初始化平均值
Figure PCTCN2019123989-appb-000001
累积和S k＝0；其中[L 0，L k]为存放TCP延迟信息从0到k的队列，k为0<k<60的整数；
再次输入TCP延迟信息L t，将TCP延迟信息L t插入滑动窗口，并删除滑动窗口内最早的TCP延迟信息L t-k，计算窗口内平均值
Figure PCTCN2019123989-appb-000002
并计算累积和
Figure PCTCN2019123989-appb-000003
其中L t为t时刻的TCP延迟信息，t为t>k的整数；
计算预警值S diff＝S max-S min，其中S max、S min∈？S t-k，S t]，S t-k为最早的TCP延迟信息时的累积和；
判断S diff是否处于正常阈值[-h，h]之间，如果是，则判断该组件的状态Status为正常，否则判断该组件的状态Status为异常；
根据各组件的状态信息生成组件状态信息键值对<CID:MID:Status>，其中CID表示组件的编号，MID表示组件所处的物理机的编号，Status表示组件的状态，当组件状态为异常时Status值为1，正常则为0。
进一步地，通过组件状态信息键值对构造组件异常子图包括：
输入组件依赖关系图G，组件依赖关系图的矩阵表示为G＝(Eij)，其中i，j表示应用集群内的组件，Eij表示i组件与j组件之间的依赖关系，如果组件i依赖于组件j则Eij值为1，否则Eij值为0；
遍历组件状态信息键值对，当Status值为0时，从组件依赖关系图G中删除i＝CID或者j＝CID的行和列，遍历完毕得到组件依赖关系子图G1；
判断组件依赖关系子图G1中是否存在独立组件节点，独立组件节点为不依赖于其他组件节点且不为其他任意组件节点依赖的组件节点，将这类组件节点删除后构造组件异常子图G’。
进一步地，根据组件异常子图定位出异常发生的容器组件节点包括：
遍历组件异常子图G’，计算δ i＝∑ j∈G’E ij，如果δ i＝0，则表示组件节点i 为异常的根节点。
进一步地，方法在根据组件异常子图定位出异常发生的容器组件节点之后还包括：
判断各异常根节点的MID是否相同，如果相同，则判断编号为MID的物理机发生异常。
进一步地，获取各容器组件的TCP延迟信息包括：
利用软件tcprstat收集各组件的TCP延迟信息。
根据本发明的另一实施例，提供了一种应用于分布式容器云平台的异常检测与定位装置，包括：
延迟信息获取单元，用于获取各容器组件的TCP延迟信息；
状态信息获取单元，用于通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对；
组件异常子图构建单元，用于通过组件状态信息键值对构造组件异常子图；
异常定位单元，用于根据组件异常子图定位出异常发生的容器组件节点。
进一步地，装置还包括：
异常判断单元，用于判断各异常根节点的MID是否相同，如果相同，则判断编号为MID的物理机发生异常。
一种存储介质，存储介质存储有能够实现上述任意一项应用于分布式容器云平台的异常检测与定位方法的程序文件。
一种处理器，处理器用于运行程序，其中，程序运行时执行上述任意一项的应用于分布式容器云平台的异常检测与定位方法。
本发明实施例中的应用于分布式容器云平台的异常检测与定位方法及装置，采用TCP延迟信息进行异常状态判断，降低了数据采集的开销，提高了异常状态判断的准确性与实时性。同时考虑到各组件之间，物理机与组件之间 的干扰，提出了组件异常子图用以表示异常状态的传播，提高了异常定位的准确性。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为本发明应用于分布式容器云平台的异常检测与定位方法的流程图；
图2为本发明应用于分布式容器云平台的异常检测与定位方法的优选流程图；
图3为本发明应用于分布式容器云平台的异常检测与定位装置的模块图；
图4为本发明应用于分布式容器云平台的异常检测与定位方法的优选模块图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设 备固有的其它步骤或单元。
随着容器技术的发展成熟，基于容器技术的云计算系统即容器云已经开始逐步的取代传统的基于虚拟机的云计算系统。由于容器具有轻量化的特点，容器的部署更加便捷。因而容器云内部组成相比于传统云计算平台更加复杂。其次容器对系统各项资源的隔离相较于虚拟机来说不强，而同一台物理主机上运行多个容器，容器间的干扰相对较为强烈，因此一旦容器云内部某个容器发生异常，异常将迅速传播，进而影响到整个集群。而由于容器云复杂的内部环境，对于传统基于单组件的异常检测方法已经不适用于分布式容器云环境。现有技术采用性能指标对异常进行分析，增加了数据采集的开销，同时需要构造正常的波动模型，对于波动频繁且复杂的容器云平台来说准确率较低且缺乏实时性。
本发明针对容器云平台提供了一种应用于分布式容器云平台的异常检测与定位方法及装置。通过该方法及装置能够对更加复杂的分布式容器云平台进行异常定位与检测，同时通过其组件异常子图提高异常定位的准确率。
实施例1
根据本发明一实施例，提供了一种应用于分布式容器云平台的异常检测与定位方法，参见图1，包括以下步骤：
S101:获取各容器组件的TCP延迟信息；
S102:通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对；
S103:通过组件状态信息键值对构造组件异常子图；
S104:根据组件异常子图定位出异常发生的容器组件节点。
该方法采用TCP延迟信息进行异常状态判断，降低了数据采集的开销，提高了异常状态判断的准确性与实时性。同时考虑到各组件之间，物理机与组件之间的干扰，提出了组件异常子图用以表示异常状态的传播，提高了异常定位的准确性。
作为优选的技术方案中，通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对包括：
初始化组件的滑动窗口[L 0，L k]，输入TCP(Transmission Control Protocol传输控制协议)延迟信息直到滑动窗口内TCP延迟的数据个数达到k，初始化平均值
Figure PCTCN2019123989-appb-000004
累积和S k＝0，该值是初始化值，S k＝S k-1＝…S 0＝0，L k＝L k-1…＝L 0＝0；其中[L 0，L k]为存放TCP延迟信息从0到k的队列，队列的大小为k，k值作为输入，k为0<k<60的整数，通常k取10；
再次输入TCP延迟信息L t，将TCP延迟信息L t插入滑动窗口，并删除滑动窗口内最早的TCP延迟信息L t-k，计算窗口内平均值
Figure PCTCN2019123989-appb-000005
并计算累积和
Figure PCTCN2019123989-appb-000006
此处为迭代计算，当t为k+1时，S t-1＝S k＝0；其中L t为t时刻的TCP延迟信息，t为t>k的整数；
计算预警值S diff＝S max-S min，其中S max、S min∈？S t-k，S t]，S t-k为最早的TCP延迟信息时的累积和；
判断S diff是否处于正常阈值[-h，h]之间，如果是，则判断该组件的状态Status为正常，否则判断该组件的状态Status为异常；h表示可接受的S diff的范围，为输入参数之一。
根据各组件的状态信息生成组件状态信息键值对<CID:MID:Status>，其中CID表示组件的编号，MID表示组件所处的物理机的编号，Status表示组件的状态，当组件状态为异常时Status值为1，正常则为0。
作为优选的技术方案中，通过组件状态信息键值对构造组件异常子图包括：
输入组件依赖关系图G，组件依赖关系图的矩阵表示为G＝(Eij)，其中i，j表示应用集群内的组件，Eij表示i组件与j组件之间的依赖关系，如果组件i依赖于组件j则Eij值为1，否则Eij值为0；
遍历组件状态信息键值对，当Status值为0时，从组件依赖关系图G中删除i＝CID或者j＝CID的行和列，遍历完毕得到组件依赖关系子图G1；
判断组件依赖关系子图G1中是否存在独立组件节点，即该独立组件节点为不依赖于其他组件节点且不为其他任意组件节点依赖的组件节点，将这类组件节点删除后构造组件异常子图G’。
作为优选的技术方案中，根据组件异常子图定位出异常发生的容器组件节点包括：
遍历组件异常子图G’，计算δ i＝∑ j∈G’E ij，如果δ i＝0，则表示组件节点i为异常的根节点。
作为优选的技术方案中，参见图2，方法在根据组件异常子图定位出异常发生的容器组件节点之后还包括：
S105：判断各异常根节点的MID是否相同，如果相同，则判断编号为MID的物理机发生异常。
作为优选的技术方案中，获取各容器组件的TCP延迟信息包括：
利用软件tcprstat收集各组件的TCP延迟信息。
下面以具体实施例，对本方法进行详细说明，本发明一种应用于分布式容器云平台的异常检测与定位方法包括以下步骤：
服务管理程序向服务代理程序提交异常定位请求；
服务代理程序接收到异常定位请求后，利用软件tcprstat收集组件的TCP延迟信息。软件tcprstat是免费开源的tcp层分析工具，统计分析请求的响应时间，可以用于临时分析，也可定时任务做信息收集；
通过滑动窗口累积和异常检测算法对服务代理程序所收集的组件的TCP延迟信息进行分析，获取组件的状态信息Status并生成组件状态信息键值对<CID:MID:Status>；
服务代理程序将组件状态信息键值对<CID:MID:Status>提交给服务管理程序；
服务管理程序收集到所有的组件状态信息键值之后构造组件异常子图G’；
服务管理程序遍历组件异常子图G’，计算δ i＝∑ j∈G’E ij，如果δ i＝0，则表示组件节点i为异常的根节点；
判断各异常根节点的MID是否相同，如果相同，表示编号为MID的物理机发生异常。
实施例2
根据本发明另一实施例，提供了一种应用于分布式容器云平台的异常检测与定位装置，参见图3，包括：
延迟信息获取单元201，用于获取各容器组件的TCP延迟信息；
状态信息获取单元202，用于通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对；
组件异常子图构建单元203，用于通过组件状态信息键值对构造组件异常子图；
异常定位单元204，用于根据组件异常子图定位出异常发生的容器组件节点。
本发明面向分布式容器云平台的异常检测与定位装置采用TCP延迟信息进行异常状态判断，降低了数据采集的开销，提高了异常状态判断的准确性与实时性。同时考虑到各组件之间，物理机与组件之间的干扰，提出了组件异常子图用以表示异常状态的传播，提高了异常定位的准确性。
作为优选的技术方案中，参见图4，装置还包括：
异常判断单元205，用于判断各异常根节点的MID是否相同，如果相同，则判断编号为MID的物理机发生异常。
实施例3
一种存储介质，存储介质存储有能够实现上述任意一项应用于分布式容器云平台的异常检测与定位方法的程序文件。
实施例4
一种处理器，处理器用于运行程序，其中，程序运行时执行上述任意一项的应用于分布式容器云平台的异常检测与定位方法。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的系统实施例仅仅是示意性的，例如单元的划分，可以为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例方法的全部或部分步骤。而前述的存储介质 包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (10)

  1. 一种应用于分布式容器云平台的异常检测与定位方法，其特征在于，包括以下步骤：
    获取各容器组件的TCP延迟信息；
    通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对；
    通过组件状态信息键值对构造组件异常子图；
    根据组件异常子图定位出异常发生的容器组件节点。
  2. 根据权利要求1所述的方法，其特征在于，所述通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对包括：
    初始化组件的滑动窗口[L 0，L k]，输入TCP延迟信息直到滑动窗口内TCP延迟的数据个数达到k，初始化平均值
    Figure PCTCN2019123989-appb-100001
    累积和S k＝0；其中[L 0，L k]为存放TCP延迟信息从0到k的队列，k为0<k<60的整数；
    再次输入TCP延迟信息L t，将TCP延迟信息L t插入滑动窗口，并删除滑动窗口内最早的TCP延迟信息L t-k，计算窗口内平均值
    Figure PCTCN2019123989-appb-100002
    并计算累积和
    Figure PCTCN2019123989-appb-100003
    其中L t为t时刻的TCP延迟信息，t为t>k的整数；
    计算预警值S diff＝S max-S min，其中S max、S min∈[S t-k，S t]，S t-k为最早的TCP延迟信息时的累积和；
    判断S diff是否处于正常阈值[-h，h]之间，如果是，则判断该组件的状态Status为正常，否则判断该组件的状态Status为异常；
    根据各组件的状态信息生成组件状态信息键值对<CID:MID:Status>，其中CID表示组件的编号，MID表示组件所处的物理机的编号，Status表示组件的状态，当组件状态为异常时Status值为1，正常则为0。
  3. 根据权利要求2所述的方法，其特征在于，所述通过组件状态信息键值对 构造组件异常子图包括：
    输入组件依赖关系图G，组件依赖关系图的矩阵表示为G＝(Eij)，其中i，j表示应用集群内的组件，Eij表示i组件与j组件之间的依赖关系，如果组件i依赖于组件j则Eij值为1，否则Eij值为0；
    遍历组件状态信息键值对，当Status值为0时，从组件依赖关系图G中删除i＝CID或者j＝CID的行和列，遍历完毕得到组件依赖关系子图G1；
    判断组件依赖关系子图G1中是否存在独立组件节点，独立组件节点为不依赖于其他组件节点且不为其他任意组件节点依赖的组件节点，将这类组件节点删除后构造组件异常子图G’。
  4. 根据权利要求3所述的方法，其特征在于，所述根据组件异常子图定位出异常发生的容器组件节点包括：
    遍历组件异常子图G’，计算δ i＝∑ j∈G’E ij，如果δ i＝0，则表示组件节点i为异常的根节点。
  5. 根据权利要求4所述的方法，其特征在于，所述方法在所述根据组件异常子图定位出异常发生的容器组件节点之后还包括：
    判断各异常根节点的MID是否相同，如果相同，则判断编号为MID的物理机发生异常。
  6. 根据权利要求1所述的方法，其特征在于，所述获取各容器组件的TCP延迟信息包括：
    利用软件tcprstat收集各组件的TCP延迟信息。
  7. 一种应用于分布式容器云平台的异常检测与定位装置，其特征在于，包括：
    延迟信息获取单元，用于获取各容器组件的TCP延迟信息；
    状态信息获取单元，用于通过滑动窗口累积和异常检测算法对各容器组件的TCP延迟信息进行分析，获取各组件的状态信息并生成组件状态信息键值对；
    组件异常子图构建单元，用于通过组件状态信息键值对构造组件异常子图；
    异常定位单元，用于根据组件异常子图定位出异常发生的容器组件节点。
  8. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    异常判断单元，用于判断各异常根节点的MID是否相同，如果相同，则判断编号为MID的物理机发生异常。
  9. 一种存储介质，其特征在于，所述存储介质存储有能够实现权利要求1至6中任意一项所述应用于分布式容器云平台的异常检测与定位方法的程序文件。
  10. 一种处理器，其特征在于，所述处理器用于运行程序，其中，所述程序运行时执行权利要求1至6中任意一项所述的应用于分布式容器云平台的异常检测与定位方法。
PCT/CN2019/123989 2018-12-15 2019-12-09 应用于分布式容器云平台的异常检测与定位方法及装置 Ceased WO2020119627A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811537333.2 2018-12-15
CN201811537333.2A CN109800052B (zh) 2018-12-15 2018-12-15 应用于分布式容器云平台的异常检测与定位方法及装置

Publications (1)

Publication Number Publication Date
WO2020119627A1 true WO2020119627A1 (zh) 2020-06-18

Family

ID=66556890

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/123989 Ceased WO2020119627A1 (zh) 2018-12-15 2019-12-09 应用于分布式容器云平台的异常检测与定位方法及装置

Country Status (2)

Country Link
CN (1) CN109800052B (zh)
WO (1) WO2020119627A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109800052B (zh) * 2018-12-15 2020-11-24 深圳先进技术研究院 应用于分布式容器云平台的异常检测与定位方法及装置
WO2021109048A1 (zh) * 2019-12-05 2021-06-10 深圳先进技术研究院 一种容器云平台异常检测方法、系统及电子设备
CN111061586B (zh) * 2019-12-05 2023-09-19 深圳先进技术研究院 一种容器云平台异常检测方法、系统及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5796937A (en) * 1994-09-29 1998-08-18 Fujitsu Limited Method of and apparatus for dealing with processor abnormality in multiprocessor system
CN101505243A (zh) * 2009-03-10 2009-08-12 中国科学院软件研究所 一种Web应用性能异常侦测方法
CN105242971A (zh) * 2015-10-20 2016-01-13 北京航空航天大学 面向流式处理系统的内存对象管理方法及系统
CN108306879A (zh) * 2018-01-30 2018-07-20 福建师范大学 基于Web会话流的分布式实时异常定位方法
CN109800052A (zh) * 2018-12-15 2019-05-24 深圳先进技术研究院 应用于分布式容器云平台的异常检测与定位方法及装置

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10832150B2 (en) * 2016-07-28 2020-11-10 International Business Machines Corporation Optimized re-training for analytic models
CN106487633B (zh) * 2016-10-11 2019-12-06 中国银联股份有限公司 一种虚拟机异常的监测方法和装置
US20180124080A1 (en) * 2016-11-02 2018-05-03 Qualcomm Incorporated Methods and Systems for Anomaly Detection Using Functional Specifications Derived from Server Input/Output (I/O) Behavior
CN106776005B (zh) * 2016-11-23 2019-12-13 华中科技大学 一种面向容器化应用的资源管理系统及方法
CN108306747B (zh) * 2017-01-11 2021-07-23 阿里巴巴集团控股有限公司 一种云安全检测方法、装置和电子设备
CN107612787B (zh) * 2017-11-06 2021-01-12 南京易捷思达软件科技有限公司 一种基于Openstack开源云平台的云主机故障检测方法
CN108337108A (zh) * 2017-12-28 2018-07-27 天津麒麟信息技术有限公司 一种基于关联分析的云平台故障自动化定位方法
CN108259241A (zh) * 2018-01-11 2018-07-06 上海有云信息技术有限公司 一种云平台监控系统的异常定位方法和装置
CN108491306A (zh) * 2018-03-19 2018-09-04 广东电网有限责任公司珠海供电局 一种基于企业私有云可信性监测方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5796937A (en) * 1994-09-29 1998-08-18 Fujitsu Limited Method of and apparatus for dealing with processor abnormality in multiprocessor system
CN101505243A (zh) * 2009-03-10 2009-08-12 中国科学院软件研究所 一种Web应用性能异常侦测方法
CN105242971A (zh) * 2015-10-20 2016-01-13 北京航空航天大学 面向流式处理系统的内存对象管理方法及系统
CN108306879A (zh) * 2018-01-30 2018-07-20 福建师范大学 基于Web会话流的分布式实时异常定位方法
CN109800052A (zh) * 2018-12-15 2019-05-24 深圳先进技术研究院 应用于分布式容器云平台的异常检测与定位方法及装置

Also Published As

Publication number Publication date
CN109800052B (zh) 2020-11-24
CN109800052A (zh) 2019-05-24

Similar Documents

Publication Publication Date Title
US10560309B1 (en) Identifying a root cause of alerts within virtualized computing environment monitoring system
US12007865B2 (en) Machine learning for rule evaluation
US9471455B2 (en) System, method, and computer program product for managing software updates
US10230601B1 (en) Systems and methods for integrated modeling and performance measurements of monitored virtual desktop infrastructure systems
US10484301B1 (en) Dynamic resource distribution using periodicity-aware predictive modeling
US8903995B1 (en) Performance impact analysis of network change
CN102870092B (zh) 用于在数据中心中确定应用依赖性路径的系统和方法
US10200252B1 (en) Systems and methods for integrated modeling of monitored virtual desktop infrastructure systems
US9400731B1 (en) Forecasting server behavior
CN114208126B (zh) 用于配置云存储软件设备的方法和装置
US12476874B2 (en) Predictive analytics for network topology subsets
US12373322B2 (en) Machine learning for metric collection
WO2020119627A1 (zh) 应用于分布式容器云平台的异常检测与定位方法及装置
US20150019722A1 (en) Determining, managing and deploying an application topology in a virtual environment
US20240411625A1 (en) Adaptive idle detection in a software-defined data center in a hyper-converged infrastructure
US11032152B2 (en) Machine-learning based self-populating dashboard for resource utilization monitoring in hyper-converged information technology environments
US11438245B2 (en) System monitoring with metrics correlation for data center
US20230195495A1 (en) Realtime property based application discovery and clustering within computing environments
CN111865899B (zh) 威胁驱动的协同采集方法及装置
US20130227353A1 (en) Application monitoring
US9929921B2 (en) Techniques for workload toxic mapping
JP2026503075A (ja) 演算ワークロードのマルチレイヤ予測
US12541485B1 (en) Analysis of javascript object notation (JSON) structures generated through various sources
US20230239370A1 (en) Message broker resource deletion
US20230089305A1 (en) Automated naming of an application/tier in a virtual computing environment

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19895582

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19895582

Country of ref document: EP

Kind code of ref document: A1