CN111240882B

Movatterモバイル変換

Info

Publication number: CN111240882B
Application number: CN202010047637.1A
Authority: CN
Inventors: 刘海涛; 万振华; 王颉; 李华; 董燕
Original assignee: Shenzhen Kaiyuan Internet Security Technology Co Ltd
Current assignee: Shenzhen Kaiyuan Internet Security Technology Co Ltd
Priority date: 2020-01-16
Filing date: 2020-01-16
Publication date: 2020-11-20
Anticipated expiration: 2040-01-16
Also published as: CN111240882A

Abstract

The invention provides a method for detecting an abnormal state, which comprises the following steps: extracting the abnormal information and the original request information of the abnormal information to form an original abnormal set; replaying the original request information of the abnormal information, acquiring abnormal change information and forming a replay abnormal set; and classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set to form an anomaly state detection set so as to detect the anomaly state. The method has simplicity for operators, can perform secondary replay based on the extracted tested abnormal request, does not need to generate a test request manually, and can automatically judge a test result by a tool; the method has high fine granularity, can manually replay a single request or a certain type of exception, and saves more resources. Further, the method of detecting program abnormality by applying the IAST technique can detect various kinds of abnormality occurring in the program more effectively, and even if the detected abnormality cannot be handled, the abnormality can be detected and captured.

Description

Method and system for detecting abnormal state

Technical Field

The invention relates to the field of detection of program abnormity, in particular to a method for detecting an abnormal state.

Background

At present, with the continuous development of terminal equipment technology, more and more application programs are available on the market. In the process of using the application program by a user, when the application program fails, the tool can only find the existing program exception, and an application program developer is required to develop a repair file to repair the failure of the application program. With the increased attention on program exceptions, people prefer to dynamically determine whether existing program exceptions are successfully repaired by developers using tools. But no better solution is available at present.

Disclosure of Invention

The technical problem to be solved by the invention is as follows: how to dynamically detect existing program exception conditions.

To solve the above technical problem, please refer to fig. 1, in which fig. 1 is a basic flowchart of a first embodiment of a method for detecting an abnormal state according to the present invention;

the technical scheme adopted by the invention is as follows: a method of detecting an abnormal condition, comprising the steps of:

step S1, extracting the abnormal information and the original request information of the abnormal information to form an original abnormal set;

step S2, reproducing the original request information of the abnormal information, obtaining the abnormal change information, and forming a reproduction abnormal set;

step S3, classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set to form an anomaly detection set, so as to detect the anomaly.

Further, step S2, replaying the original request information of the abnormal information to obtain abnormal state change information, specifically includes:

step S21, extracting the original request information of abnormal information playback;

step S22, detecting the execution request process to confirm that the execution request process has the exception in the original exception set;

step S23, confirming that the anomaly in the original anomaly set is a known anomaly, and obtaining time-last change information of the known anomaly.

Further, after the step of detecting the execution request procedure at step S24, the method further includes:

and confirming that the abnormity in the original abnormity set is newly added abnormity, and generating abnormal type change information.

Specifically, in step S23, the step of confirming that the anomaly in the original anomaly set is a new anomaly specifically includes:

step S231, creating a unique index;

step S232, according to the unique index, confirming that the abnormity in the original abnormity set is newly increased abnormity;

the unique index is one or more of an exception type, an exception stack and exception request information.

Preferably, in step S3, the step of classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set specifically includes:

step S31, classifying the abnormity in the original abnormity set and the replay abnormity set according to a classification aggregation rule;

and the classification aggregation rule is time-last change information of the known abnormality and/or type change information of the abnormality.

Preferably, step S33, classifying the anomalies in the original anomaly set and the replay anomaly set according to the anomaly status to be classified;

step S34, when the abnormal state to be classified is a restart state, restarting the program where the abnormal state to be classified is located;

the abnormal state to be classified is one of a repaired state, a restarting state and an unprocessed state, the repaired state is that the abnormal to be classified is in the repaired state, the restarting state is that the abnormal to be classified is in the repair failure state, and the unprocessed state is that the abnormal to be classified is in the unprocessed state.

Specifically, in step S3, when the classification and aggregation rule is abnormal category change information, the method further includes:

and step S32, adding a classification mark to the newly added abnormity.

Optionally, when the abnormal state to be classified is a closed state, if the abnormal state to be classified is a known abnormal state, step S331 is performed to change the state of the abnormal state to be classified into a restart state.

In the foregoing technical solution, in the step S1, the step of extracting the abnormal information and the original request information of the abnormal information specifically includes:

step S11, detecting an application program;

step S12, extracting the exception type and exception stack information, as well as the starting method, method chain, request URL, request header, and request body.

The invention also provides a system for detecting the abnormal state, which comprises the following modules:

the anomaly acquisition module is used for extracting the anomaly information and the original request information of the anomaly information to form an original anomaly set;

the abnormal recombination module is used for replaying the original request information of the abnormal information, acquiring abnormal change information and forming a replay abnormal set;

and the anomaly detection module is used for classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set to form an anomaly state detection set so as to detect an anomaly state.

The invention has the beneficial effects that: original request information of the abnormal information is extracted, so that the abnormal information with complete venation is efficiently collected, and the preparation of the recombination and the replay of the abnormal information is facilitated. The original abnormal set is formed, so that the original abnormal resources can be conveniently called, and the abnormal detection is facilitated. The original request information of the abnormal information is replayed, the abnormal information can be detected secondarily before the information is recombined, and the generation of misjudgment is favorably avoided. And if the abnormal change information is acquired, the attention points are reduced from the whole to the changed part, so that the calculation amount is reduced, and the further extraction of the data is facilitated. The anomalies in the original anomaly set and the replay anomaly set are classified and aggregated, and the whole data structure can be selectively recombined, so that the anomaly state can be conveniently detected.

Drawings

The detailed structure of the invention is described in detail below with reference to the accompanying drawings

FIG. 1 is a basic flow diagram of a first embodiment of a method for detecting an abnormal state according to the present invention;

FIG. 2 is a flow chart of a method of detecting an exception condition according to a second embodiment of the present invention for forming a replay exception set;

FIG. 3 is a flowchart of a method for detecting an abnormal situation according to a third embodiment of the present invention for classifying the abnormalities in the original set of abnormalities and the replayed set of abnormalities;

FIG. 4 is a flowchart of a method for detecting an abnormal state according to a fourth embodiment of the present invention for classifying the abnormalities in the original set of abnormalities and the replayed set of abnormalities.

Detailed Description

In order to explain technical contents, structural features, and objects and effects of the present invention in detail, the following detailed description is given with reference to the accompanying drawings in conjunction with the embodiments.

Referring to fig. 1, fig. 1 is a basic flowchart of a first embodiment of a method for detecting an abnormal state according to the present invention.

The invention provides a method for detecting an abnormal state, which comprises the following steps:

The method has the following basic effects: through the step S1, the complete abnormal information of the venation can be efficiently collected, so that the preparation of the recombination and the replay of the abnormal information are facilitated, the original abnormal resource is conveniently called, and the abnormality detection is facilitated. Through thestep 2, abnormal information can be detected secondarily before information recombination, so that misjudgment is avoided, attention points are reduced to a change part from the whole, the calculation amount is reduced, and further extraction of data is facilitated. Through step 3, the entire data structure can be selectively reorganized, thereby facilitating detection of abnormal conditions.

By applying the method, the information collection efficiency and the calling benefit are ensured, the method has the characteristic of comprehensively examining abnormity, the detection accuracy is high, and the detection time is integrally saved. And the operation is simple and easy, and the treatment is easy.

Further, in step S1, the step of extracting the abnormal information and the original request information of the abnormal information specifically includes:

step S11, detecting an application program;

Specifically, step S12 extracts the exception type and exception stack information, as well as the starting method, the request URL, the request header, and the request body.

The exception in the above description refers to an exception condition or an exception event that cannot be handled or is not handled by the normal program flow.

The exception types described above represent methods for dividing and merging according to a certain characteristic or cause, and include various types such as null pointer exception and array out-of-range exception. Null pointer exception, which means that when an object does not exist, the method is called to generate exception; the array out-of-range exception means that the array out-of-range exception is reported when the array is accessed by using an illegal index, and other information in the memory area may be accessed.

The exception stack information is method chain information composed from a starting point method to a method in which an exception error occurs in a program and an exception is thrown, and is detailed error information. A method chain: refers to a linked list of multiple method paths.

The starting point method may be a request of an application program, or may be a start function of an application program. Alternatively, the compiler may execute the function starting with main. For supporting the UNICODEWN 32 application, the program entry is tmain; for windows window programs, the program entry is WinMain. In gcc, there are traditionally two compilation options that can specify the name of the portal function.

When the request URL is the program execution, the program request is directed to the URL address. The URL is a uniform resource locator, a compact representation of the location and access method of a resource available from the internet, and is the address of a standard resource on the internet. Each file on the internet has a unique URL containing the location of the file and the manner of processing. The request header is a response header for setting a data and integer value, and may be selected from a setDateHeader method, a setintheader method, or other methods. The request body is the body in the request.

It can be understood that the invention has the operation function and the abnormal display function, and an operator can check the abnormal operation state. Optionally, the tested exception is classified and viewed or processed according to rules such as exception detection time, exception type or exception state and the like.

The selective extraction of the whole data of the HTTP request can reduce the whole calculation amount, improve the whole calculation accuracy and facilitate the detection of abnormal states.

Further, in step S2, the step of playing back the original request information of the abnormal information and acquiring the abnormal state change information includes:

step S23, confirming that the anomaly in the original anomaly set is a known anomaly, and obtaining the time-last change information of the known anomaly.

Specifically, step S21 extracts the original request information for abnormal information playback. Editing the abnormal original request information into a form which can be received by the application program, and then retransmitting the abnormal original request information.

optionally, the IAST technology is used to dynamically pile the logic code for processing exception in the user program, and dynamically acquire the method chain and request data requested to be executed, so as to determine whether an exception exists in the execution process.

Step S23, confirming that the anomaly in the original anomaly set is a known anomaly, and obtaining the time-last change information of the known anomaly. It will be appreciated that some anomalies will occur frequently. If the occurrence of each known exception is recorded, a large amount of redundant data is added, which is not favorable for the fluency of the program. Moreover, for the same exception, there is no need to process twice, and the exception can be solved by the processing.

When a certain abnormity is discovered for multiple times, the abnormity is not increased in number, but the last discovered time is updated.

Furthermore, by the time the anomaly was last found, the frequency of occurrence of the anomaly can be roughly inferred. Specifically, if an anomaly is last discovered much longer than other anomalies, then the anomaly is of low frequency; correspondingly, if the last discovered time of the anomaly is updated frequently, the anomaly is a high-frequency anomaly.

In a further embodiment, step S24 is performed to confirm that the anomaly in the original anomaly set is a new anomaly, and to generate anomaly type change information. It is understood that the steps S23 and S24 in the above description belong to the steps after the step S22 in the above description. Based on this, step S22 and step S23 do not have a sequential relationship. After step S22, step S22 may be performed, or step S23 may be performed.

And (4) newly-added abnormity appears, which indicates that a new problem in the running of the program is found. Therefore, the exception record is added, which is helpful to enhance the user's attention to the added exception. Therefore, the abnormity repairer can be searched in time to repair the abnormity. In addition, the new exception occurs, which indicates that some errors may exist in the process of forming the original exception set, and the specific implementation of step S1 needs to be corrected.

step S231, creating a unique index;

A unique index is a row that is not allowed to have the same index value, and thus duplicate indices or key values are prohibited. Optionally, the system checks if there are duplicate key values when creating the index, and checks each time data is added using a partial SQL statement.

By applying the unique index, on one hand, the newly added abnormity can be classified, and repeated newly added abnormity is avoided. On the other hand, since the operator can perform the operation after displaying the abnormality, after classifying the abnormality by using the unique index, the abnormality of the same category is displayed and gathered in the same area, thereby facilitating the next operation.

Preferably, in step S3, the step of classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set specifically includes three classification methods: referring to FIG. 3, FIG. 3 is a flowchart illustrating a method for detecting an abnormal state according to a third embodiment of the present invention for classifying an abnormality in an original abnormality set and a replay abnormality set.

And step S31-1, classifying the abnormity in the original abnormity set and the replay abnormity set according to the time last change information of the known abnormity. Therefore, the information change state of the known exception can be obtained, only the last change time is recorded, the calculation amount and the memory requirement are reduced, and the exception is favorably subjected to targeted processing. And the finally changed information is displayed in the same way, so that the internal relation of known abnormity can be conveniently found and processed in time.

Step S31-2, according to the abnormal type change information, classifying the abnormal in the original abnormal set and the replay abnormal set. Therefore, newly-added abnormity is focused, new bugs are discovered in time, a better detection effect is obtained, and bug repairing is carried out in time.

And step S31-3, classifying the abnormity in the original abnormity set and the replay abnormity set according to the time last change information and the type change information of the known abnormity. Thus, the main functions of step S31-1 and step S31-2 are simultaneously provided. It should be understood that the steps S31-1 and S31-2 are not necessarily linked in the proper order. Thereby, the fine granularity of the abnormality can be increased.

Further, after the step S31-2 and the step S31-3, there is a step S32 of adding a classification flag to the newly added anomaly. By adding the classification identification to the newly added abnormity, an operator can easily compare the abnormity information, and the label is added to the abnormity, so that the discovery of the internal regularity between the abnormity is facilitated.

Preferably, referring to fig. 4, fig. 4 is a flowchart of a method for detecting an abnormal state according to a fourth embodiment of the present invention for classifying the abnormalities in the original abnormal set and the replayed abnormal set;

step S33, classifying the abnormity in the original abnormity set and the replay abnormity set according to the abnormity state to be classified;

Specifically, step S33 classifies the anomalies in the original anomaly set and the replay anomaly set according to the anomaly status.

Unlike the classification of the sort mode performed at step S31-1, step S31-2, or step S31-3, step S33 mainly classifies the abnormal repair state, thereby better detecting the abnormal repair state. The exception is divided into a repaired state, a restarting state and an unprocessed state, so that the exception handling process can be divided more accurately.

In step S33, when the abnormal state to be classified is the shutdown state, if the abnormal state to be classified is the known abnormal, the method further includes step S331, changing the state of the abnormal state to be classified into the restart state.

Since most known anomalies are automatically repairable, changing them to a restart state is beneficial to enhance the accuracy of the detection.

And step S34, when the exception to be classified is in the restart state, restarting the program where the exception to be classified is located. Thus, certain anomalies may be automatically repaired.

In the above steps S33 and S34, the repaired state refers to a state in which the abnormality has been repaired by the encoding staff and is actively closed, or a state in which the abnormality is repaired and automatically closed by abnormality detection of the dynamic detection program. The unprocessed state refers to a state in which an abnormality is detected and has not been modified. The restart state refers to a state that the abnormity is manually closed by encoding personnel, then is still existed after being detected by the abnormity of a dynamic detection program, and finally is reopened.

and the anomaly detection module is used for classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set to form an anomaly state detection set so as to detect the anomaly state.

The system is used for carrying the method to operate.

Each functional module in the embodiments of the present invention may be integrated into one processing module, or each module may exist alone physically, or two or more modules are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The module-integrated module, if implemented in the form of a software functional module and sold or used as a separate product, may be stored in a computer-readable storage medium.

The invention can realize all or part of the flow in the method of the above embodiments, and can also be completed by instructing relevant hardware through a computer program, and the computer program of the module can be stored in a computer readable storage medium, and when the computer program is executed by a processor, the steps of the above embodiments of the method can be realized. Where the modular computer program comprises computer program code, the modular computer program code may be in the form of source code, object code, an executable file or some intermediate form, or the like. The module computer readable medium may include: any entity or device capable of carrying modular computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM), Random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution media, and the like.

In summary, the method and system for detecting an abnormal state provided by the invention have the following advantages: the method has simplicity for operators, can perform secondary replay based on the extracted tested abnormal request, does not need to generate a test request manually, and can automatically judge a test result by a tool; the method has high fine granularity for users, and can manually replay requests for a single request or a certain type of exception, thereby saving resources. In addition, the present application, which employs the method of detecting program abnormalities using the iatt technique, can more effectively detect various abnormalities occurring in the program and capture the detected abnormalities even if they cannot be handled.

The above description is only an embodiment of the present invention, and not intended to limit the scope of the present invention, and all modifications of equivalent structures and equivalent processes performed by the present specification and drawings, or directly or indirectly applied to other related technical fields, are included in the scope of the present invention.

Claims

1. A method of detecting an abnormal condition, the method comprising the steps of:

extracting the abnormal information and the original request information of the abnormal information to form an original abnormal set;

extracting original request information replayed by abnormal information, and detecting an execution request process to confirm that the execution request process has an abnormality in an original abnormality set;

if the abnormity in the original abnormity set is confirmed to be known abnormity, acquiring time last change information of the known abnormity to form a replay abnormity set, and classifying and aggregating the abnormity in the original abnormity set and the replay abnormity set according to the time last change information of the known abnormity to form an abnormity state detection set;

if the abnormality in the original abnormality set is confirmed to be a newly-added abnormality, generating abnormality type change information, and classifying the abnormality in the original abnormality set and the abnormality reproduction set according to the abnormality type change information to form an abnormality state detection set;

and applying the abnormal state detection set to detect the abnormal state.

2. The method according to claim 1, wherein the step of confirming that the anomaly in the original anomaly set is a new anomaly specifically comprises:

creating a unique index;

according to the unique index, confirming that the abnormality in the original abnormality set is a newly-added abnormality;

wherein, the unique index is one or more of an exception type, an exception stack and exception request information.

3. The method according to claim 1 or 2, wherein the step of classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set to detect the anomaly specifically comprises:

classifying the abnormity in the original abnormity set and the replay abnormity set according to the abnormity state to be classified;

when the abnormal state to be classified is a restarting state, restarting a program where the abnormal state to be classified is located;

the abnormal state to be classified is one of a repaired state, a restarted state and an unprocessed state, the repaired state is that the abnormal to be classified is in the repaired state, the restarted state is that the abnormal to be classified is in the repair failure state, and the unprocessed state is that the abnormal to be classified is in the unprocessed state.

4. The method of detecting an abnormal state according to claim 1, wherein when the classification aggregation rule is abnormal category change information, the method further comprises:

and adding a classification identifier for the newly added exception.

5. The method of claim 3, wherein when the abnormal state to be classified is a shutdown state, if the abnormal state to be classified is a known abnormal, the state of the abnormal state to be classified is changed to a restart state.

6. The method for detecting an abnormal state according to claim 1, wherein the step of extracting the abnormal information and the original request information of the abnormal information specifically includes:

detecting an application program;

and extracting the exception type and exception stack information, as well as a starting point method, a request URL, a request head and a request body.

7. A system for detecting an abnormal condition, comprising:

the abnormal recombination module is used for extracting original request information replayed by abnormal information and detecting an execution request process so as to confirm that the execution request process has the abnormality in an original abnormal set; if the abnormity in the original abnormity set is confirmed to be known abnormity, acquiring time last change information of the known abnormity to form a replay abnormity set;

the anomaly detection module is used for classifying and aggregating the anomalies in the original anomaly set and the replay anomaly set according to the time last change information of the known anomalies to form an anomaly state detection set if the anomalies in the original anomaly set are confirmed to be known anomalies;

if the abnormity in the original abnormity set is confirmed to be newly increased abnormity, generating abnormal type change information, and classifying the abnormity in the original abnormity set and the replay abnormity set according to a classification aggregation rule to form an abnormal state detection set;

and applying the abnormal state detection set to detect the abnormal state.