Movatterモバイル変換


[0]ホーム

URL:


CN120105313A - Front-end state anomaly detection method and system based on causal chain - Google Patents

Front-end state anomaly detection method and system based on causal chain
Download PDF

Info

Publication number
CN120105313A
CN120105313ACN202510577970.6ACN202510577970ACN120105313ACN 120105313 ACN120105313 ACN 120105313ACN 202510577970 ACN202510577970 ACN 202510577970ACN 120105313 ACN120105313 ACN 120105313A
Authority
CN
China
Prior art keywords
causal chain
causal
repair
model
chain
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202510577970.6A
Other languages
Chinese (zh)
Other versions
CN120105313B (en
Inventor
冯俊宇
黄进
陈凯平
谢姝航
惠路路
孔奥博
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Anquan Digital Intelligence Technology Co ltd
Original Assignee
Hangzhou Anquan Digital Intelligence Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Anquan Digital Intelligence Technology Co ltdfiledCriticalHangzhou Anquan Digital Intelligence Technology Co ltd
Priority to CN202510577970.6ApriorityCriticalpatent/CN120105313B/en
Publication of CN120105313ApublicationCriticalpatent/CN120105313A/en
Application grantedgrantedCritical
Publication of CN120105313BpublicationCriticalpatent/CN120105313B/en
Activelegal-statusCriticalCurrent
Anticipated expirationlegal-statusCritical

Links

Classifications

Landscapes

Abstract

Translated fromChinese

本说明书实施例公开了基于因果链的前端状态异常检测方法及系统。该包括以下步骤:步骤S1:通过解析源代码识别事件监听器、异步任务与状态变更逻辑之间的调用关系,构建一个预期因果链模型;步骤S2:在应用运行期间,动态验证实际发生的因果链是否符合预期模型;其中,步骤S1中,源代码的解析通过包括但不限于AST技术;在步骤S2中,关键函数的劫持方式包括但不限于Proxy机制、函数包装以及Hook技术。本申请通过构建预期因果链模型并在运行时动态验证实际路径,避免因因果链异常导致的系统不一致性,其次利用AI模型生成修复策略建议,将传统依赖日志和断点调试的低效排查流程升级为智能决策,显著提升修复效率。

The embodiments of this specification disclose a front-end state anomaly detection method and system based on causal chain. The method includes the following steps: Step S1: Identify the calling relationship between event listeners, asynchronous tasks and state change logic by parsing the source code, and build an expected causal chain model; Step S2: During the application operation, dynamically verify whether the actual causal chain conforms to the expected model; wherein, in step S1, the parsing of the source code includes but is not limited to AST technology; in step S2, the hijacking method of the key function includes but is not limited to Proxy mechanism, function packaging and Hook technology. This application avoids system inconsistency caused by causal chain anomalies by constructing an expected causal chain model and dynamically verifying the actual path at runtime. Secondly, it uses AI models to generate repair strategy recommendations, upgrades the traditional inefficient troubleshooting process that relies on logs and breakpoint debugging to intelligent decision-making, and significantly improves repair efficiency.

Description

Front-end state anomaly detection method and system based on causal chain
Technical Field
Embodiments of the present disclosure relate to the field of front-end state anomaly detection, and in particular, to a front-end state anomaly detection method and system based on causal links.
Background
Front-end state management based on causal links is a method of emphasizing causal relationships between operations in order to ensure that there is a clear and consistent association between user interactions and state changes caused by them, in which each user behavior such as clicking on a button, submitting a form, etc. is regarded as a "cause", whereas corresponding application state changes such as data updates, page redrawing, etc. are "effects" of this cause, by creating and maintaining such causal relationships, a developer can more precisely control the behavior of an application so that each user interaction can cause a corresponding state update as expected, in such a way as to emphasize the importance of causal relationships between operations in order to achieve predictable application behavior and simplify the debugging process, whereas in the prior art, a state management framework such as Vuex or Redux relies on the developer to manually handle asynchronous logic, which makes the integrity of causal links largely dependent on code quality, due to lack of automatic verification mechanisms, once network delays, failures or code logic errors occur, cause causal link breaks or failures, and further the association between user behavior and state changes is lost, and therefore, the causal link repair or failure detection and repair of causal links is required.
Disclosure of Invention
Various embodiments of the present specification describe a causal link-based front end state anomaly detection method, i.e., system.
In a first aspect, embodiments of the present disclosure provide a causal link-based front end status anomaly detection method, including the steps of:
step S1, static analysis, namely identifying calling relations among an event monitor, an asynchronous task and state change logic by analyzing source codes, and constructing an expected causal chain model;
Step S2, dynamically verifying whether an actually-occurring causal chain accords with an expected model or not during the running of an application;
Wherein in step S1, the parsing of the source code is performed by techniques including, but not limited to, AST techniques;
in step S2, the hijacking manner of the key function includes, but is not limited to, proxy mechanism, function wrapper, and Hook technology.
In a second aspect, embodiments of the present disclosure provide a causal link-based front end status anomaly detection system, comprising:
The static analysis and modeling module extracts key nodes of event monitoring, asynchronous tasks and state change through analyzing codes, constructs a causal relationship graph among the nodes, forms an expected causal chain model and serves as a reference for subsequent dynamic verification;
The dynamic monitoring and verification module is used for recording the actual paths of event triggering, asynchronous calling and state changing in real time through code hijacking when in operation, and comparing the expected causal chain model to detect abnormality;
the restoration module is used for combining a rule engine and an AI model, locating cause and effect chain abnormality reasons, generating a restoration scheme based on a strategy library, and finally outputting an executable restoration suggestion;
The fault-tolerant and rollback module is used for recovering the system to the latest stable state through a snapshot rollback mechanism when the irreversible abnormality is detected, supporting the selection of rollback points according to time, version or user behavior dimension, and recording a difference log;
The data storage module is used for persistently storing causal chain model versions, structured logs of abnormal events, repair strategy execution records and system state snapshots, supporting quick query and analysis and integrating the causal chain model versions, the structured logs of abnormal events and the repair strategy execution records into the existing monitoring system;
The alarm and notification module is used for triggering notification through a grading strategy according to the severity and the influence range of the abnormality, supporting a self-defined alarm rule and generating a periodic report for team duplication;
And the verification and execution module simulates the execution effect of the repair strategy in the isolation environment, ensures that no new problem is introduced in repair, and records the verification result to optimize the subsequent strategy selection.
In a third aspect, embodiments of the present disclosure provide an electronic device comprising a processor and a memory;
The processor is connected with the memory;
the memory is used for storing executable program codes;
The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory for performing the method of any one of the above aspects.
In a fourth aspect, embodiments of the present description provide a computer-readable storage medium, on which a computer program is stored, which when executed by a processor, implements the method of any of the above aspects.
In a fifth aspect, embodiments of the present description provide a computer program product comprising a computer program which, when executed by a processor, implements the method of any of the above aspects.
The technical scheme provided by some embodiments of the present specification has the following beneficial effects:
1. Actively discovering causal logic loopholes, preventing breakage, namely constructing an expected causal chain model through static code analysis, dynamically verifying an actual path in running, identifying logic defects in codes in advance, avoiding system inconsistency and unpredictability caused by causal chain breakage, and obviously reducing development and maintenance cost;
2. The whole-coverage asynchronous operation management reduces human errors, namely, the association relation between an asynchronous task, an event and a state node is automatically extracted and modeled through AST analysis and code hijacking technology, an asynchronous execution path and a result are recorded in real time, dependence on a developer for manually processing asynchronous logic is reduced, and the fracture risk caused by improper asynchronous management is reduced;
3. The cause is precisely positioned, the problem repair is accelerated, namely, a rule engine and an AI model are combined, the cause of the causal chain fracture is rapidly positioned, a repair strategy suggestion is generated, the traditional low-efficiency investigation flow depending on log and breakpoint debugging is upgraded to an intelligent decision, and the repair efficiency is remarkably improved;
4. Real-time fault tolerance and rollback, ensuring system stability, namely rapidly rollback to a latest stable state or an on-demand degradation function when breakage or failure is detected through a causal link snapshot storage and layering degradation protocol, ensuring the usability of the core functions of the system, and minimizing service interruption risks;
5. the method is suitable for complex environments and micro-service architectures, realizes collaborative repair in the micro-service architecture through cross-service API notification, stores a causal chain model and snapshot by using a distributed database, supports global consistency and high availability, and realizes full-link tracking and management of a causal chain in a complex system.
Other features and advantages of various embodiments of the present disclosure will be further disclosed in the following detailed description, the accompanying drawings.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present description, the drawings that are required in the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present description, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a schematic diagram of a causal link integrity test provided in an embodiment of the present disclosure;
FIG. 2 is a schematic diagram of constructing an expected causal chain model provided in an embodiment of the present description;
FIG. 3 is a schematic diagram of a validation run-phase causal chain provided by an embodiment of the present description;
FIG. 4 is a schematic diagram of an AI-aided repair causal chain provided in an embodiment of the disclosure;
FIG. 5 is a schematic diagram of a causal link-based front end status anomaly detection system according to an embodiment of the present disclosure;
fig. 6 is a schematic diagram of an electronic device according to an embodiment of the present disclosure.
Detailed Description
The technical solutions of the embodiments of the present specification are explained and illustrated below with reference to the drawings of the embodiments of the present specification, but the following embodiments are only preferred embodiments of the present specification, and not all the embodiments. Based on the examples in the implementation manner, those skilled in the art may obtain other examples without making any creative effort, which fall within the protection scope of the present specification.
The terms first, second, third and the like in the description and in the claims and in the above drawings are used for distinguishing between different objects and not necessarily for describing a particular sequential or chronological order. Furthermore, the terms "comprise" and "have," as well as any variations thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those listed steps or elements but may include other steps or elements not listed or inherent to such process, method, article, or apparatus.
In the following description, directional or positional relationships such as the terms "inner", "outer", "upper", "lower", "left", "right", etc., are presented merely to facilitate describing the embodiments and simplify the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operate in a particular orientation, and therefore should not be construed as limiting the description.
The data related to the application are information and data authorized by the user or fully authorized by all parties, and the collection of the related data complies with related laws and regulations and standards of related countries and regions.
Before describing the technical scheme, the application scene of the technical scheme and related technology are described.
A causal link is a model or tool describing causal relationships between events, which explains the occurrence and development of a certain phenomenon through a series of reasons and results, and in the field of software development, particularly in front-end applications, the causal link focuses on direct association between user operations and application state changes, and a causal link-based state management method can help a developer understand and implement how to update an application state through a series of user operations such as clicking buttons, submitting forms, and the like, for example, redux is a popular state management library, manages state changes through concepts of actions and reducers, and has clear causal relationships between actions and reducers, focuses on causal relationships between user interactions and events inside the system, so as to better manage and optimize the state and behavior of the front-end application.
However, the conventional framework only provides state management, cannot actively discover causal logic loopholes, and may cause causal link breakage or failure, which refers to the fact that in a software system, the association between events such as user behaviors and results such as state changes is lost due to various reasons, and the system cannot be ensured to execute according to expected logic, so that inconsistency and unpredictability of the system may be caused, and user experience and system reliability are seriously affected.
Specific phenomena of causal link breakage or failure are that the user operation does not produce expected effects, such as that after the user clicks a button, the expected state change does not occur or an error state change occurs, an asynchronous request fails or delays, network delay or server response time out, so that state update depending on the responses cannot be executed correctly, data inconsistency, problems occur in data synchronization among different modules due to the breakage of the causal link, inconsistent data in the system occurs, and problems are difficult to track, and the problem root is that effective logging or monitoring tools are lacked, so that positioning of the problem becomes difficult.
Cause of cause and effect chain breakage or failure are improper management of asynchronous operations such as API requests, if proper mechanisms are not available to ensure successful completion of the requests and necessary state updating is performed based on the request results, cause of cause and effect chain breakage, logic defects such as logic errors such as conditional branch omission, improper exception handling and the like, cause of specific user behaviors to not trigger correct state change, memory leakage such as available memory depletion of long-running application programs with memory leakage, further cause of historical cause and effect chain data loss, influence on consistency and traceability of states, and incorrect binding of event listeners such as application in dynamic environments, cause of cause and effect chain breakage if event listeners do not bind or unbind correctly, and miss some important user interaction events.
For these phenomena, manual handling of asynchronous logic is generally required, as is required by Vuex/reduce frameworks, which increases the risk of human error, because causal link integrity is entirely dependent on the developer's code quality, lacks automatic verification mechanisms, and moreover, current troubleshooting of such problems relies primarily on journaling and breakpoint debugging, which is time consuming and inefficient, especially in complex asynchronous scenarios where it is more difficult to locate the problem.
For this reason, first, a front-end state anomaly detection method based on a causal chain needs to be studied, please refer to fig. 1, which is a system diagram of the technology for causal chain integrity detection, and shows a scheme in two stages, firstly, in a static analysis stage, the main purpose of the stage is to identify and understand the interaction relationship between each component through analysis of source codes, and to process the call relationship between key elements, and under the condition of not running a program, help a developer identify design defects or logic errors which may cause problems in advance, and track the actual behavior of the program in real time during the program running, so as to verify whether the actually occurring causal chain accords with the data collected in a static analysis stage, if deviation occurs, it may mean that an anomaly condition exists, and further investigation is needed to detect whether the causal chain fails or breaks during the program running.
In view of the many terms involved in the present application, these terms will be described first.
A causal chain model refers to a logical structure that describes or predicts the behavior of a system by analyzing causal relationships between various components within the system, and is used to identify how different parts of the system interact and how these interactions affect the overall performance and stability of the system.
AI (artificial intelligence): in the application, AI analyzes a large amount of data generated during front-end application running through an algorithm and a model, identifies abnormal modes, and automatically proposes or implements a restoration strategy based on a knowledge base trained in advance or learned in real time, thereby ensuring that the application state meets the requirements of an expected causal chain model.
Confidence and risk level, wherein the confidence refers to the judgment reliability of the AI model on the repair strategy, the risk level represents the level of negative influence possibly brought by the repair strategy, and the risk assessment in AI repair refers to the logic of information security risk assessment.
Specifically, referring to fig. 2 and 3, the present disclosure first provides a causal chain-based front end status anomaly detection method, which includes the following steps:
step S1, static analysis, namely identifying calling relations among an event monitor, an asynchronous task and state change logic by analyzing source codes, and constructing an expected causal chain model;
Step S2, dynamically verifying whether the actually-occurring causal link accords with an expected model or not during the running of the application.
Wherein, in step S1, the step of constructing the expected causal chain model comprises:
Step A1, extracting key interaction nodes in codes through static code analysis, providing basic data for causal modeling, wherein the basic data comprises two parts of AST analysis and key node extraction, and the specific contents are as follows:
AST analysis, namely generating Abstract Syntax Tree (AST) by using a Babel or TYPESCRIPT COMPILER API compiler on front-end source codes, and realizing depth code analysis by combining plug-in modules of ESLint or SonarJS;
the key node extraction comprises the following steps:
An event listener, which identifies all event binding codes, such as addEventListener, onClick, e.g., document. GetElementById ('btn')addEventListener ('click', handler), extracts information as event type click, target element btn, callback function handler;
Asynchronous tasks, including displaying asynchronous and implicit asynchronous, identifying asynchronous function calls such as fetch, setTimeout, axios. Get, examples are fetch ('/api/data'). Then (data= > setState (data)), extracted information is asynchronous type fetch, uniform Resource Locator (URL)/api/data, callback function setState;
state change-either identify the dispatch of state update logic like reduce, vuex, or direct state assignment, example: store. Dispatch ({ type: 'SET_DATA', payload: DATA }), extract information as action type SET_DATA, trigger condition like DATA is valid.
Step A2, mapping the extracted nodes into a causal relation graph, and dividing the hierarchy according to a TRIZ method, wherein the method specifically comprises the following steps:
Defining node types:
Event nodes, representing user interactions or system events, such as click, submit;
Asynchronous nodes, representing asynchronous operations, such as fetch, setTimeout;
A status node, representing a status change, such as SET_DATA, SET_ LOADING;
Interface node-mapping reflecting state to interface, e.g., render, updateUI.
Defining edge types:
trigger edge, which represents event triggering asynchronous operation such as click→fetch;
dependent edges-representing that the result of an asynchronous operation depends on a state change, such as fetch→SET_DATA;
Feedback edge, which is to feedback to user interface after state change, such as SET_DATA→render;
hierarchy edges-parent nodes that label the causal link hierarchy and dependencies, such as SET_DATA, are fetch.
Constructing a causal graph:
directed Acyclic Graphs (DAGs) that ensure paths are unique and loop-free;
Hierarchical annotation, namely, hierarchical annotation is a logic hierarchy of the DAG, is used for defining the depth and the priority of a causal chain, comprises marking a direct cause and a root cause, and is combined with defect analysis deduction of TRIZ;
AND/OR relation, wherein the part is logic condition constraint among DAG nodes AND is used for describing preconditions of causal trigger, in the AND relation, a plurality of conditions must be satisfied simultaneously, such as DATA valid AND API success- & gt SET_DATA, OR relation, any condition is satisfied, such as user login OR API caching- & gt DATA display.
And (3) visualization:
The node type and edge relationships are annotated using cytoscape.js or Mermaid to generate a causal graph.
And step A3, verifying a rule set and optimizing a model, and optimizing the integrity of a causal chain model through a static rule and a dynamic model, wherein the method specifically comprises the following steps of:
static rule verification, namely checking error processing and code specification by using ESLint plug-in units, performing static analysis on codes by using TYPESCRIPT compiler verification type definition, checking DAG legality, hierarchical relationship, loops and the like by using graph analysis tools such as networkx, and realizing verification of a model structure;
dynamic model enhancement:
Causal Machine Learning (CML) using an Interactive Regression Model (IRM) to analyze code structures to find implicit causal relationships in a data-driven manner, such as by IRM inferring the association of the setTimeout threshold with the status update delay;
TRIZ causal chain analysis, namely dividing the causal chain into direct reasons such as API failure and root causes such as server configuration errors;
adding hidden risk nodes, predicting potential risks and optimizing model paths, such as network delay, timeout and state non-update;
Type system integration-ensuring that the state and data type meet expectations in dynamic execution, avoiding implicit errors, verifying the state conditions with typeguard of TYPESCRIPT.
And A4, generating a structured model.
Output format, JSON/YAML, comprising node, edge, rule, hierarchical relationship, structured representation causal chain graph.
Wherein in step S2, the step of verifying the causal link comprises:
And step B1, hijacking the key function through code injection or proxy technology.
Wherein hijacking the target includes:
event handlers such as user interaction events, frame hooks;
asynchronous functions such as network requests, timers, promise chains;
state change functions such as setState of dispatch, react of Redux, commit of state management library.
The hijacking method comprises the following steps:
Proxy mechanism, by intercepting function call such as new Proxy (fn, handler), inserting monitoring logic before and after call, recording parameter, return value and time stamp;
Function wrapping, namely, inserting monitoring codes before and after the original function is executed by rewriting the function, such as originalFn =. Fn= wrapper (originalFn);
the Hook technology is that in node. Js or original environment, the bottom layer functions such as socket and open are hijacked by LD_PRELOAD or dtrace, and the bottom layer operation path is recorded.
And step B2, recording an actual execution path, wherein the recorded content comprises context information and key data, setting a data structure, constructing a complete execution path chain, converting the path into an actual DAG, wherein nodes represent operations, and edges represent causal relationships.
Wherein, the key data of record includes:
Event triggering, including event types such as click, keydown, submit, trigger time, time stamp accurate to millisecond, target element, DOM element ID or path of trigger event, user behavior context such as click coordinates, input content, scroll position;
Asynchronous operation, including asynchronous type, key parameters and execution results.
The state change comprises an action type, a state value, a changed state snapshot such as loading, true, a trigger source and an associated preamble function or event.
The recorded context information comprises network state, equipment information, environment snapshot and the like.
The data structure is a chain hash structure, each record generates a unique hash value and is linked to the previous record to form a non-tamperable chain structure, so that the recorded data can be ensured not to be tampered, and a reliable basis is provided for comparison.
And B3, setting a verification mechanism, and comparing the actual path with an expected causal chain model in real time through the verification mechanism to detect whether the causal chain is broken or invalid, wherein the verification mechanism comprises graph structure comparison and anomaly detection.
The graph structure comprises the following components in comparison with the prior art:
Node matching, checking whether the actual node type is consistent with the expected one, such as whether fetch is marked as an asynchronous operation;
verifying whether the triggering relationship accords with the expectation, such as whether the fetch is triggered by a click event;
the condition constraint is that whether the node execution condition is met or not is checked, if the SET_DATA is triggered after the fetch is successful;
Order verification-ensuring that the node execution order conforms to the topological ordering of the DAG, e.g., fetch must precede set_data.
The abnormality detection specifically includes:
Explicit exceptions include break points where the actual path lacks an intended node, e.g., fetch does not trigger SET_DATA, unintended nodes where undefined operations occur, e.g., SET_ERROR state changes that are not declared in the model, and order ERRORs where the nodes execute an order that conflicts with the model, e.g., state updates precede asynchronous operations.
Implicit anomalies include causal reasoning, analyzing causal relationships of paths by Causal Machine Learning (CML), detecting implicit fractures, such as the success of fetch but not triggering SET_DATA, possibly due to DATA format errors, pattern recognition, learning historical anomaly patterns by a Graph Neural Network (GNN), predicting potential fracture points, such as the fetch returning 200 but not updated status marking as a "DATA unresolved" anomaly.
On the other hand, when a causal link abnormality is detected, the present application proposes to use AI to assist in repairing, please refer to fig. 4, which specifically includes the following steps:
Step C1, after detecting the cause and effect chain abnormality, if detecting the explicit or implicit abnormality of the step B3, triggering a repair flow, constructing context characteristics comprising multi-dimensional data, including code paths, state snapshots, environment data, user behaviors and the like, then compressing the high-dimensional characteristics through PCA or hash coding, splicing the compressed characteristics into unified input vectors, and providing comprehensive input for AI reasoning;
And step C2, combining a rule engine such as Drools with a lightweight model such as an LSTM model, locating the root cause of the fracture, mapping the root cause to TRIZ defect classification, generating a repair template, and providing basis for generating a repair strategy.
And step C3, setting a repair strategy library, setting a risk level for each repair strategy, selecting the repair strategy by using an AI model, and evaluating the feasibility of the repair strategy, specifically, using a model based on TensorFlow. Js, inputting the compressed feature vector of the step C1, outputting strategy probability, namely confidence degree distribution, setting a reliability comprehensive scoring formula, balancing the risk and the confidence degree by the comprehensive scoring formula, and carrying out priority ranking on the strategies to ensure the feasibility and the safety of the repair.
Specifically, the reliability comprehensive scoring formula is that comprehensive scoring=confidence factor× (1-risk level×α), wherein α is a constant between (0, 1), the influence weight of the risk level on scoring is controlled, and the value of α can be optimized and adjusted in real time according to historical data or cases.
Examples of repair policy library and corresponding risk level and confidence are:
The strategy 1 is that the automatic retry is performed, the confidence coefficient is 0.8, if the LSTM prediction continuous timeout probability is high, the risk level is 1, the risk is low, and only the retry operation is performed;
Policy 2, inserting a state update code, wherein the confidence coefficient is 0.75, such as the condition absence of matching of a rule engine, the risk level is 2, and the code change is related to the risk;
and 3, triggering a fusing mechanism, wherein the confidence coefficient is 0.65, and the risk level is 3, namely the high risk.
And step C4, previewing the repair strategy in a sandbox environment to ensure feasibility and safety, wherein the method specifically comprises the following steps of:
WebAssembly (Wasm) simulation, namely simulating a repaired code execution path in a browser by Wasm, simulating a network environment and user behaviors, checking whether a critical path is closed or not, and recording the repaired response time;
AST conversion verification, namely analyzing an original code by using an AST tool chain of Babel, inserting a repair code, and ensuring that a patch has no grammar errors through ESLint or a grammar verifier of Babel;
and a failure rollback mechanism, namely if the sandbox verification fails, returning the strategy priority, such as strategy 1 to strategy 2.
And step C5, setting a strategy execution condition, automatically or semi-automatically executing restoration according to the strategy risk level, supporting cross-service collaboration, and informing other services through an API in the micro-service architecture.
Example execution conditions include:
The automatic execution condition is that the confidence is >0.8 and the risk level is less than or equal to 2, for example, policy 1 is that the API request is retried, such as fetch () is retried 3 times, and policy 2 is that the code is dynamically inserted, such as setState ('paid');
and (3) manually confirming execution, namely generating a patch suggestion when the confidence coefficient is less than 0.8 or the risk level is more than 2, highlighting the Code position through a VS Code plug-in, and displaying a repair suggestion for a developer to check and confirm.
And step 6, evaluating the repairing effect, including path comparison, confirming whether the causal chain breaking point is repaired or not, recording the repaired performance index, collecting user feedback, optimizing the model and root cause library to form a continuous improved closed loop, and supporting rollback and audit.
Wherein the model optimization comprises:
on-line learning, namely collecting the repair cases, and only updating the last layer of the model, such as a Dense layer, so as to avoid retraining;
And (3) migration learning, namely extracting a repair case, such as 'state machine design defect', 'Circuit Breaker mode', from GitHub Issues, and enhancing generalization capability through data enhancement.
Wherein root cause library optimization includes:
New root causes categorize, for example, "missing fuse configuration" as "architecture design defect", associated design patterns;
rule base update-adding newly discovered root cause to rule engine, such as "API returns format change" → "switch standby interface".
On the other hand, the application is also provided with a fault-tolerant mechanism of causal link failure, when the causal link such as a business flow, a system state or a data dependency relationship is abnormal or broken, the system stability and the user experience are ensured, and meanwhile, the data loss and the business interruption are minimized, and the application specifically comprises the following steps:
The causal link snapshot storage is used for preventing data loss caused by memory leakage or program breakdown, providing a reliable basis for rollback, using IndexedDB (front end) or a distributed database (rear end) to store the causal link snapshot in a lasting mode, recording states according to time stamps and version numbers, supporting rollback to any historical effective state, forcedly generating the snapshot after key nodes such as state change and asynchronous operation are completed, and pre-judging possible failure and triggering the snapshot in advance by monitoring indexes such as memory utilization rate, API response time and the like;
and (3) failure detection and rollback, namely detecting logic fracture, parameter out-of-range or overtime and the like, selecting the latest effective snapshot to recover the system state, and recording rollback reasons and state differences for subsequent analysis.
And degrading the protocol, namely setting a layering strategy, and maintaining the usability of the core function during failure so as to avoid user experience breakdown.
Wherein the layering strategy comprises:
The first layer, non-critical asynchronous timeout, UI displays "in-load" or basic information, and retains core operation;
the second layer is that the core API fails in full link, the UI displays cache data, such as history records, and the non-core module is closed;
and the third layer, namely the key state is missing, the UI displays static content, and only basic inquiry is allowed.
On the other hand, the application also provides a front-end state anomaly detection system based on a causal chain, referring to fig. 5, the system comprises the following modules:
The static analysis and modeling module extracts key nodes such as event monitoring, asynchronous tasks, state change and the like through analyzing codes, constructs a causal relationship graph among the nodes, forms an expected causal chain model and serves as a reference for subsequent dynamic verification;
The dynamic monitoring and verification module is used for recording the actual paths of event triggering, asynchronous calling and state changing in real time through code hijacking when in operation, and comparing the expected causal chain model to detect abnormality;
The restoration module is used for combining a rule engine and an AI model, locating the root cause of the causal link abnormality, generating a restoration scheme based on a strategy library, and finally outputting an executable restoration suggestion;
The fault-tolerant and rollback module is used for recovering the system to a latest stable state through a snapshot rollback mechanism or degrading the function according to a preset strategy when the irreversible abnormality is detected, supporting the selection of rollback points according to time, version or user behavior dimension and recording a difference log;
The data storage module is used for persistently storing causal chain model versions, structured logs of abnormal events, repair strategy execution records and system state snapshots, supporting quick query and analysis and integrating the system into the existing monitoring system;
The alarm and notification module is used for triggering notification through a grading strategy according to the severity and the influence range of the abnormality, supporting a self-defined alarm rule and generating a periodic report for team duplication;
And the verification and execution module simulates the execution effect of the repair strategy in the isolation environment, ensures that no new problem is introduced in repair, and records the verification result to optimize the subsequent strategy selection.
In another aspect, referring to FIG. 6, a block diagram of an electronic device is provided for embodiments of the present disclosure, which may include at least one processor, at least one network interface, a user interface, a memory, and at least one communication bus. Wherein a communication bus may be used to enable the connection communication of the various components described above. The optional user interface may also include a standard wired interface, a wireless interface, where the network interface may include, but is not limited to, a bluetooth module, NFC module, wi-Fi module, etc. Wherein the processor may include one or more processing cores. The processor uses various interfaces and lines to connect various portions of the overall electronic device, perform various functions of the routing device and process data by executing or executing instructions, programs, code sets, or instruction sets stored in memory, and invoking data stored in memory. Wherein the processor may be implemented in at least one hardware form of DSP, FPGA, PLA. The processor may integrate one or a combination of several of a CPU, GPU, modem, etc. The CPU mainly processes an operating system, a user interface, an application program and the like, the GPU is used for rendering and drawing contents required to be displayed by the display screen, the processor can efficiently process high-computation tasks such as static analysis (AST analysis and DAG construction), dynamic monitoring (hijacking function and real-time recording), AI auxiliary repair (LSTM reasoning and CML model) and the like, and the modem is used for processing wireless communication.
It will be appreciated that the modem may not be integrated into the processor and may be implemented by a single chip. The memory may include, among other things, RAM and ROM. Optionally, the memory comprises a non-transitory computer readable medium. The memory may be used to store instructions, programs, code sets, or instruction sets. The memory may include a stored program area that may store instructions for implementing the operating system, instructions for at least one function, instructions for implementing the various method embodiments described above, and the like, and a stored data area that may store data and the like referred to in the various method embodiments described above. The memory may optionally also be at least one storage device located remotely from the aforementioned processor. The memory, which is a type of computer storage medium, may include an operating system, a network communication module, a user interface module, and application programs. The processor may be configured to invoke the application stored in the memory and perform the methods of the various embodiments described above, where the memory is capable of meeting the storage requirements of code resolution, causal chain model, execution path record (chain hash structure), and repair policy library, supporting the persistence (IndexedDB) and rollback mechanisms of causal chain snapshots.
The present description also provides a computer-readable storage medium having instructions stored therein, which when executed on a computer or processor, cause the computer or processor to perform the steps of the above embodiments. The above-described constituent modules of the electronic apparatus may be stored in the computer-readable storage medium if implemented in the form of software functional units and sold or used as independent products.
The present description also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the above embodiments.
The technical features in the present examples and embodiments may be arbitrarily combined without conflict.
In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes a plurality of computer instructions. When loaded and executed on a computer, produces a flow or function in accordance with embodiments of the present description, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in or transmitted across a computer-readable storage medium. The computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by a wired (e.g., coaxial cable, fiber optic, digital subscriber line (Digital Subscriber Line, DSL)), or wireless (e.g., infrared, wireless, microwave, etc.). The computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains an integration of a plurality of available media. The usable medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital versatile disk (DIGITAL VERSATILE DISC, DVD)), or a semiconductor medium (e.g., a Solid state disk (Solid STATE DISK, SSD)), or the like.
When the method is realized by hardware and firmware, the method flow is programmed into a hardware circuit to obtain a corresponding hardware circuit structure, so as to realize corresponding functions. For example, a programmable logic device (Programmable Logic Device, PLD) (e.g., field programmable gate array (FieldProgrammable GATEARRAY, FPGA)) is an integrated circuit whose logic functions are determined by user programming of the device. A designer programs to "integrate" a digital system onto a PLD without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Moreover, today, instead of manually fabricating integrated circuit chips, such programming is most often implemented with "logic compiler (logic compiler)" software, which is similar to the software compiler used in program development and writing, and the original code before it is compiled is also written in a specific programming language, which is called hardware description language (Hardware Description Language, HDL), which is not just one but a plurality of HDL. It will also be apparent to those skilled in the art that a hardware circuit implementing the logic method flow can be readily obtained by merely slightly programming the method flow into an integrated circuit using several of the hardware description languages described above.

Claims (10)

Translated fromChinese
1.基于因果链的前端状态异常检测方法,其特征在于,包括以下步骤:1. A front-end state anomaly detection method based on a causal chain, characterized in that it comprises the following steps:步骤S1:在静态分析阶段,通过解析源代码识别事件监听器、异步任务与状态变更逻辑之间的调用关系,构建预期因果链模型;Step S1: In the static analysis phase, the calling relationship between event listeners, asynchronous tasks and state change logic is identified by parsing the source code, and an expected causal chain model is constructed;步骤S2:在应用运行期间,劫持关键函数,动态验证对比实际发生的因果链与预期因果链模型;Step S2: During the application running, hijack the key functions, and dynamically verify and compare the actual causal chain with the expected causal chain model;其中,在步骤S1中,源代码的解析通过包括但不限于AST技术;Wherein, in step S1, the source code is parsed by, including but not limited to, AST technology;其中,在步骤S2中,关键函数的劫持方式包括但不限于Proxy机制、函数包装以及Hook技术。Among them, in step S2, the hijacking methods of key functions include but are not limited to Proxy mechanism, function packaging and Hook technology.2.根据权利要求1所述的基于因果链的前端状态异常检测方法,其特征在于,在所述步骤S1中,预期因果链模型的构建步骤包括:2. The front-end state anomaly detection method based on causal chain according to claim 1 is characterized in that, in step S1, the step of constructing the expected causal chain model includes:步骤A1:通过静态代码分析提取代码中的关键交互节点,为因果建模提供基础数据;Step A1: Extract key interaction nodes in the code through static code analysis to provide basic data for causal modeling;步骤A2:将提取的节点映射为因果关系图,并按TRIZ方法划分层级;Step A2: Map the extracted nodes into a cause-effect relationship diagram and divide the levels according to the TRIZ method;步骤A3: 规则集验证与模型优化,通过静态规则和动态模型优化因果链模型的完整性;Step A3: Rule set verification and model optimization, optimizing the integrity of the causal chain model through static rules and dynamic models;步骤A4:生成优化后的因果链模型。Step A4: Generate an optimized causal chain model.3.根据权利要求2所述的基于因果链的前端状态异常检测方法,其特征在于,在所述步骤S2中,对因果链的验证步骤包括:3. The front-end state anomaly detection method based on causal chain according to claim 2 is characterized in that, in step S2, the verification step of the causal chain includes:步骤B1:通过代码注入劫持关键函数;Step B1: Hijack key functions through code injection;步骤B2:记录实际执行路径,记录内容包含上下文信息和关键数据,设置数据结构并构建完整的执行路径链,将路径转换为实际有向无环图;Step B2: Record the actual execution path, including context information and key data, set up the data structure and build a complete execution path chain, and convert the path into an actual directed acyclic graph;步骤B3:设置验证机制,通过验证机制实时对比实际有向无环图与预期因果链模型。Step B3: Set up a verification mechanism to compare the actual directed acyclic graph with the expected causal chain model in real time through the verification mechanism.4.根据权利要求3所述的基于因果链的前端状态异常检测方法,其特征在于,在所述步骤B3中,验证机制包括图结构对比和异常检测;4. The front-end state anomaly detection method based on causal chain according to claim 3 is characterized in that, in step B3, the verification mechanism includes graph structure comparison and anomaly detection;其中,图结构对比包括:节点匹配、边匹配、条件约束以及顺序验证;Among them, graph structure comparison includes: node matching, edge matching, conditional constraints, and sequential verification;其中,异常检测具体包括:显示异常和隐式异常。Among them, anomaly detection specifically includes: explicit anomalies and implicit anomalies.5.根据权利要求4所述的基于因果链的前端状态异常检测方法,其特征在于,该基于因果链的前端状态异常检测方法还包括:5. The front-end state abnormality detection method based on causal chain according to claim 4 is characterized in that the front-end state abnormality detection method based on causal chain further comprises:在通过所述步骤S2检测到因果链异常后,通过AI辅助修复;After the causal chain anomaly is detected in step S2, repair is performed with the assistance of AI;所述AI辅助修复的步骤包括:The steps of the AI-assisted repair include:步骤C1:检测到因果链异常后,触发修复流程,构建包含多维度数据的上下文特征,为AI模型推理提供全面输入;Step C1: After detecting an anomaly in the causal chain, trigger the repair process to build context features containing multi-dimensional data to provide comprehensive input for AI model reasoning;步骤C2:将规则引擎与轻量级模型相结合,定位断裂的根本原因,并映射到TRIZ缺陷分类,生成修复模板,为修复策略生成提供依据;Step C2: Combine the rule engine with the lightweight model to locate the root cause of the fracture and map it to the TRIZ defect classification to generate a repair template, which provides a basis for repair strategy generation;步骤C3:设置修复策略库,并为每条修复策略设置风险等级,利用AI模型选择对应的修复策略;Step C3: Set up a repair strategy library, set a risk level for each repair strategy, and use the AI model to select the corresponding repair strategy;步骤C4:在沙箱环境中预演修复策略,验证其可行性与安全性;Step C4: Rehearse the repair strategy in the sandbox environment to verify its feasibility and safety;步骤C5:设置策略执行条件,根据策略风险等级执行修复,并支持跨服务协作,在微服务架构中,通过API通知其他服务;Step C5: Set policy execution conditions, perform remediation according to the policy risk level, and support cross-service collaboration. In the microservice architecture, notify other services through APIs;步骤C6:评估修复效果,收集用户反馈,优化AI模型和根因库进而形成持续改进闭环,并支持回滚与审计。Step C6: Evaluate the repair effect, collect user feedback, optimize the AI model and root cause library to form a continuous improvement closed loop, and support rollback and audit.6.根据权利要求5所述的基于因果链的前端状态异常检测方法,其特征在于,该基于因果链的前端状态异常检测方法还包括因果链失效的容错机制;6. The front-end state anomaly detection method based on causal chain according to claim 5 is characterized in that the front-end state anomaly detection method based on causal chain also includes a fault tolerance mechanism for causal chain failure;所述容错机制包括:The fault tolerance mechanism includes:因果链快照存储:防止内存泄漏以及程序崩溃导致数据丢失,为回滚提供可靠依据,持久化存储因果链快照,按时间戳和版本号记录状态,支持回滚到任意历史有效状态;Causal chain snapshot storage: prevents data loss caused by memory leaks and program crashes, provides a reliable basis for rollback, persistently stores causal chain snapshots, records states by timestamp and version number, and supports rollback to any historical valid state;失效检测与回滚:检测到逻辑断裂、参数越界、超时现象时,选择最近有效快照恢复系统状态,记录回滚原因和状态差异,供后续分析;Failure detection and rollback: When a logic break, parameter out-of-bounds, or timeout is detected, the system status is restored using the most recent valid snapshot, and the rollback reason and status difference are recorded for subsequent analysis.降级协议:设置分层策略,在失效期间维持核心功能可用性,避免用户体验崩溃。Degradation protocol: Set up a tiered strategy to maintain the availability of core functions during failures and avoid a breakdown in user experience.7.基于因果链的前端状态异常检测系统,其特征在于,包括:7. A front-end state anomaly detection system based on a causal chain, characterized by comprising:静态分析与建模模块:通过解析代码,提取事件监听、异步任务、状态变更关键节点,并构建节点间的因果关系图,形成预期的因果链模型,作为后续动态验证的基准;Static analysis and modeling module: By parsing the code, it extracts key nodes of event monitoring, asynchronous tasks, and state changes, and constructs a causal relationship diagram between nodes to form an expected causal chain model as a benchmark for subsequent dynamic verification;动态监控与验证模块:在运行时通过代码劫持实时记录事件触发、异步调用、状态变更的实际路径,并对比预期因果链模型检测异常;Dynamic monitoring and verification module: records the actual path of event triggering, asynchronous calls, and state changes in real time through code hijacking at runtime, and detects anomalies by comparing with the expected causal chain model;修复模块:结合规则引擎和AI模型,定位因果链异常原因,基于策略库生成修复方案,最终输出可执行的修复建议;Repair module: Combines the rule engine and AI model to locate the cause of causal chain anomalies, generates repair plans based on the policy library, and finally outputs executable repair suggestions;容错与回滚模块:在检测到不可逆异常时,通过快照回滚机制恢复系统到最近稳定状态,支持按时间、版本或用户行为维度选择回滚点,并记录差异日志;Fault tolerance and rollback module: When an irreversible anomaly is detected, the system is restored to the most recent stable state through a snapshot rollback mechanism. It supports selecting a rollback point by time, version, or user behavior, and records a difference log.数据存储模块:持久化存储因果链模型版本、异常事件的结构化日志、修复策略执行记录以及系统状态快照,支持快速查询和分析,并集成到现有监控系统;Data storage module: persistently stores causal chain model versions, structured logs of abnormal events, repair strategy execution records, and system status snapshots, supports fast query and analysis, and is integrated into existing monitoring systems;报警与通知模块:根据异常的严重性和影响范围,通过分级策略触发通知,支持自定义告警规则,并生成周期性报告供团队复盘;Alarm and notification module: triggers notifications through grading strategies based on the severity and impact of the anomaly, supports custom alarm rules, and generates periodic reports for team review;验证与执行模块:在隔离环境中模拟修复策略的执行效果,确保修复不会引入新问题,并记录验证结果以优化后续策略选择。Verification and execution module: simulates the execution effect of the repair strategy in an isolated environment to ensure that the repair will not introduce new problems, and records the verification results to optimize subsequent strategy selection.8.电子设备,其特征在于,包括处理器以及存储器;8. An electronic device, characterized in that it comprises a processor and a memory;所述处理器与所述存储器相连;The processor is connected to the memory;所述存储器,用于存储可执行程序代码;The memory is used to store executable program code;所述处理器通过读取所述存储器中存储的可执行程序代码来运行与所述可执行程序代码对应的程序,以用于执行如权利要求1-6任一项所述的方法。The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 6.9.计算机可读存储介质,其上存储有计算机程序,其特征在于,所述计算机程序被处理器执行时实现如权利要求1-6任一项所述的方法。9. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.10.计算机程序产品,包括计算机程序,其特征在于,该计算机程序被处理器执行时实现如权利要求1-6任一项所述的方法。10. A computer program product, comprising a computer program, characterized in that when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.
CN202510577970.6A2025-05-072025-05-07 Front-end state anomaly detection method and system based on causal chainActiveCN120105313B (en)

Priority Applications (1)

Application NumberPriority DateFiling DateTitle
CN202510577970.6ACN120105313B (en)2025-05-072025-05-07 Front-end state anomaly detection method and system based on causal chain

Applications Claiming Priority (1)

Application NumberPriority DateFiling DateTitle
CN202510577970.6ACN120105313B (en)2025-05-072025-05-07 Front-end state anomaly detection method and system based on causal chain

Publications (2)

Publication NumberPublication Date
CN120105313Atrue CN120105313A (en)2025-06-06
CN120105313B CN120105313B (en)2025-07-22

Family

ID=95874107

Family Applications (1)

Application NumberTitlePriority DateFiling Date
CN202510577970.6AActiveCN120105313B (en)2025-05-072025-05-07 Front-end state anomaly detection method and system based on causal chain

Country Status (1)

CountryLink
CN (1)CN120105313B (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
US20190227860A1 (en)*2018-01-212019-07-25EMC IP Holding Company LLCRoot cause analysis for protection storage devices using causal graphs
CN115361215A (en)*2022-08-222022-11-18西安电子科技大学Network attack behavior detection method based on causal graph
CN119128886A (en)*2024-09-252024-12-13北京邮电大学 A system, method, device and electronic device for detecting abnormal call chain
CN119720191A (en)*2024-10-292025-03-28云南电网有限责任公司信息中心 Webshell security detection and analysis method and system based on semantic analysis engine
CN119760730A (en)*2025-03-052025-04-04华清未央(北京)科技有限公司Intelligent vulnerability discovery platform construction method and system based on large model

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
US20190227860A1 (en)*2018-01-212019-07-25EMC IP Holding Company LLCRoot cause analysis for protection storage devices using causal graphs
CN115361215A (en)*2022-08-222022-11-18西安电子科技大学Network attack behavior detection method based on causal graph
CN119128886A (en)*2024-09-252024-12-13北京邮电大学 A system, method, device and electronic device for detecting abnormal call chain
CN119720191A (en)*2024-10-292025-03-28云南电网有限责任公司信息中心 Webshell security detection and analysis method and system based on semantic analysis engine
CN119760730A (en)*2025-03-052025-04-04华清未央(北京)科技有限公司Intelligent vulnerability discovery platform construction method and system based on large model

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
周克强: "基于机器学习的源代码漏洞挖掘", 《中国优秀硕士学位论文全文数据库 (信息科技辑)》, no. 2021, 15 March 2021 (2021-03-15), pages 138 - 111*
王莹: "软件系统网络化建模、质量度量与保证", 《万方》, 12 August 2022 (2022-08-12)*

Also Published As

Publication numberPublication date
CN120105313B (en)2025-07-22

Similar Documents

PublicationPublication DateTitle
EP3769223B1 (en)Unified test automation system
US20210279577A1 (en)Testing of Computing Processes Using Artificial Intelligence
US10430319B1 (en)Systems and methods for automatic software testing
US6986125B2 (en)Method and apparatus for testing and evaluating a software component using an abstraction matrix
JP7743403B2 (en) Unit testing components of the data flow graph
US10489274B2 (en)Using emulation to disassociate verification from stimulus in functional test
US7661031B2 (en)Correlating macro and error data for debugging program error event
JP7557431B2 (en) Apparatus and method for supporting source code modification
US11119899B2 (en)Determining potential test actions
CN119544497A (en) Server configuration method, computer equipment and storage medium
CN119537213A (en) A method for interface automation testing based on RPA
CN116088846A (en)Processing method, related device and equipment for continuous integrated code format
CN119539063A (en) A rule engine and related products
CN120105313B (en) Front-end state anomaly detection method and system based on causal chain
CN119065695B (en) Cross-version upgrade method and system for examination system of SaaS software
CN120256298A (en) Chip development method, device, electronic device and storage medium
GaigalsAddressing functionality gaps, data integrity, and system interoperability in enterprise systems
de ChauveronImproving Software Testing in an Agile Environment
Yu et al.Towards Understanding Bugs in Distributed Training and Inference Frameworks for Large Language Models
CN120631746A (en)Automatic testing method and device for micro-service architecture, electronic equipment and storage medium
CN117707590A (en)Continuous integrated state tracking method, device, equipment and medium for storage software
CN118535461A (en) A test script generation method and device, electronic device and storage medium
CN120123226A (en) Browser rendering engine fuzz testing method, device, equipment and storage medium
CN119718932A (en)Modularized software testing method and system based on RPA and large model
CN120705056A (en) Test case generation method, device, electronic device and readable storage medium

Legal Events

DateCodeTitleDescription
PB01Publication
PB01Publication
SE01Entry into force of request for substantive examination
SE01Entry into force of request for substantive examination
GR01Patent grant
GR01Patent grant

[8]ページ先頭

©2009-2025 Movatter.jp