CN111949481A - An anomaly tracking and detection system based on microservices - Google Patents

Abstract

The invention relates to the technical field of abnormality tracking and detection, in particular to a microservice-based abnormality tracking and detection system, comprising a tracking code implantation module, a log collection module and a log storage module, an abnormality tracking module and an abnormality detection module, and a tracking code implantation module. The module selects the AspectJ implantation mechanism according to the requirements, and directly embeds the tracking code into the target code module. The service is monitored, and the monitoring mainly focuses on the call requests between the various microservices. The monitoring mechanism can collect and summarize the monitoring information in time through the tracking on each link. At the same time, the exception tracking system should also be able to analyze and audit the generated monitoring information, extract the characteristics of the interaction between microservices, find abnormalities from the monitoring information according to these characteristics, and issue an alarm in time.

Description

An anomaly tracking and detection system based on microservices

technical field

The invention relates to the technical field of abnormality tracking and detection, in particular to a microservice-based abnormality tracking and detection system.

Background technique

The microservice architecture emphasizes more thorough componentization and serviceization. The original monolithic application is divided into a series of independently distributed microservices according to the business, and each microservice can be independently deployed and expanded. These characteristics of the microservice architecture make microservices face more severe security problems. When a microservice system provides services, it needs to expose more interfaces, which greatly increases the possibility of microservices being attacked. Microservices are usually designed to trust each other. If an intruder invades a microservice and completely controls the microservice, the intruder can send requests to other microservices to obtain sensitive information, or even attack other microservices and cause the entire system to collapse. .

There are two main monitoring methods used in the current microservice exception tracking: black-box-based monitoring methods and annotation-based monitoring methods. Black-box methods require more detailed logging to achieve higher accuracy. The main disadvantage of this method is the need to implant monitoring code.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is how to omit the implantation of monitoring codes while ensuring the accuracy of abnormal tracking and detection.

In order to solve the above technical problems, the present invention provides a micro-service-based anomaly tracking and detection system, including a tracking code implantation module, a log collection module and a log storage module, an exception tracking module and an exception detection module, and the tracking code implantation module is based on requirements. Select the AspectJ implantation mechanism to directly embed the tracking code into the target code module. The AspectJ implantation mechanism freely inserts the code into any position of the tracking code, and automatically implants the code according to the configuration information.

Preferably, the log collection module includes: an analysis collector, and the analysis collector adopts an implantable analysis collector to collect data information;

The analysis collector includes: a data extraction unit that extracts data from a data source, a data storage unit, and a data transmission unit.

Preferably, after receiving the log data, the log collection module will extract, merge, and format the log data for each attribute, and finally store the log data in the log storage module.

Preferably, the tracking data is obtained from the log storage module, and feature rules and filtering are extracted by the abnormal feature extraction unit. During the extraction process, the tracking records of the abnormal tracking module are verified. If the tracking records are missing or tampered with, the module will issue an alarm And write the corresponding information into the exception record database, mark the data as Next, and write it back to the log storage module.

Preferably, the extraction step of the abnormal feature extraction unit includes:

(1) Obtain abnormal information data through scan in the log storage module;

(2), data normalization processing;

(3) Extraction of feature information;

(4) Determine whether the calling relationship, calling sequence, and calling role relationship are in the feature information sets R1, R2, and R3, respectively. If one item does not exist, execute an alarm prompt and terminate the service process; otherwise, return to execute the judgment relationship. Track exceptions.

Preferably, the extraction method of the abnormal feature extraction unit is as follows: define each abnormal feature ID, each ID corresponds to the ID generated by each call request in the log tracking, and the feature vectors are R1, R2, and R3, and the feature data is extracted. The call relationship R1, the call sequence R2 and the call role R3 of each call in .

Advantages of the present invention:

The exception tracking system for microservice applications can monitor each scattered microservice. The monitoring mainly focuses on the call requests between various microservices. Since the microservices are scattered in each node and each virtual machine, the monitoring mechanism can be traced through each link. The monitoring information can be collected and summarized in a timely manner. At the same time, the exception tracking system should also be able to analyze and audit the generated monitoring information, extract the characteristics of the interaction between microservices, find exceptions from the monitoring information according to these characteristics, and issue alarms in time to solve the security problem under the microservice architecture. question.

Description of drawings

Fig. 1 is the system frame diagram of the present invention;

FIG. 2 is a flowchart of the abnormal feature extraction unit extraction according to the present invention.

Detailed ways

In order to make the technical means, creative features, achievement goals and effects realized by the present invention easy to understand, the present invention will be further described below with reference to the specific embodiments.

Please refer to Figure 1-2. An exception tracking and detection system based on microservices includes a tracking code implantation module, a log collection module and a log storage module, an exception tracking module and an exception detection module. The tracking code implantation module is based on requirements. Select the AspectJ implantation mechanism to directly embed the tracking code into the target code module. The AspectJ implantation mechanism freely inserts the code into any position of the tracking code, and automatically implants the code according to the configuration information.

As a specific embodiment of the present invention, the log collection module includes: an analysis collector, and the analysis collector adopts an implantable analysis collector to collect data information;

The analysis collector includes: a data extraction unit that extracts data from a data source, a data storage unit, and a data transmission unit.

As a specific embodiment of the present invention, after receiving the log data, the log collection module will extract, merge, and format the log data with various attributes, and finally store the log data in the log storage module.

As a specific embodiment of the present invention, the tracking data is obtained in the log storage module, and the feature rules and filtering are extracted by the abnormal feature extraction unit. During the extraction process, the tracking records of the abnormal tracking module are verified. If it is tampered with, the module will issue an alarm and write the corresponding information into the abnormal record database, mark the data as Next, and write it back to the log storage module.

As a specific embodiment of the present invention, the abnormal feature extraction unit extraction step includes:

(1) Obtain abnormal information data through scan in the log storage module;

(2), data normalization processing;

(3) Extraction of feature information;

(4) Determine whether the calling relationship, calling sequence, and calling role relationship are in the feature information sets R1, R2, and R3, respectively. If one item does not exist, execute an alarm prompt and terminate the service process; otherwise, return to execute the judgment relationship. Track exceptions.

As a specific embodiment of the present invention, the extraction method of the abnormal feature extraction unit is as follows: define each abnormal feature ID, each ID corresponds to the ID generated by each call request in the log tracking, and the feature vectors are R1, R2 , and R3, extract the calling relationship R1, calling sequence R2 and calling role R3 of each call in the feature data.

Claims (6)

1. A microservice-based exception tracking detection system, characterized in that: comprising a tracking code implantation module, a log collection module and a log storage module, an exception tracking module and an exception detection module, and the tracking code implantation module is selected according to requirements The AspectJ implantation mechanism directly embeds the tracking code into the target code module. The AspectJ implantation mechanism freely inserts the code into any position of the tracking code, and automatically implants the code according to the configuration information. 2. A microservice-based anomaly tracking and detection system according to claim 1, wherein the log collection module comprises: an analysis collector, and the analysis collector adopts an implantable analysis collector, which collects Data information; The analysis collector includes: a data extraction unit for extracting data functions from a data source, a data storage unit, and a data transmission unit. 3. A microservice-based anomaly tracking detection system according to claim 2, characterized in that: after the log collection module receives the log data, the log data will be extracted for each attribute, merged, and format converted, Finally, log data is stored in the log storage module. 4. A microservice-based anomaly tracking and detection system according to claim 3, characterized in that: the log storage module obtains tracking data, and extracts feature rules and filtering through an anomaly feature extraction unit. The tracking records of the exception tracking module are verified. If the tracking records are missing or tampered with, the module will issue an alarm and write the corresponding information into the exception record database, mark the data as Next, and write it back to the log storage module. . 5. A microservice-based anomaly tracking and detection system according to claim 4, wherein the extraction step of the anomaly feature extraction unit comprises: (1) Obtain abnormal information data through scan in the log storage module; (2), data normalization processing; (3) Extraction of feature information; (4) Determine whether the calling relationship, calling sequence, and calling role relationship are in the feature information sets R1, R2, and R3, respectively. If one item does not exist, execute an alarm prompt and terminate the service process; otherwise, return to execute the judgment relationship. Track exceptions. 6. A microservice-based anomaly tracking detection system according to claim 5, wherein the extraction method of the anomaly feature extraction unit is: define each anomaly feature ID, and each ID corresponds to log tracking The ID generated by each call request in the feature vector is R1, R2, and R3, and the call relationship R1, call sequence R2, and call role R3 of each call in the feature data are extracted.

Images