Research On Monitoring And Analyzing Of Software Behavior In Open Network Environment

In open network environment, new-type distributed software has the characteristics of loosely-coupled software entities, open and dynamic environment, complex behaviors, which are different from traditional distributed software. The software supervision is faced with unprecedented difficulties in such environment. The footprints left by interaction and collaboration of loosely-coupled software entities are similar to sequential net structure, interactive process shows a kind of group behavior which behaves in emerging, dynamic, accidental, correlative and repeating properties. The thesis looks on software behavior as breakthrough, and constructs a type of new software behavior supervision mechanism with behavior trust at the core by adopting the strategies of "obvious and structural environment" and "answering change with change".In Behavior Footprints (BF) monitoring, dynamic AOP monitoring technology is adopted to monitor interactive events related with business logic which are produced by the third party software entities. In BF representing and analyzing, software system looks on events as basic unit, maps monitored state changes into events with semantic meanings, uses sequence or Petri-net to represent behavior process and effect, which is coarse grain BF. Software system looks on events as breakthrough-point, researches on detailed behavior information (such as calling methods, parameters and experiential knowledge), and uses Dynamic Bayesian Network (DBN) or Multi-Entity Bayesian Network (MEBN) to represent complex process and effect of interactive behavior, which is fine grain BF. The methods of BF analyzing and predicting presented in this thesis can intuitively find bottle-necks that restrict efficient and trustworthy running, and predict possible anomalous behaviors, which makes behavior analyzing and predicting the "baton" that instructs software trustworthy evolvement and continuous optimization.The main work of this thesis includes the following:(1) For the problem that existed software supervision technology architectures particularly emphasize on operation layer information, the thesis presents a new one for new-type distributed software. This architecture integrates operation layer information with intermediate layer and business logic layer information, implements behavior analyzing from top to bottom, accurately recognizes anomalous behavior, quickly locates resource bottle-necks restricting efficient running; proactively predicts runtime behavior and resource uses; adjusts interactive behavior from bottom to top according to analyzing and predicting results in order to improve the capacity of tolerating changes.(2) The thesis presents a suit of behavior monitoring mechanism oriented open network environment, which has characteristics of transparency, dynamics, controllability, autonomy and expansibility for behavior monitoring. The dynamic AOP monitoring technology is adopted to monitor interactive events related with business logic which are produced by the third party software entities. By introducing new AOP dimensions, monitoring mechanism can be fused into software system with more flexible, loose and transparent way, and support online expansion. With dynamic weaving mechanisms, the monitors can be added or deleted in the running process to improve the dynamics of online monitoring.(3) For the problems that existed BF analyzing methods mostly emphasize on behavior sequences which have not repeated sub-footprints, behavior sequence patterns saved in knowledge base are not concise enough, online BF analyzing algorithm is not efficient enough, the thesis presents a kind of tagged, complex coarse grain BF analyzing method. In online behavior analyzing, repeated sub-footprints can be automatically recognized and removed, minimum main footprint is quickly discovered, removed contents and locations are recorded. Simplifying marks are used to replace removed motifs and cyclic sub-sequences to reduce footprint length. The method effectively reduces the number of pair-wise comparison with sequence patterns in knowledge base, and improves BF analyzing efficiency. The method may accurately predict next possible event, and proactively predict subsequently possible behavior trend.(4) For the problem that some events produced in business may have incomplete or unusable tags, the thesis presents a kind of incompletely tagged, simple coarse grain BF analyzing method. If the transition time among these events are independent and identically distributed, all possible states (events) are separated into multi-cutsets, each of them forms a bigraph system. The improved algorithm of maximum-weight perfect matching is adopted to finish respective matching, and then the results of independent matching of many bigraph systems are spliced to gain the most possible sequences of BF produced by multi-business, which is convenient for subsequent analyzing. (5) Using MEBN to represent and analyze fine grain BF, the thesis presents a kind of situation-sensitive software behavior modeling method. The method takes full advantage of FOL semantic representation and probabilistic reasoning of MEBN, fuses monitored evidence information and experiential knowledge in concrete context, and constructs BF model suitable for current situation. The method can analyze behavior trust of current context. Multi-grain knowledge patterns reuse, quick network model construction, and flexible reasoning of MEBN agree with the strategies of "obvious and structural environment" and "answering change with change" of software behavior supervision in open network environment, which can effectively represent and analyze complex group behavior produced by multi software entities.