Information technology risk assessment display system and method based on cloud platform

Abstract

The invention discloses an information technology risk assessment display system and method based on a cloud platform, and relates to the technical field of risk assessment. A risk sampling module collects real-time state information of a system and obtains a preset evaluation index; the scoring network model analysis module analyzes the evaluation indexes to obtain comprehensive risk evaluation parameters and operation scores; the evaluation hierarchical structure construction module divides the system into different risk levels according to the operation score; the comprehensive evaluation score calculation module calculates a comprehensive evaluation score of the system; the anomaly detection and processing module detects whether the equipment runs abnormally or not; the final score calculation module calculates final scores of all systems on different systems at the same moment; and the resource allocation module generates a resource allocation instruction according to the resource utilization rate and the resource difference, and optimizes resource allocation. According to the invention, a manager can quickly identify a high-risk system and formulate a targeted risk management strategy, so that the overall risk management level is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of risk assessment, and specifically relates to an information technology risk assessment display system and method based on a cloud platform. Background Art

[0002] With the rapid development of information technology, various information systems and network applications are becoming increasingly popular, and enterprises and society are increasingly dependent on information technology. However, the complexity, openness and interconnectedness of the system make it face many security risks and challenges. How to effectively evaluate and manage these risks and ensure the stable operation of the system has become an urgent problem to be solved.

[0003] Traditional information technology risk assessment methods mostly rely on manual experience and simple statistical analysis, which makes it difficult to fully and accurately reflect the risk status of the system. At the same time, these methods often lack real-time and dynamic characteristics, and cannot respond to changes in system status and new risk threats in a timely manner.

[0004] In order to overcome the limitations of traditional methods, information technology risk assessment methods based on cloud platforms and big data technologies have gradually emerged in recent years. However, existing information technology risk assessment methods based on cloud platforms still have some shortcomings. For example, some methods pay too much attention to technical details and ignore the integrity and hierarchy of risk assessment; some methods lack intelligent anomaly detection and processing mechanisms, making it difficult to timely discover and deal with potential security issues; and some methods lack flexibility and dynamism in resource allocation and cannot optimize resources in a timely manner according to changes in system status. Summary of the invention

[0005] In order to overcome the shortcomings and deficiencies of the above-mentioned prior art, the first purpose of the present invention is to provide an information technology risk assessment and display system based on a cloud platform; the second purpose of the present invention is to provide an information technology risk assessment and display method based on a cloud platform.

[0006] The first object of the present invention adopts the following technical solution:

[0007] The information technology risk assessment display system based on the cloud platform includes a risk sampling module, a scoring network model analysis module, an evaluation hierarchy building module, a comprehensive evaluation score calculation module, an anomaly detection and processing module, a final score calculation module and a resource allocation module;

[0008] The risk sampling module is used to collect real-time status information of the system and obtain preset evaluation indicators;

[0009] The scoring network model analysis module is used to analyze the evaluation indicators and obtain comprehensive risk assessment parameters and operation scores;

[0010] The evaluation hierarchy building module is used to classify the system into different risk levels based on the operational scores;

[0011] The comprehensive evaluation score calculation module is used to calculate the comprehensive evaluation score of the system;

[0012] The anomaly detection and processing module is used to detect whether the device has any operating anomalies and adjust the operating status or configuration of the device according to the type of anomaly;

[0013] The final score calculation module is used to calculate the final scores of all systems on different systems at the same time;

[0014] The resource allocation module is used to generate resource configuration instructions based on resource utilization and resource difference to optimize resource allocation.

[0015] The second object of the present invention adopts the following technical solution:

[0016] The information technology risk assessment display method based on a cloud platform is used to implement an information technology risk assessment display system based on a cloud platform, and includes the following steps:

[0017] Step 1: Perform risk sampling on the collected real-time status information of the system to obtain preset evaluation indicators of the system, which include system response time, data transmission delay time, CPU usage, memory usage and geographic location information;

[0018] Step 2: Use the pre-trained scoring network model to analyze the preset evaluation indicators to obtain the corresponding comprehensive risk assessment parameters, mark the largest comprehensive risk assessment parameter as the system operation score of the current operation plan, and arrange the system operation scores in a hierarchical manner to obtain an evaluation hierarchy;

[0019] Step 3: Obtain the weight corresponding to the system operation score according to the evaluation hierarchy, and calculate the weighted average of the system operation score and the corresponding operation evaluation weight to obtain the system comprehensive evaluation score;

[0020] Step 4: Calculate the weighted average of all system comprehensive evaluation scores on different systems at the same time to obtain the final system comprehensive evaluation score;

[0021] Step 5: Determine whether the device has any abnormal operation;

[0022] Step 6: Adjust the operating status of the abnormally operating equipment;

[0023] Step 7. Adjust the configuration of the device that is running abnormally or restart the service.

[0024] Preferably, the risk sampling method comprises:

[0025] Randomly select 5 data points from the network traffic data every minute;

[0026] Select the first data point of each minute from the response time data for every 10 seconds;

[0027] Select the first data point every 5 minutes from the CPU and memory usage per minute;

[0028] Record the system's position change every hour.

[0029] Preferably, the specific steps of step 2 include:

[0030] Standardize or normalize the collected evaluation indicators to ensure that the format and range of the input data meet the requirements of the model;

[0031] The processed evaluation indicators are input into the pre-trained scoring network model, and the model performs calculations based on the trained parameters to output comprehensive risk assessment parameters;

[0032] Select the largest value from the comprehensive risk assessment parameters as the system operation score of the current operation scheme, which is used to indicate the operation status of the current system;

[0033] Gather the operation scores of all systems together and sort them according to the operation scores;

[0034] The sorted scores are divided into three layers: high-risk layer, medium-risk layer and low-risk layer, each layer represents a different risk level.

[0035] Preferably, the comprehensive evaluation score calculation formula in step three is as follows:

[0036]

[0037] Among them, S i is the running score of the ith system; W i is the weight of the ith system.

[0038] Preferably, the final score calculation formula in step 4 is as follows:

[0039]

[0040] Among them, C i is the comprehensive evaluation score of the ith system; V i is the weight of the ith system.

[0041] Preferably, the specific steps of step five include:

[0042] S501, device identification: the number of devices is N, the devices are numbered as n, n = 1, 2, ..., N, where N is a positive integer; the response time, data transmission delay time and resource utilization rate of the nth device are marked as R respectively. n , D n and U n ;

[0043] S502, abnormality detection: the response time R of the nth device n , Data transmission delay time D n and resource utilization U n The corresponding threshold R th , D th and U th Compare and calculate the equipment abnormal operation coefficient A according to the formula n , the calculation formula is as follows:

[0044] Among them, α, β, and γ are preset weight coefficients used to balance the importance of various indicators;

[0045] S503, comparison analysis: abnormal operation coefficient A n With the preset reference value A ref Perform comparative analysis to determine whether the equipment has any abnormal operation; if A n Greater than A ref , then it is judged that the device has an abnormal operation; if A n Less than or equal to A ref , it is determined that there is no operating abnormality in the device.

[0046] Preferably, the specific steps of step six include:

[0047] S601, abnormal number statistics: obtain the number K of devices with abnormal operation in the same time period, where K is an integer greater than or equal to 0, and K<N;

[0048] S602, abnormal ratio analysis: the ratio of the number of devices K with abnormal operation at the current moment to the number of devices N is marked as abnormal ratio P.

[0049]

[0050] According to the locations of K abnormal devices at the current moment, an abnormal distribution data set is established, and the standard deviation S of the abnormal distribution data set is calculated.

[0051] If there is an abnormal ratio P that is less than or equal to the preset abnormal threshold P th The case is marked as case A;

[0052] If there is an abnormal ratio P greater than the preset abnormal threshold Pth The case is marked as case B;

[0053] If there is a standard deviation S that is less than or equal to the preset standard deviation threshold S th The case is marked as case C;

[0054] If there is a standard deviation S greater than the preset standard deviation threshold S th The case is marked as case D;

[0055] S603, abnormal type mark:

[0056] Mark the devices with both A and C conditions as hardware abnormalities, and adjust the devices with hardware abnormalities to isolation mode or shut down for maintenance;

[0057] The abnormally operating device in any condition except the condition A and condition C is marked as a software abnormality, and the configuration of the abnormally operating device is adjusted or the service is restarted.

[0058] Preferably, the specific steps of step seven include:

[0059] S701, resource utilization detection: extract resource utilization rates of N devices on the system at the same time; number the devices on the same system as n in sequence, and number them in sequence according to the network topology order of the devices;

[0060] S702, resource allocation: the resource utilization rate of the current device U n Resource utilization U of adjacent devices n-1 and U n+1 The difference is marked as resource difference ΔU n-1 and ΔU n+1 ;

[0061] ΔU n-1 =|U n -U n-1 |;

[0062] ΔU n+1 =|U n -U n+ |;

[0063] Compare and analyze the resource difference with the resource configuration threshold T, and generate resource configuration instructions of different levels according to different resource difference ranges:

[0064] If ΔU n-1 ≤T and ΔU n+1 ≤T, it is marked as a low-level resource difference and a low-level resource configuration instruction is generated;

[0065] If ΔU n-1 >T and ΔUn+1 <T or ΔU n-1 ≤T and ΔU n+1 >T, it is marked as medium-level resource deficiency and a medium-level resource configuration instruction is generated;

[0066] If ΔU n-1 >T and ΔU n+1 >T, it is marked as high-level resource deficiency and a high-level resource configuration instruction is generated.

[0067] In summary, due to the adoption of the above technical solutions, the beneficial effects of the present invention are as follows:

[0068] 1. Through the application of the scoring network model and multi-level risk assessment and display in the present invention, the system can more accurately evaluate the risk level of the system, improving the accuracy and efficiency of risk assessment; dividing the system into different risk levels helps managers quickly identify high-risk systems, formulate targeted risk management strategies, and improve the overall risk management level.

[0069] 2. The comprehensive evaluation scoring calculation module in the present invention calculates the comprehensive evaluation score of the system through weighted average calculation, providing a more scientific risk assessment result and a reliable basis for decision-makers; the final scoring calculation module performs weighted average calculation on the comprehensive evaluation scores of all systems on different systems at the same moment to obtain the final score of the comprehensive evaluation of the system, providing a quantitative basis for overall risk management.

[0070] 3. The intelligent anomaly detection and processing mechanism in the present invention automatically detects whether there is an abnormal operation of the device by real-time monitoring the status information of the device, and timely adjusts the operation status or configuration of the device, improving the stability and reliability of the system; the dynamic resource allocation strategy generates resource configuration instructions according to resource utilization rate and resource difference, optimizes resource allocation, ensures the efficient use of system resources, and reduces maintenance costs; through the risk assessment model, multi-level evaluation and display methods, intelligent anomaly detection and processing mechanism, and dynamic resource allocation strategy, comprehensive monitoring and optimized management of the system are realized, providing strong support for the long-term stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0072] Figure 1 Shows a module diagram of the information technology risk assessment and display system based on the cloud platform of the present invention;

[0073] Figure 2 A flow chart of the information technology risk assessment display method based on a cloud platform of the present invention is shown;

[0074] Figure 3 The flowchart of step six of the present invention for adjusting the operating state of abnormally operating equipment is shown. DETAILED DESCRIPTION

[0075] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0076] Embodiment 1:

[0077] See also Figure 1 As shown, the information technology risk assessment and display system based on the cloud platform of this embodiment includes a risk sampling module, a scoring network model analysis module, an evaluation hierarchy building module, a comprehensive evaluation scoring calculation module, an anomaly detection and processing module, a final scoring calculation module and a resource allocation module;

[0078] The risk sampling module is used to collect real-time status information of the system and obtain preset evaluation indicators.

[0079] The scoring network model analysis module is used to analyze the evaluation indicators and obtain comprehensive risk assessment parameters and operation scores.

[0080] The Assessment Hierarchy building block is used to classify systems into different risk levels based on operational scores.

[0081] The comprehensive evaluation score calculation module is used to calculate the comprehensive evaluation score of the system.

[0082] The anomaly detection and processing module is used to detect whether there are any operating anomalies in the device and adjust the operating status or configuration of the device according to the type of anomaly.

[0083] The final score calculation module is used to calculate the final scores of all systems on different systems at the same time.

[0084] The resource allocation module is used to generate resource configuration instructions based on resource utilization and resource difference to optimize resource allocation.

[0085] The beneficial effects of this embodiment are as follows: through the application of the scoring network model and multi-level risk evaluation and display, the system can more accurately evaluate the risk level of the system and improve the accuracy and efficiency of risk evaluation. The system is divided into different risk levels according to the operation score, which helps managers quickly identify high-risk systems, formulate targeted risk management strategies, and improve the overall risk management level.

[0086] Embodiment 2:

[0087] See also Figure 2 As shown, the information technology risk assessment display method based on the cloud platform in this embodiment is as follows:

[0088] Step 1: Perform risk sampling on the collected real-time status information of the system.

[0089] Risk sampling is performed on the collected real-time status information of the system to obtain preset evaluation indicators of the system, wherein the preset evaluation indicators include but are not limited to the system response time, data transmission delay time, CPU utilization, memory utilization and geographic location information, etc.

[0090] The specific sampling method is as follows: randomly select 5 data points from the network traffic data every minute; select the first data point of each minute from the response time data every 10 seconds; select the first data point of every 5 minutes from the CPU and memory usage every minute; record the system's location changes every hour.

[0091] Step 2: Use the pre-trained scoring network model for analysis.

[0092] The preset evaluation indicators are analyzed using a pre-trained scoring network model to obtain corresponding comprehensive risk assessment parameters, and the largest comprehensive risk assessment parameter is marked as the system operation score of the current operation scheme; the system operation scores are arranged hierarchically to obtain an evaluation hierarchy.

[0093] Specifically, the collected evaluation indicators are standardized or normalized to ensure that the format and range of the input data meet the requirements of the model.

[0094] The processed evaluation indicators are input into the pre-trained scoring network model. The model calculates according to the trained parameters and outputs the comprehensive risk assessment parameter R i =(R1,R2,R3,...,R i ).

[0095] From the comprehensive risk assessment parameter R i The largest value is selected as the system operation score of the current operation scheme, which is used to indicate the operation status of the current system.

[0096] The operation scores of all systems are aggregated and sorted according to the operation scores. The sorted scores are divided into three layers: high risk layer, medium risk layer and low risk layer. Each layer represents a different risk level. The levels are as follows:

[0097] High-risk tier: The highest-scoring systems that require priority.

[0098] Medium risk tier: Systems with medium scores that require regular monitoring.

[0099] Low-risk tier: The lowest-scoring systems are relatively stable.

[0100] Step 3: Obtain the weight corresponding to the system operation score according to the evaluation hierarchy.

[0101] According to the evaluation hierarchy, the system operation evaluation weight corresponding to the system operation score is obtained, and the system operation score and the corresponding operation evaluation weight are weighted averaged to obtain the system comprehensive evaluation score SW. The calculation formula is as follows:

[0102]

[0103] Among them, S i is the running score of the ith system; W i is the weight of the ith system.

[0104] Step 4: Perform a weighted average calculation on all system comprehensive evaluation scores on different systems at the same time to obtain a final system comprehensive evaluation score.

[0105] Final score calculation: Get the comprehensive evaluation scores of all systems on different systems at the same time, determine the weight of each score based on the operational importance and historical performance of each system, and perform weighted average calculation through the formula to obtain the final score CV of the system comprehensive evaluation. The calculation formula is as follows:

[0106]

[0107] Among them, C i is the comprehensive evaluation score of the ith system; V i is the weight of the ith system.

[0108] The specific method is as follows:

[0109] S401. Establish an operation plan: According to the operating environment of the current system, establish J operation plans, and simulate each operation plan M times according to the preset evaluation indicators to obtain the maximum information technology resource occupation of each simulation of the current operation plan and each risk assessment parameter of the corresponding preset evaluation indicators, including but not limited to response time, data transmission delay time, and resource utilization.

[0110] S402, normalization processing: each risk assessment parameter P i Through normalization processing, the normalized risk assessment parameter P′ is obtained i ,

[0111] Among them, min(P) and max(P) are the minimum and maximum values ​​of all risk parameters respectively.

[0112] S403, comprehensive risk assessment parameters: multiple normalized risk assessment parameters P'1, P'2, P'3, P'4, P'5, P'6, P'7, P'8, P'9, P'10, P'11, P'22, P'33, P'14, P'15, P'16, P'17, P'18, P'19, P'20, P'21, P'22, P'33, P'44, n The comprehensive risk assessment parameter R of the current operation scheme is accumulated, R = ∑P′ n ;

[0113] The comprehensive risk assessment parameters of the M simulation runs are analyzed for size, and the largest comprehensive risk assessment parameter is marked as the system operation score corresponding to the current operation plan.

[0114] S404, hierarchical arrangement: hierarchically arranging the system operation scores to obtain an evaluation hierarchy structure.

[0115] Aggregate the operational scores of all systems.

[0116] Sort by running score, either in ascending or descending order.

[0117] The ranked scores are divided into several levels, each representing a different risk level. For example:

[0118] High-risk tier: The highest-scoring systems that require priority.

[0119] Medium risk tier: Systems with medium scores that require regular monitoring.

[0120] Low-risk tier: The lowest-scoring systems are relatively stable.

[0121] The maximum occupied information technology resources are obtained as follows:

[0122] Real-time status information collection: obtain the real-time status information of all devices on the system in the same time period, perform risk sampling on the collected real-time status information of the devices, and obtain the preset evaluation indicators of the devices.

[0123] Operation status judgment: determine the operation status of the device according to the preset evaluation index, and judge whether the device has any operation abnormality. If the operation is abnormal, adjust the operation status of the abnormal device (such as adjusting resource allocation)

[0124] Step 5: Determine whether the device has any operating abnormalities.

[0125] S501, device identification: the number of devices is N, the devices are numbered as n, n = 1, 2, ..., N, where N is a positive integer; the response time, data transmission delay time and resource utilization rate of the nth device are marked as R respectively. n , D n and U n .

[0126] S502, abnormality detection: the response time R of the nth device n , Data transmission delay time D n and resource utilization U n The corresponding threshold R th , D th and U th Compare and calculate the equipment abnormal operation coefficient A according to the formula n , the calculation formula is as follows:

[0127] Among them, α, β, and γ are preset weight coefficients used to balance the importance of various indicators.

[0128] S503, comparison analysis: abnormal operation coefficient A n With the preset reference value A ref Perform comparative analysis to determine whether the equipment has any abnormal operation; if A n Greater than A ref , it is determined that the device has an abnormal operation; if A n Less than or equal to A ref , it is determined that there is no operating abnormality in the device.

[0129] Step 6: Adjust the operating status of the abnormally operating equipment.

[0130] See also Figure 3 As shown, the details are as follows:

[0131] S601. Abnormal number statistics: obtain the number K of devices with abnormal operation in the same time period, where K is an integer greater than or equal to 0, and K<N.

[0132] S602, abnormal ratio analysis: the ratio of the number of devices K with abnormal operation at the current moment to the number of devices N is marked as abnormal ratio P.

[0133]

[0134] According to the locations of K abnormal devices at the current moment, an abnormal distribution data set is established, and the standard deviation S of the abnormal distribution data set is calculated.

[0135] If there is an abnormal ratio P that is less than or equal to the preset abnormal threshold P th The case is marked as case A;

[0136] If there is an abnormal ratio P greater than the preset abnormal threshold P th The case is marked as case B;

[0137] If there is a standard deviation S that is less than or equal to the preset standard deviation threshold S th The case is marked as case C;

[0138] If there is a standard deviation S greater than the preset standard deviation threshold S th The case is marked as case D.

[0139] S603, abnormal type mark:

[0140] Mark the devices with both A and C conditions as hardware abnormalities, and adjust the devices with hardware abnormalities to isolation mode or shut down for maintenance;

[0141] The abnormally operating device in any condition except the condition A and condition C is marked as a software abnormality, and the configuration of the abnormally operating device is adjusted or the service is restarted.

[0142] Step 7. Adjust the configuration of the device that is running abnormally or restart the service.

[0143] S701, resource utilization detection: extract resource utilization rates of N devices on the system at the same time; number the devices on the same system as n in sequence, and number them in sequence according to the network topology order of the devices.

[0144] S702, resource allocation: the resource utilization rate of the current device U n Resource utilization U of adjacent devices n-1 and U n+1 The difference is marked as resource difference ΔU n-1 and ΔU n+1 ;

[0145] ΔU n-1 =|U n -U n-1 |;

[0146] ΔU n+1 =|U n -U n+ |;

[0147] Compare and analyze the resource difference with the resource configuration threshold T, and generate resource configuration instructions of different levels according to different resource difference ranges:

[0148] If ΔUn-1 ≤ T and ΔU n+1 ≤ T, it is marked as poor low - level resources and a low - level resource configuration instruction is generated;

[0149] If ΔU n-1 > T and ΔU n+1 < T or ΔU n-1 ≤ T and ΔU n+1 > T, it is marked as poor medium - level resources and a medium - level resource configuration instruction is generated;

[0150] If ΔU n-1 > T and ΔU n+1 > T, it is marked as poor high - level resources and a high - level resource configuration instruction is generated.

[0151] The beneficial effects of this embodiment are as follows: Through the risk assessment model, multi - level evaluation and display methods, intelligent anomaly detection and processing mechanisms, and dynamic resource allocation strategies, the comprehensive monitoring and optimization management of the system are realized, the stability and reliability of the system are improved, and the maintenance cost is reduced.

[0152] The weight coefficients of the present invention are used to measure the influence degree of different factors or variables on a certain result or decision. The definition of the weight coefficient refers to the numerical value assigned to each factor when comparing and evaluating multiple factors to reflect its importance or priority. These weight coefficients can be determined according to specific situations and requirements, and are usually formulated and confirmed jointly by professionals or relevant interested parties. By reasonably setting the weight coefficients, it can help the program or system make more accurate decisions or predictions.

[0153] As mentioned above, only the specific preferred embodiments of the present invention are described, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, according to the technical solution and inventive concept of the present invention, makes equivalent replacements or changes, and should be covered within the protection scope of the present invention.

[0154] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all details in detail, nor do they limit the present invention to only the specific embodiments. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments to better explain the principle and practical application of the present invention, so that those skilled in the art in the relevant technical field can well understand and utilize the present invention. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. The information technology risk assessment and display system based on the cloud platform is characterized by: The system includes a risk sampling module, a scoring network model analysis module, an evaluation hierarchy construction module, a comprehensive evaluation score calculation module, an anomaly detection and processing module, a final score calculation module and a resource allocation module; The risk sampling module is used to collect real-time status information of the system and obtain preset evaluation indicators; The scoring network model analysis module is used to analyze the evaluation indicators and obtain comprehensive risk assessment parameters and operation scores; The evaluation hierarchy building module is used to classify the system into different risk levels based on the operational scores; The comprehensive evaluation score calculation module is used to calculate the comprehensive evaluation score of the system; The anomaly detection and processing module is used to detect whether the device has any operating anomalies and adjust the operating status or configuration of the device according to the type of anomaly; The final score calculation module is used to calculate the final scores of all systems on different systems at the same time; The resource allocation module is used to generate resource configuration instructions based on resource utilization and resource difference to optimize resource allocation.

2. A cloud-based information technology risk assessment and display method, used to implement the cloud-based information technology risk assessment and display system as claimed in claim 1, characterized in that: The following steps are involved: Step 1: Perform risk sampling on the collected real-time status information of the system to obtain preset evaluation indicators of the system, wherein the preset evaluation indicators include the system response time, data transmission delay time, CPU usage, memory usage and geographic location information; Step 2: Use the pre-trained scoring network model to analyze the preset evaluation indicators to obtain the corresponding comprehensive risk assessment parameters, mark the largest comprehensive risk assessment parameter as the system operation score of the current operation plan, and arrange the system operation scores in a hierarchical manner to obtain an evaluation hierarchy; Step 3: Obtain the weight corresponding to the system operation score according to the evaluation hierarchy, and calculate the weighted average of the system operation score and the corresponding operation evaluation weight to obtain the system comprehensive evaluation score; Step 4: Calculate the weighted average of all system comprehensive evaluation scores on different systems at the same time to obtain the final system comprehensive evaluation score; Step 5: Determine whether the device has any abnormal operation; Step 6: Adjust the operating status of the abnormally operating equipment; Step 7. Adjust the configuration of the device that is running abnormally or restart the service.

3. The information technology risk assessment and display method based on a cloud platform according to claim 2 is characterized in that: The risk sampling method in step 1 includes: Randomly select 5 data points from the network traffic data every minute; Select the first data point of each minute from the response time data for every 10 seconds; Select the first data point every 5 minutes from the CPU and memory usage per minute; Record the system's position change every hour.

4. The information technology risk assessment and display method based on a cloud platform according to claim 2 is characterized in that: The specific steps of step 2 include: Standardize or normalize the collected evaluation indicators to ensure that the format and range of the input data meet the requirements of the model; The processed evaluation indicators are input into the pre-trained scoring network model, and the model performs calculations based on the trained parameters to output comprehensive risk assessment parameters; Select the largest value from the comprehensive risk assessment parameters as the system operation score of the current operation scheme, which is used to indicate the operation status of the current system; Gather the operation scores of all systems together and sort them according to the operation scores; The sorted scores are divided into three layers: high-risk layer, medium-risk layer and low-risk layer, each layer represents a different risk level.

5. The information technology risk assessment and display method based on a cloud platform according to claim 2 is characterized in that: The comprehensive evaluation score calculation formula of step 3 is as follows: Among them, S i is the running score of the ith system; W i is the weight of the ith system.

6. The information technology risk assessment and display method based on a cloud platform according to claim 2 is characterized in that: The final score calculation formula of step 4 is as follows: Among them, C i is the comprehensive evaluation score of the ith system; V i is the weight of the ith system.

7. The information technology risk assessment and display method based on a cloud platform according to claim 2 is characterized in that: The specific steps of step five include: S501, device identification: the number of devices is N, the devices are numbered as n, n = 1, 2, ..., N, where N is a positive integer; the response time, data transmission delay time and resource utilization rate of the nth device are marked as R respectively. n , D n and U n ; S502, abnormality detection: the response time R of the nth device n , Data transmission delay time D n and resource utilization U n The corresponding threshold R th , D th and U th Compare and calculate the equipment abnormal operation coefficient A according to the formula n , the calculation formula is as follows: Among them, α, β, and γ are preset weight coefficients used to balance the importance of various indicators; S503, comparison analysis: abnormal operation coefficient A n With the preset reference value A ref Perform comparative analysis to determine whether the equipment has any abnormal operation; if A n Greater than A ref , it is determined that the device has an abnormal operation; if A n Less than or equal to A ref , it is determined that there is no operating abnormality in the device.

8. The information technology risk assessment and display method based on a cloud platform according to claim 2 is characterized in that: The specific steps of step six include: S601, abnormal number statistics: obtain the number K of devices with abnormal operation in the same time period, where K is an integer greater than or equal to 0, and K<N; S602, abnormal ratio analysis: the ratio of the number of devices K with abnormal operation at the current moment to the number of devices N is marked as abnormal ratio P. According to the locations of K abnormal devices at the current moment, an abnormal distribution data set is established, and the standard deviation S of the abnormal distribution data set is calculated. If there is an abnormal ratio P that is less than or equal to the preset abnormal threshold P th The case is marked as case A; If there is an abnormal ratio P greater than the preset abnormal threshold P th The case is marked as case B; If there is a standard deviation S that is less than or equal to the preset standard deviation threshold S th The case is marked as case C; If there is a standard deviation S greater than the preset standard deviation threshold S th The case is marked as case D; S603, abnormal type mark: Mark the devices with both A and C conditions as hardware abnormalities, and adjust the devices with hardware abnormalities to isolation mode or shut down for maintenance; The abnormally operating device in any condition except the condition A and condition C is marked as a software abnormality, and the configuration of the abnormally operating device is adjusted or the service is restarted.

9. The information technology risk assessment and display method based on a cloud platform according to claim 2 is characterized in that: The specific steps of step seven include: S701, resource utilization detection: extract resource utilization rates of N devices on the system at the same time; number the devices on the same system as n in sequence, and number them in sequence according to the network topology order of the devices; S702, resource allocation: the resource utilization rate of the current device U n Resource utilization U of adjacent devices n-1 and U n+1 The difference is marked as resource difference ΔU n-1 and ΔU n+1 ; ΔU n-1 =|U n -U n-1 |; ΔU n+1 =|U n -U n+ |; Compare and analyze the resource difference with the resource configuration threshold T, and generate resource configuration instructions of different levels according to different resource difference ranges: If ΔU n-1 ≤T and ΔU n+1 ≤T, it is marked as a low-level resource difference and a low-level resource configuration instruction is generated; If ΔU n-1 >T and ΔU n+1 ≤T or ΔU n_1 ≤T and ΔU n+1 >T, it is marked as a medium-level resource difference and generates a medium-level resource configuration instruction; If ΔU n-1 >T and ΔU n+1 >T, it is marked as a high-level resource difference and generates a high-level resource configuration instruction.

Images