Multi-dimensional assessment method for credential environment migration

Abstract

The invention discloses a multi-dimensional evaluation method for credential environment migration, and particularly relates to the field of evaluation. According to the method, an evaluation index system covering infrastructure, an application system, data resources and security compliance is constructed, and comprehensive scanning is realized through instruction set detection, binary analysis and equal security compliance inspection; dynamically calculating the weight by adopting an AHP-entropy weight hybrid model, and triggering weight rebalance based on the volatility; through combination of static scanning and a dynamic probe, the compatibility, performance and safety differences are quantitatively analyzed; and finally, generating a visual risk assessment report, integrating data of each stage to calculate a compatibility score, a performance loss rate and a security level, providing instruction level difference comparison, a performance flame graph and a vulnerability attack path interaction view, and outputting a migration suggestion comprising a priority reconstruction list, an NEON instruction optimization scheme and a staged reinforcement plan.

Description

Technical Field

[0001] The present invention relates to the field of evaluation technology, and more specifically, to a multi-dimensional evaluation method for the migration of an information and communication technology environment. Background Art

[0002] In today's digital age, innovation in information technology applications (ICT) has become a key strategy for promoting national scientific and technological self-reliance and ensuring national information security. With the intensification of global scientific and technological competition and the urgent domestic demand for independent and controllable technologies, the ICT industry has ushered in unprecedented development opportunities. Key industries such as government, finance, telecommunications, and energy have accelerated the transformation to ICT, gradually achieving domestic substitution from chips and operating systems to databases, middleware, and various application software. Against this backdrop, a large number of traditional business systems based on the x86 architecture need to be migrated to domestic ICT environments (such as ARM, LoongArch, and other architectures).

[0003] However, it still has some shortcomings in actual use. For example, the migration assessment of information technology innovation mainly relies on manual experience and lacks systematic quantitative analysis tools, resulting in high migration costs, long cycles and uncontrollable risks. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a multi-dimensional evaluation method for the migration of an information and communication environment to solve the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] S1: Build an evaluation indicator system covering the infrastructure layer, application system layer, data resource layer, and security and compliance layer;

[0007] S2: Calculate the weight coefficients of indicators at each level through the dynamic weight allocation module;

[0008] S3: Use a quantitative assessment engine to conduct a multi-dimensional comparative analysis of the source environment and the target trusted computing environment;

[0009] S4: Generate a visual assessment report based on the migration risk assessment model, including compatibility score, performance loss rate, and security level.

[0010] Preferably, in step S1, based on a comprehensive scan and analysis of the source environment and the target trust creation environment: at the infrastructure layer, through CPUID instruction set detection and / proc / cpuinfo parsing, the coverage difference of SIMD instruction sets under x86 and ARM architectures, as well as the missing of AVX / AVX2 and NEON instructions are compared; at the same time, the sysfs interface of the Linux kernel is used to monitor the driver adaptation status of PCIe / USB devices in real time, and record the number of driver loading failures and the corresponding device ID;

[0011] At the application system layer, a combination of static analysis and dynamic tracing is adopted. The objdump and readelf tools are used to parse the .dynamic segment of the ELF file, count the number of unresolved symbols, and track system calls through strace to analyze API call failure cases caused by architecture differences.

[0012] Preferably, in step S2, an initial judgment matrix is ​​constructed based on the analytic hierarchy process (AHP), and domain experts compare the importance of each of the infrastructure layer (weight basis 30%), application system layer (25%), data resource layer (20%), and security compliance layer (25%) to form an initial weight distribution on a scale of 1-9;

[0013] In order to eliminate subjective bias, the system simultaneously introduces the entropy weight method to correct the objective weight of indicators: by collecting sample data of historical migration projects, the information entropy of each indicator is calculated;

[0014] For key localization indicators (such as Kylin OS compatibility), the system sets a hard weight lower limit of 40% and dynamically updates the weights of related indicators through a Bayesian network. For example, if the peripheral driver compatibility rate is detected to be less than 85%, the weight of the relevant CPU instruction set indicator will be automatically increased by 20%. After all weight coefficients pass the consistency check (CR < 0.1), they are written to the weight configuration library by the distributed computing nodes, and a timestamped weight change log is generated for audit traceability.

[0015] Preferably, in step S3, distributed scanning nodes are deployed in the static scanning phase to perform full asset discovery on the source environment, and an improved ELF parser is used to disassemble the binary file to construct a knowledge graph containing function call relationships, symbol table dependencies, and instruction features. For Java / Python interpreted applications, cross-platform sensitive operation features are extracted through bytecode analysis tools, such as JNI calls and system command execution.

[0016] The dynamic probe system adopts a modular design and includes the following core components:

[0017] Kernel-level probes use eBPF technology to implant detection hooks at system call entry points, capturing the differences in parameters and return values ​​of file operations and network communication behaviors in real time.

[0018] The runtime analyzer injects bytecode probes into the JVM / .NET managed environment to monitor abnormal calling patterns of cross-platform APIs;

[0019] Hardware performance counters collect microarchitectural metrics such as CPI and cache hit rate through the PMU interface. The probe system is optimized specifically for typical differences in trusted computing environments: when a NEON instruction conversion is detected under the ARM architecture, test vectors are automatically injected to verify the loss of computational precision.

[0020] The quantitative comparison engine uses a multi-stage processing pipeline: in the preprocessing stage, feature engineering is used to convert static scan results into standardized metrics. In the dynamic analysis stage, a time series database is used to store runtime metrics collected by the probe, and a sliding window algorithm is used to calculate the performance deviation rate. The security comparison uses ATT&CK matrix modeling to map detected configuration differences to the corresponding CRIME attack risk attack techniques used in TLS 1.0.

[0021] The final quantitative report includes: a compatibility matrix that shows the matching degree of each component in three dimensions: ABI, API, and behavior.

[0022] Preferably, in step S4, the evaluation results of the previous stages are integrated: the instruction set compatibility analysis of the infrastructure layer, the dynamic link library adaptation of the application system layer, the verification error rate of the data resource layer, and the national secret algorithm coverage data of the security compliance layer are comprehensively calculated through a weighted decision model; the compatibility score adopts a percentage system, of which hardware compatibility accounts for 35%, including CPU instruction set matching and driver adaptation rate; software compatibility accounts for 45%, including binary compatibility and middleware dependency; data compatibility accounts for 20%, and finally the comprehensive score of the current environment is obtained by the formula. The specific calculation scheme of the compatibility score is:

[0023] D = ∑(E × F) × γ, where D is the compatibility score, E is the sub-item score, F is the dynamic weight, and γ is the architecture modification coefficient;

[0024] The detection results of static scanning and dynamic probes are integrated: on the one hand, based on the cross-compilation performance analysis data of the LLVM compiler, and on the other hand, combined with the performance probe data actually running in the target environment, the performance loss rate of each business component is predicted through a regression model; the report specifically marks the high-loss components and displays the specific bottleneck points, such as the lack of specific CRC32 instruction acceleration under the ARM architecture; the security level assessment adopts the scoring system of Information Security Technology 2.0, mapping the usage of cryptographic algorithms and audit log integrity data detected in the early stage to five security levels, and generating reinforcement suggestions including a specific vulnerability list.

[0025] The report's visualization is interactive: the main dashboard uses a "traffic light" format to intuitively display the status of three core metrics: compatibility (yellow warning), performance (green compliance), and security (red high risk). Drill down to view detailed analysis at each level. The compatibility dimension provides an instruction-level diff comparison view, using a code diff comparer to visually identify assembly code segments requiring modification. Performance analysis uses flame graphs to display function-level time distribution and highlight hotspot functions caused by cross-architecture differences.

[0026] The technical effects and advantages of the present invention are as follows:

[0027] 1. Establish an evaluation indicator system covering four levels: infrastructure, application systems, data resources, and security compliance. Use a variety of technical means to conduct a comprehensive scan and analysis of both the source and target environments to ensure a comprehensive and systematic evaluation, without missing any key factors that may affect the migration.

[0028] 2. Precise detection methods are used in assessments at all levels. For example, the infrastructure layer uses CPUID instruction set detection, / proc / cpuinfo parsing, and sysfs interface monitoring to accurately compare different architecture differences and device driver adaptation status. The application system layer combines static analysis and dynamic tracing to accurately count the number of unresolved symbols and analyze API call failure cases. The data resource layer uses specific SQL commands and verification algorithms to accurately establish performance benchmarks and calculate error rates. The security and compliance layer uses the Information Security Protection 2.0 standard to accurately detect system service configurations and scan for vulnerabilities, thereby providing accurate data support for assessments. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0030] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0031] See also Figure 1 As shown, the present invention provides a multi-dimensional evaluation method for the migration of an information and innovation environment, comprising:

[0032] S1: Build an evaluation indicator system covering the infrastructure layer, application system layer, data resource layer, and security and compliance layer;

[0033] In the step S1, based on a comprehensive scan and analysis of the source environment and the target trusted innovation environment: at the infrastructure layer, through CPUID instruction set detection and / proc / cpuinfo parsing, the coverage difference of SIMD instruction sets under x86 and ARM architectures, as well as the missing of AVX / AVX2 and NEON instructions are compared; at the same time, the sysfs interface of the Linux kernel is used to monitor the driver adaptation status of PCIe / USB devices in real time, and record the number of driver loading failures and the corresponding device ID;

[0034] At the application system level, we combine static analysis with dynamic tracing. We use objdump and readelf to parse the .dynamic section of ELF files, count the number of unresolved symbols, and use strace to track system calls and analyze API call failures caused by architecture differences.

[0035] The data resource layer establishes a performance benchmark by executing the SQL commands SELECT COUNT(*) and EXPLAIN ANALYZE on the source database. Comparative testing is then conducted in the target environment to calculate the deviation rate of query response time. BLOB fields are also verified block by block using the block CRC32 checksum algorithm, with an error threshold set to no more than 0.005%.

[0036] The assessment of the security compliance layer relies on the Information Security Protection 2.0 standard and uses automated scripts to detect system service configurations, including but not limited to checking whether the encryption algorithm configuration in / etc / ssh / sshd_config complies with national encryption standards, whether the retention period of audit logs meets the 180-day requirement, and using OpenSCAP tools to scan system vulnerabilities.

[0037] S2: Calculate the weight coefficients of indicators at each level through the dynamic weight allocation module;

[0038] In step S2, an initial judgment matrix is ​​constructed based on the Analytic Hierarchy Process (AHP), and domain experts compare the importance of each of the infrastructure layer (weight basis 30%), application system layer (25%), data resource layer (20%), and security and compliance layer (25%) to form an initial weight distribution on a scale of 1-9;

[0039] In order to eliminate subjective bias, the system simultaneously introduces the entropy weight method to correct the objective weight of the indicators: by collecting sample data of historical migration projects, the information entropy of each indicator is calculated. The specific method for calculating information entropy is as follows:

[0040] A j =-k∑(p ij lnp ij ), where A j Expressed as information entropy, p ij It is represented as the normalized value of the i-th sample on the j-th indicator, and k is represented as the proportional constant;

[0041] Finally, the entropy weight is obtained, and the calculation method of the entropy weight is as follows:

[0042] ω=(1-A j ) / ∑(1-A j ), where ω is the entropy weight, A j Expressed as information entropy;

[0043] The dynamic adjustment process uses a sliding window mechanism. The indicator volatility is recalculated every time an evaluation cycle is completed (usually 24 hours). Since one evaluation cycle is 24 hours, the indicator volatility is calculated as follows:

[0044] Among them, σ represents the index volatility, x t Expressed as the indicator value at the t-th time point, It is expressed as the indicator mean, and n is the total number of data points.

[0045] When the hardware compatibility index of the infrastructure layer fluctuates by more than 15%, the weight rebalancing algorithm is triggered. The calculation method of the weight rebalancing algorithm is as follows:

[0046] B0==αB1+(1-α)B2, where B0 represents the updated weight, B1 represents the old weight, B2 represents the real-time weight, and α represents the smoothing factor;

[0047] For key localization indicators (such as Kylin OS compatibility), the system sets a hard weight lower limit of 40% and dynamically updates the weights of related indicators through a Bayesian network. For example, if the peripheral driver compatibility rate is detected to be less than 85%, the weight of the relevant CPU instruction set indicator will be automatically increased by 20%. After all weight coefficients pass the consistency check (CR < 0.1), they are written to the weight configuration library by the distributed computing nodes, and a timestamped weight change log is generated for audit traceability.

[0048] S3: Use a quantitative assessment engine to conduct a multi-dimensional comparative analysis of the source environment and the target trusted computing environment;

[0049] In step S3, during the static scanning phase, distributed scanning nodes are deployed to perform full asset discovery on the source environment. An improved ELF parser is used to disassemble binary files and construct a knowledge graph containing function call relationships, symbol table dependencies, and instruction features. For Java / Python interpreted applications, bytecode analysis tools are used to extract cross-platform sensitive operation features, such as JNI calls and system command execution.

[0050] The dynamic probe system adopts a modular design and includes the following core components:

[0051] Kernel-level probes use eBPF technology to implant detection hooks at system call entry points, capturing the differences in parameters and return values ​​of file operations and network communication behaviors in real time.

[0052] The runtime analyzer injects bytecode probes into the JVM / .NET managed environment to monitor abnormal calling patterns of cross-platform APIs;

[0053] Hardware performance counters collect microarchitectural metrics such as CPI and cache hit rate through the PMU interface. The probe system is optimized specifically for typical differences in trusted computing environments: when a NEON instruction conversion is detected under the ARM architecture, test vectors are automatically injected to verify the loss of computational precision.

[0054] The quantitative comparison engine uses a multi-stage processing pipeline: in the preprocessing stage, feature engineering is used to convert static scan results into standardized metrics. In the dynamic analysis stage, a time series database is used to store runtime metrics collected by the probe, and a sliding window algorithm is used to calculate the performance deviation rate. The security comparison uses ATT&CK matrix modeling to map detected configuration differences to the corresponding CRIME attack risk attack techniques used in TLS 1.0.

[0055] The resulting quantitative report includes: a compatibility matrix showing the compatibility of each component in three dimensions: ABI, API, and behavior;

[0056] Performance degradation spectrum, which intuitively displays the loss of each subsystem in terms of IPC, latency and other indicators;

[0057] Security gap analysis, using CVSS scores to quantify the risk level of non-compliant items;

[0058] All data is presented through a visualization platform, which supports drilling down to specific problematic instructions or system calls, providing precise positioning for migration and transformation.

[0059] S4: Generate a visual assessment report based on the migration risk assessment model, including compatibility score, performance loss rate, and security level.

[0060] In step S4, the evaluation results of the previous stages are integrated: the instruction set compatibility analysis of the infrastructure layer, the dynamic link library adaptation of the application system layer, the verification error rate of the data resource layer, and the national secret algorithm coverage data of the security compliance layer are comprehensively calculated through a weighted decision model; the compatibility score is based on a percentage system, of which hardware compatibility accounts for 35%, including CPU instruction set matching and driver adaptation rate; software compatibility accounts for 45%, including binary compatibility and middleware dependency; data compatibility accounts for 20%, and finally the comprehensive score of the current environment is obtained through the formula. The specific calculation scheme for the compatibility score is:

[0061] D = ∑(E × F) × γ, where D is the compatibility score, E is the sub-item score, F is the dynamic weight, and γ is the architecture modification coefficient;

[0062] The detection results of static scanning and dynamic probes are integrated: on the one hand, based on the cross-compilation performance analysis data of the LLVM compiler, and on the other hand, combined with the performance probe data actually running in the target environment, the performance loss rate of each business component is predicted through a regression model; the report specifically marks the high-loss components and displays the specific bottleneck points, such as the lack of specific CRC32 instruction acceleration under the ARM architecture; the security level assessment adopts the scoring system of Information Security Technology 2.0, mapping the usage of cryptographic algorithms and audit log integrity data detected in the early stage to five security levels, and generating reinforcement suggestions including a specific vulnerability list.

[0063] The report's visualization is interactive: the main dashboard uses a "traffic light" format to visually display the status of three core indicators: compatibility (yellow warning), performance (green compliance), and security (red high risk). Drill down to view detailed analysis at each level. The compatibility dimension provides an instruction-level difference comparison view, using a code difference comparer to visually display assembly code segments that need modification. Performance analysis uses flame graphs to display function-level time distribution and highlight hot functions caused by cross-architecture differences. Security assessment uses attack path diagrams to visualize vulnerability exploit chains, specifically highlighting key risks involving domestically produced components. Automatically generated migration path recommendations include:

[0064] A prioritized list of modifications, prioritizing three high-risk compatibility issues that affect business continuity;

[0065] Performance optimization plan: It is recommended to rewrite modules with loss exceeding 20% ​​using ARM NEON instructions;

[0066] A phased security reinforcement plan, such as completing the replacement of cryptographic algorithms in the first week and fixing high-risk vulnerabilities within two weeks.

[0067] All recommendations come with workload estimates and impact analysis, allowing users to adjust the migration roadmap interactively via drag-and-drop. The report concludes with a simulation function, allowing users to adjust various parameters and view real-time risk assessment changes. The report also supports exporting standardized XML / JSON documents that meet security requirements.

[0068] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multi-dimensional evaluation method for the migration of a trusted innovation environment, characterized in that: include: S1: Build an evaluation indicator system covering the infrastructure layer, application system layer, data resource layer, and security and compliance layer; S2: Calculate the weight coefficients of indicators at each level through the dynamic weight allocation module; S3: Use a quantitative assessment engine to conduct a multi-dimensional comparative analysis of the source environment and the target trusted computing environment; S4: Generate a visual assessment report based on the migration risk assessment model, including compatibility score, performance loss rate, and security level.

2. A multi-dimensional evaluation method for migration of an information and innovation environment according to claim 1, characterized in that: In the step S1, based on a comprehensive scan and analysis of the source environment and the target trusted innovation environment: at the infrastructure layer, through CPUID instruction set detection and / proc / cpuinfo parsing, the coverage difference of SIMD instruction sets under x86 and ARM architectures, as well as the missing of AVX / AVX2 and NEON instructions are compared; at the same time, the sysfs interface of the Linux kernel is used to monitor the driver adaptation status of PCIe / USB devices in real time, and record the number of driver loading failures and the corresponding device ID; At the application system layer, a combination of static analysis and dynamic tracing is adopted. The objdump and readelf tools are used to parse the .dynamic segment of the ELF file, count the number of unresolved symbols, and track system calls through strace to analyze API call failure cases caused by architecture differences.

3. A multi-dimensional evaluation method for the migration of an information and innovation environment according to claim 2, characterized in that: The data resource layer establishes a performance benchmark by executing the SQL commands SELECT COUNT(*) and EXPLAIN ANALYZE on the source database. Comparative testing is then conducted in the target environment to calculate the deviation rate of query response time. BLOB fields are also verified block by block using the block CRC32 checksum algorithm, with an error threshold set to no more than 0.005%. The assessment of the security compliance layer relies on the Information Security Protection 2.0 standard and uses automated scripts to detect system service configurations, including but not limited to checking whether the encryption algorithm configuration in / etc / ssh / sshd_config complies with national encryption standards, whether the retention period of audit logs meets the 180-day requirement, and using OpenSCAP tools to scan system vulnerabilities.

4. The multi-dimensional evaluation method for migration of an information and innovation environment according to claim 1 is characterized in that: In step S2, an initial judgment matrix is ​​constructed based on the Analytic Hierarchy Process (AHP), and domain experts compare the importance of each of the infrastructure layer (weight basis 30%), application system layer (25%), data resource layer (20%), and security and compliance layer (25%) to form an initial weight distribution on a scale of 1-9; In order to eliminate subjective bias, the system simultaneously introduces the entropy weight method to correct the objective weight of the indicators: by collecting sample data of historical migration projects, the information entropy of each indicator is calculated. The specific method for calculating information entropy is as follows: A j =-k∑(p ij lnp ij ), where A j Expressed as information entropy, p ij It is represented as the normalized value of the i-th sample on the j-th indicator, and k is represented as the proportional constant; Finally, the entropy weight is obtained, and the calculation method of the entropy weight is as follows: ω=(1-A j ) / ∑(1-A j ), where ω is the entropy weight, A j Expressed as information entropy; The dynamic adjustment process uses a sliding window mechanism. The indicator volatility is recalculated every time an evaluation cycle is completed (usually 24 hours). Since one evaluation cycle is 24 hours, the indicator volatility is calculated as follows: Among them, σ represents the index volatility, x t Expressed as the indicator value at the t-th time point, It is expressed as the indicator mean, and n is the total number of data points.

5. A multi-dimensional evaluation method for migration of an information and innovation environment according to claim 4, characterized in that: When the hardware compatibility index of the infrastructure layer fluctuates by more than 15%, the weight rebalancing algorithm is triggered. The calculation method of the weight rebalancing algorithm is as follows: B0==αB1+(1-α)B2, where B0 represents the updated weight, B1 represents the old weight, B2 represents the real-time weight, and α represents the smoothing factor.

6. A multi-dimensional evaluation method for migration of an information and innovation environment according to claim 1, characterized in that: In step S3, distributed scanning nodes are deployed in the static scanning phase to perform full asset discovery on the source environment. An improved ELF parser is used to disassemble binary files and construct a knowledge graph containing function call relationships, symbol table dependencies, and instruction features. For Java / Python interpreted applications, cross-platform sensitive operation features are extracted through bytecode analysis tools, such as JNI calls and system command execution.

7. The multi-dimensional evaluation method for migration of an information and innovation environment according to claim 1 is characterized by: In step S4, the evaluation results of each previous stage are integrated: the instruction set compatibility analysis of the infrastructure layer, the dynamic link library adaptation of the application system layer, the verification error rate of the data resource layer, and the national secret algorithm coverage data of the security compliance layer are comprehensively calculated through a weighted decision model; The detection results of static scanning and dynamic probes are integrated: on the one hand, based on the cross-compilation performance analysis data of the LLVM compiler, and on the other hand, combined with the performance probe data actually running in the target environment, the performance loss rate of each business component is predicted through a regression model; the report specifically marks the high-loss components and displays the specific bottleneck points, such as the lack of specific CRC32 instruction acceleration under the ARM architecture; the security level assessment adopts the scoring system of Information Security Technology 2.0, mapping the usage of cryptographic algorithms and audit log integrity data detected in the early stage to five security levels, and generating reinforcement suggestions including a specific vulnerability list.

Images