Component risk prediction method and system fused with time decay factor, and storage medium

Abstract

The invention relates to the technical field of computers, in particular to a component risk prediction method and system fusing a time decay factor and a storage medium, and the method comprises the steps: analyzing a component interaction relationship, building a node set and an edge set, and introducing the time decay factor to construct a time decay weighted component dependency relationship graph; performing dynamic graph structure feature analysis and time sequence modeling on the nodes and the associated edges thereof, and by extracting multilayer neighborhood features of the nodes, constructing a time sequence behavior model and calculating a structure lag coefficient to generate a graph feature set; introducing a service weight to carry out multi-layer dependency fusion and weight dynamic adjustment to obtain a graph feature set after weight fusion; and constructing a risk prediction input matrix, inputting the constructed risk prediction input matrix into a preset risk prediction model, and outputting a risk prediction score and a risk level of each component by the model. According to the method, the accuracy and timeliness of component risk prediction in a complex system can be remarkably improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a component risk prediction method, system and storage medium that incorporates a time decay factor. Background Technology

[0002] As financial information systems become increasingly complex, they typically contain a vast number of business components and service modules. These components are interconnected through multi-layered dependencies, forming a dynamically evolving system structure. Over time, component version iterations, interface changes, vulnerability fixes, and adjustments to operational strategies all lead to changes in the system's risk structure. Traditional risk prediction methods primarily rely on static features or statistical modeling based on historical risk events, making it difficult to accurately reflect the dynamic evolution of risk propagation relationships between components. Therefore, in recent years, researchers have begun to explore the introduction of graph computing methods into financial risk assessment. By constructing component relationship graphs to model the system's internal dependency structure, and combining this with machine learning methods, they aim to achieve intelligent prediction of component risks, thereby improving the comprehensiveness and accuracy of risk identification.

[0003] In existing technologies, component risk prediction typically employs graph-based computational analysis. Specifically, a component relationship graph is first constructed based on the dependencies between components. Nodes represent components within the system, and edges represent function calls or data dependencies between components. Then, historical operational data, version update information, or vulnerability patch records are used to adjust the weights of the edges in the graph. Some methods introduce a time decay factor to weight the edges, weakening the impact between components that have not interacted for a long time or have low-frequency updates, thus reflecting the timeliness of risk propagation to some extent. Next, the graph structure characteristics of the nodes are calculated based on this weighted graph, and combined with the component's own attribute characteristics, feature vectors are formed and input into the prediction model for analysis and prediction, assessing the potential risk level of each component during system operation.

[0004] However, in real-world complex systems, the interactions, dependencies, and business functions between components are not static but evolve over time. Some components, though not updated for a long time, still perform critical business functions, and their potential risks may not necessarily diminish over time. Other components experience changes in call frequency or dependency direction at different times, making their risk impact distinctly phased. Simultaneously, risk propagation typically exhibits cross-level, multi-link diffusion characteristics, with dependencies between different business modules having a differentiated effect on propagation paths. Because current technologies only perform time decay processing at the edge weight level, and the dynamic changes in node characteristics and propagation paths are not modeled synchronously, the feature results obtained from graph structure calculations cannot reflect the true temporal transmission patterns of risk within the system. When these incomplete graph features are used for risk prediction, the model often makes judgments based on outdated or one-sided relational information, leading to a systematic deviation between the prediction results and the current risk state of the system. Summary of the Invention

[0005] This application provides a component risk prediction method, system, and storage medium that incorporates a time decay factor, which can significantly improve the accuracy and timeliness of component risk prediction in complex systems. This application provides the following technical solution: In a first aspect, this application provides a method for predicting component risk by incorporating a time decay factor, the method comprising: Based on the interaction relationship between component runtime logs and dependency records, a set of nodes and a set of edges are established, and a time decay factor is introduced to construct a time decay weighted component dependency graph. Based on the time decay weighted component dependency graph, dynamic graph structure feature analysis and time series modeling are performed on nodes and their associated edges. By extracting multi-layer neighborhood features of nodes, constructing time series behavior models and calculating structural lag coefficients, a graph feature set that can reflect the component structure evolution and time series dependency characteristics is generated. By introducing business weights, the generated graph feature set is subjected to multi-layer dependency fusion and dynamic weight adjustment to obtain a weighted fused graph feature set. Based on the weighted and fused graph feature set, a risk prediction input matrix is ​​constructed. The structural features, temporal behavior features and business weight features of nodes are fused in multiple dimensions to form a unified risk feature representation. Input the constructed risk prediction input matrix into the preset risk prediction model, and the model outputs the risk prediction score and risk level of each component.

[0006] In a specific feasible implementation, the step of establishing a node set and an edge set based on the parsing interaction relationship of component runtime logs and dependency records, and constructing a time-decay-weighted component dependency graph by introducing a time decay factor includes: Parse the runtime logs and generate dependency samples using component call events or data interaction events as the smallest unit of analysis. For each dependency sample, extract parameters and form dependency pairs with component identifiers. After aggregating and deduplicating all dependency samples, count the metrics between each pair of components, calculate the initial edge weights, and obtain the initial edge weight matrix. After obtaining the initial edge weights, a time decay factor is introduced to re-weight the edge weights. The time decay factor is based on the most recent interaction time. With current time time interval The calculation uses an exponential decay function. ,in The time decay coefficient; the final effective edge weights. It is determined by the product of the initial edge weights and the time decay factor, i.e. ; The resulting component dependency graph consists of a set of nodes. Edge set and weighted matrix Common definition, denoted as .

[0007] In a specific implementation scheme, the dynamic graph structure feature analysis and temporal modeling of nodes and their associated edges based on the time-decay weighted component dependency graph, by extracting multi-layer neighborhood features of nodes, constructing a time-series behavior model and calculating structural lag coefficients, generates a graph feature set that reflects the component structure evolution and temporal dependency characteristics, including: For each node in the component dependency graph, taking multi-hop neighbors as the analysis object, we calculate the aggregation activity, number of neighbors, dependency in-degree and centrality index of each node at different neighborhood levels, and generate a feature matrix describing the local and global structure of the node. Temporal analysis is performed on the generated feature matrix and aggregated activity to establish a time series behavior model for each node. The temporal centrality, activity change rate, and dependency in-degree change of the node in different time windows are calculated to generate a dynamic stability descriptor. Based on the node dynamic stability descriptor and the node activity time series, the structural lag coefficient of the node is calculated. The dynamic response characteristics of the node are quantified according to the relationship between the node's own behavioral inertia and the response delay of the neighborhood. The structural lag coefficient is introduced into the edge weight update process to perform nonlinear dynamic correction on the edge weight, generating a time-sensitive graph feature set that reflects the temporal behavior characteristics and structural dependence changes of the node.

[0008] In a specific implementation scheme, for each node in the component dependency graph, taking multi-hop neighbors as the analysis object, the aggregation activity, number of neighbors, dependency in-degree and centrality index of each node at different neighborhood levels are calculated, and a feature matrix describing the local and global structure of the node is generated, including: For each node Identify its 1-hop to K-hop neighbor set Using the obtained time decay weighted edge weight matrix For each neighbor node activity level Perform weighted summation and calculate the nodes. In the The aggregation activity of skip neighborhoods is as follows: ; in, It is a node Pointing to node Time-decay weighted edge weights, For nodes Current activity level; Aggregate the activity vectors of neighbors with different hop counts. Perform column concatenation to form a multi-hop neighbor matrix. ; Count the number of neighbors and in-degree of each node and Dependency Out-degree ; Neighborhood centrality index of computing nodes ,in, The multi-hop neighbor matrix of a node is weighted by the hop count. Dependency on in-degree Dependency on out-degree and neighborhood centrality index By concatenating the nodes, a local structural feature matrix is ​​generated, thus producing a complete local structural feature matrix. .

[0009] In a specific feasible implementation, the step of performing time-series analysis on the generated feature matrix and aggregated activity, establishing a time-series behavior model for each node, calculating the temporal centrality, activity change rate, and dependency in-degree changes of the node within different time windows, and generating a dynamic stability descriptor includes: The observation time interval is divided into A fixed-length time window ; for nodes own activity level and its multi-hop neighbor aggregation activity Record statistics; Within each time window, the temporal centrality of a node is calculated based on the activity of its multi-hop neighbors. ; in, A weighted vector of hop counts; the in-degree dependency of nodes in each time window is calculated. and Dependency Out-degree The changes were calculated as follows: ; Aggregate activity sequence of neighbors The time difference was performed, and the rate of change of node activity was calculated as follows: ; Time centrality Dependence on change and activity change rate The nodes are spliced ​​together to form a dynamic stability descriptor: .

[0010] In a specific implementation scheme, the structural lag coefficient of a node is calculated based on the node's dynamic stability descriptor and node activity time series. The dynamic response characteristics of the node are quantified according to the relationship between the node's own behavioral inertia and the neighborhood response delay. The structural lag coefficient is then introduced into the edge weight update process to perform nonlinear dynamic correction on the edge weights, generating a time-sensitive graph feature set reflecting the temporal behavioral characteristics and structural dependency changes of nodes. This set includes: Compute node activity sequence The autocorrelation function is determined, and its autocorrelation time scale is determined. : ; in, This represents the covariance function, used to measure the time lag of a node. Correlation between time activity; The preset threshold is used to calculate the node's own activity sequence. Aggregate activity sequences with neighbors The cross-correlation function was calculated, and the lag value corresponding to the maximum correlation was obtained as follows: ; in, The Pearson correlation coefficient is represented; the structural hysteresis coefficient is defined by considering the node's own inertial characteristics, the response delay between itself and its neighbors, and the fluctuation of neighborhood activity. ; in, This represents the maximum response delay of a node to changes in its neighborhood. The timescale of the node's own behavioral inertia; The coefficient of variation of neighborhood aggregation activity; The degree value of the node; This represents the average degree value across the entire map. All are adjustable parameters; For each directed edge Define the edge correction factor as follows: ; in, This is the adjustment coefficient for the lag difference; For nodes With nodes Correlation coefficient of aggregation activity series; For relevance weight parameters; The revised definition of edge weights is as follows: ; in, Represents a node With nodes Differences in dynamic stability descriptors For the Sigmoid function, This parameter amplifies attribute differences.

[0011] In a specific feasible implementation, the introduction of business weights to perform multi-layer dependency fusion and dynamic weight adjustment on the generated graph feature set, resulting in a weighted fused graph feature set, includes: For each node, its initial business weight is dynamically adjusted by combining it with the structural lag coefficient: nodes with high structural lag coefficients have their business weights increased; nodes with low structural lag coefficients have their business weights decreased. The adjusted business weights are fused with the original graph features of the nodes to form a weighted node feature vector. For multi-layered dependent nodes within the same business system, the nodes are aggregated according to their comprehensive weights to generate the comprehensive graph features of each node in the multi-layered dependent network.

[0012] Secondly, this application provides a component risk prediction system that incorporates a time decay factor, employing the following technical solution: A component risk prediction system incorporating a time decay factor includes: The graph construction module is used to parse the interaction relationship based on the component runtime log and dependency record, establish the node set and edge set, and introduce the time decay factor to construct the time decay weighted component dependency graph; The node analysis module is used to perform dynamic graph structure feature analysis and time series modeling on nodes and their associated edges based on the time decay weighted component dependency graph. By extracting multi-layer neighborhood features of nodes, constructing time series behavior models and calculating structural lag coefficients, a graph feature set that can reflect the component structure evolution and time series dependency characteristics is generated. The business adjustment module is used to introduce business weights to perform multi-layer dependency fusion and dynamic weight adjustment on the generated graph feature set, so as to obtain a weighted fused graph feature set. The input construction module is used to construct a risk prediction input matrix based on the weighted and fused graph feature set, and to perform multi-dimensional fusion of the structural features, temporal behavior features and business weight features of nodes to form a unified risk feature representation. The risk prediction module is used to input the constructed risk prediction input matrix into the preset risk prediction model, and the model outputs the risk prediction score and risk level of each component.

[0013] Thirdly, this application provides an electronic device, the device including a processor and a memory; the memory stores a program, the program being loaded and executed by the processor to implement a component risk prediction method for incorporating a time decay factor as described in the first aspect.

[0014] Fourthly, this application provides a computer-readable storage medium storing a program that, when executed by a processor, is used to implement a component risk prediction method for incorporating a time decay factor as described in the first aspect.

[0015] This paper proposes a graph feature modeling method that reflects the structural evolution and temporal dependency characteristics of components by performing time-sensitive dynamic graph structural feature analysis on component dependency graphs. The core of this method lies in extracting multi-layer neighborhood features of nodes after constructing the graph structure, characterizing the dynamic stability of nodes through a time-series behavioral model, and introducing a structural lag coefficient to quantify the response rate of nodes to changes in external dependencies. This generates a graph feature set that comprehensively reflects structural status, behavioral evolution, and response characteristics. This method overcomes the limitations of traditional methods that only perform time decay on edge weights, systematically incorporating the behavioral patterns of nodes in different time windows, dependency migration trends, and potential risk sensitivity into the model. This allows the feature set to truly reflect the risk status of components in complex systems over time. This in-depth analysis addresses the problems of existing technologies failing to capture node stage risks, ignoring behavioral inertia, and the impact of business differentiation. It enables subsequent risk prediction models to be evaluated based on dynamic and comprehensive graph features, thereby significantly improving the accuracy and timeliness of component risk prediction in complex systems.

[0016] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, the preferred embodiments of this application are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the component risk prediction method incorporating a time decay factor in the embodiments of this application.

[0018] Figure 2 This is a flowchart illustrating step S102 in an embodiment of this application.

[0019] Figure 3 This is a structural block diagram of the component risk prediction system that incorporates a time decay factor in the embodiments of this application.

[0020] Figure 4 This is a block diagram of an electronic device for component risk prediction that incorporates a time decay factor, as described in the embodiments of this application. Detailed Implementation

[0021] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0022] Optionally, this application uses the component risk prediction method of the fusion time decay factor provided in various embodiments in an electronic device as an example for illustration. The electronic device is a terminal or a server. The terminal can be a computer, tablet computer, etc. This embodiment does not limit the type of electronic device.

[0023] Reference Figure 1 This is a flowchart illustrating a component risk prediction method for a fusion time decay factor provided in one embodiment of this application. The method includes at least the following steps: Step S101: Based on the component runtime log and dependency record parsing interaction relationship, establish node set and edge set, and introduce time decay factor to construct time decay weighted component dependency relationship graph.

[0024] In step S101, for various business components and service modules in the financial information system, interaction relationship parsing is performed using system operation logs and dependency records to establish a basic graph model reflecting the dependency structure between components. The parsing objects include component call logs, interface communication records, message transmission data, configuration file reference information, and security event tracking logs. During the parsing process, components are used as analysis units to extract attribute information such as identifiers, types, version numbers, business affiliation, deployment locations, and update times, and these are used to construct a node set (N). If there is a function call, data transmission, or security dependency relationship between any two components, a directed edge is established between the corresponding nodes to represent the dependency direction and dependency type, with the caller node pointing to the callee node; if there is bidirectional interaction, two edges in opposite directions are established to fully represent the communication path. This yields the initial node set N and edge set E, forming an unweighted component dependency graph.

[0025] Specifically, when constructing the component dependency graph, the system runtime logs are first parsed, and dependency samples are generated using component call events or data interaction events as the smallest unit of analysis. For each dependency sample, parameters such as call timestamp, interaction frequency, amount of data transmitted, and response status are extracted, and dependency pairs <component A, component B> are formed using component identifiers. After aggregating and deduplicating all dependency samples, the average number of calls, total amount of data transmitted, and response latency between each pair of components are statistically analyzed. Initial edge weights are then calculated to obtain the initial edge weight matrix, whose elements... This represents the initial edge weight between component A and component B.

[0026] After obtaining the initial edge weights, a time decay factor is introduced to re-weight the edge weights in order to characterize the temporal changes in dependencies between components. The time decay factor is based on the most recent interaction time. With current time time interval The calculation can be performed using an exponential decay function. ,in This is the time decay factor, used to control the rate at which dependency strength decreases over time. When there is no interaction between components for a long period, the decay factor tends to be low; when interactions are frequent or occur recently, the decay factor is close to 1. The final effective edge weights. It is determined by the product of the initial edge weights and the time decay factor, i.e. This results in a weighted edge weight that numerically reflects both the strength of dependence and the temporal activity.

[0027] After the above processing, the resulting component dependency graph consists of a set of nodes. Edge set and weighted matrix Common definition, denoted as This graph structure not only expresses the logical and data dependencies between components, but also reflects the dynamic characteristics of the system structure over time through a time decay weighting mechanism. This allows the strength of dependencies between components to be automatically adjusted according to time evolution, forming a dynamic dependency graph structure with temporal characteristics.

[0028] Step S102: Based on the time decay weighted component dependency graph, perform dynamic graph structure feature analysis and time series modeling on nodes and their associated edges. By extracting multi-layer neighborhood features of nodes, constructing time series behavior models and calculating structural lag coefficients, a graph feature set that can reflect the component structure evolution and time series dependency characteristics is generated.

[0029] In step S102, the time-decay weighted component dependency graph obtained in step S101 is first used. For each node in the graph, the input is... Dynamic structural features are extracted and a time-series model of node behavior is established to generate a graph feature set reflecting the temporal evolution characteristics of components. In this process, not only are the temporal changes in the multi-hop neighbor distribution, centrality index, and dependence on in-degree and out-degree of nodes statistically analyzed, but also a novel structural lag coefficient (SLC) is designed and calculated by analyzing the lag relationship between node activity time series and edge weight changes. This coefficient is then applied to relevant edge weights using a nonlinear function mapping, achieving the reverse adjustment of edge weights by node attributes and creating a bidirectional coupling relationship between node behavior and edge structure.

[0030] Reference Figure 2 Step S102 includes at least the following steps: Step S1021: For each node in the component dependency graph, taking multi-hop neighbors as the analysis object, calculate the aggregation activity, number of neighbors, dependency in-degree and centrality index of each node at different neighborhood levels, and generate a feature matrix describing the local and global structure of the node.

[0031] In step S1021, firstly for each node First, identify its 1-hop to K-hop neighbor set. Among them, a 1-hop neighbor refers to a node... A node is directly connected by an edge; a 2-hop neighbor is a node that is connected to a 1-hop neighbor by an edge but not directly to the node. Connected nodes, and so on, with K-hop neighbors representing indirect neighbors at more distant levels. This hierarchical neighbor partitioning allows us to distinguish the influence of nodes at different dependency levels and the information transmission paths. Subsequently, the time-decayed weighted edge weight matrix obtained in step S101 is used... For each neighbor node activity level Perform weighted summation and calculate the nodes. In the The aggregation activity of skip neighborhoods is as follows: ; in, It is a node Pointing to node The time-decay weighted edge weights are used to reflect dependency strength and temporal activity. For nodes The current activity level quantifies the frequency of operations or business importance of the node in the system. By weighted summation, the overall activity contribution of each node in different hop count neighborhoods can be obtained.

[0032] Then aggregate the activity vectors of neighbors with different hop counts. Perform column concatenation to form a multi-hop neighbor matrix. ; Count the number of neighbors and in-degree of each node and Dependency Out-degree This forms a local topological description vector for the node, where, Represents a node The number of nodes that depend on a node reflects the degree to which a node is invoked or depended upon. Represents a node The number of other nodes it depends on reflects the scope of a node's active invocation or dependency. This is an indicator function; it takes the value 1 if the condition is met, and 0 otherwise. In-degree is a fundamental quantitative indicator of a node's local structure, measuring the strength of a node's dependency and its information transmission capability within the system.

[0033] Finally, the neighborhood centrality index of the node is calculated. ,in, This is a hop-weighted vector used to assign higher weights to low-hop neighbors. It is the 1-norm of the aggregated activity vector, used for normalization. Centrality index. This reflects the relative importance of nodes at the neighborhood and system levels, as well as their information propagation capabilities. It involves creating a multi-hop neighbor matrix for each node. Dependency on in-degree Dependency on out-degree and neighborhood centrality index By concatenating the nodes, a local structural feature matrix is ​​generated, thus producing a complete local structural feature matrix. This matrix simultaneously expresses the characteristic information of nodes in terms of local neighborhood structure, dependency strength, and centrality.

[0034] This approach allows each node to not only capture the influence of its direct neighbors but also incorporate the activity of multi-hop neighborhoods into its quantitative analysis, thus fully expressing the node's position and potential impact within the overall system structure. Multi-hop neighbor aggregation activity reveals the intensity of interaction between the node and its surrounding components, while in-degree reflects the node's role in information flow and business processes. Centrality metrics integrate influence information from various neighborhood levels, balancing local and global perspectives. This refined, multi-layered feature extraction method enables subsequent time-series modeling and risk prediction to accurately capture the dynamics of node behavior and its potential risk contribution, making the features both time-sensitive and structurally comprehensive.

[0035] Step S1022: Perform time series analysis on the generated feature matrix and aggregated activity, establish a time series behavior model for each node, calculate the temporal centrality, activity change rate, and dependency in-degree change of the node in different time windows, and generate a dynamic stability descriptor.

[0036] In step S1022, the entire observation time interval is first divided into... A fixed-length time window ; for nodes own activity level and its multi-hop neighbor aggregation activity Record statistics. Node activity. Quantify the node's operation frequency, business event processing volume, or API call count within this time window; aggregate activity of multi-hop neighbors. From step S1021, this time window division allows us to capture the evolutionary characteristics of node behavior in different time periods. Then, within each time window, the temporal centrality of the node is calculated based on the aggregation activity of its multi-hop neighbors: ; in, The hop-weighted vector emphasizes the relative importance of low-hop neighbors, reflecting the strength of direct interactions between a node and its neighboring key components. The denominator is used for normalization, ensuring that centrality values ​​are comparable across different nodes and time windows. Temporal centrality. It quantitatively reflects the structural position and information transmission capability of a node within that time window.

[0037] Then calculate the in-degree dependency of each node in each time window. and Dependency Out-degree The changes were calculated as follows: ; Among them, the dependence on in-degree This represents the number of times a node is depended on by other nodes, and the dependency out-degree. This represents the number of nodes that a node actively depends on other nodes. (Change amount) This reflects the dynamic migration of a node's dependencies within a given time window, such as dependency expansion or contraction trends. By comparing changes across different time windows, the behavioral adjustments and role transitions of nodes within the structured network can be quantified.

[0038] Then aggregate the activity sequence of the neighbors. The time difference was performed, and the rate of change of node activity was calculated as follows: ; Among them, the rate of change in activity Quantifying the activity trends of a node's neighborhood within a time window reflects the fluctuations in the intensity of interaction between the node and its neighbors, revealing the potential behavioral phases and dynamic adjustments of structural dependencies.

[0039] Finally, time centrality will be considered. Dependence on change and activity change rate The nodes are spliced ​​together to form a dynamic stability descriptor: ; This descriptor simultaneously contains information about the node's structural position, dependency behavior, and neighborhood activity changes within the time window, forming a time-sensitive representation of node behavior.

[0040] By extending the local structural features of nodes to the time dimension, step S1022 can not only capture the behavioral patterns of nodes at different stages, but also reflect the dynamic changes in node dependencies and neighborhood activity. Temporal centrality reveals the relative importance of nodes in the system structure, dependency change characterizes the migration trend of node dependency structure, and the rate of change in neighbor activity reflects the stage-specific fluctuations in node behavior. This design overcomes the shortcomings of traditional methods that only focus on edge weight decay and ignore the temporal changes in node behavior, enabling node features to truly reflect their dynamic status and changing trends in the risk propagation process.

[0041] Step S1023: Based on the node dynamic stability descriptor and the node activity time series, calculate the structural lag coefficient of the node, quantify the dynamic response characteristics of the node according to the relationship between the node's own behavioral inertia and the neighborhood response delay, and introduce the structural lag coefficient into the edge weight update process to perform nonlinear dynamic correction on the edge weight, thereby generating a time-sensitive graph feature set that reflects the temporal behavior characteristics and structural dependence changes of the node.

[0042] In step S1023, the node activity sequence is first calculated. The autocorrelation function is determined, and its autocorrelation time scale is determined. : ; in, This represents the covariance function, used to measure the time lag of a node. Correlation between time activity; This is a preset threshold, representing the boundary at which node activity autocorrelation decays to a negligible level. The calculated... This refers to the length of time a node's own active mode maintains its correlation, reflecting the inertial characteristics of changes in node behavior. A larger [value] A smaller value indicates that the node's behavior pattern is relatively stable and has strong inertia, while a smaller value indicates that the node's activity characteristics change frequently.

[0043] Subsequently, to evaluate the node's response speed to changes in its neighbor's structure, the node's own activity sequence was further calculated. Aggregate activity sequences with neighbors The cross-correlation function was calculated, and the lag value corresponding to the maximum correlation was obtained as follows: ; in, This represents the Pearson correlation coefficient, used to measure the temporal synchronicity between changes in node behavior and changes in the behavior of its neighbors. If... A larger value indicates that the node's response to changes in its neighborhood has a significant time lag; if the value is smaller, it means that the node and the neighborhood changes almost synchronously.

[0044] Taking into account the node's own inertial characteristics, the response delay between itself and its neighbors, and the fluctuation of neighborhood activity, the structural hysteresis coefficient is defined as follows: ; in, This represents the maximum response delay of a node to changes in its neighborhood. The timescale of the node's own behavioral inertia; The coefficient of variation represents the activity level of neighbor aggregation, used to characterize the fluctuation range of neighbor activity. Represents a node The average neighborhood activity over the observation period. For nodes The fluctuation range of neighbor aggregation activity over time; This represents the degree of a node, which is the number of connections a node depends on. This is the average degree value across the entire map, used to compare the structural positions of nodes; These are all adjustment parameters used to control the influence of activity fluctuations and structural location on hysteresis metrics. The formula consists of three multiplied parts. The first term represents the logarithmic ratio of a node's response delay to its own inertial time scale, compressing extreme values ​​to prevent distortion. The second term introduces a neighborhood activity fluctuation correction; when neighborhood fluctuations are strong, the node's hysteresis effect is amplified. The third term reflects the node's position in the overall graph structure through an S-shaped mapping, reducing the sensitivity of high-degree nodes to hysteresis effects while making them more pronounced in low-degree nodes. By combining these three factors, the structural hysteresis coefficient... It can simultaneously capture the combined effects of time delay, neighborhood fluctuations, and structural hierarchy on node response characteristics.

[0045] Finally, the calculated SLC not only describes the dynamic response characteristics of node behavior but can also serve as a feedback signal for edge weight correction. Therefore, for each directed edge... Define the edge correction factor as follows: ; in, This is the adjustment coefficient for the lag difference, controlling the impact of the SLC difference on the correction magnitude; For nodes With nodes The correlation coefficient of the aggregated activity sequence measures the synchronicity of the behavior of two nodes. For relevance weight parameters; The revised definition of edge weights is as follows: ; in, Represents a node With nodes Differences in dynamic stability descriptors For the Sigmoid function, This is the attribute difference amplification parameter, which controls the weight of difference features in the correction process. In this correction formula, The direction and intensity of the correction are determined by the node. The lag is higher than that of the node. If the edge weight decays, the trend in edge weight decay is strengthened; conversely, it is enhanced. By combining it with the Sigmoid function, the correction can be made smooth and controllable.

[0046] After obtaining the corrected edge weight matrix, the multi-hop neighbor aggregation activity, dependency in-out degree, neighborhood centrality, and dynamic stability descriptor of each node are recalculated. The node's own attribute features are then concatenated with the updated structural features to form a complete graph feature vector. The graph feature vectors of all nodes are then set together to obtain the final time-sensitive graph feature set. Each of them It includes node attributes, local and global structural features, dynamic stability parameters, and edge weight information corrected by structural hysteresis coefficients, which can comprehensively characterize the structural position, behavioral evolution, and risk transmission characteristics of components in the system.

[0047] The aforementioned SLC design uses time response ratio, active fluctuation correction, and degree distribution modulation as its core structure. Its core idea is to quantitatively couple node behavioral inertia with neighborhood response lags through autocorrelation and cross-correlation analysis, thereby obtaining the true dynamic response rate of nodes during structural evolution. SLC does not rely on static topology or single snapshot data, but rather obtains reproducible response indicators through time-dimensional statistics, ensuring temporal consistency and structural interpretability in lag measurements. Introducing SLC into edge weight correction creates a closed-loop feedback mechanism between nodes and edges: node behavioral lags affect edge weight distribution, and changes in edge weights, in turn, influence node centrality and activity in subsequent time windows. Through this nonlinear feedback, the graph structure achieves adaptive evolution, and the temporal characteristics of nodes and edges form a computationally coupled update relationship. This mechanism ensures that the graph model can not only express instantaneous dependencies but also capture the temporal patterns of dynamic propagation, making component relationship networks more expressive and timely in risk evolution prediction.

[0048] Step S103: Introduce business weights to perform multi-layer dependency fusion and dynamic weight adjustment on the generated graph feature set to obtain a weighted fused graph feature set.

[0049] In step S103, the time-sensitive graph feature set obtained in step S102 is processed, introducing business weights to reflect the differences in importance of each node within its respective business system, and fusing and weighting the multi-layer dependencies. Each node's graph feature vector includes multi-layer neighborhood features, time-series behavioral features, and a dynamic stability descriptor. An initial business weight vector is generated based on the priority and business role of the node's business system, and this vector is used as an additional dimension for the node's features.

[0050] Specifically, for each node, its initial business weight is dynamically adjusted by combining it with the structural lag coefficient calculated in step S102: nodes with higher structural lag coefficients indicate slow structural updates and potential risk accumulation, thus their business weights are appropriately increased; nodes with lower structural lag coefficients or more active behavior have their business weights appropriately decreased. Subsequently, the adjusted business weights are fused with the node's original graph features to form a weighted node feature vector. For multi-layered dependent nodes within the same business system, weighted aggregation is performed according to the node's comprehensive weight to generate a comprehensive graph feature for each node in the multi-layered dependency network. The final graph feature set includes each node's structural evolution features, time-sensitive behavioral features, and dynamically adjusted business weight information, while preserving inter-node dependencies and multi-level structural information.

[0051] Step S104: Construct a risk prediction input matrix based on the weighted fusion graph feature set, and perform multi-dimensional fusion of the structural features, temporal behavior features and business weight features of the nodes to form a unified risk feature representation.

[0052] In step S104, the weighted fusion graph feature set output in step S103 is first obtained. This set contains three main components for each node's graph features: firstly, structural features, such as multi-level neighborhood aggregation activity, number of neighbors, dependency in-degree and out-degree, and local and global centrality indices, used to describe the node's topological position and influence range in the entire component dependency graph; secondly, temporal behavioral features, including dynamic stability descriptors of the node within different time windows, such as temporal centrality, activity change rate, and dependency migration trends, reflecting the node's behavioral patterns over time; and thirdly, business weight features, derived from the importance assessment and dynamically adjusted weights of the business system to which the node belongs, used to characterize the node's risk impact at the business level. Subsequently, for each node, the structural features, temporal behavioral features, and business weight features are concatenated to form a comprehensive feature vector. Specifically, the concatenation order is arranged according to structural information, temporal information, and business information; each vector element retains its original quantification unit or undergoes standardization to eliminate dimensional differences. After vector concatenation, the comprehensive feature vectors of all nodes are summarized in order of node number to form the risk prediction input matrix for the entire component dependency graph. Each row of this matrix corresponds to a node, and each column corresponds to a feature indicator of one dimension, including three aspects: structure, time series, and business.

[0053] Step S105: Input the constructed risk prediction input matrix into the preset risk prediction model. The model outputs the risk prediction score and risk level of each component.

[0054] In step S105, the constructed risk prediction input matrix is ​​first obtained. Each row of this matrix corresponds to a component node, and each column corresponds to the comprehensive features of the node, including structural features, temporal behavior features, and business weight features. Subsequently, the risk prediction input matrix is ​​input into an existing risk prediction model for evaluation. The risk prediction model is a mature, deployed model, with options including traditional machine learning models or deep learning models. During the training phase, the model has already established a mapping relationship between features and risks using historical component features and known risk events. The model calculates and analyzes the comprehensive feature vector of each node to assess its potential risk level. The model output includes two main components: first, a risk prediction score, which is a continuous numerical value representing the quantification of the potential risk of each component under the current system state; second, a risk level, which is obtained by mapping the risk prediction score to a preset threshold range (e.g., low risk, medium risk, high risk), used to intuitively express the severity of component risk. Finally, the output is presented in the form of a list or matrix, with each row corresponding to a component node and each column including the risk prediction score and risk level, which facilitates further sorting, analysis and visualization, and enables dynamic assessment and management of the risks of each component in the entire system.

[0055] In summary, the core of this application's technical solution lies in proposing a graph feature modeling and multi-dimensional risk fusion method to accurately predict risks, addressing the dynamic evolution characteristics of component risks in complex systems. Specifically, firstly, by analyzing system operation logs and dependency records, a component dependency graph is constructed. Nodes in the graph represent individual components, and edges represent dependencies between components. A time decay factor is introduced to weight the edge weights, reflecting the dynamic changes in the strength of dependencies between components over time. This process not only characterizes the static structural relationships of components but also incorporates time-sensitive information such as interaction frequency and response status into the graph structure, enabling the dependencies between components to automatically adjust over time. Subsequently, dynamic graph structural feature analysis is performed on the nodes and their associated edges. By extracting multi-layer neighborhood features, calculating the temporal centrality and dynamic stability descriptors of nodes, and combining structural lag coefficients, the behavioral patterns, dependency migration trends, and rates of response to external changes of nodes within different time windows are quantified. This ultimately forms a graph feature set that comprehensively reflects the structural evolution and temporal dependency characteristics of components. These features not only reveal the topological position of nodes in the system but also capture their potential risk sensitivity and behavioral inertia, providing a reliable foundation for dynamic risk analysis. Building upon this foundation, business weights are introduced to weight and fuse the graph feature set. These weights are derived from the importance assessment of the business systems to which each component belongs, and through dynamic adjustments to node features, the relative influence of different business modules in risk propagation is reflected. After fusion processing, the resulting weighted graph feature set simultaneously reflects structural characteristics, temporal behavioral characteristics, and business weight information, thus comprehensively describing the overall risk attributes of components within the system. Finally, the weighted graph feature set is transformed into a risk prediction input matrix. The structural characteristics, dynamic behavioral characteristics, and business weights of each node are multi-dimensionally concatenated to form a unified risk feature representation. This representation is then input into an existing risk prediction model, outputting the risk score and risk level of each component, thereby achieving a dynamic quantitative assessment of the risk of each component in the system.

[0056] This technical solution effectively addresses the key problems faced by traditional methods. Existing technologies typically only perform time decay processing at the edge weight level, ignoring the dynamic changes in node behavior and business layers, leading to discrepancies between graph features and the actual risk state of the system. This solution models the multi-layered neighborhood characteristics, time-series behavior, and structural lag response of nodes, capturing the evolutionary characteristics of node behavior over time and quantifying risk migration trends. By introducing multi-layered dependency fusion through business weights, the contributions of different business modules to risk propagation are expressed differently. By constructing a multi-dimensional risk feature matrix and inputting it into the prediction model, risk prediction can simultaneously consider structural, temporal, and business information, achieving a comprehensive, dynamic, and accurate assessment of component risks in complex systems. This effectively compensates for the shortcomings of existing methods in terms of temporal sensitivity and business relevance.

[0057] Figure 3This is a structural block diagram of a component risk prediction system for a fusion time decay factor provided in one embodiment of this application. The system includes at least the following modules: The graph construction module is used to parse the interaction relationship based on the component runtime log and dependency record, establish the node set and edge set, and introduce the time decay factor to construct the time decay weighted component dependency graph; The node analysis module is used to perform dynamic graph structure feature analysis and time series modeling on nodes and their associated edges based on time decay weighted component dependency graphs. By extracting multi-layer neighborhood features of nodes, constructing time series behavior models and calculating structural lag coefficients, it generates a graph feature set that can reflect the component structure evolution and time series dependency characteristics. The business adjustment module is used to introduce business weights to perform multi-layer dependency fusion and dynamic weight adjustment on the generated graph feature set, so as to obtain a weighted fused graph feature set. The input construction module is used to construct a risk prediction input matrix based on the weighted and fused graph feature set. It performs multi-dimensional fusion of the structural features, temporal behavior features and business weight features of nodes to form a unified risk feature representation. The risk prediction module is used to input the constructed risk prediction input matrix into the preset risk prediction model, and the model outputs the risk prediction score and risk level of each component.

[0058] For relevant details, please refer to the above method implementation examples.

[0059] Figure 4 This is a block diagram of an electronic device provided in one embodiment of this application. The device includes at least a processor 401 and a memory 402.

[0060] Processor 401 may include one or more processing cores, such as a quad-core processor or an octa-core processor. Processor 401 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 401 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 401 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 401 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0061] Memory 402 may include one or more computer-readable storage media, which may be non-transitory. Memory 402 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in memory 402 is used to store at least one instruction, which is executed by processor 401 to implement the component risk prediction method for fusion time decay factor provided in the method embodiments of this application.

[0062] In some embodiments, the electronic device may also optionally include: a peripheral device interface and at least one peripheral device. The processor 401, memory 402, and peripheral device interface can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface via a bus, signal line, or circuit board. Indicatively, peripheral devices include, but are not limited to: radio frequency circuits, touch displays, audio circuits, and power supplies.

[0063] Of course, electronic devices may also include fewer or more components, and this embodiment does not limit this.

[0064] Optionally, this application also provides a computer-readable storage medium storing a program that is loaded and executed by a processor to implement the component risk prediction method for the fusion time decay factor of the above method embodiments.

[0065] Optionally, this application also provides a computer product including a computer-readable storage medium storing a program that is loaded and executed by a processor to implement the component risk prediction method of the fusion time decay factor in the above method embodiments.

[0066] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0067] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A component risk prediction method incorporating a time decay factor, characterized in that, The method includes: Based on the interaction relationship between component runtime logs and dependency records, a set of nodes and a set of edges are established, and a time decay factor is introduced to construct a time decay weighted component dependency graph. Based on the time decay weighted component dependency graph, dynamic graph structure feature analysis and time series modeling are performed on nodes and their associated edges. By extracting multi-layer neighborhood features of nodes, constructing time series behavior models and calculating structural lag coefficients, a graph feature set that can reflect the component structure evolution and time series dependency characteristics is generated. By introducing business weights, the generated graph feature set is subjected to multi-layer dependency fusion and dynamic weight adjustment to obtain a weighted fused graph feature set. Based on the weighted and fused graph feature set, a risk prediction input matrix is ​​constructed. The structural features, temporal behavior features and business weight features of nodes are fused in multiple dimensions to form a unified risk feature representation. Input the constructed risk prediction input matrix into the preset risk prediction model, and the model outputs the risk prediction score and risk level of each component.

2. The component risk prediction method based on the fusion time decay factor according to claim 1, characterized in that, The process of establishing a node set and an edge set based on the interaction between component runtime logs and dependency records, and constructing a time-decay-weighted component dependency graph by introducing a time decay factor, includes: Parse the runtime logs and generate dependency samples using component call events or data interaction events as the smallest unit of analysis. For each dependency sample, extract parameters and form dependency pairs with component identifiers. After aggregating and deduplicating all dependency samples, count the metrics between each pair of components, calculate the initial edge weights, and obtain the initial edge weight matrix. After obtaining the initial edge weights, a time decay factor is introduced to re-weight the edge weights. The time decay factor is based on the most recent interaction time. With current time time interval The calculation uses an exponential decay function. ,in The time decay coefficient; the final effective edge weights. It is determined by the product of the initial edge weights and the time decay factor, i.e. ; The resulting component dependency graph consists of a set of nodes. Edge set and weighted matrix Common definition, denoted as .

3. The component risk prediction method based on the fusion time decay factor according to claim 1, characterized in that, The component dependency graph based on the time decay weighted analysis performs dynamic graph structure feature analysis and temporal modeling on nodes and their associated edges. By extracting multi-layer neighborhood features of nodes, constructing a time series behavior model, and calculating structural lag coefficients, a graph feature set that reflects the component structure evolution and temporal dependency characteristics is generated, including: For each node in the component dependency graph, taking multi-hop neighbors as the analysis object, we calculate the aggregation activity, number of neighbors, dependency in-degree and centrality index of each node at different neighborhood levels, and generate a feature matrix describing the local and global structure of the node. Temporal analysis is performed on the generated feature matrix and aggregated activity to establish a time series behavior model for each node. The temporal centrality, activity change rate, and dependency in-degree change of the node in different time windows are calculated to generate a dynamic stability descriptor. Based on the node dynamic stability descriptor and the node activity time series, the structural lag coefficient of the node is calculated. The dynamic response characteristics of the node are quantified according to the relationship between the node's own behavioral inertia and the response delay of the neighborhood. The structural lag coefficient is introduced into the edge weight update process to perform nonlinear dynamic correction on the edge weight, generating a time-sensitive graph feature set that reflects the temporal behavior characteristics and structural dependence changes of the node.

4. The component risk prediction method based on the fusion time decay factor according to claim 3, characterized in that, For each node in the component dependency graph, taking multi-hop neighbors as the analysis object, the aggregation activity, number of neighbors, dependency in-degree and centrality index of each node at different neighborhood levels are calculated, and a feature matrix describing the local and global structure of the node is generated, including: For each node Identify its 1-hop to K-hop neighbor set Using the obtained time decay weighted edge weight matrix For each neighbor node activity level Perform weighted summation and calculate the nodes. In the The aggregation activity of skip neighborhoods is as follows: ； in, It is a node Pointing to node Time-decay weighted edge weights, For nodes Current activity level; Aggregate the activity vectors of neighbors with different hop counts. Perform column concatenation to form a multi-hop neighbor matrix. ; Count the number of neighbors and in-degree of each node and Dependency Out-degree ; Neighborhood centrality index of computing nodes ,in, The multi-hop neighbor matrix of a node is weighted by the hop count. Dependency on in-degree Dependency on out-degree and neighborhood centrality index By concatenating the nodes, a local structural feature matrix is ​​generated, thus producing a complete local structural feature matrix. .

5. The component risk prediction method based on the fusion time decay factor according to claim 4, characterized in that, The process of performing time-series analysis on the generated feature matrix and aggregated activity, establishing a time-series behavior model for each node, calculating the temporal centrality, activity change rate, and dependency in-degree changes of nodes within different time windows, and generating a dynamic stability descriptor includes: The observation time interval is divided into A fixed-length time window ; for nodes own activity level and its multi-hop neighbor aggregation activity Record statistics; Within each time window, the temporal centrality of a node is calculated based on the activity of its multi-hop neighbors. ； in, A weighted vector of hop counts; the in-degree dependency of nodes in each time window is calculated. and Dependency Out-degree The changes were calculated as follows: ； Aggregate activity sequence of neighbors The time difference was performed, and the rate of change of node activity was calculated as follows: ； Time centrality Dependence on change and activity change rate The nodes are spliced ​​together to form a dynamic stability descriptor: 。 6. The component risk prediction method based on the fusion time decay factor according to claim 5, characterized in that, The method calculates the structural lag coefficient of nodes based on node dynamic stability descriptors and node activity time series, quantifies the dynamic response characteristics of nodes according to the relationship between node behavior inertia and neighborhood response delay, and incorporates the structural lag coefficient into the edge weight update process to perform nonlinear dynamic correction on the edge weights, generating a time-sensitive graph feature set that reflects the temporal behavior characteristics and structural dependency changes of nodes, including: Compute node activity sequence The autocorrelation function is determined, and its autocorrelation time scale is determined. : ； in, This represents the covariance function, used to measure the time lag of a node. Correlation between time activity; The preset threshold is used to calculate the node's own activity sequence. Aggregate activity sequences with neighbors The cross-correlation function was calculated, and the lag value corresponding to the maximum correlation was obtained as follows: ； in, The Pearson correlation coefficient is represented; the structural hysteresis coefficient is defined by considering the node's own inertial characteristics, the response delay between itself and its neighbors, and the fluctuation of neighborhood activity. ； in, This represents the maximum response delay of a node to changes in its neighborhood. The timescale of the node's own behavioral inertia; The coefficient of variation of neighborhood aggregation activity; The degree value of the node; This represents the average degree value across the entire map. All are adjustable parameters; For each directed edge Define the edge correction factor as follows: ； in, This is the adjustment coefficient for the lag difference; For nodes With nodes Correlation coefficient of aggregation activity series; For relevance weight parameters; The revised definition of edge weights is as follows: ； in, Represents a node With nodes Differences in dynamic stability descriptors For the Sigmoid function, This parameter amplifies attribute differences.

7. The component risk prediction method based on the fusion time decay factor according to claim 1, characterized in that, The process of introducing business weights to perform multi-layer dependency fusion and dynamic weight adjustment on the generated graph feature set results in a weighted fused graph feature set including: For each node, its initial business weight is dynamically adjusted by combining it with the structural lag coefficient: nodes with high structural lag coefficients have their business weights increased; nodes with low structural lag coefficients have their business weights decreased. The adjusted business weights are fused with the original graph features of the nodes to form a weighted node feature vector. For multi-layered dependent nodes within the same business system, the nodes are aggregated according to their comprehensive weights to generate the comprehensive graph features of each node in the multi-layered dependent network.

8. A component risk prediction system incorporating a time decay factor, characterized in that, include: The graph construction module is used to parse the interaction relationship based on the component runtime log and dependency record, establish the node set and edge set, and introduce the time decay factor to construct the time decay weighted component dependency graph; The node analysis module is used to perform dynamic graph structure feature analysis and time series modeling on nodes and their associated edges based on the time decay weighted component dependency graph. By extracting multi-layer neighborhood features of nodes, constructing time series behavior models and calculating structural lag coefficients, a graph feature set that can reflect the component structure evolution and time series dependency characteristics is generated. The business adjustment module is used to introduce business weights to perform multi-layer dependency fusion and dynamic weight adjustment on the generated graph feature set, so as to obtain a weighted fused graph feature set. The input construction module is used to construct a risk prediction input matrix based on the weighted and fused graph feature set, and to perform multi-dimensional fusion of the structural features, temporal behavior features and business weight features of nodes to form a unified risk feature representation. The risk prediction module is used to input the constructed risk prediction input matrix into the preset risk prediction model, and the model outputs the risk prediction score and risk level of each component.

9. An electronic device, characterized in that, The device includes a processor and a memory; the memory stores a program that is loaded and executed by the processor to implement a component risk prediction method for incorporating a time decay factor as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a program that, when executed by a processor, is used to implement a component risk prediction method for a fusion time decay factor as described in any one of claims 1 to 7.

Images