Big data-based software product information management method and device, and storage medium

Abstract

This invention relates to the field of computer software maintenance, and more particularly to a method, apparatus, and storage medium for software product information management based on big data. By constructing a knowledge graph of information items for the target software product, it associates event data and information items in multi-source event streams and calculates the comprehensive coupling degree. Information items exceeding a preset activation threshold are marked as vulnerability propagation sources. The cumulative vulnerability heat value of each information item is calculated, as well as the estimated remaining time for each information item to degrade to a preset risk state. Finally, a maintenance work order sequence is generated based on the estimated remaining time and the cumulative vulnerability heat value. This achieves an upgrade in proactive risk propagation quantitative assessment, enabling the identification of vulnerability propagation paths and affected scopes within the software's internal dependency network. Furthermore, it prioritizes maintenance based on degradation trend predictions, ensuring that maintenance resources are focused on critical information items with imminent risks and broad impact, thereby improving the scientific nature of maintenance decisions and the efficiency of operational resource utilization.

Description

Technical Field

[0001] This invention relates to the field of computer software maintenance, and more particularly to a method, apparatus, and storage medium for managing software product information based on big data. Background Technology

[0002] In the operation and maintenance management of large-scale software products, the software system is usually composed of a large number of interconnected modules, components and services. In order to ensure the stable operation of the software product, the existing methods mainly collect performance indicators (such as CPU utilization, memory usage, response time, etc.) or error logs through monitoring systems. When a certain indicator exceeds a preset fixed threshold, an alarm is triggered, and the operation and maintenance personnel judge the root cause of the fault based on experience and manually generate a maintenance work order.

[0003] However, software product failures do not occur in isolation. An anomaly in one module often propagates upstream and downstream along the inter-module call dependency chain, triggering cascading failures. Existing threshold-based alerting mechanisms only focus on the metric status of a single module and cannot perceive the propagation impact of anomalies between information items. Furthermore, heterogeneous events from different monitoring sources differ in severity and scope of impact. Existing methods lack a systematic approach that can correlate multi-source events with the internal software structure, quantify the propagation effect of vulnerabilities in the dependency network, predict the risk degradation trend of each information item, and determine maintenance priorities. Therefore, in large and complex software products, operations and maintenance personnel often face a large number of homogeneous alerts, making it difficult to quickly identify the source and propagation path of critical vulnerabilities. This leads to improper allocation of maintenance resources, with high-priority risk components being delayed while low-impact components are over-maintained.

[0004] Therefore, it is necessary to propose a software product information management method, device, and storage medium based on big data to solve at least one of the above-mentioned technical problems. Summary of the Invention

[0005] To address these issues, the present invention provides a software product information management method, apparatus, and storage medium based on big data, which overcomes the problems in the prior art of being unable to associate multi-source heterogeneous events with the internal dependency structure of software, being unable to quantify the cascading propagation effect of vulnerabilities, and being unable to prioritize maintenance based on risk degradation trends.

[0006] Firstly, this disclosure provides a software product information management method based on big data, including:

[0007] Real-time acquisition of event data from at least one heterogeneous signal source and generation of a multi-source event stream, wherein the event data carries at least a timestamp, an event type label, and an event severity weight;

[0008] Construct an information item knowledge graph of the target software product, wherein the information item knowledge graph contains directed edges reflecting the dependency and calling relationships between the information items;

[0009] The event data in the multi-source event stream is associated with the information items, and the overall coupling degree of each information item is calculated.

[0010] The overall coupling degree is compared with a preset activation threshold. When the overall coupling degree is greater than the preset activation threshold, the corresponding information item is marked as a vulnerability propagation source and assigned an initial vulnerability heat value, which is equal to the overall coupling degree.

[0011] Based on the directed edges, the initial vulnerability heat values ​​are cascaded and propagated to calculate the cumulative vulnerability heat values ​​of each information item.

[0012] Based on the cumulative vulnerability heat value formed by each of the information items within at least one continuous time window, calculate the estimated remaining time for each of the information items to degrade to a preset risk state;

[0013] Based on the estimated remaining time and the cumulative vulnerability heat value, a maintenance priority score is calculated for each information item, and a maintenance work order sequence for the target software product is generated based on the maintenance priority score of each information item.

[0014] Furthermore, the step of associating the event data in the multi-source event stream with the information items and calculating the comprehensive coupling degree of each information item includes:

[0015] Convert the event data in the multi-source event stream into external environment nodes;

[0016] Based on the association between the event data and the information item, a coupling edge is created between the information item and the external environment node. The coupling edge has a type attribute and an edge weight.

[0017] For each information item, the overall coupling degree of the information item is calculated based on the event severity weight of the external environment node associated with the information item and the edge weight of the corresponding coupling edge.

[0018] Further, the step of cascading the initial vulnerability heat value based on the directed edge and calculating the cumulative vulnerability heat value of each information item includes:

[0019] Along the propagation path of the directed edge, the initial vulnerability heat value of the vulnerability propagation source point is weighted and attenuated to obtain the attenuated vulnerability heat value of the vulnerability propagation source point, and the attenuated vulnerability heat value of the vulnerability propagation source point is passed to the downstream information item adjacent to the vulnerability propagation source point.

[0020] The downstream information item accumulates the attenuated vulnerability heat values ​​of each upstream information item to obtain the cumulative vulnerability heat value of the downstream information item.

[0021] When the cumulative vulnerability heat value of the downstream information item exceeds the preset continuation threshold, the downstream information item is triggered as a continuation propagation node. The cumulative vulnerability heat value of the continuation propagation node is weighted and attenuated to obtain the attenuated vulnerability heat value of the continuation propagation node.

[0022] The decayed vulnerability heat value of the continued propagation node is passed to the downstream information item adjacent to the continued propagation node.

[0023] Furthermore, the cascading propagation continues until the cumulative vulnerability heat value of all information items in the propagation path does not exceed the preset continuation threshold, or until there are no further downstream information items.

[0024] Further, the step of calculating the estimated remaining time for each information item to degrade to a preset risk state based on the cumulative vulnerability heat value formed by each information item within at least one continuous time window includes:

[0025] The cumulative vulnerability heat values ​​of the information items are obtained respectively within at least one of the continuous time windows, forming a heat value time series;

[0026] Based on the heat value time series, the vulnerability degradation rate of the information item is determined;

[0027] Obtain the risk critical calorific value corresponding to the preset risk state;

[0028] Based on the heat value time series, the vulnerability degradation rate, and the risk critical heat value, calculate the estimated remaining time for each information item to degrade to the preset risk state.

[0029] Further, the step of calculating a maintenance priority score for each information item based on the estimated remaining time and the accumulated vulnerability heat value, and generating a maintenance work order sequence for the target software product based on the maintenance priority score of each information item, includes:

[0030] The estimated remaining time for each of the information items is normalized to obtain a time risk factor, and the calorific value time series for each of the information items is normalized to obtain a calorific value risk factor.

[0031] The maintenance priority score of the information item is obtained by weighted summation of the time risk factor and the heat value risk factor.

[0032] The information items are sorted according to the maintenance priority score to generate a maintenance work order sequence for the target software product.

[0033] Secondly, this disclosure provides a software product information management device based on big data, including:

[0034] The acquisition module is configured to acquire event data from at least one heterogeneous signal source in real time and generate a multi-source event stream, wherein the event data carries at least a timestamp, an event type label, and an event severity weight.

[0035] The building module is configured to build an information item knowledge graph of the target software product, wherein the information item knowledge graph contains directed edges reflecting the dependencies and calling relationships between the information items;

[0036] The calculation module is configured to associate event data in the multi-source event stream with the information items and calculate the overall coupling degree of each information item;

[0037] The assignment module is configured to compare the overall coupling degree with a preset activation threshold. When the overall coupling degree is greater than the preset activation threshold, the corresponding information item is marked as a vulnerability propagation source and an initial vulnerability heat value is assigned. The initial vulnerability heat value is equal to the overall coupling degree.

[0038] The propagation module is configured to propagate the initial vulnerability heat value in a cascade manner based on the directed edge, and calculate the cumulative vulnerability heat value of each information item;

[0039] The prediction module is configured to calculate the estimated remaining time for each information item to degrade to a preset risk state based on the cumulative vulnerability heat value formed by each information item within at least one continuous time window;

[0040] The sequence module is configured to calculate a maintenance priority score for each information item based on the estimated remaining time and the cumulative vulnerability heat value, and generate a maintenance work order sequence for the target software product based on the maintenance priority score of each information item.

[0041] Thirdly, this disclosure provides a storage medium, including:

[0042] One or more processors;

[0043] Storage device, on which one or more programs are stored,

[0044] When the above-described one or more programs are executed by the above-described one or more processors, the above-described one or more processors implement the method as described in any embodiment of the first aspect of this disclosure.

[0045] Fourthly, this disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by one or more processors, implements the method described in any embodiment of the first aspect of this disclosure.

[0046] Fifthly, this disclosure provides a computer program product including a computer program / instructions that, when executed by a processor, implement the method described in any embodiment of the first aspect of this disclosure.

[0047] Compared with existing technologies, the beneficial effects of this invention are as follows: by constructing a knowledge graph of information items for the target software product, the event data and information items in the multi-source event stream are associated and the comprehensive coupling degree is calculated. Information items exceeding the preset activation threshold are marked as vulnerability propagation sources. The cumulative vulnerability heat value of each information item is calculated, and the estimated remaining time for each information item to degrade to the preset risk state is calculated. Finally, a maintenance work order sequence is generated based on the estimated remaining time and the cumulative vulnerability heat value. This achieves an upgrade from passive single-point alarm to proactive risk propagation quantitative assessment. It can identify the propagation path and affected scope of vulnerabilities in the software's internal dependency network, and prioritize maintenance based on degradation trend prediction. This ensures that maintenance resources are focused on key information items with imminent risks and wide impact, improving the scientific nature of maintenance decisions and the efficiency of operation and maintenance resource utilization. Attached Figure Description

[0048] Figure 1 This is a system architecture diagram of one embodiment of the software product information management method based on big data disclosed herein;

[0049] Figure 2A This is a flowchart of one embodiment of the software product information management method based on big data disclosed herein;

[0050] Figure 2B This is an exploded flowchart of one embodiment of step 203 of this disclosure;

[0051] Figure 2C This is an exploded flowchart of one embodiment of step 205 of the present disclosure;

[0052] Figure 2D This is an exploded flowchart of one embodiment of step 206 of this disclosure;

[0053] Figure 2E This is an exploded flowchart of one embodiment of step 207 of this disclosure;

[0054] Figure 3 This is a schematic diagram of a structure of an embodiment of a software product information management device based on big data according to the present disclosure. Detailed Implementation

[0055] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0056] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0057] It should be noted that in the description of this invention, the terms "upper", "lower", "left", "right", "inner", "outer", etc., which indicate directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and is not intended to indicate or imply that the device or element must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of this invention.

[0058] Furthermore, it should be noted that, in the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0059] Figure 1 An exemplary system architecture 100 is shown, in which embodiments of the big data-based software product information management method, apparatus, storage medium, and storage medium of this disclosure can be applied.

[0060] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0061] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as big data-based software product information management applications, voice interaction applications, video conferencing applications, short video social applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0062] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices with microphones and speakers, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), portable computers, and desktop computers, etc. When terminal devices 101, 102, and 103 are software, they can be installed in the aforementioned electronic devices. They can be implemented as multiple software programs or software modules, or as a single software program or software module. No specific limitations are made here.

[0063] Server 105 can be a server that provides various services, such as a backend server that processes event data collected from terminal devices 101, 102, and 103. The backend server can perform corresponding processing based on the event data collected from the terminal devices.

[0064] In some cases, the big data-based software product information management method provided in this disclosure can be jointly executed by terminal devices 101, 102, and 103 and server 105. For example, the step of "constructing a knowledge graph of information items for the target software product" can be executed by terminal devices 101, 102, and 103, and the step of "associating event data with information items in a multi-source event stream and calculating the comprehensive coupling degree of each information item" can be executed by server 105. This disclosure does not limit this. Correspondingly, the big data-based software product information management device can also be respectively set in terminal devices 101, 102, and 103 and server 105.

[0065] In some cases, the software product information management method based on big data provided in this disclosure can be executed by server 105. Correspondingly, the software product information management device based on big data can also be set in server 105. In this case, the system architecture 100 may not include terminal devices 101, 102, and 103.

[0066] In some cases, the software product information management method based on big data provided in this disclosure can be executed by terminal devices 101, 102, and 103. Correspondingly, the software product information management device based on big data can also be set in terminal devices 101, 102, and 103. In this case, the system architecture 100 may not include server 105.

[0067] It should be noted that server 105 can be either hardware or software. When server 105 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 105 is software, it can be implemented as multiple software programs or software modules (for example, used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0068] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0069] Continue to refer to Figure 2A , Figure 2A The flowchart 200 illustrates an embodiment of the software product information management method based on big data according to this disclosure. Figure 2A The big data-based software product information management method shown can be applied to... Figure 1 The terminal device or server shown. This process 200 includes the following steps:

[0070] Step 201: Real-time acquisition of event data from at least one heterogeneous signal source and generation of multi-source event stream.

[0071] In this embodiment, the executing entity of the big data-based software product information management method (e.g.) Figure 1 The server 105 can first collect event data from at least one heterogeneous signal source in real time and generate a multi-source event stream.

[0072] Here, heterogeneous signal sources refer to various monitoring systems that generate software runtime status information with different data formats, semantics, and collection granularities. Heterogeneous signal sources can be log collection systems, application performance monitoring systems, infrastructure monitoring systems, or message queue middleware, etc. Event data refers to standardized data records extracted from these heterogeneous signal sources to describe specific state changes or anomalies occurring during the operation of the software product. Event data carries at least a timestamp, event type label, and event severity weight. A timestamp is a precise record of the exact time the event occurred, typically accurate to the millisecond level, used to sort and align events in the time dimension, and is a fundamental element in constructing event sequences. Event type labels are markers used to classify the nature of events, distinguishing different types of events, such as "memory overflow alarm," "interface response timeout," "database connection failure," or "high CPU utilization." Event severity weighting refers to the subjective quantitative assignment of a value to the degree of threat an event poses to the health of a software product. It is typically pre-set based on the experience of operations and maintenance experts or historical fault correlation analysis. For example, the severity weight for "database connection failure" can be set to 0.9, while the severity weight for "disk space utilization exceeding 70%" can be set to 0.3. Multi-source event streams refer to the aggregation of real-time event data from different heterogeneous signal sources according to their respective timestamps, forming a continuously flowing sequence of event data. This sequence dynamically reflects the overall changes in the external environment in which the software product operates.

[0073] By acquiring event data from at least one heterogeneous signal source in real time and generating a multi-source event stream, the problems of isolated monitoring sources and scattered data in existing methods are solved. By aggregating multi-source heterogeneous events into a single event stream along a unified timeline, changes in the external environment of the software product can be comprehensively, continuously, and systematically perceived and acquired. This lays a unified and complete data foundation for subsequent correlation analysis between external events and the internal structure of the software, overcoming the shortcomings of global analysis due to scattered data sources and inconsistent formats.

[0074] Step 202: Construct a knowledge graph of information items for the target software product.

[0075] Here, an information item refers to a functional unit or technical component that constitutes a software product and can be independently identified and managed. It can be a module, package, or class in the code, an independent service in a microservice architecture, or a table or a set of interfaces in a database.

[0076] The target software product refers to the monitored software system that requires risk management and maintenance scheduling.

[0077] An information item knowledge graph is a directed graph data structure with information items as nodes and relationships between them as edges, used to formally represent the internal architectural topology of a software product. An information item knowledge graph contains directed edges reflecting the dependencies and calls between information items. A directed edge is a directional connection, pointing from one upstream information item to another downstream information item; the direction indicates the direction of vulnerability propagation. A dependency relationship means that the normal operation of one information item depends on the functionality or data of another information item; for example, module A needs to call a computation function provided by module B. A call relationship refers to a call chain at the code execution level; for example, service C calls the interface of service D through a remote procedure call interface. The direction of a directed edge is usually from the dependent or called party to the dependent or caller, because when the dependent party experiences an exception, the vulnerability will propagate along the call chain to the dependent party.

[0078] Knowledge graphs of information items can be automatically constructed by parsing code dependency structures using static code analysis tools, or dynamically constructed by collecting runtime call topology data from a distributed link tracing system, or a combination of both.

[0079] By constructing an information item knowledge graph of the target software product, the internal architecture topology of the software product is explicitly expressed in a data structure. It clarifies the directional relationships of dependencies and calls between information items, enabling the system to understand the possible propagation channels of vulnerabilities. This provides structured path support for subsequently internalizing external environmental shocks as vulnerability heat values ​​for information items and simulating their cascading propagation on the dependency network. This transforms vulnerability analysis from isolated node assessments into a network-based correlation analysis.

[0080] Step 203: Associate the event data and information items in the multi-source event stream, and calculate the comprehensive coupling degree of each information item.

[0081] In this embodiment, the overall coupling degree is a quantitative indicator used to measure the overall external environmental impact intensity caused to a certain information item by all multi-source events related to that information item within a specified time window. The overall coupling degree reflects the degree of dynamic interaction between multi-source events and information items. The higher the value of the overall coupling degree, the more severe the external impact that the information item is currently experiencing, and the greater the possibility of it being activated as a vulnerability propagation source.

[0082] In some alternative implementations, step 203 may include, for example: Figure 2B The following steps 2031 to 2033 are shown:

[0083] Step 2031: Convert the event data in the multi-source event stream into external environment nodes.

[0084] Here, external environment nodes refer to a special type of node in a knowledge graph that abstracts each event data point in a multi-source event stream, representing the impact signals exerted from outside the software product. Unlike information item nodes, external environment nodes do not represent the internal structure of the software product, but rather the instantaneous state of the external environment. Converting event data into external environment nodes allows event data that was originally outside the knowledge graph to be integrated into the graph's computational system in a structured form.

[0085] By transforming event data into external environment nodes, the formal barriers between external monitoring events and internal software architecture are broken down, enabling subsequent operations to be carried out within a unified knowledge graph framework. This provides a foundational entity for establishing precise quantitative relationships between information items and external events.

[0086] Step 2032: Create coupling edges between information items and external environment nodes based on the association between event data and information items.

[0087] Here, association refers to predefined mapping rules used to determine which types of events will affect which information items. Associations can be established based on service mapping tables in the configuration management database (e.g., associating the "database connection failure" event with the "user service" information item), or they can be automatically built based on topology discovery results from the application performance monitoring system.

[0088] A coupling edge is a specific type of edge connecting external environment nodes and information items; it acts as a bridge for external shocks to propagate to internal nodes. Coupling edges have type attributes and edge weights. Type attributes identify the nature of the relationship, such as direct impact or potential association. Edge weights are coefficients that quantify the degree of impact of an event on the information item, typically ranging from 0 to 1, and are calibrated by operations experts based on experience or through correlation analysis of historical fault data. For example, a memory alarm event might have an edge weight of 0.6 for the order service module because memory problems directly affect the hash table operations of the order module, while the same event might only have an edge weight of 0.1 for the log service module, as the log module has low sensitivity to this type of anomaly.

[0089] By creating coupling edges between information items and external environment nodes based on correlations, precise targets for external environmental shocks are identified, and quantitative weight coefficients are assigned to these targets, forming a structured and quantifiable expression of the influence pathway from external events to internal components.

[0090] Step 2033: For each information item, calculate the comprehensive coupling degree of the information item based on the event severity weight of the external environment node associated with the information item and the edge weight of the corresponding coupling edge.

[0091] In this embodiment, the event severity weight refers to the quantified severity value of the event data carried by the external environment node, reflecting the theoretical threat level of the event to the overall health of the software product. The edge weight of the coupling edge refers to the degree of closeness of the association between the external environment node and the information item, reflecting the actual impact ratio of this type of event on the specific information item. When calculating the comprehensive coupling degree, for each information item, all external environment nodes associated with the information item are traversed, and the event severity weight of each external environment node is combined with the edge weight of the corresponding coupling edge for calculation. The calculation results of all external environment nodes are then aggregated to finally obtain the comprehensive coupling degree of the information item.

[0092] Here, aggregation refers to merging the calculation results generated by multiple external environment nodes into a single comprehensive score value according to a specified strategy, which can be achieved by summation or weighted average.

[0093] By calculating the comprehensive coupling degree based on the event severity weights of external environment nodes associated with information items and the edge weights of the corresponding coupling edges, the transformation from a dispersed multi-source event flow to a unified risk quantification indicator for each information item is achieved. This calculation method considers both the inherent severity of the event and the degree of correlation between the event and the information item, enabling the comprehensive coupling degree to accurately reflect the external environmental pressure currently faced by each information item, providing a direct and reliable quantitative basis for the accurate determination of subsequent vulnerability propagation sources.

[0094] Step 204: Compare the overall coupling degree with the preset activation threshold. When the overall coupling degree is greater than the preset activation threshold, mark the corresponding information item as the vulnerability propagation source and assign an initial vulnerability heat value.

[0095] In this embodiment, the preset activation threshold refers to a pre-defined empirical judgment boundary value used to distinguish whether the external environmental shock faced by an information item is within the normal fluctuation range or has reached a dangerous level that may trigger cascading vulnerabilities. The vulnerability propagation source point refers to an information item node that, within the current time window, is considered to have been "infected" with vulnerability due to external shocks exceeding the threshold. The vulnerability propagation source point is the initial injection point of heat value in the subsequent cascading propagation process, acting as the "epicenter" of vulnerability propagation. The initial vulnerability heat value refers to an initial vulnerability quantification value assigned to the vulnerability propagation source point, used to characterize the vulnerability intensity carried by the source point at the start of propagation. The initial vulnerability heat value is equal to the comprehensive coupling degree of the information item. The reason for this setting is that the higher the comprehensive coupling degree, the stronger the external shock received by the source point, and the stronger the vulnerability energy it initially carries that can propagate downstream. The process of assigning an initial vulnerability heat value is essentially quantifying the intensity of the external environmental shock into the initial energy of propagation within the knowledge graph.

[0096] By comparing the overall coupling degree with a preset activation threshold and marking the vulnerability propagation source points, a large number of normal fluctuation noise events were filtered out, and only those information items with impact intensity reaching the dangerous level were identified as vulnerability sources. The starting injection point of the cascade analysis was accurately found, providing a clear signal and initial momentum for starting the risk propagation simulation.

[0097] Step 205: Based on directed edges, the initial vulnerability heat values ​​are cascaded and propagated to calculate the cumulative vulnerability heat values ​​of each information item.

[0098] In this embodiment, cascading propagation refers to the computational process of simulating vulnerability propagation from the source point, following the dependency and invocation directions indicated by the directed edges of the information item knowledge graph, and proceeding multiple times and level by level along the path. The cumulative vulnerability heat value refers to the sum of vulnerability heat values ​​received and accumulated by each information item node from all its upstream neighboring nodes during and after the cascading propagation process. The cumulative vulnerability heat value comprehensively reflects that the information item is not only directly impacted by external events but also suffers from indirect vulnerabilities propagated from its upstream dependent components; it is a comprehensive indicator quantifying the overall degree of impact.

[0099] In some alternative implementations, step 205 may include, for example: Figure 2C The following steps 2051 to 2054 are shown:

[0100] Step 2051: Along the propagation path of the directed edge, the initial vulnerability heat value of the vulnerability propagation source point is weighted and attenuated to obtain the attenuated vulnerability heat value of the vulnerability propagation source point, and the attenuated vulnerability heat value of the vulnerability propagation source point is passed to the downstream information item adjacent to the vulnerability propagation source point.

[0101] Here, weighted attenuation refers to the process where, when the vulnerability heat value of an upstream node is transmitted to the receiving node, the entire value is not transmitted directly, but rather multiplied by an attenuation factor less than 1 for reduction. The attenuation factor is determined jointly based on the dependency strength represented by the directed edge and the preset vulnerability damping coefficient of the downstream information item itself. The dependency strength represented by the directed edge refers to the tightness of the call or dependency relationship between two information items in the knowledge graph. The higher the dependency strength, the easier it is for the vulnerability to propagate through that edge, and the smaller the attenuation.

[0102] The attenuated vulnerability calorific value refers to the actual calorific value transferred outward after the original calorific value has been reduced by the aforementioned attenuation factor. This attenuated vulnerability calorific value is then transferred to downstream information items.

[0103] This weighted attenuation mechanism significantly improves the realism and accuracy of cascading risk calculation.

[0104] Step 2052: The downstream information item accumulates the attenuated vulnerability heat values ​​of each upstream information item to obtain the cumulative vulnerability heat value of the downstream information item.

[0105] In this embodiment, summation refers to the process of summing the attenuated vulnerability heat values ​​transmitted from all its upstream neighboring nodes to a downstream information item. Since an information item may be depended upon or invoked by multiple upstream modules, it will simultaneously receive vulnerability heat values ​​transmitted from multiple upstream sources. By summing to form a cumulative vulnerability heat value, the "vulnerability inflow" state of the information item in the dependency network can be fully reflected.

[0106] Step 2053: When the cumulative vulnerability heat value of the downstream information item exceeds the preset retransmission threshold, the downstream information item is triggered as a retransmission node. The cumulative vulnerability heat value of the retransmission node is weighted and attenuated to obtain the attenuated vulnerability heat value of the retransmission node.

[0107] In this embodiment, the preset continuation threshold refers to the critical value used to determine whether the accumulated vulnerability received by an information item is sufficient to support its continued propagation downstream. A continuation propagation node is an information item node that is activated because its accumulated vulnerability heat value exceeds the preset continuation threshold, thus no longer being the passive endpoint of vulnerability reception, but becoming a new propagation starting point.

[0108] By setting continuation conditions, the threshold-triggered physical process of vulnerability propagation was simulated—only when the information item is affected sufficiently will its anomaly be perceived downstream, making the propagation more focused on real and influential cascading risk paths.

[0109] Step 2054: Pass the decayed vulnerability heat value of the propagation node to the downstream information item adjacent to the propagation node.

[0110] Here, the next downstream information item refers to the next-level adjacent node along the directed edge direction, with the continuing propagation node as the upstream node. The transmission process is the same as the previous steps, forming a loop iteration until the cumulative vulnerability heat value of all information items in the propagation path does not exceed the preset continuing propagation threshold, or there are no more downstream information items.

[0111] In some preferred embodiments, to avoid the vulnerability heat values ​​from cyclically accumulating and infinitely amplifying intensities when loops exist in the information item knowledge graph (e.g., A depends on B, B depends on C, and C depends on A), a set of information items along the propagated path is maintained during cascading propagation. This set records all information items that have been processed as source or subsequent propagation nodes during the current cascading propagation. When a downstream information item exists in this set, it indicates that the item has been processed in this propagation, and the transmission of attenuated vulnerability heat values ​​to that downstream item is stopped, thus suppressing loop propagation.

[0112] Through iterative control and loop suppression mechanisms using cascaded propagation, the computation process is ensured to terminate and the results are stable. This enables the algorithm to handle complex network dependencies and even circular dependencies common in real software systems. The results will not become invalid due to the path search entering an infinite loop, thus enhancing the engineering robustness and the breadth of applicable scenarios.

[0113] Step 206: Based on the cumulative vulnerability heat value formed by each information item within at least one continuous time window, calculate the estimated remaining time for each information item to degrade to a preset risk state.

[0114] In this embodiment, the preset risk state refers to a high-risk level state defined according to the operation and maintenance management objectives. When an information item reaches this state, it means that if maintenance intervention is not carried out immediately, it will very likely develop into an actual failure. The estimated remaining time refers to how long it is expected that, starting from the end of the current time window, based on the current vulnerability degradation trend of the information item, it will take for its accumulated vulnerability heat value to reach the risk threshold heat value corresponding to the preset risk state.

[0115] In some alternative implementations, step 206 may include, for example: Figure 2D The following steps 2061 to 2064 are shown:

[0116] Step 2061: Obtain the cumulative vulnerability heat values ​​of the information items formed in at least one continuous time window, and construct a heat value time series.

[0117] Here, a continuous time window is an adjacent time period obtained by dividing the time axis into equal parts according to a fixed time step, such as one window per hour or every 5 minutes. A heat value time series refers to a numerical sequence composed of the cumulative vulnerability heat values ​​of the most recent continuous time windows (such as the most recent 6 windows) arranged in chronological order up to the current window, used to record the evolution history of the risk state of this information item.

[0118] By acquiring the cumulative vulnerability heat values ​​within multiple consecutive time windows and constructing a time series, the risk snapshot of a single point is expanded into a dynamic dataset that can track the trend of risk changes. This provides the necessary time dimension information for subsequent degradation rate analysis and remaining time prediction, thus providing historical data support for future predictions.

[0119] Step 2062: Determine the vulnerability degradation rate of information items based on the heat value time series.

[0120] In this embodiment, the vulnerability degradation rate refers to the average rate at which the cumulative vulnerability heat value of an information item increases within a unit time window, reflecting how quickly the risk status of the information item deteriorates.

[0121] As an example, based on the trajectory of numerical changes in the calorific value time series, mathematical methods such as linear regression, exponential regression, or curve fitting are used to fit a degradation curve, and the vulnerability degradation rate of the information item is determined according to the slope of the degradation curve. For example, if the slope of the fitted line obtained by linear regression is 0.12, it means that the vulnerability calorific value of the information item increases by an average of 0.12 in each time window.

[0122] By determining the vulnerability degradation rate of information items based on calorific value time series, a core dynamic trend variable is provided for calculating the estimated remaining time.

[0123] Step 2063: Obtain the risk critical heat value corresponding to the preset risk state.

[0124] Here, the risk threshold heat value refers to the heat value boundary value used to determine whether an information item enters a preset risk state. The risk threshold heat value is set according to the type of information item, historical failure thresholds, or preset industry standards. For example, the risk threshold heat value of the core trading module can be set to 0.85, while that of the auxiliary log module can be set to 0.95, reflecting the difference in risk tolerance between different components. It can also be calibrated based on the statistical data of the probability of actual failure after the information item has accumulated a certain vulnerability heat value in history.

[0125] Step 2064: Based on the calorific value time series, vulnerability degradation rate, and risk critical calorific value, calculate the estimated remaining time for each information item to degrade to the preset risk state.

[0126] As an example, if the cumulative vulnerability heat value of a certain information item is 0.65, the risk critical heat value is 0.85, and the degradation rate is 0.04 per window, then the estimated remaining time is (0.85-0.65) / 0.04=5 time windows.

[0127] By calculating the estimated remaining time for each information item to degrade to a preset risk state based on heat value time series, vulnerability degradation rate, and risk critical heat value, operation and maintenance decision-makers can clearly know which information items are in the last window of risk, providing the most critical time-series decision basis for subsequent maintenance scheduling.

[0128] Step 207: Based on the estimated remaining time and cumulative vulnerability heat value, calculate the maintenance priority score for each information item, and generate a maintenance work order sequence for the target software product based on the maintenance priority score for each information item.

[0129] In this embodiment, the maintenance priority score is a comprehensive rating used to compare the urgency and impact of each information item requiring maintenance. The maintenance work order sequence refers to a list of information items arranged in descending order of maintenance priority score. This list of information items directly serves as the basis for the operation and maintenance team to execute maintenance tasks in a timely manner and allocate resources.

[0130] In some alternative implementations, step 207 may include, for example: Figure 2E The following steps 2071 to 2073 are shown:

[0131] Step 2071: Normalize the estimated remaining time for each information item to obtain the time risk factor, and normalize the heat value time series for each information item to obtain the heat value risk factor.

[0132] Here, normalization refers to mapping two indicators with different dimensions and value ranges to the same numerical interval (e.g., 0 to 1) through methods such as range standardization, so that they can be weighted and fused. For the time risk factor, the normalization direction is consistent with the urgency of the risk; that is, the shorter the remaining time, the closer the time risk factor is to 1, indicating greater urgency. For the heat value risk factor, the higher the cumulative vulnerability heat value, the closer the heat value risk factor is to 1, indicating a deeper impact from the current vulnerability.

[0133] By normalizing the two indicators separately, the risk factors were obtained, eliminating the difference in dimensions. This enabled the time urgency indicator and the scope of impact indicator to be compared and integrated under a unified scale, laying a mathematical foundation for subsequent comprehensive ranking of multiple indicators.

[0134] Step 2072: The time risk factor and heat value risk factor are weighted and summed to obtain the maintenance priority score of the information item.

[0135] Here, the weights in the weighted summation can be adjusted according to the operation and maintenance strategy. The weight of the time risk factor can be set higher (e.g., 0.7) to prioritize components that are about to reach the risk threshold, and the weight of the heat value risk factor can be set higher (e.g., 0.6) to prioritize components with the highest cumulative heat value and the widest spread of impact.

[0136] As an example, if the time risk factor of a certain information item is 0.9 and the heat value risk factor is 0.4, and the weights of the time risk factor and the heat value risk factor are 0.7 and 0.3 respectively, then the maintenance priority score of this information item = 0.9 × 0.7 + 0.4 × 0.3 = 0.75.

[0137] By weighted summation and merging risk factors from both time and heat value dimensions, the maintenance priority score can flexibly adapt to different operation and maintenance management philosophies, avoiding decision-making biases caused by sorting based on only a single dimension, and improving the comprehensiveness and adaptability of maintenance scheduling.

[0138] Step 2073: Sort the information items according to the maintenance priority score to generate a maintenance work order sequence for the target software product.

[0139] Here, the generated maintenance work order sequence for the target software product can be directly pushed to the operation and maintenance task scheduling system, or displayed visually on the front-end interface.

[0140] By calculating maintenance priority scores based on estimated remaining time and accumulated vulnerability heat values ​​and generating maintenance work order sequences, the final results of the entire complex set of event perception, correlation analysis, cascading propagation simulation and degradation prediction analysis are transformed into clear action instructions that maintenance personnel can execute immediately. This effectively transforms big data analysis capabilities into the execution efficiency and risk control effect of software product maintenance management.

[0141] The software product information management method based on big data provided in the above embodiments of this disclosure constructs a knowledge graph of information items of the target software product, associates event data and information items in multi-source event streams and calculates the comprehensive coupling degree, marks information items exceeding a preset activation threshold as vulnerability propagation sources, calculates the cumulative vulnerability heat value of each information item, calculates the estimated remaining time for each information item to degrade to a preset risk state, and finally generates a maintenance work order sequence based on the estimated remaining time and cumulative vulnerability heat value. This achieves an upgrade from passive single-point alarms to proactive risk propagation quantitative assessment, can identify the propagation path and affected scope of vulnerabilities in the software's internal dependency network, and prioritizes maintenance based on degradation trend prediction, ensuring that maintenance resources are focused on key information items with imminent risks and wide impact, thereby improving the scientific nature of maintenance decisions and the efficiency of operation and maintenance resource utilization.

[0142] Further reference Figure 3 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a software product information management device based on big data. This device embodiment is similar to... Figure 2A Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0143] like Figure 3As shown, the software product information management device 300 based on big data in this embodiment includes: a collection module 301, a construction module 302, a calculation module 303, an assignment module 304, a propagation module 305, a prediction module 306, and a sequence module 307. The collection module 301 is configured to collect event data from at least one heterogeneous signal source in real time and generate a multi-source event stream. The event data carries at least a timestamp, an event type label, and an event severity weight. The construction module 302 is configured to construct an information item knowledge graph of the target software product. The information item knowledge graph contains directed edges reflecting the dependencies and calling relationships between information items. The calculation module 303 is configured to associate the event data in the multi-source event stream with information items and calculate the comprehensive coupling degree of each information item. The assignment module 304 is configured to compare the comprehensive coupling degree with a preset activation threshold. When the comprehensive coupling degree is greater than the preset activation threshold, the corresponding information item is assigned a value. The vulnerability propagation source is marked and assigned an initial vulnerability heat value, which is equal to the overall coupling degree. The propagation module 305 is configured to cascade the initial vulnerability heat values ​​based on directed edges and calculate the cumulative vulnerability heat value of each information item. The prediction module 306 is configured to calculate the estimated remaining time for each information item to degrade to a preset risk state based on the cumulative vulnerability heat value formed by each information item within at least one continuous time window. The sequence module 307 is configured to calculate the maintenance priority score of each information item based on the estimated remaining time and the cumulative vulnerability heat value, and generate a maintenance work order sequence for the target software product based on the maintenance priority score of each information item.

[0144] It should be noted that the implementation details and technical effects of each module and unit in the big data-based software product information management device provided in the embodiments of this disclosure can be referred to the descriptions of other embodiments in this disclosure, and will not be repeated here.

[0145] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A software product information management method based on big data, characterized in that, include: Real-time acquisition of event data from at least one heterogeneous signal source and generation of a multi-source event stream, wherein the event data carries at least a timestamp, an event type label, and an event severity weight; Construct an information item knowledge graph of the target software product, wherein the information item knowledge graph contains directed edges reflecting the dependency and calling relationships between the information items; The event data in the multi-source event stream is associated with the information items, and the overall coupling degree of each information item is calculated. The overall coupling degree is compared with a preset activation threshold. When the overall coupling degree is greater than the preset activation threshold, the corresponding information item is marked as a vulnerability propagation source and assigned an initial vulnerability heat value, which is equal to the overall coupling degree. Based on the directed edges, the initial vulnerability heat values ​​are cascaded and propagated to calculate the cumulative vulnerability heat values ​​of each information item. Based on the cumulative vulnerability heat value formed by each of the information items within at least one continuous time window, calculate the estimated remaining time for each of the information items to degrade to a preset risk state; Based on the estimated remaining time and the cumulative vulnerability heat value, a maintenance priority score is calculated for each information item, and a maintenance work order sequence for the target software product is generated based on the maintenance priority score of each information item.

2. The method according to claim 1, characterized in that, The step of associating event data in the multi-source event stream with the information items and calculating the comprehensive coupling degree of each information item includes: Convert the event data in the multi-source event stream into external environment nodes; Based on the association between the event data and the information item, a coupling edge is created between the information item and the external environment node. The coupling edge has a type attribute and an edge weight. For each information item, the overall coupling degree of the information item is calculated based on the event severity weight of the external environment node associated with the information item and the edge weight of the corresponding coupling edge.

3. The method according to claim 1, characterized in that, The step of cascading the initial vulnerability heat values ​​based on the directed edges and calculating the cumulative vulnerability heat values ​​of each information item includes: Along the propagation path of the directed edge, the initial vulnerability heat value of the vulnerability propagation source point is weighted and attenuated to obtain the attenuated vulnerability heat value of the vulnerability propagation source point, and the attenuated vulnerability heat value of the vulnerability propagation source point is passed to the downstream information item adjacent to the vulnerability propagation source point. The downstream information item accumulates the attenuated vulnerability heat values ​​of each upstream information item to obtain the cumulative vulnerability heat value of the downstream information item. When the cumulative vulnerability heat value of the downstream information item exceeds the preset continuation threshold, the downstream information item is triggered as a continuation propagation node. The cumulative vulnerability heat value of the continuation propagation node is weighted and attenuated to obtain the attenuated vulnerability heat value of the continuation propagation node. The decayed vulnerability heat value of the continued propagation node is passed to the downstream information item adjacent to the continued propagation node.

4. The method according to claim 3, characterized in that, The cascading propagation continues until the cumulative vulnerability heat value of all information items in the propagation path does not exceed the preset continuation threshold, or there are no further downstream information items.

5. The method according to claim 1, characterized in that, The step of calculating the estimated remaining time for each information item to degrade to a preset risk state based on the cumulative vulnerability heat value formed by each information item within at least one continuous time window includes: The cumulative vulnerability heat values ​​of the information items are obtained respectively within at least one of the continuous time windows, forming a heat value time series; Based on the heat value time series, the vulnerability degradation rate of the information item is determined; Obtain the risk critical calorific value corresponding to the preset risk state; Based on the heat value time series, the vulnerability degradation rate, and the risk critical heat value, calculate the estimated remaining time for each information item to degrade to the preset risk state.

6. The method according to claim 5, characterized in that, The step of calculating a maintenance priority score for each information item based on the estimated remaining time and the accumulated vulnerability heat value, and generating a maintenance work order sequence for the target software product based on the maintenance priority score of each information item, includes: The estimated remaining time for each of the information items is normalized to obtain a time risk factor, and the calorific value time series for each of the information items is normalized to obtain a calorific value risk factor. The maintenance priority score of the information item is obtained by weighted summation of the time risk factor and the heat value risk factor. The information items are sorted according to the maintenance priority score to generate a maintenance work order sequence for the target software product.

7. A software product information management device based on big data, characterized in that, include: The acquisition module is configured to acquire event data from at least one heterogeneous signal source in real time and generate a multi-source event stream, wherein the event data carries at least a timestamp, an event type label, and an event severity weight. The building module is configured to build an information item knowledge graph of the target software product, wherein the information item knowledge graph contains directed edges reflecting the dependencies and calling relationships between the information items; The calculation module is configured to associate event data in the multi-source event stream with the information items and calculate the overall coupling degree of each information item; The assignment module is configured to compare the overall coupling degree with a preset activation threshold. When the overall coupling degree is greater than the preset activation threshold, the corresponding information item is marked as a vulnerability propagation source and an initial vulnerability heat value is assigned. The initial vulnerability heat value is equal to the overall coupling degree. The propagation module is configured to propagate the initial vulnerability heat value in a cascade manner based on the directed edge, and calculate the cumulative vulnerability heat value of each information item; The prediction module is configured to calculate the estimated remaining time for each information item to degrade to a preset risk state based on the cumulative vulnerability heat value formed by each information item within at least one continuous time window; The sequence module is configured to calculate a maintenance priority score for each information item based on the estimated remaining time and the cumulative vulnerability heat value, and generate a maintenance work order sequence for the target software product based on the maintenance priority score of each information item.

8. A storage medium, comprising: One or more processors; Storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method as described in any one of claims 1-6.

9. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1-6.

10. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the method as described in any one of claims 1-6.

Images