Risk identification method and related equipment

Abstract

The invention discloses a risk identification method and device, computing equipment, a computer readable storage medium and a computer program product. The method comprises the steps of determining similarities between information in fields of at least two types of granularities selected from a detected change list and information in fields of at least two types of granularities selected from historical change lists; wherein the to-be-tested change list is used for recording related information of target change of the information technology IT system in a field contained in the to-be-tested change list; the historical change list is used for recording related information of historical changes of the IT system in fields contained in the historical change list; according to the similarities, selecting all historical change lists of which the corresponding similarities meet a preset similarity condition from the historical change lists; when the target information in the tested change list and the target information in all the selected historical change lists do not meet a preset consistency requirement, determining that the target change has a risk; wherein the target information is information which is recorded in the specified field and corresponds to the specified change object.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a risk identification method, apparatus, device, computer-readable storage medium, and computer program product. Background Art

[0002] Information Technology (IT) system changes generally refer to changes to an already online IT system, IT infrastructure, or IT service. Based on the objects that have changed, IT system changes can include: infrastructure changes, system external changes, and system internal changes.

[0003] Among them, infrastructure changes may include changes in basic hardware, networks, cloud service containers, etc. If these changes are not handled properly, they may affect the stability and service capabilities of the IT system; external changes in the system, such as sudden increases in user traffic and changes in user demand, may increase the risk of IT system stability; and internal changes in the system, such as technical personnel iterations and new function releases, may cause system vulnerabilities and cause the IT system to face security risks.

[0004] How to identify whether changes to IT systems pose risks so as to issue early warnings and prepare for risk responses in advance is an urgent problem that needs to be solved with existing technologies. Summary of the invention

[0005] The embodiment of the present application provides a risk identification method to solve the problem of how to identify whether a change in an IT system involves risks in the prior art.

[0006] Embodiments of the present application also provide a risk identification device, equipment, computer-readable storage medium, and computer program product.

[0007] The present application embodiment adopts the following technical solutions: A risk identification method comprising: Determine the similarities between the information in the fields of at least two types of granularity selected from the tested change order and the information in the fields of the at least two types of granularity selected from each historical change order; wherein the tested change order is used to record the relevant information of the target change occurred in the information technology IT system in the fields included in the tested change order; the historical change order is used to record the relevant information of the historical change occurred in the IT system in the fields included in the historical change order; According to the similarities, all historical change orders whose corresponding similarities meet a preset similarity condition are selected from the historical change orders; When the target information in the tested change order does not meet the preset consistency requirements with the target information in all the selected historical change orders, it is determined that there is a risk in the target change; wherein, the target information is the information recorded in the specified field corresponding to the specified change object.

[0008] A risk identification device, comprising: A similarity determination unit is used to determine the similarities between the information in the fields of at least two types of granularity selected from the tested change order and the information in the fields of the at least two types of granularity selected from each historical change order; wherein the tested change order is used to record the relevant information of the target change occurred in the information technology IT system in the fields included in the tested change order; the historical change order is used to record the relevant information of the historical change occurred in the IT system in the fields included in the historical change order; A change order selection unit, configured to select, from the historical change orders, all historical change orders whose corresponding similarities satisfy a preset similarity condition according to the similarities; A risk determination unit is used to determine that there is a risk in the target change when the target information in the tested change order does not meet the preset consistency requirements with the target information in all the selected historical change orders; wherein the target information is the information recorded in the specified field corresponding to the specified change object. A computing device, comprising: a memory and a processor, wherein: The memory is used to store computer programs; The processor is coupled to the memory and is used to execute the computer program in the memory to perform the above method.

[0009] A computer-readable storage medium storing a computer program, wherein the computer program can implement the above method when executed by a computer.

[0010] A computer program product stores instructions, which, when executed by a computer, enable the computer to implement the above method.

[0011] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: By selecting from the historical change orders all historical change orders whose information similarity in fields of at least two types of granularity meets the preset similarity conditions, and based on this, further, when the target information in the change order under test and the target information in all the selected historical change orders do not meet the preset consistency requirements, it is determined that there is a risk in the target change, thereby solving the problem of how to identify whether there is a risk in the change of the IT system in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings described herein are used to provide a further understanding of the present application and together constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not together constitute an improper limitation on the present application. In the drawings: Figure 1 A specific implementation flow chart of a risk identification method provided in an embodiment of the present application; Figure 2 A schematic diagram of the specific structure of a risk identification device provided in an embodiment of the present application; Figure 3 A schematic diagram of the specific structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0014] Those skilled in the art may appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0015] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0016] Example 1 Embodiment 1 of the present application provides a risk identification method to solve the problem existing in the prior art of how to identify whether a change in an IT system involves risks.

[0017] The executor of the method may be any computing device that can implement the method, such as a server, a mobile phone, a personal computer, a smart wearable device, a smart robot, and the like.

[0018] The different steps of the method may be implemented by the same execution subject or by different execution subjects. The embodiment of the present application does not limit the execution subject used to implement the method.

[0019] In addition, the execution order of different steps is not limited in the embodiment of the present application. When using the method provided in the embodiment of the present application, the execution order of different steps can be adjusted according to actual needs.

[0020] For ease of description, the method provided in the embodiment of the present application is described in detail below by taking a change management system as an example of the execution subject of the method.

[0021] The change management system can be a software system that can at least be used to control IT system changes and track and record relevant information about IT system changes. Controlling IT system changes mainly refers to controlling changes within the system; the relevant information tracked and recorded can be changes to the IT system's infrastructure, external changes to the system, and internal changes to the system.

[0022] From the functional perspective, the IT system described in the embodiments of this application may include but is not limited to: computer hardware systems, operating systems, database management systems, network systems, and application software systems, etc. From the application perspective, the IT system described in the embodiments of this application may include but is not limited to: human resources information systems, procurement supply chain management systems, production and manufacturing systems, financial management information systems, medical and health information systems, etc. The embodiments of this application do not limit what kind of IT system the IT system described is.

[0023] like Figure 1 As shown, a specific implementation flow chart of a risk identification method provided in an embodiment of the present application includes the following steps: Step 11: the change management system determines the similarities between "the information in the fields of at least two types of granularity selected from the tested change order" and "the information in the fields of at least two types of granularity selected from each historical change order"; The change order described in the embodiment of the present application is a file for recording relevant information of changes that occur in the IT system. In terms of form, the change order can be a text file or a table. The embodiment of the present application does not limit the specific form of the change order.

[0024] To distinguish the description, in an embodiment of the present application, the change order used to record relevant information of the target changes occurring in the IT system is referred to as a "tested change order", and the change order used to record relevant information of the historical changes occurring in the IT system is referred to as a "historical change order".

[0025] Among them, the target change refers to the change that needs to be judged whether there is a change risk, such as the most recent change that occurred in the IT system, or the change that is about to occur but has not yet occurred in the IT system; historical changes generally refer to changes that occurred before the target change. Those skilled in the art can understand that the target change can also be a historical change that occurred in the IT system. The embodiments of this application do not limit which specific change the target change refers to. In actual application scenarios, a certain change can be specified as the target change according to needs.

[0026] The change order in the embodiment of the present application includes fields, and the relevant information of the change is stored in the fields. Fields are the basic units in data management, which are used to store and organize data. The relevant information of the change can be filled in the fields included in the change order by technicians according to the changes that have occurred in the IT system.

[0027] The relevant information may include, for example, but is not limited to: Category “A” of the changed object involved in the change that occurred in the IT system - “A” can be stored in the field “Category of changed object” as the value of the field; Change action "X" of the change object - "X" can be stored in the field "Change action of the change object" as the value of the field; Description of the changes that occurred to the change object "Adding new functionality" - this description can be stored in the field "Description of changes that occurred to the change object" as the value of this field; A change type “B” of a change that occurs to a change object—“B” may be stored in the field “change type of a change that occurs to a change object” as a value of the field.

[0028] The change object refers to the object of the change involved in the change of the IT system. Objects include but are not limited to basic hardware, networks, cloud server containers, user traffic, user needs, technicians, IT system functions, etc. In general, any object whose "change can cause changes in the IT system" can be used as the change object described in the embodiments of this application.

[0029] In a specific example, taking the relevant information of the change of a certain change object "LAN 001" as an example, it can be recorded in the change order in the form shown in the following Table 1. The first row in Table 1 is all fields, and the second row is all field values, that is, the relevant information of the change stored in the field.

[0030] Table 1:

[0031] In the embodiment of the present application, the fields in the same change order may have different granularities. The granularity described in the embodiment of the present application is an Internet term, where a large granularity means macroscopic and general, and a small granularity means microscopic and detail-oriented.

[0032] In actual scenarios, users can configure the granularity of the selected fields for the change management system as needed. Based on the configured granularity, the change management system can select fields that match the configured granularity from the change order and then obtain the information in the selected fields.

[0033] In an optional implementation, the first type of granularity is greater than the second type of granularity. For example, in a specific example, the fields of the first type of granularity may be selected according to the following first type selection principle, and the fields of the second type of granularity (the second type of granularity is smaller than the first type of granularity) may be selected according to the following second type selection principle.

[0034] The first category selection principles include but are not limited to: Prioritize the selection of fields that represent the main differences between different change objects, such as the category of the change object; prioritize the selection of fields that represent the main differences between different change operations, such as change description, change type, or change action; prioritize the selection of fields whose values ​​are not empty. In a specific example, for example, the second type of granularity fields can be selected according to the second type selection principle. The second type selection principle includes but is not limited to: Prioritize the selection of fields that characterize the main differences between different change objects, but the granularity of the fields is lower than the fields that characterize the main differences between different change objects selected according to the first selection principle - for example, they can be subcategories of change objects; select fields that can further classify the fields selected according to the first selection principle. In an optional implementation, the change management system can select fields of at least two types of granularity, and then the change management system can further determine the similarities between "the information in the fields of at least two types of granularity selected from the tested change order" and "the information in the fields of at least two types of granularity selected from each historical change order".

[0035] In an optional implementation, the change management system may determine the similarity in the following manner: On the one hand, determining first similarities between “information in a field of the first type of granularity selected from the tested change order” and “information in a field of the first type of granularity selected from each historical change order”; On the other hand, the second similarities between "the information in the fields of the second type of granularity selected from the tested change order" and "the information in the fields of the second type of granularity selected from each historical change order" are determined.

[0036] In an optional implementation, in order to enhance the robustness of similarity calculation, the embodiment of the present application may determine each first similarity by randomly slicing similarities. The specific implementation is as follows: For each historical change order, perform the following sub-steps 1 to 4 respectively: Sub-step 1: Combine the information in the fields of the first type of granularity selected from the tested change order into a first string, and combine the information in the fields of the first type of granularity selected from the historical change order into a second string; the number of characters contained in the first string and the second string are both L ; For example, the first type of granularity fields selected from the tested change order include: category of the change object and change action, and the relevant information in these two fields are: "network" and "increase in bandwidth". Then, the two can be combined into "increase in network bandwidth" as the first string.

[0037] Similarly, assuming that the information obtained from the fields of the first type of granularity in the historical change order is respectively: "network" and "bandwidth reduction", then the two can be combined into "network bandwidth reduction" as the second character string.

[0038] Sub-step 2: Generate values ​​between 0 and 1 N Random numbers n 1~ n N ; N <L ; Sub-step 3: From the first string, extract the n 1 L 、 n 2 L、...、n N L The characters in the first position together constitute a new first string; from the second string, extract the characters arranged in the first n 1 L 、 n 2 L、...、n N L The characters of the bits together constitute a new second string; By executing the above sub-step 2 and sub-step 3, characters can be randomly selected from the first character string and the second character string respectively to construct new character strings respectively.

[0039] Sub-step 4: Calculate the similarity between the new first string and the new second string as the first similarity corresponding to the historical change order.

[0040] In an optional implementation, for example, the minimum edit distance between the new first character string and the new second character string can be calculated, and then the first similarity is determined according to the minimum edit distance. The minimum edit distance is negatively correlated with the first similarity - the smaller the distance, the greater the first similarity; conversely, the larger the distance, the smaller the first similarity.

[0041] A similar method as above may be adopted to respectively perform the following sub-steps ① to ④ for each historical change order, thereby determining the second similarity: Sub-step ①: combine the information in the fields of the second type of granularity selected from the tested change order into a third character string, and combine the information in the fields of the second type of granularity selected from the historical change order into a fourth character string; the number of characters contained in the third character string and the fourth character string are both Q ; Sub-step ②: Generate a value between 0 and 1 M Random numbers m 1~ m M ; M Q、...m ; Sub-step ③: From the third string, extract the m 1 Q 、 m 2 Q、...m M Q The characters in the first position together form a new third string; from the fourth string, extract the characters arranged in the m 1 Q 、 m 2 i M Q The characters of the bits together form a new fourth string; Sub-step ④: Calculate the similarity between the new third character string and the new fourth character string as the second similarity corresponding to the historical change order.

[0042] The specific implementation method of the above sub-steps ① to ④ is similar to the implementation method of sub-steps 1 to 4, and will not be repeated here.

[0043] Step 12: The change management system selects all historical change orders whose corresponding similarities meet a preset similarity condition from the historical change orders according to the determined similarities; In an optional implementation, if the determined similarities include first similarities and second similarities, then, based on the first similarities and the second similarities, all historical change orders whose corresponding first similarities and second similarities satisfy the preset similarity conditions can be selected from the historical change orders.

[0044] For example, in an optional implementation, a target similarity may be calculated based on each first similarity and each second similarity, and then all historical change orders corresponding to the target similarity greater than a predetermined similarity threshold may be selected.

[0045] In an optional implementation, for each historical change order, the following operations may be performed respectively: i 1, and a second threshold value set for the second similarity i 2, and the first similarity corresponding to the historical change order S 1 and 2 similarity S 2. Calculate the target similarity corresponding to the historical change order using the following formula [1]: similarity=U( S 1- i 1) U( S 2- i 2)[1] Where U is a step function that satisfies: .

[0046] In an optional embodiment, i 1 and i 2 can be pre-set in the change management system and can meet: i 1> i 2.

[0047] In another optional implementation, the following method can also be used to calculate i 1: Sort all first similarities from small to large; after sorting, find the corresponding quantile value according to the preset value as i 1. For example, if the default value is 0.5, then the median is found as i 1.

[0048] Similarly, all second similarities can be sorted from small to large; after sorting, the corresponding quantile value is found according to the preset value as i 2.

[0049] Quantile, also known as percentile, is a commonly used concept in statistics, used to describe the position of a specific percentage in a set of data. i 1Instead of directly defining a similarity as i 1 (or s 2) The benefit is that as the running time of the method provided by the embodiment of the present application in the change management system increases, the volatility of the data also increases, which may lead to the risk of threshold failure in the method of defining the threshold based on the value of the similarity itself; while the use of the quantile method utilizes the relative stability of the distribution in the data fluctuation, which can avoid this risk and make the operation of the change management system more stable.

[0050] Step 13: When the target information in the tested change order does not meet the preset consistency requirements with the target information in all selected historical change orders, the change management system determines that there is a risk in the target change.

[0051] The target information is the information corresponding to the specified change object recorded in the specified field. The specified field can be one field or multiple fields.

[0052] For example, a technician can trigger the change management system to determine a field in the change order that matches the name of the designated field entered and the name of the designated change object by inputting the name of the designated field into the change management system, and then determine the information in the designated field that corresponds to the name of the designated change object as the target information.

[0053] For example, a technician may input the name of the field "change action" and the name of the designated change object "LAN 001" into the change management system, so that the change management system may determine "change action" as the designated field in the tested change order shown in Table 2 based on the input; further, from the information stored in the designated field, determine "bandwidth increase" that matches (corresponds to) "LAN 001" as the target information.

[0054] Table 2:

[0055] Similarly, based on the input, the change management system can respectively determine the target information in each selected historical change order.

[0056] In an optional implementation, the technician may also only input the name of the specified change object into the change management system, and the change management system may determine all fields in the change order as specified fields based on the name of the change object, and determine the information stored in these specified fields corresponding to the name of the change object as the target information.

[0057] In an optional implementation, after determining the target information in the tested change order and the target information in all selected historical change orders, the change management system may respectively perform the following sub-steps 131 to 133 for each designated field to determine whether there is a risk in the target change: Sub-step 131: the change management system counts the occurrence frequencies of different information corresponding to the specified change object in the specified field in all selected historical change orders; In a specific example, assuming that the change object specified by the technician is LAN 001, and the corresponding designated field is the change action, then the change management system can count the frequency of occurrence of different information corresponding to the specified change object in the designated field (assuming that there are only two types of information, "bandwidth increase" and "bandwidth decrease") in all selected historical change orders based on all selected historical change orders - for example, assuming that the frequency of occurrence of "bandwidth increase" in the designated field is 40%, while the frequency of occurrence of "bandwidth decrease" is 60%.

[0058] The frequency of occurrence of a certain information in the specified field in all selected historical change orders can be recorded as p i , the specific calculation method is as follows [2]: [2] in, i The value range is [1, Q], where Q is the total number of all selected historical change orders.

[0059] Sub-step 132: determining the information with the highest frequency of occurrence among the different information (assuming that there are only two types of information, "bandwidth increase" and "bandwidth decrease") as the recommended value of the designated field; Continuing with the above example, "Bandwidth Reduction" may be determined as the recommended value for the specified field.

[0060] Sub-step 133: If the target information in the tested change order is different from the recommended value of the specified field, it is determined that there is a risk in the target change.

[0061] Continuing with the above example, since the target information determined in the tested change order is "increase in bandwidth" and the recommended value is "decrease in bandwidth", the two are different. Therefore, it can be determined that the target information in the tested change order and the target information in all selected historical change orders do not meet the preset consistency requirements, thereby determining that there is a risk in the target change.

[0062] In an optional implementation, if the change management system determines all fields in the change order as designated fields according to the name of the designated change object, then sub-steps 131 to 133 can be executed for each designated field, and in step 133, if there are designated fields with information exceeding a certain number threshold that is different from the corresponding recommended value, it can be determined that the target information in the tested change order does not meet the preset consistency requirements with the target information in all selected historical change orders, thereby determining that there is a risk in the target change. The number threshold can be preset according to actual needs, for example, it can be set to 1, or set to other natural numbers that do not exceed the total number of all fields.

[0063] In an optional implementation, if it is determined that there is a risk in the target change, the change management system can issue an early warning to provide a warning of the risk. Specific early warning methods may include but are not limited to: sending early warning information via mobile phone text messages, emails or instant messaging tools; publishing early warning announcements on relevant display screens and / or applications; etc.

[0064] In an optional embodiment, if for any specified field, the target information in the tested change order is different from the recommended value of the specified field, and the target information in the tested change order is different from the target information of any selected historical change order, then the change management system can issue a warning message with the content "Prompt, first occurrence".

[0065] In an optional implementation, the following method may be used to more accurately determine whether there is a risk in the target change: If the "information corresponding to the specified change object recorded in the specified field" in the tested change order is different from the recommended value of the specified field, the length difference and text similarity between the target information in the tested change order and the recommended value are compared; If the length difference is greater than a predetermined length threshold, and the text similarity is less than a predetermined text similarity threshold, it is determined that there is a risk in the target change.

[0066] The length difference refers to the difference between the length of the character string as the target information and the length of the character string as the recommended value.

[0067] In a specific example, if the length (string length) of the target information in the tested change order is greater than 10, and the text similarity between it and the recommended value is higher than 0.6, it is determined that there is no risk in the target change; if the length of the target information in the tested change order is less than 10, and the text similarity between it and the recommended value is lower than 0.8, it is determined that there is a risk in the target change and an early warning can be issued. In other words, when the length is greater than 10, 0.6 is the early warning demarcation line; and when the length is less than 10, 0.8 is the early warning demarcation line.

[0068] In an optional implementation, the credibility of the recommended value may be determined based on the frequency of occurrence of different information corresponding to the specified change object in the specified field in all historical change orders, wherein the credibility of the determined recommended value is used as a reference for whether to issue an early warning.

[0069] Among them, the credibility of the recommended value can be used to characterize the credibility of the recommended value. Thus, when the credibility of the recommended value is greater than the preset credibility threshold, if the target information in the tested change order is inconsistent with the recommended value of the specified field, it can be determined that the target change has risks and an early warning can be issued. If the target information in the tested change order is consistent with the recommended value, it can be determined that the target change does not have risks and no early warning is issued; conversely, when the credibility of the recommended value is not greater than the preset credibility threshold, regardless of whether the target information in the tested change order is consistent with the recommended value, it can be determined that the target change may not have risks and no early warning is issued.

[0070] In an optional implementation, the credibility of the recommended value (denoted as s ) can be calculated using the following formula [3]: [3] In the above formula, sin represents the sine function; Figure 2 The frequency of occurrence of "the information corresponding to the specified change object in the specified field" in all selected historical change orders p i ( i [1,Q]); p max The frequency of occurrence of "the information corresponding to the specified change object in the specified field" in all selected historical change orders p i ( i The maximum value among [1,Q]); k The frequency of occurrence of "the information corresponding to the specified change object in the specified field" in all selected historical change orders p i ( i [1,Q]), is calculated as follows: [4] p min for p i ( i The minimum value in [1,Q]); pmean for p i ( i [1,Q]).

[0071] By determining the credibility of the recommended value, a reference can be provided for early warning for the specified field.

[0072] In a specific example, the corresponding relationship between the designated field, the current value of the designated field, the recommended value determined by the above method, and the credibility of the recommended value can be shown in Table 3: Table 3:

[0073] In an optional implementation, a credibility threshold may be pre-set to 0.6. When the credibility of the recommended value is greater than the credibility threshold, if the current value of the specified field is inconsistent with the recommended value, the change management system may determine that there is a risk in the target change and determine that an early warning may be issued for the specified fields involved in the target change.

[0074] In an optional implementation, when the credibility of the recommended value is greater than the credibility threshold, the value of "Warning Strength" in Table 3 can be set to 1; when the credibility of the recommended value is not greater than the credibility threshold, the value of "Warning Strength" can be set to 0.

[0075] The table shown in Table 3 can be displayed by the change management system, so that the technical staff can intuitively check whether the specified field has a warning, and know the credibility of the warning according to the value of the warning strength.

[0076] By adopting the above-mentioned scheme provided in the embodiment of the present application, all historical change orders whose information similarity in fields of at least two types of granularity meets the preset similarity conditions are selected from the historical change orders, and based on this, further, when the target information in the tested change order and the target information in all the selected historical change orders do not meet the preset consistency requirements, it is determined that the target change is risky, thereby solving the problem of how to identify whether there is a risk in the change of the IT system in the prior art.

[0077] Example 2 In order to solve the problem existing in the prior art of how to identify whether changes to IT systems involve risks, based on the same inventive concept as the above-mentioned embodiments of the present application, Embodiment 2 of the present application provides a risk identification device.

[0078] The specific structural diagram of the device is shown in N <L As shown, it includes the following functional units: The similarity determination unit 21 is used to determine the similarities between the information in the fields of at least two types of granularity selected from the tested change order and the information in the fields of the at least two types of granularity selected from each historical change order; wherein the tested change order is used to record the relevant information of the target change occurring in the information technology IT system in the fields included in the tested change order; the historical change order is used to record the relevant information of the historical change occurring in the IT system in the fields included in the historical change order; A change order selection unit 22 is used to select, from the historical change orders, all historical change orders whose corresponding similarities meet a preset similarity condition according to the similarities; The risk determination unit 23 is used to determine that there is a risk in the target change when the target information in the tested change order does not meet the preset consistency requirements with the target information in all the selected historical change orders; wherein the target information is the information recorded in the specified field corresponding to the specified change object.

[0079] In an optional embodiment, the similarity determination unit 21 can be specifically used to: determine the first similarities between the information in the fields of the first type of granularity selected from the tested change order and the information in the fields of the first type of granularity selected from each historical change order, and the second similarities between the information in the fields of the second type of granularity selected from the tested change order and the information in the fields of the second type of granularity selected from each historical change order.

[0080] Accordingly, the change order selection unit 22 may be specifically configured to select, from the historical change orders, all historical change orders whose corresponding first similarities and second similarities satisfy a preset similarity condition.

[0081] In an optional implementation, the similarity determination unit 21 may be specifically used for: For each historical change order, perform the following operations: The information in the first type of granularity fields selected from the tested change order is combined into a first string, and the information in the first type of granularity fields selected from the historical change order is combined into a second string; the number of characters contained in the first string and the second string is L ; Generates values ​​between 0 and 1 N Random numbers n 1~ n N ; L、...、n ; From the first string, extract the n 1 L、 n 2 L、...、n N L The characters in the first position together constitute a new first string; from the second string, extract the characters arranged in the first n 1 L 、 n 2 M Q、...m N L The characters of the bits together constitute a new second string; The similarity between the new first character string and the new second character string is calculated as the first similarity corresponding to the historical change order.

[0082] In an optional implementation, the similarity determination unit 21 may be specifically used for: For each historical change order, perform the following operations: The information in the second type of granularity fields selected from the tested change order is combined into a third character string, and the information in the second type of granularity fields selected from the historical change order is combined into a fourth character string; the number of characters contained in the third character string and the fourth character string is Q ; Generates values ​​between 0 and 1 M Random numbers m 1~ m M ; Q、...m ; From the third string, extract the m 1 Q 、 m 2 i M Q The characters in the first position together form a new third string; from the fourth string, extract the characters arranged in the m 1 Q 、 m 2 i M Q The characters of the bits together form a new fourth string; The similarity between the new third character string and the new fourth character string is calculated as the second similarity corresponding to the historical change order.

[0083] In an optional embodiment, the first type of particle size may be larger than the second type of particle size.

[0084] In an optional implementation, if the preset similarity condition includes: the target similarity calculated according to the corresponding first similarity and second similarity is greater than a preset similarity threshold; then, the device provided in the embodiment of the present application may further include a target similarity determination unit, which is used to: For each historical change order, execute: According to the first threshold value set for the first similarity i 1, and a second threshold value set for the second similarity i 2, and the first similarity corresponding to the historical change order S 1 and 2 similarity S 2. Calculate the target similarity corresponding to the historical change order in the following way: similarity=U( S 1- Figure 3 1) U( S 2- Figure 3 2) Where U is a step function that satisfies: .

[0085] In an optional implementation, the risk determination unit 23 may be specifically configured to: For each specified field, execute: Counting the occurrence frequencies of different information in the designated field corresponding to the designated change object in all the historical change orders; Determine the information with the highest frequency of occurrence among the different information as the recommended value of the designated field; If "the information corresponding to the designated change object recorded in the designated field" in the tested change order is different from the recommended value of the designated field, it is determined that there is a risk in the target change.

[0086] In an optional implementation, the risk determination unit 23 may be specifically configured to: If the "information corresponding to the specified change object recorded in the specified field" in the tested change order is different from the recommended value of the specified field, then the length difference and text similarity between the "information corresponding to the specified change object recorded in the specified field" and the recommended value of the specified field are compared; If the length difference is greater than a predetermined length threshold and the text similarity is less than a predetermined text similarity threshold, it is determined that there is a risk in the target change.

[0087] In an optional implementation, the device provided in the embodiment of the present application may further include: an early warning unit. The early warning unit may be specifically used for: If the "information recorded in the designated field corresponding to the designated change object" in the tested change order is different from the recommended value of the designated field, then the credibility of the recommended value of the designated field is determined based on the frequency of appearance of different information corresponding to the designated change object in the designated field in all historical change orders; based on the credibility of the recommended value of the designated field, an early warning is issued for the designated field in the tested change order.

[0088] In an optional implementation, the early warning unit may be specifically used for: According to the occurrence frequency, the credibility s of the recommended value of the specified field is calculated using the following formula:

[0089] Wherein, σ is the standard deviation of the frequency of occurrence of the different information in all the historical change orders; k is the kurtosis of the frequency of occurrence of the different information in all the historical change orders; p max It is the maximum value of the occurrence frequency of the different information in all the historical change orders.

[0090] By adopting the above-mentioned device provided in the embodiment of the present application, all historical change orders whose information similarity in fields of at least two types of granularity meets the preset similarity conditions are selected from the historical change orders, and based on this, further, when the target information in the tested change order and the target information in all the selected historical change orders do not meet the preset consistency requirements, it is determined that the target change is risky, thereby solving the problem of how to identify whether there is a risk in the change of the IT system in the prior art.

[0091] Example 3 Based on the same inventive concept as the aforementioned embodiments of the present application, Embodiment 3 of the present application provides a computing device to solve the problem existing in the prior art of how to identify whether changes to an IT system involve risks.

[0092] like Figure 3 As shown, the computing device includes: a memory 31 and a processor 32. The memory 31 can be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application or method operating on the electronic device. The memory 31 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0093] The processor 32 is coupled to the memory 31 and is used to execute the computer program in the memory 31 to execute a risk identification method described in Example 1 of the present application.

[0094] When the processor 32 executes the computer program in the memory 31, in addition to the above functions, it can also realize other functions, which can be seen from the description of the previous embodiments for details.

[0095] Further, such as Figure 3 As shown, the computing device also includes: a display 34, a communication component 33, a power component 35, an audio component 36 and other components. ​ Only some components are shown schematically, and it does not mean that the computing device only includes ​ Components shown.

[0096] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the methods provided in the above embodiments can be implemented.

[0097] Accordingly, an embodiment of the present application further provides a computer program product, which stores instructions, and when the instructions are executed by a computer, the computer implements the methods provided in the above embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0098] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A risk identification method, characterized in that: include: Determine the similarities between the information in the fields of at least two types of granularity selected from the tested change order and the information in the fields of the at least two types of granularity selected from each historical change order; wherein the tested change order is used to record the relevant information of the target change occurred in the information technology IT system in the fields included in the tested change order; the historical change order is used to record the relevant information of the historical change occurred in the IT system in the fields included in the historical change order; According to the similarities, all historical change orders whose corresponding similarities meet a preset similarity condition are selected from the historical change orders; When the target information in the tested change order does not meet the preset consistency requirements with the target information in all the selected historical change orders, it is determined that there is a risk in the target change; wherein, the target information is the information recorded in the specified field corresponding to the specified change object.

2. The method according to claim 1, characterized in that Determining the similarities between information in at least two types of granularity fields selected from the tested change order and information in at least two types of granularity fields selected from each historical change order, respectively, includes: Determine each first similarity between the information in the fields of the first type of granularity selected from the tested change order and the information in the fields of the first type of granularity selected from each historical change order, and each second similarity between the information in the fields of the second type of granularity selected from the tested change order and the information in the fields of the second type of granularity selected from each historical change order; then, According to the similarities, all historical change orders whose corresponding similarities meet a preset similarity condition are selected from the historical change orders, including: According to each first similarity and each second similarity, all historical change orders whose corresponding first similarity and second similarity both satisfy a preset similarity condition are selected from the historical change orders.

3. The method according to claim 2, characterized in that Determining each first similarity includes: For each historical change order, perform the following operations: The information in the first type of granularity fields selected from the tested change order is combined into a first string, and the information in the first type of granularity fields selected from the historical change order is combined into a second string; the number of characters contained in the first string and the second string is L ; Generates values ​​between 0 and 1 N Random numbers n 1~ n N ; N <L ; From the first string, extract the n 1 L 、 n 2 L, ..., n N L The characters in the first position together constitute a new first string; from the second string, extract the characters arranged in the first n 1 L 、 n 2 L, ..., n N L The characters of the bits together constitute a new second string; The similarity between the new first character string and the new second character string is calculated as the first similarity corresponding to the historical change order.

4. The method according to claim 2 or 3, characterized in that Determining each second similarity includes: For each historical change order, perform the following operations: The information in the second type of granularity fields selected from the tested change order is combined into a third character string, and the information in the second type of granularity fields selected from the historical change order is combined into a fourth character string; the number of characters contained in the third character string and the fourth character string is Q ; Generates values ​​between 0 and 1 M Random numbers m 1~ m M ; M Q, ...m ; From the third string, extract the m 1 Q 、 m 2 Q, ...m M Q The characters in the first position together form a new third string; from the fourth string, extract the characters arranged in the m 1 Q 、 m 2 The similarity between the new third character string and the new fourth character string is calculated as the second similarity corresponding to the historical change order. M Q The characters of the bits together form a new fourth string; The first type of particle size is larger than the second type of particle size.

5. The method according to claim 2, characterized in that: The preset similarity condition includes: the target similarity calculated according to the corresponding first similarity and second similarity is greater than a preset similarity threshold; then, the method further includes:

6. The method according to claim 2, characterized in that For each historical change order, execute: θ According to the first threshold value set for the first similarity θ 1, and a second threshold value set for the second similarity θ 2, and the first similarity corresponding to the historical change order S 1 and 2 similarity S 2. Calculate the target similarity corresponding to the historical change order in the following way: similarity=U( S 1- θ 1) U( S 2- When the target information in the tested change order does not meet the preset consistency requirement with the target information in all the selected historical change orders, determining that the target change has a risk includes: 2) Where U is a step function that satisfies: .

7. The method according to claim 1, characterized in that For each specified field, execute: Counting the occurrence frequencies of different information in the designated field corresponding to the designated change object in all the historical change orders; ​ Determine the information with the highest frequency of occurrence among the different information as the recommended value of the designated field; If the "information corresponding to the specified change object recorded in the specified field" in the tested change order is different from the recommended value of the specified field, it is determined that there is a risk in the target change.

8. The method according to claim 7, characterized in that If the "information corresponding to the specified change object recorded in the specified field" in the tested change order is different from the recommended value of the specified field, then determining that the target change has a risk includes: If the "information corresponding to the specified change object recorded in the specified field" in the tested change order is different from the recommended value of the specified field, then the length difference and text similarity between the "information corresponding to the specified change object recorded in the specified field" and the recommended value of the specified field are compared; If the length difference is greater than a predetermined length threshold and the text similarity is less than a predetermined text similarity threshold, it is determined that there is a risk in the target change.

9. The method according to claim 7 or 8, characterized in that If the "information corresponding to the specified change object recorded in the specified field" in the tested change order is different from the recommended value of the specified field, the method further includes: Determining the credibility of the recommended value of the specified field according to the appearance frequencies of different information corresponding to the specified change object in the specified field in all the historical change orders; According to the credibility of the recommended value of the specified field, an early warning is issued for the specified field in the tested change order.

10. The method according to claim 9, characterized in that Determining the credibility of the recommended value of the specified field according to the appearance frequencies of different information corresponding to the specified change object in the specified field in all the historical change orders, including: According to the occurrence frequency, the credibility s of the recommended value of the specified field is calculated using the following formula: Wherein, σ is the standard deviation of the frequency of occurrence of the different information in all the historical change orders; k is the kurtosis of the frequency of occurrence of the different information in all the historical change orders; p max It is the maximum value of the occurrence frequency of the different information in all the historical change orders.

11. A risk identification device, characterized in that: include: A similarity determination unit is used to determine the similarities between the information in the fields of at least two types of granularity selected from the tested change order and the information in the fields of the at least two types of granularity selected from each historical change order; wherein the tested change order is used to record the relevant information of the target change occurred in the information technology IT system in the fields included in the tested change order; the historical change order is used to record the relevant information of the historical change occurred in the IT system in the fields included in the historical change order; A change order selection unit, configured to select, from the historical change orders, all historical change orders whose corresponding similarities satisfy a preset similarity condition according to the similarities; A risk determination unit is used to determine that there is a risk in the target change when the target information in the tested change order does not meet the preset consistency requirements with the target information in all the selected historical change orders; wherein the target information is the information recorded in the specified field corresponding to the specified change object.

12. A computing device, characterized in that: include: Memory and processor, wherein: The memory is used to store computer programs; The processor is coupled to the memory and is used to execute the computer program in the memory to execute the method described in any one of claims 1 to 10.

13. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer, can implement the method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The computer program product stores instructions, which, when executed by a computer, enable the computer to implement the method according to any one of claims 1 to 10.

Images