Middleware adjustment strategy determination method and device and storage medium

Abstract

The invention provides a middleware adjustment strategy determination method and device and a storage medium, relates to the technical field of software security, and is used for solving the problem of how to adjust middleware according to the security of the middleware so as to guarantee normal operation of a system. The method comprises the steps that risk factors of at least one risk type of middleware and an initial risk value of each risk factor are acquired, and one risk type corresponds to at least one risk factor; based on the multiple risk factors and the initial risk value of each risk factor, target risk information of the middleware is determined, and the target risk information is used for indicating the influence degree of the middleware on software operation. Based on the target risk information, an adjustment strategy of the middleware is determined, and the adjustment strategy is used for reducing the influence degree of the middleware on normal operation of the software.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a method, device and storage medium for determining a middleware adjustment strategy. Background Art

[0002] Middleware is a basic software that simplifies business applications. It can effectively abstract and hide the cumbersome details of the underlying system and complete the tasks of underlying support and data transmission. With the widespread application of middleware in various core business systems, the security and reliability risks of middleware are also receiving more and more attention. Therefore, how to adjust the middleware according to its security to ensure the normal operation of the system has become an urgent problem to be solved.

[0003] Therefore, a middleware adjustment strategy is needed to adjust the middleware. Summary of the invention

[0004] The present application provides a method, device and storage medium for determining a middleware adjustment strategy, which are used to solve the problem of how to adjust the middleware according to the security of the middleware to ensure the normal operation of the system.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a method for determining a middleware adjustment strategy. In the method, a risk factor of at least one risk type of the middleware and an initial risk value of each risk factor are obtained, and one risk type corresponds to at least one risk factor. Based on multiple risk factors and the initial risk value of each risk factor, the target risk information of the middleware is determined, and the target risk information is used to indicate the degree of influence of the middleware on the operation of the software. Based on the target risk information, an adjustment strategy for the middleware is determined, and the adjustment strategy is used to reduce the degree of influence of the middleware on the normal operation of the software.

[0007] Based on the above technical solution, the risk factors of at least one risk type of the middleware and the initial risk value of each risk factor are obtained, that is, a more comprehensive risk factor can be obtained. Afterwards, the target risk information of the middleware is determined based on multiple risk factors and the initial risk value of each risk factor. By comprehensively considering multiple risk factors of different types, the target risk information can more accurately reflect the impact of the middleware on the software operation, making the risk assessment of the middleware more accurate. Finally, based on the target risk information, the adjustment strategy of the middleware is determined to reduce the impact of the middleware on the normal operation of the software. In this way, the software supply chain security risks can be effectively resisted, allowing the software to run stably.

[0008] In one possible design, multiple risk factors and the initial risk value of each risk factor are input into a trained risk assessment model to obtain target risk information. The risk assessment model is used to predict the impact of the middleware on the software operation.

[0009] In a possible design, the risk assessment model includes multiple preset decision paths, each of which is composed of at least one risk factor and a preset risk value of the risk factor, and each preset decision path corresponds to a preset risk information. Based on the multiple risk factors and the initial risk value of each risk factor, a target decision path is determined from the multiple preset decision paths. Based on the target decision path, the target risk information is determined.

[0010] In a possible design, the target decision path includes multiple sub-paths, and one sub-path is composed of two risk factors. For multiple risk factors, multiple sub-paths are determined based on the target operation. The target operation includes: based on the first risk factor and the initial risk value of the first risk factor, determining the second risk factor from multiple preset decision paths, the first risk factor and the second risk factor are any risk factor among the multiple risk factors, and the second risk factor is a risk factor located at a node next to the first risk factor in the target decision path. Based on the first risk factor and the second risk factor, determine the target sub-path, the target sub-path is any sub-path among the multiple sub-paths. After executing the target operation, determine the target decision path based on the multiple target sub-paths.

[0011] In one possible design, the target risk information is the first risk information or the second risk information, and the impact level indicated by the first risk information is greater than the impact level indicated by the second risk information. If the target risk information is the first risk information, the target type of the middleware is obtained, and the target type is the first type or the second type. The first type is used to indicate that the middleware can be repaired or replaced, and the second type is used to indicate that the middleware cannot be repaired or replaced. If the target type is the first type, the adjustment strategy is determined to be the first strategy, and the first strategy is used to indicate that the middleware is repaired or replaced; if the target type is the second type, the adjustment strategy is determined to be the second strategy, and the second strategy is used to indicate that the middleware is stopped from being used.

[0012] In one possible design, if the target risk information is the second risk information, the adjustment strategy is determined to be the third strategy, and the third strategy is used to indicate the periodic update of the target risk information.

[0013] In a second aspect, the present application provides a device for determining a middleware adjustment strategy, the device comprising an acquisition module and a processing module.

[0014] The acquisition module is used to acquire the risk factor of at least one risk type of the middleware and the initial risk value of each risk factor, and one risk type corresponds to at least one risk factor. The processing module is used to determine the target risk information of the middleware based on multiple risk factors and the initial risk value of each risk factor, and the target risk information is used to indicate the degree of influence of the middleware on the operation of the software. The processing module is also used to determine the adjustment strategy of the middleware based on the target risk information, and the adjustment strategy is used to reduce the degree of influence of the middleware on the normal operation of the software.

[0015] In one possible design, a processing module is used to input multiple risk factors and the initial risk value of each risk factor into a trained risk assessment model to obtain target risk information. The risk assessment model is used to predict the impact of the middleware on the software operation.

[0016] In a possible design, the risk assessment model includes multiple preset decision paths, each of which is composed of at least one risk factor and a preset risk value of the risk factor, and each preset decision path corresponds to a preset risk information. The processing module is used to determine a target decision path from the multiple preset decision paths based on the multiple risk factors and the initial risk value of each risk factor. The processing module is also used to determine the target risk information based on the target decision path.

[0017] In one possible design, the target decision path includes multiple sub-paths, and one sub-path is composed of two risk factors. The processing module is used to determine multiple sub-paths based on the target operation for multiple risk factors, and the target operation includes: based on the first risk factor and the initial risk value of the first risk factor, determining the second risk factor from multiple preset decision paths, the first risk factor and the second risk factor are any risk factor among the multiple risk factors, and the second risk factor is a risk factor located at the next node of the first risk factor in the target decision path. The processing module is also used to determine the target sub-path based on the first risk factor and the second risk factor, and the target sub-path is any sub-path among the multiple sub-paths. The processing module is also used to determine the target decision path based on the multiple target sub-paths after executing the target operation.

[0018] In one possible design, the target risk information is the first risk information or the second risk information, and the degree of influence indicated by the first risk information is greater than the degree of influence indicated by the second risk information. The processing module is used to obtain the target type of the middleware if the target risk information is the first risk information, and the target type is the first type or the second type, the first type is used to indicate that the middleware can be repaired or replaced, and the second type is used to indicate that the middleware cannot be repaired or replaced. If the target type is the first type, the adjustment strategy is determined to be the first strategy, and the first strategy is used to indicate the repair or replacement of the middleware. The processing module is also used to determine the adjustment strategy to be the second strategy if the target type is the second type, and the second strategy is used to indicate the cessation of use of the middleware.

[0019] In one possible design, the processing module is used to determine that the adjustment strategy is a third strategy if the target risk information is the second risk information, and the third strategy is used to indicate periodic updating of the target risk information.

[0020] In a third aspect, the present application provides a device for determining a middleware adjustment strategy, the device comprising: a processor and a memory; the processor and the memory are coupled; the memory is used to store one or more programs, the one or more programs comprising computer execution instructions, and when the device for determining the middleware adjustment strategy is running, the processor executes the computer execution instructions stored in the memory to implement the method described in the first aspect and any possible implementation of the first aspect.

[0021] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a computer, the computer executes the method described in the above-mentioned first aspect and any possible implementation of the first aspect.

[0022] In a fifth aspect, the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the method described in the first aspect and any possible implementation of the first aspect.

[0023] In a sixth aspect, the present application provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to execute the method described in the above-mentioned first aspect and any possible implementation manner of the first aspect.

[0024] In the above scheme, the technical problems that can be solved and the technical effects achieved by the middleware adjustment strategy determination device, computer equipment, computer storage medium, chip or computer program product can be referred to the technical problems and technical effects solved by the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flowchart of a method for determining a middleware adjustment strategy provided in an embodiment of the present application;

[0026] Figure 2 A flowchart of another method for determining a middleware adjustment strategy provided in an embodiment of the present application;

[0027] Figure 3 An example schematic diagram of a decision tree model provided in an embodiment of the present application;

[0028] Figure 4 An example schematic diagram of another decision tree model provided in an embodiment of the present application;

[0029] Figure 5 A schematic diagram of the structure of a device for determining a middleware adjustment strategy provided in an embodiment of the present application;

[0030] Figure 6 A schematic diagram of the structure of another device for determining a middleware adjustment strategy provided in an embodiment of the present application;

[0031] Figure 7 A conceptual partial view of a computer program product provided for an embodiment of the present application. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0033] The terms “first” and “second” in the description and claims of the present application are used to distinguish different objects rather than to describe a specific order of the objects.

[0034] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not limited to the listed steps or modules, but may optionally include other steps or modules that are not listed, or may optionally include other steps or modules that are inherent to these processes, methods, products or devices.

[0035] In addition, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present concepts in a specific way.

[0036] Internet technology is changing with each passing day, promoting the birth of distributed systems and network applications. As a key component of modern software system architecture, middleware can solve common problems such as software system communication and interoperability in heterogeneous distributed network environments. Middleware is a basic software that can simplify business applications. It is located between applications and operating systems and databases, and can be deeply applied to multiple fields such as telecommunications operators, e-commerce, financial services, manufacturing, and healthcare. In addition, it can effectively abstract and hide the cumbersome details of the underlying system and complete the tasks of underlying support and data transmission. With the widespread application of middleware in various core business systems, the security and reliability risks of middleware are also receiving more and more attention.

[0037] However, there is no complete process for the evaluation of middleware security. How to evaluate the security of middleware and adjust the middleware according to the security of the middleware to ensure the normal operation of the system has become an urgent problem to be solved. Therefore, a middleware adjustment strategy is needed to adjust the middleware.

[0038] In order to solve the above technical problems, an embodiment of the present application provides a method for determining a middleware adjustment strategy. In this method, a risk factor of at least one risk type of the middleware and an initial risk value of each risk factor are obtained, that is, a more comprehensive risk factor can be obtained. Afterwards, based on multiple risk factors and the initial risk value of each risk factor, the target risk information of the middleware is determined. By comprehensively considering multiple risk factors of different types, the target risk information can more accurately reflect the degree of influence of the middleware on the operation of the software, making the risk assessment of the middleware more accurate. Finally, based on the target risk information, the adjustment strategy of the middleware is determined, which can reduce the degree of influence of the middleware on the normal operation of the software. In this way, the software supply chain security risks can be effectively resisted, so that the software can run stably.

[0039] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0040] like Figure 1 As shown, a method for determining a middleware adjustment strategy provided by an embodiment of the present application includes:

[0041] S101. Obtain a risk factor of at least one risk type of middleware and an initial risk value of each risk factor.

[0042] Among them, risk types include technical risk types, compliance risk types and supply risk types, and one risk type corresponds to at least one risk factor.

[0043] Exemplarily, the risk factors of the technical risk type include at least one of the following: a security vulnerability risk factor and a security vulnerability repair risk factor. The security vulnerability risk factor is used to indicate whether the middleware has a security vulnerability, and the security vulnerability repair risk factor is used to indicate whether the middleware can repair the security vulnerability. The risk factors of the compliance risk type include at least one of the following: a license risk factor. The license risk factor is used to indicate whether the middleware has an open source license. The risk factors of the supply risk type include at least one of the following: a software type risk factor, an open source organization reliability risk factor, a supplier risk factor, a supplier reputation risk factor, and a regional risk factor. The software type risk factor is used to indicate whether the middleware is open source software, the supplier risk factor is used to indicate whether the supplier of the middleware is a commercial supplier, the supplier reputation risk factor is used to indicate the credibility of the supplier of the middleware, and the regional risk factor is used to indicate whether the middleware is locally developed middleware.

[0044] In a possible implementation, the middleware adjustment strategy determination device stores an initial risk value of each risk factor of the middleware.

[0045] For example, the initial risk value of the security vulnerability risk factor is the existence of a security vulnerability. The initial risk value of the security vulnerability repair risk factor is the ability to repair the security vulnerability. The initial risk value of the license risk factor is the existence of open source license risk. The initial risk value of the software type risk factor is open source software. The initial risk value of the open source organization reliability risk factor is safe and reliable. The initial risk value of the supplier risk factor is a commercial supplier. The initial risk value of the supplier reputation risk factor is trustworthy. The initial risk value of the regional risk factor is local development.

[0046] In another possible implementation, basic information of the middleware is obtained, where the basic information is used to describe the middleware, and an initial risk value of the risk factor is determined based on the basic information of the middleware.

[0047] In a possible design, initial vulnerability information is obtained, and the initial vulnerability information is used to describe the security status of the middleware. The middleware is detected based on the initial vulnerability information to determine the initial risk value of the security vulnerability risk factor. Initial repair information is obtained, and the initial risk value of the security vulnerability repair risk factor is determined based on the initial repair information. The initial repair information includes at least one of the following: the historical update frequency of the middleware, the historical security vulnerability repair speed, the historical security vulnerability repair frequency, the security vulnerability repair process, and the security vulnerability repair policy.

[0048] It should be noted that the present application does not limit the method for obtaining the initial vulnerability information. For example, the initial vulnerability information can be obtained by accessing the open source vulnerability library and threat information. The present application does not limit the method for detecting the middleware. For example, the middleware can be detected by vulnerability scanning. For another example, the middleware can be detected by penetration testing. For another example, the middleware can be detected by code review. The present application does not limit the method for obtaining the initial repair information. For example, the initial repair information can be obtained by scanning the middleware.

[0049] In a possible design, open source license information is obtained, and the open source license information is used to describe the risk status of the open source license. Based on the open source license information, an initial risk value of the license risk factor is determined.

[0050] It should be noted that this application does not limit the method of obtaining open source license information. For example, the open source license information can be obtained by detecting the dependencies and components of the software.

[0051] In a possible design, the software type of the middleware is obtained. Based on the software type of the middleware, the initial risk value of the software type risk factor is determined. The open source organization information is obtained, and the open source organization information is used to describe the credibility of the open source organization. Based on the open source organization information, the initial risk value of the open source organization reliability risk factor is determined. The supplier information is obtained, and based on the supplier information, the initial risk value of the supplier risk factor is determined. The trusted list information is obtained, and the trusted list information is used to determine a trusted supplier. Based on the trusted list information, the initial risk value of the supplier reputation risk factor is determined. The development information is obtained, and based on the development information, the initial risk value of the regional risk factor is determined.

[0052] It should be noted that the present application does not limit the method for obtaining the software type of the middleware. For example, the software type of the middleware can be obtained by visiting the official website, viewing the license file, or searching the open source platform.

[0053] S102: Determine target risk information of the middleware based on multiple risk factors and an initial risk value of each risk factor.

[0054] Among them, the target risk information is used to indicate the impact of the middleware on the software operation.

[0055] In a possible implementation, multiple risk factors and the initial risk value of each risk factor are input into a trained risk assessment model to obtain target risk information. The risk assessment model is used to predict the impact of the middleware on the software operation.

[0056] It should be noted that the embodiments of the present application do not limit the risk assessment model. For example, the risk assessment model can be generated based on a convolutional neural network model. For another example, the risk assessment model can be generated based on a logistic regression model. For another example, the risk assessment model can be generated based on a decision tree algorithm. The following takes the generation of a risk assessment model based on a decision tree algorithm as an example to introduce the embodiments of the present application. In the case where the risk assessment model is generated based on a decision tree algorithm, the risk assessment model is composed of multiple nodes and directed edges, the internal nodes and the root node are risk factors, the leaf nodes are initial risk values, and each directed edge is a decision output for the risk factor.

[0057] In a possible design, a decision tree model is generated by a decision tree algorithm, and the generated decision tree model is used as a risk assessment model. A training set is obtained, and the risk assessment model is trained based on the training set to obtain a trained risk assessment model. The training set includes each risk factor and the risk value of the risk factor.

[0058] S103. Determine the adjustment strategy of the middleware based on the target risk information.

[0059] The target risk information is the first risk information or the second risk information, and the impact level indicated by the first risk information is greater than the impact level indicated by the second risk information. The adjustment strategy is used to reduce the impact level of the middleware on the normal operation of the software.

[0060] In a possible implementation, if the target risk information is the first risk information, the target type of the middleware is obtained, and the target type is the first type or the second type. If the target type is the first type, the adjustment strategy is determined to be the first strategy; if the target type is the second type, the adjustment strategy is determined to be the second strategy. The first type is used to indicate that the middleware can be repaired or replaced. The first strategy is used to indicate that the middleware can be repaired or replaced, and the second type is used to indicate that the middleware cannot be repaired or replaced. The second strategy is used to indicate that the middleware is stopped from being used.

[0061] In another possible implementation, if the target risk information is the second risk information, the adjustment strategy is determined to be the third strategy, and the third strategy is used to indicate periodic updating of the target risk information.

[0062] Based on the above technical solution, the risk factors of at least one risk type of the middleware and the initial risk value of each risk factor are obtained, that is, a more comprehensive risk factor can be obtained. Afterwards, the target risk information of the middleware is determined based on multiple risk factors and the initial risk value of each risk factor. By comprehensively considering multiple risk factors of different types, the target risk information can more accurately reflect the impact of the middleware on the software operation, making the risk assessment of the middleware more accurate. Finally, based on the target risk information, the adjustment strategy of the middleware is determined to reduce the impact of the middleware on the normal operation of the software. In this way, the software supply chain security risks can be effectively resisted, allowing the software to run stably.

[0063] like Figure 2 As shown, another method for determining a middleware adjustment strategy provided by an embodiment of the present application, in which S102 may include:

[0064] S201. Determine a target decision path from multiple preset decision paths based on multiple risk factors and an initial risk value of each risk factor.

[0065] In a possible implementation, multiple risk factors and an initial risk value of each risk factor are input into a risk assessment model, multiple preset decision paths are obtained based on the risk assessment model, and a target decision path is determined from the multiple preset decision paths.

[0066] In one possible design, the risk assessment model includes multiple preset decision paths, each preset decision path consists of at least one risk factor and a preset risk value of the risk factor, and each preset decision path corresponds to a preset risk information.

[0067] For example, Figure 3 As shown, the preset decision path 1 consists of software type risk factor, open source organization reliability risk factor, license risk factor and security vulnerability risk factor. In the preset decision path 1, the preset risk value of the software type risk factor is open source software, the preset risk value of the open source organization reliability risk factor is safe and reliable, the preset risk value of the license risk factor is the existence of open source license risk, and the preset risk value of the security vulnerability risk factor is the absence of security vulnerabilities. The preset decision path 2 consists of software type risk factor, supplier risk factor and supplier reputation risk factor. In the preset decision path 2, the preset risk value of the software type risk factor is non-open source software, the preset risk value of the supplier risk factor is commercial supplier, and the preset risk value of the supplier reputation risk factor is untrustworthy.

[0068] In a possible implementation, the target decision path includes multiple sub-paths, and one sub-path is composed of two risk factors. For multiple risk factors, multiple sub-paths are determined based on the target operation. The target operation includes: determining a second risk factor from multiple preset decision paths based on a first risk factor and an initial risk value of the first risk factor. The first risk factor and the second risk factor are both any risk factor among the multiple risk factors. The second risk factor is a risk factor located at a node next to the first risk factor in the target decision path. Based on the first risk factor and the second risk factor, a target sub-path is determined, and the target sub-path is any sub-path among the multiple sub-paths. After executing the target operation, the target decision path is determined based on the multiple target sub-paths.

[0069] Exemplary, combined Figure 3 , if the first risk factor is a software type risk factor and the initial risk value is open source software, then the second risk factor is an open source organization reliability risk factor, and the software type risk factor and the open source organization reliability risk factor are target subpath 1. After that, with the open source organization reliability risk factor as the first risk factor and the initial risk value as safe and reliable, the second risk factor is a license risk factor, and the open source organization reliability risk factor and the license risk factor are target subpath 2. Until the second risk factor is a local risk factor, the target decision path is determined. Among them, the target decision path includes target subpath 1 and target subpath 2.

[0070] S202. Determine target risk information based on the target decision path.

[0071] In a possible implementation, the target decision path includes a plurality of preset decision paths, each preset decision path corresponds to a preset risk information, and the target risk information is determined based on the plurality of preset risk information.

[0072] In another possible implementation, a preset risk value of a risk factor corresponds to a preset risk information. Based on the preset risk value of each risk factor in the target decision path, the preset risk information corresponding to the preset risk value of each risk factor is determined. Based on the preset risk information corresponding to the preset risk value of each risk factor, the target risk information is determined.

[0073] It should be noted that the embodiments of the present application do not limit the preset risk information corresponding to the preset risk value of the risk factor. For example, the preset risk value of the open source organization reliable risk factor is safe and reliable, and the preset risk information corresponding to the preset risk value of the open source organization reliable risk factor can be a low level; the preset risk value of the open source organization reliable risk factor is unsafe and reliable, and the preset risk information corresponding to the preset risk value of the open source organization reliable risk factor can be a medium level. The preset risk value of the open source organization reliable risk factor is safe and reliable, and the preset risk information corresponding to the preset risk value of the open source organization reliable risk factor can be a low level; the preset risk value of the open source organization reliable risk factor is unsafe and reliable, and the preset risk information corresponding to the preset risk value of the open source organization reliable risk factor can be a high level.

[0074] Exemplarily, in the target decision path, if the number of risk factors with preset risk information as high level is greater than 2, the target risk information is determined to be high level. If the target decision path includes: software type risk factor, initial risk value of software type risk factor, open source organization reliability risk factor, initial risk value of open source organization reliability risk factor, license risk factor, initial risk value of license risk factor, security vulnerability risk factor, initial risk value of security vulnerability risk factor, security vulnerability repair risk factor, initial risk value of security vulnerability repair risk factor, regional risk factor and initial risk value of regional risk factor. Among them, when the initial risk value of the software type risk factor is open source software, the preset risk information is medium level. The initial risk value of the open source organization reliability risk factor is safe and reliable, and the preset risk information is low level. The initial risk value of the license risk factor is the existence of open source license risk, and the preset risk information is high level. The initial risk value of the security vulnerability risk factor is the existence of security vulnerabilities, and the preset risk information is high level. The initial risk value of the security vulnerability repair risk factor is the inability to repair security vulnerabilities, and the preset risk information is high level. The initial risk value of the regional risk factor is local development, and the preset risk information is low level. Then the target risk information corresponding to the target decision path is high level.

[0075] Based on the above technical solution, based on multiple risk factors and the initial risk value of each risk factor, the target decision path can be determined from multiple preset decision paths. By gradually analyzing and comparing different options and paths, the impact of multiple risk factors on the middleware can be considered more comprehensively and systematically, thereby ensuring the comprehensiveness and rationality of the decision. Afterwards, based on the target decision path, the target risk information is determined. In this way, the appropriate strategy can be selected by predicting the risk status of the current middleware in advance.

[0076] The following is an introduction to the embodiments of the present application with reference to specific examples. Figure 3As shown, it is a preset decision path composed of multiple sub-paths. The first risk factor is the software type risk factor, and the preset risk value is open source software. The second risk factor is the open source organization reliability risk factor, and the software type risk factor and the open source organization reliability risk factor are a sub-path. After that, the open source organization reliability risk factor is the first risk factor, the preset risk value is non-safe and reliable, and the preset risk information is medium level; the preset risk value is safe and reliable, then the second risk factor is the license risk factor, and the open source organization reliability risk factor and the license risk factor are a sub-path. The first risk factor is the license risk factor, the preset risk value is the absence of open source license risk, and the preset risk information is medium level; the preset risk value is the presence of open source license risk, then the second risk factor is the security vulnerability risk factor, and the license risk factor and the security vulnerability risk factor are a sub-path. After that, the security vulnerability risk factor is the first risk factor, the preset risk value is the presence of security vulnerabilities, and the preset risk information is high level; the preset risk value is the absence of security vulnerabilities, then the second risk factor is the security vulnerability repair risk factor, and the security vulnerability risk factor and the security vulnerability repair risk factor are a sub-path. The first risk factor is the security vulnerability repair risk factor, the preset risk value is that the security vulnerability cannot be repaired, and the preset risk information is a high level; the preset risk value is that the security vulnerability can be repaired, then the second risk factor is the regional risk factor, the security vulnerability repair risk factor and the regional risk factor are a subpath. The preset risk value of the regional risk factor is local development, and the preset risk information is a high level; the preset risk value of the regional risk factor is local development, and the preset risk information is a low level;

[0077] The first risk factor is the software type risk factor, and the preset risk value is non-open source software, then the second risk factor is the supplier risk factor, and the software type risk factor and the supplier risk factor are a subpath. After that, the first risk factor is the supplier risk factor, and the preset risk value is commercial supplier, then the second risk factor is the supplier reputation risk factor, and the supplier risk factor and the supplier reputation risk factor are a subpath.

[0078] The first risk factor is the supplier risk factor, and the preset risk value is non-commercial supplier. The second risk factor is the security vulnerability risk factor. The supplier risk factor and the security vulnerability risk factor are a sub-path.

[0079] The first risk factor is the supplier reputation risk factor, and the preset risk value is credible. The second risk factor is the security vulnerability risk factor. The supplier reputation risk factor and the security vulnerability risk factor are a subpath. The supplier reputation risk factor has a preset risk value of untrustworthy and a preset risk information of high level.

[0080] The following is an introduction to the embodiments of the present application with reference to specific examples. Figure 4As shown, it is a subpath composed of two risk factors. The preset risk value of the first risk factor (i.e., risk point 1) is that there is a problem, and the preset risk information of the first risk factor is a low level. If the preset risk value of the first risk factor is that there is no problem, then the first risk factor and the second risk factor (i.e., risk point 2) are a subpath. If the preset risk value of the second risk factor is that there is a problem, then the preset risk information of the second risk factor is a medium level; if the preset risk value of the second risk factor is that there is no problem, then the preset risk information of the second risk factor is a low level.

[0081] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. It can be understood that in order to realize the above functions, the device for determining the middleware adjustment strategy includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the steps of the method for determining the middleware adjustment strategy of each example described in the embodiment disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0082] The embodiment of the present application also provides a device for determining a middleware adjustment policy. The device for determining a middleware adjustment policy can be a server, a CPU in the server, a determination module in the server for determining a middleware adjustment policy, or a device in the server for determining a middleware adjustment policy.

[0083] The embodiment of the present application can divide the middleware adjustment strategy determination device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

[0084] The present application embodiment provides a device for determining a middleware adjustment strategy. Figure 5 As shown, the device for determining the middleware adjustment strategy may include: an acquisition module 501 and a processing module 502 .

[0085] The acquisition module 501 is used to obtain the risk factors of at least one risk type of the middleware and the initial risk value of each risk factor, and one risk type corresponds to at least one risk factor. The processing module 502 is used to determine the target risk information of the middleware based on multiple risk factors and the initial risk value of each risk factor, and the target risk information is used to indicate the degree of influence of the middleware on the operation of the software. The processing module 502 is also used to determine the adjustment strategy of the middleware based on the target risk information, and the adjustment strategy is used to reduce the degree of influence of the middleware on the normal operation of the software.

[0086] Figure 6 6 is a schematic diagram of another device for determining a middleware adjustment strategy according to an exemplary embodiment. The device for determining a middleware adjustment strategy may include a processor 602, and the processor 602 is used to execute application code to implement the method for determining a middleware adjustment strategy in the present application.

[0087] The processor 602 may be a central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0088] like Figure 6 As shown, the middleware adjustment strategy determination device may further include a memory 603. The memory 603 is used to store application program codes for executing the solution of the present application, and the execution is controlled by the processor 602.

[0089] The memory 603 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 603 may exist independently and be connected to the processor 602 via a bus 604. The memory 603 may also be integrated with the processor 602.

[0090] like Figure 6 As shown, the apparatus for determining the middleware adjustment strategy may further include a communication interface 601, wherein the communication interface 601, the processor 602, and the memory 603 may be coupled to each other, for example, via a bus 604. The communication interface 601 is used to perform information interaction with other devices, for example, to support information interaction between the apparatus for determining the middleware adjustment strategy and other devices.

[0091] It should be pointed out that Figure 6 The device structure shown in the figure does not constitute a limitation on the determination device of the middleware adjustment strategy, except Figure 6 In addition to the components shown, the device for determining the middleware adjustment strategy may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0092] In actual implementation, the functions implemented by the processing unit can be Figure 6 The processor 602 shown calls the program code in the memory 603 to implement.

[0093] The present application also provides a computer-readable storage medium having instructions stored thereon, and when the instructions in the computer-readable storage medium are executed by a processor of a computer device, the computer is enabled to execute the method for determining the middleware adjustment strategy provided in the above-mentioned embodiment. For example, the computer-readable storage medium may be a memory 603 including instructions, and the above instructions may be executed by a processor 602 of a computer device to complete the above method. Optionally, the computer-readable storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0094] Figure 7 A conceptual partial view of a computer program product provided by an embodiment of the present application is schematically shown, where the computer program product includes a computer program for executing a computer process on a computing device.

[0095] In one embodiment, the computer program product is provided using a signal bearing medium 700. The signal bearing medium 700 may include one or more program instructions that, when executed by one or more processors, may provide the above-described Figure 1 , Figure 2 Thus, for example, reference to Figure 1 In the embodiment shown in , one or more features of S101 to S103 may be undertaken by one or more instructions associated with the signal bearing medium 700. In addition, Figure 7 The program instructions in also describe example instructions.

[0096] In some examples, the signal bearing medium 700 may include a computer readable medium 701, such as, but not limited to, a hard drive, a compact disk (CD), a digital video disk (DVD), a digital tape, a memory, a read-only memory (ROM) or a random access memory (RAM), and the like.

[0097] In some implementations, signal bearing medium 700 may include computer recordable medium 702 such as, but not limited to, memory, read / write (R / W) CD, R / W DVD, and the like.

[0098] In some implementations, signal bearing medium 700 may include communication medium 703 such as, but not limited to, digital and / or analog communication media (eg, fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).

[0099] The signal bearing medium 700 may be communicated by a wireless form of communication medium 703. The one or more program instructions may be, for example, computer executable instructions or logic implemented instructions.

[0100] In some examples, the middleware adjustment policy determination device may be configured to provide various operations, functions, or actions in response to one or more program instructions in computer-readable medium 701 , computer-recordable medium 702 , and / or communication medium 703 .

[0101] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0102] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0103] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0104] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0105] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the full classification part or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute the full classification part or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes various media that can store program codes, such as-U disk, mobile hard disk, ROM, RAM, disk or CD.

[0106] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for determining a middleware adjustment strategy, characterized in that: The method comprises: Obtaining a risk factor of at least one risk type of the middleware and an initial risk value of each risk factor, wherein one risk type corresponds to at least one risk factor; Determining target risk information of the middleware based on multiple risk factors and an initial risk value of each risk factor, wherein the target risk information is used to indicate the degree of influence of the middleware on software operation; Based on the target risk information, an adjustment strategy for the middleware is determined, where the adjustment strategy is used to reduce the impact of the middleware on the normal operation of the software.

2. The method according to claim 1, characterized in that The step of determining target risk information of the middleware based on the plurality of risk factors and the initial risk value of each risk factor includes: The multiple risk factors and the initial risk value of each risk factor are input into a trained risk assessment model to obtain the target risk information. The risk assessment model is used to predict the impact of the middleware on software operation.

3. The method according to claim 2, characterized in that The risk assessment model includes a plurality of preset decision paths, each of which is composed of at least one risk factor and a preset risk value of the risk factor, and each preset decision path corresponds to a preset risk information; The step of inputting the plurality of risk factors and the initial risk value of each risk factor into the trained risk assessment model to obtain the target risk information includes: Determining a target decision path from the plurality of preset decision paths based on the plurality of risk factors and the initial risk value of each risk factor; Based on the target decision path, the target risk information is determined.

4. The method according to claim 3, characterized in that The target decision path includes a plurality of sub-paths, one sub-path consists of two risk factors; and determining the target decision path from the plurality of preset decision paths based on the plurality of risk factors and the initial risk value of each risk factor includes: For the multiple risk factors, multiple sub-paths are determined based on target operations, where the target operations include: Based on the first risk factor and the initial risk value of the first risk factor, determining a second risk factor from the multiple preset decision paths, the first risk factor and the second risk factor are any risk factor among the multiple risk factors, and the second risk factor is a risk factor located at a node next to the first risk factor in the target decision path; Determine a target subpath based on the first risk factor and the second risk factor, where the target subpath is any subpath among the multiple subpaths; After performing the target operation, the target decision path is determined based on the multiple target sub-paths.

5. The method according to any one of claims 1 to 4, characterized in that The target risk information is the first risk information or the second risk information, and the impact degree indicated by the first risk information is greater than the impact degree indicated by the second risk information; The step of determining the adjustment strategy of the middleware based on the target risk information includes: If the target risk information is the first risk information, acquiring a target type of the middleware, the target type being a first type or a second type, the first type being used to indicate that the middleware can be repaired or replaced, and the second type being used to indicate that the middleware cannot be repaired or replaced; If the target type is the first type, determining that the adjustment strategy is a first strategy, the first strategy is used to instruct to repair or replace the middleware; If the target type is the second type, the adjustment policy is determined to be a second policy, and the second policy is used to instruct to stop using the middleware.

6. The method according to claim 5, characterized in that The step of determining the adjustment strategy of the middleware based on the target risk information includes: If the target risk information is the second risk information, it is determined that the adjustment strategy is a third strategy, and the third strategy is used to indicate that the target risk information is periodically updated.

7. A device for determining a middleware adjustment strategy, characterized in that: The device comprises an acquisition module and a processing module: The acquisition module is used to acquire risk factors of at least one risk type of the middleware and an initial risk value of each risk factor, wherein one risk type corresponds to at least one risk factor; The processing module is used to determine the target risk information of the middleware based on multiple risk factors and the initial risk value of each risk factor, wherein the target risk information is used to indicate the degree of influence of the middleware on the software operation; The processing module is further used to determine an adjustment strategy for the middleware based on the target risk information, wherein the adjustment strategy is used to reduce the impact of the middleware on the normal operation of the software.

8. A device for determining a middleware adjustment strategy, characterized in that: include: Processor and memory; The processor is coupled to the memory; The memory is used to store one or more programs, and one or more of the programs include computer execution instructions. When the middleware adjustment policy determination device is running, the processor executes the computer execution instructions stored in the memory to enable the middleware adjustment policy determination device to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, characterized in that: When a computer executes the instruction, the computer performs the method according to any one of claims 1 to 6.

10. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 6.

Images