Key operation instruction identification and risk research and judgment method in scheme change

Abstract

The invention discloses a key operation instruction identification and risk study and judgment method in a change scheme, which comprises the following steps of: extracting contents of an extracted document, and splitting text contents, image contents and additional file contents; carrying out circular processing on the additional file content; the data preprocessing is used for carrying out secondary correction on text codes, extracting text features and key business features in an image after preprocessing the image content, and generating business element description or instruction operation description through RNN (Recurrent Neural Network); business elements and instruction elements are analyzed through key rules and semantic rules, and matched influence factors are calculated by adopting a two-dimensional influence factor calculation library; and constructing a correlation analysis engine to perform correlation analysis on the influence factors and the multiple scene dimensions to obtain a plurality of calculation factors, and calculating a risk assessment value through a risk degree operator. According to the method, the risk condition of the instruction is identified more effectively, the working pressure of a scheme reviewer is relieved, and production accidents caused by knowledge blind areas are avoided.

Description

Technical Field

[0001] The present invention relates to the field of network operation security technology, and in particular to a method for identifying key operation instructions and assessing risks in a change plan. Background Art

[0002] With the development of digitalization, electronic documents have become the main form of information exchange and storage. The key operating instructions in the documents may involve IT / CT change operations such as the implementation, upgrade, and security reinforcement of key equipment, which are essential to the normal operation of the organization. The diversity and complexity of electronic documents make it difficult to extract unified and effective content structure, and traditional document processing methods mainly focus on the storage, transmission, and access control of documents, lacking the extraction of key content and context analysis of documents. When reviewers or approvers read documents on change operation plans, they need a lot of professional knowledge and contextual business scenario analysis to further judge the importance and risk level of key operating instructions in the documents, which makes reviewers or approvers make wrong judgments or decisions when reading documents, resulting in serious impact on organizational production.

[0003] The change operation plan document is only stored, transmitted, and access controlled. The key instruction information in the document is not extracted. The risk level of the key instructions in the plan depends on the reviewer's professional knowledge and business understanding, which is very easy to cause errors or omissions. Summary of the invention

[0004] The purpose of the present invention is to provide a method for identifying and assessing the risks of key operating instructions in a change plan. Apache Tika is used in combination with data preprocessing knowledge anchors to extract key instruction information and key business information in a document. The business information elements are associated with key commands through the Apriori algorithm to analyze the risk level of the key instructions on the business, and the risk causes are graded and marked for document reviewers to assist in decision-making.

[0005] The technical solution adopted by the present invention is:

[0006] A method for identifying key operation instructions and assessing risks in a change plan includes the following steps:

[0007] Step 1, content extraction: extract the document content of the change plan as a whole to obtain all text information, all images and attached files;

[0008] Specifically, all text information is separated from the document. All images (such as screenshots, charts, etc.) are identified and extracted from the document. Attachments or embedded files contained in the document are identified and separated.

[0009] Step 2, loop traversal: determine whether there are any additional files in the overall extracted content; if so, perform overall extraction processing on the contents of all the extracted additional files in a loop traversal until there are no more additional files; otherwise, execute step 3;

[0010] Furthermore, in step 2, a corresponding parsing tool is used according to the file type of the attached file (such as PDF, Word, Excel, etc.). Specifically, the Apache tika parser is used to parse the relevant files.

[0011] Specifically, the file content is processed in a loop: the file contents of all the extracted attached files are processed in a loop. A similar extraction process of the text and image content is performed on each file. The corresponding parsing tool is used according to the file type (such as PDF, Word, Excel, etc.).

[0012] Step 3, text encoding correction: perform secondary encoding correction on the extracted text information to convert it to the specified encoding format to ensure encoding consistency.

[0013] Specifically, the text encoding is detected and converted to a unified format (such as UTF-8), and illegal characters in the text are removed or replaced.

[0014] Step 4, image content preprocessing: After preprocessing the extracted image, text information is extracted from the image through text recognition and key business features in the image are obtained through feature extraction;

[0015] Specifically, image preprocessing includes image cleaning, denoising, cropping, etc. Text recognition (OCR) extracts text information from images. Feature extraction extracts key business features (such as shape, color distribution, etc.) from images.

[0016] Step 5, generate business description: generate descriptive text by learning the text information and key business features extracted from the image through a neural network model; the descriptive text includes a description of business elements or a description of instruction operations.

[0017] Specifically, RNN (recurrent neural network) is used to generate business element descriptions or instruction operation descriptions. The key business features extracted from the text information and the image are learned through the RNN model to generate descriptive text.

[0018] Step 6: Build a data impact analysis engine: Build a key rule regular expression matrix to extract key elements of instructions, and obtain a set of instruction impact factors and a set of business impact factors;

[0019] Furthermore, step 6 specifically includes the following steps:

[0020] Step 6-1, identifying instruction information through coarse recognition regularization;

[0021] Step 6-2, identify the operation object and operation type by using detailed recognition regular expressions on the instruction information;

[0022] Step 6-3, build the instruction impact factor calculation library: Let x be the mapping value between the instruction object and the operation type, and calculate it through the knowledge function In(x), In(x) = β0+β1x1+β2x2+…+β n x n , where x1,x2,…,x n are the features of input x, β0,β1,…,β n is the model parameter learned by training risk knowledge data; let td be the risk threshold of instruction impact factor, P(x)=In(x)>td, and obtain the instruction impact factor set {x|P(x)};

[0023] Step 6-4: Based on NLP, construct lexical, syntactic analysis and semantic understanding, extract business information and identify the business impact scope and impact time;

[0024] Step 6-5, build a business impact factor calculation library: let y be the business impact range and t be the impact time, and use the knowledge function BI(y,t), BI(y,t)=a*y+(tb) / b+c to calculate, where a is the complexity of the business network, b is the average recovery time of historical failures, and c is the balance coefficient (dynamically adjusted according to the current network situation). Let tm be the risk threshold of the business impact factor, P(y)=BI(y,t)>tm, and obtain the business impact factor set {y|P(y)}.

[0025] Specifically, we first use coarse recognition regularization to identify instruction information, and then use fine recognition regularization to identify the operation object and operation type, build an instruction impact factor calculation library, and calculate through the knowledge function In(x) to obtain the instruction impact factor set {x|P(x)}; based on NLP, we build lexical, syntactic analysis and semantic understanding, extract business information to identify the business impact scope and impact time, build a business impact factor calculation library, and calculate through the knowledge function BI(y,t) to obtain the business impact factor set {y|P(y)}.

[0026] Step 7: Calculate the instruction risk by correlation analysis: extract the instruction impact information and business impact information of the specified number of risk objects, match the corresponding instruction impact factors and business impact factors respectively, and calculate the risk value of the risk object;

[0027] Further, the specified number of risk objects is 6 risk objects.

[0028] Furthermore, the risk value of the risk object includes the risk value corresponding to the instruction impact information and the risk value corresponding to the business impact information; wherein the risk value corresponding to the instruction impact information is the instruction impact factor multiplied by the specified number of risk objects; the risk value corresponding to the business impact information is the business impact factor multiplied by the specified number of risk objects.

[0029] Specifically, first, extract the instruction impact information of the six risk objects, match the instruction impact factors in sequence, obtain the risk value of the risk object, and obtain 6n risk values, where n is the number of instruction impact factor sets. Extract the business impact information of the six risk objects, match the business impact factors in sequence, obtain the risk value of the risk object, and obtain 6m risk values, where m is the number of business impact factor sets.

[0030] Step 8: Build a risk assessment engine and extract the risk value of all indicators as k i , calculate the proportion p of the i-th sample in the corresponding index i , Set the risk adjustment coefficient z, the value range of z is between [0,1], and calculate the entropy value e of the indicator. n is the total number of samples; the final risk assessment value R = 1-e; the final risk assessment value is output. According to the common practice and theoretical framework of risk assessment, changing the plan when the risk assessment value is between [0,0.1) is considered extremely high risk, changing the plan when the risk assessment value is between [0.1,0.5) is considered high risk, changing the plan when the risk assessment value is between [0.5,0.9) is considered average risk, and changing the plan when the risk assessment value is between [0.9~1] is considered slight risk, which is used for decision support.

[0031] The present invention adopts the above technical scheme and adopts data preprocessing knowledge anchor technology. Compared with traditional document reading technology, data preprocessing speed is faster and the extraction of key information is more accurate. It has significant advantages in processing a large number of large files in scenarios where organizations frequently make changes. The Apriori algorithm is used to correlate business information elements with key commands, and the risk situation of key instructions is comprehensively analyzed in combination with business scenarios. The risk situation of instructions is more effectively identified, avoiding in-depth reading of a large number of instructions that have no impact on production, greatly reducing the work pressure of solution reviewers, and avoiding production accidents due to knowledge blind spots. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments;

[0033] Figure 1 The figure is a flow chart of a method for identifying key operation instructions and assessing risks in a modification scheme of the present invention. Implementation

[0035] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0036] like Figure 1 As shown, the present invention discloses a method for identifying key operation instructions and assessing risks in a change plan. First, the content of the extracted document is extracted, and the text content, image content, and file content are split. The file content needs to be processed cyclically; data preprocessing performs secondary correction on the text encoding, and preprocesses the image content, extracts text features and key business features in the image, and generates business element descriptions or instruction operation descriptions through RNN; a data impact analysis engine is constructed, and business elements and instruction elements are parsed through key rules and semantic rules, and a two-dimensional impact factor calculation library is used to calculate matching impact factors; an association analysis engine is constructed to associate the impact factors with 6 scenario dimensions to obtain 6 calculation factors, and the risk value is calculated through a risk operator, which specifically includes the following steps:

[0037] Step 1, content extraction, extracts the content of the extracted document as a whole. Separates all text information from the document. Identifies and extracts all images (such as screenshots, charts, etc.) from the document. Identifies and separates attachments or embedded files contained in the document.

[0038] Step 2, file content loop processing, the extracted file content is looped through. For each file, a similar extraction process of text and image content is performed. According to the file type (such as PDF, Word, Excel, etc.), the corresponding parsing tool is used. Specifically, the Apache tika parser is used to parse the relevant files.

[0039] Step 3: Text encoding correction: Perform secondary encoding correction on the extracted text content to ensure encoding consistency. Detect and convert the text encoding to a unified format (such as UTF-8). Remove or replace illegal characters in the text.

[0040] Step 4: Image content preprocessing: preprocess the extracted image for subsequent analysis. Image cleaning, denoising, cropping, etc. Text recognition (OCR): extract text information from the image. Feature extraction: extract key business features (such as shape, color distribution, etc.) from the image.

[0041] Step 5: Generate business descriptions, using RNN (recurrent neural network) to generate business element descriptions or instruction operation descriptions. Text features and key business features extracted from images. Learn and generate descriptive text through the RNN model.

[0042] Step 6, build a data impact analysis engine, build a key rule regular expression matrix to extract key elements of instructions, first use coarse recognition regular expressions to obtain instruction information, then use fine recognition regular expressions to identify the operation object and operation type, build an instruction impact factor calculation library, and calculate through the knowledge function In(x) to obtain the instruction impact factor set {x|P(x)}; build lexical, syntactic analysis and semantic understanding based on NLP, extract business information to identify the business impact scope and impact time, build a business impact factor calculation library, and calculate through the knowledge function BI(y) to obtain the business impact factor set {y|P(y)}. Step 6 specifically includes the following steps:

[0043] Step 6-1, identifying instruction information through coarse recognition regularization;

[0044] Step 6-2, identify the operation object and operation type by using detailed recognition regular expressions on the instruction information;

[0045] Step 6-3, build the instruction impact factor calculation library: Let x be the mapping value between the instruction object and the operation type, and calculate it through the knowledge function In(x), In(x) = β0+β1x1+β2x2+…+β n x n , where x1,x2,…,x n are the features of input x, β0,β1,…,β n is the model parameter learned by training risk knowledge data; let td be the risk threshold of instruction impact factor, P(x)=In(x)>td, and obtain the instruction impact factor set {x|P(x)};

[0046] Step 6-4: Based on NLP, construct lexical, syntactic analysis and semantic understanding, extract business information and identify the business impact scope and impact time;

[0047] Step 6-5, build a business impact factor calculation library: let y be the business impact range and t be the impact time, and use the knowledge function BI(y,t), BI(y,t)=a*y+(tb) / b+c to calculate, where a is the complexity of the business network, b is the average recovery time of historical failures, and c is the balance coefficient (dynamically adjusted according to the current network situation). Let tm be the risk threshold of the business impact factor, P(y)=BI(y,t)>tm, and obtain the business impact factor set {y|P(y)}.

[0048] Step 7: Calculate the instruction risk by correlation analysis. First, extract the instruction impact information of the 6 risk objects, match the instruction impact factors in sequence, and obtain the risk value of the risk object, and obtain 6n risk values, where n is the number of instruction impact factor sets. Extract the business impact information of the 6 risk objects, match the business impact factors in sequence, and obtain the risk value of the risk object, and obtain 6m risk values, where m is the number of business impact factor sets.

[0049] Step 8: Build a risk assessment engine to extract the risk values ​​of all indicators, which is k i , calculate the proportion of the i-th sample in the index, Set the risk adjustment coefficient z, the value range of z is between [0,1], and calculate the entropy value e of the indicator. n is the total number of samples; the final risk assessment value R = 1-e; the final risk assessment value is output. According to the common practice and theoretical framework of risk assessment, changing the plan when the risk assessment value is between [0,0.1) is considered extremely high risk, changing the plan when the risk assessment value is between [0.1,0.5) is considered high risk, changing the plan when the risk assessment value is between [0.5,0.9) is considered average risk, and changing the plan when the risk assessment value is between [0.9~1] is considered slight risk, which is used for decision support.

[0050] The present invention adopts the above technical scheme and adopts data preprocessing knowledge anchor technology. Compared with traditional document reading technology, data preprocessing speed is faster and the extraction of key information is more accurate. It has significant advantages in processing a large number of large files in scenarios where organizations frequently make changes. The Apriori algorithm is used to correlate business information elements with key commands, and the risk situation of key instructions is comprehensively analyzed in combination with business scenarios. The risk situation of instructions is more effectively identified, avoiding in-depth reading of a large number of instructions that have no impact on production, greatly reducing the work pressure of solution reviewers, and avoiding production accidents due to knowledge blind spots.

[0051] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians of the art without making creative work are within the scope of protection of the present application.

Claims

1. A method for identifying key operation instructions and assessing risks in a change plan, characterized by: It includes the following steps: Step 1, content extraction: extract the document content of the change plan as a whole to obtain all text information, all images and attached files; Step 2, loop traversal: determine whether there are any additional files in the overall extracted content; if so, perform overall extraction processing on the contents of all the extracted additional files in a loop traversal until there are no more additional files; Otherwise, go to step 3; Step 3, text encoding correction: perform secondary encoding correction on the extracted text information to convert it into the specified encoding format to ensure encoding consistency; Step 4, image content preprocessing: After preprocessing the extracted image, text information is extracted from the image through text recognition and key business features in the image are obtained through feature extraction; Step 5, generating business description: generating descriptive text by learning the text information and the key business features extracted from the image through a neural network model; the descriptive text includes a description of business elements or a description of instruction operations; Step 6: Build a data impact analysis engine: Build a key rule regular expression matrix to extract key elements of instructions, and obtain a set of instruction impact factors and a set of business impact factors; Step 7: Calculate the instruction risk by correlation analysis: extract the instruction impact information and business impact information of a specified number of risk objects, match the corresponding instruction impact factors and business impact factors respectively, and calculate several risk values ​​of the risk objects; Step 8: Build a risk assessment engine: extract all indicator risk values ​​k i , calculate the proportion p of the i-th sample in the corresponding index i , Set the risk adjustment coefficient z, the value range of z is between [0,1], and calculate the entropy value e of the indicator. n is the total number of samples; the final risk assessment value R = 1-e; the final risk assessment value is output. According to the common practice and theoretical framework of risk assessment, changing the plan when the risk assessment value is between [0,0.1) is considered to be extremely high risk, changing the plan when the risk assessment value is between [0.1,0.5) is considered to be high risk, changing the plan when the risk assessment value is between [0.5,0.9) is considered to be average risk, and changing the plan when the risk assessment value is between [0.9~1] is considered to be a slight risk, which is used for decision support.

2. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: In step 2, use the corresponding parsing tool according to the file type of the attached file.

3. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: In step 3, the text encoding is detected and converted to the unified UTF-8 format, and illegal characters in the text are removed or replaced.

4. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: Image preprocessing in step 4 includes image cleaning, denoising, and cropping.

5. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: The key business features in step 4 include shape and color distribution.

6. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: In step 5, a recurrent neural network (RNN) is used to generate a business element description or an instruction operation description.

7. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: Step 6 specifically includes the following steps: Step 6-1, identifying instruction information through coarse recognition regularization; Step 6-2, identify the operation object and operation type by using detailed recognition regular expressions on the instruction information; Step 6-3, build the instruction impact factor calculation library: Let x be the mapping value between the instruction object and the operation type, and calculate it through the knowledge function In(x), In(x) = β0+β1x1+β2x2+…+β n x n , where x1,x2,…,x n are the features of input x, β0,β1,…,β n is the model parameter learned by training risk knowledge data; let td be the risk threshold of instruction impact factor, P(x)=In(x)>td, and obtain the instruction impact factor set {x|P(x)}; Step 6-4: Based on NLP, construct lexical, syntactic analysis and semantic understanding, extract business information and identify the business impact scope and impact time; Step 6-5, build a business impact factor calculation library: let y be the business impact range and t be the impact time, and calculate through the knowledge function BI(y,t), BI(y,t)=a*y+(tb) / b+c, where a is the complexity of the business network, b is the average recovery time of historical failures, and c is the balance coefficient; let tm be the business impact factor risk threshold, P(y)=BI(y,t)>tm, and obtain the business impact factor set {y|P(y)}.

8. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: The specified number of risk objects is 6 risk objects.

9. The method for identifying key operation instructions and assessing risks in a change plan according to claim 1, characterized in that: The risk value of the risk object includes the risk value corresponding to the instruction impact information and the risk value corresponding to the business impact information; The risk value corresponding to the instruction impact information is the instruction impact factor multiplied by the specified number of risk objects; the risk value corresponding to the business impact information is the business impact factor multiplied by the specified number of risk objects.

Images