Component risk acquisition method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a component risk acquisition method and device, computer equipment, a readable storage medium and a program product. The method comprises the steps of obtaining key configuration items of a to-be-detected component, generating a detection script according to the key configuration items, issuing the detection script to a corresponding host to indicate the host to execute the detection script, obtaining key configuration data reported when the host executes the detection script, and determining risk levels of the key configuration items according to the key configuration data, and determining the component risk of the to-be-detected component according to the key configuration data and the risk levels of all the key configuration items. By adopting the method, real-time monitoring and component risk grading of the key configuration of the component can be effectively realized, and potential risks existing in the component configuration can be found in time, so that the stability of the component is ensured.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a component risk acquisition method, apparatus, computer equipment, readable storage medium and program product. Background Art

[0002] Component key configuration refers to a series of parameters and options that must be correctly set to ensure that the component can run as expected. It usually involves multiple aspects such as component function activation, performance adjustment, security policy, data interaction, etc. Correct configuration can ensure the stability and security of the component and improve the overall performance and reliability of the system.

[0003] In traditional methods, the detection of key component configurations mainly relies on predefined security policies and baseline standards. By executing collection tasks, the system verifies whether the configuration of each component complies with the established security specifications, and takes corresponding measures for configuration items that do not meet the requirements.

[0004] However, the configuration requirements for the same components in different business scenarios often vary significantly. Traditional detection methods use unified predefined strategies and baseline standards, which make it difficult to provide customizable detection rules. As a result, in some specific scenarios, some necessary configuration items are misjudged as non-compliant, which in turn leads to unnecessary configuration adjustments and increases operation and maintenance costs. Summary of the invention

[0005] Based on this, it is necessary to provide a component risk acquisition method, device, computer equipment, readable storage medium and program product that can accurately detect the security of component key configurations in response to the above technical problems.

[0006] In a first aspect, the present application provides a component risk acquisition method, comprising:

[0007] Obtain key configuration items of the component to be tested, and generate a detection script based on the key configuration items; the key configuration items include multiple add-ons of the component to be tested in the current IT environment;

[0008] Send the detection script to the corresponding host to instruct the host to execute the detection script and obtain the key configuration data reported by the host when executing the detection script;

[0009] Determine the risk level of key configuration items based on key configuration data, and determine the component risk of the component to be tested based on the key configuration data and risk levels of all key configuration items.

[0010] In one embodiment, the step of generating a detection script according to key configuration items includes:

[0011] For each key configuration item, generate a script unit of the key configuration item according to the detection logic defined by the user for the key configuration item;

[0012] The script units of all key configuration items are combined to obtain the detection script.

[0013] In one embodiment, the method further comprises:

[0014] Assign a version number to the detection script and add a header comment to get the target file;

[0015] Perform hash calculation on the target file and save the target file and the calculated hash value to the file library.

[0016] In one embodiment, the step of sending the detection script to the corresponding host includes:

[0017] Get the current script loaded on the host where the component to be detected is deployed;

[0018] When the version number of the current script is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, the detection script is sent to the host through the agent program.

[0019] In one embodiment, the step of determining the risk level of the key configuration item according to the key configuration data includes:

[0020] For each key configuration item, obtain the reference risk range of the key configuration item; the reference risk range includes low risk range, medium risk range and high risk range;

[0021] According to the key configuration data of the key configuration items, determine the target risk range corresponding to the key configuration items, and use the risk level corresponding to the target risk range as the risk level of the key configuration items.

[0022] In one embodiment, the step of determining the component risk of the component to be detected according to the key configuration data and risk levels of all key configuration items includes:

[0023] Standardize the key configuration data of all key configuration items to obtain feature data;

[0024] The feature data and the corresponding risk level are input into the classification model, and the component risk of the component to be tested is output; the component risk includes low risk, medium risk and high risk.

[0025] In a second aspect, the present application also provides a component risk acquisition device, including:

[0026] The configuration acquisition module is used to obtain key configuration items of the component to be detected and generate a detection script based on the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment;

[0027] The data acquisition module is used to send the detection script to the corresponding host to instruct the host to execute the detection script and obtain the key configuration data reported by the host when executing the detection script;

[0028] The risk determination module is used to determine the risk level of the key configuration items according to the key configuration data, and to determine the component risk of the component to be detected according to the key configuration data and risk levels of all the key configuration items.

[0029] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method steps of any one of the first aspects are implemented.

[0030] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements any one of the method steps in the first aspect when the computer program is executed by a processor.

[0031] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which implements any one of the method steps in the first aspect when executed by a processor.

[0032] The above-mentioned component risk acquisition method, device, computer equipment, readable storage medium and program product can adapt to the configuration requirements for component security in different scenarios by dynamically generating detection scripts according to the key configuration items of the components and sending the detection scripts to the corresponding hosts, quickly adjust the detection scripts, monitor the changes in component configurations in real time, and then determine the component risk of the component to be detected according to the risk level of the key configuration items. It can effectively realize real-time monitoring of the key configuration of the components and component risk grading, and timely discover the potential risks in the component configuration, thereby ensuring the stability of the components. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0034] FIG1 is an application environment diagram of a component risk acquisition method in one embodiment;

[0035] FIG2 is a schematic diagram of a flow chart of a component risk acquisition method in one embodiment;

[0036] FIG3 is a schematic diagram of data interaction of a component risk acquisition method in another embodiment;

[0037] FIG4 is a structural block diagram of a component risk acquisition device in one embodiment;

[0038] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0040] The component risk acquisition method provided in the embodiment of the present application can be applied in the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 is used to obtain the key configuration items of the component to be detected, generate a detection script according to the key configuration items, send the detection script to the corresponding host to instruct the host to execute the detection script, and obtain the key configuration data reported by the host to execute the detection script, determine the risk level of the key configuration items according to the key configuration data, and determine the component risk of the component to be detected according to the key configuration data and risk level of all key configuration items. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head mounted device may be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0041] In an exemplary embodiment, as shown in FIG2 , a component risk acquisition method is provided, which is described by taking the method applied to the terminal 102 in FIG1 as an example, and includes the following steps 202 to 206. Among them:

[0042] S202: Acquire key configuration items of the component to be detected, and generate a detection script according to the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment.

[0043] Optionally, in a complex IT environment, the component to be detected has many configuration options. Key configuration items are configuration parameters that have a significant impact on the normal operation, security, performance, etc. of the component, including multiple add-ons of the component in the current IT environment, such as plug-ins and dynamic link libraries loaded by software components, or security policy modules and routing protocols loaded by network devices. Afterwards, a detection script is written based on the characteristics of the key configuration items and the content to be detected, wherein the detection script is an automated tool for obtaining the actual configuration data of the key configuration items. For example, for the plug-in loading status of a software component, the detection script may obtain the name, version, loading status, and other information of the plug-in by querying the system's plug-in management interface or scanning a specific plug-in directory.

[0044] S204: Send the detection script to the corresponding host to instruct the host to execute the detection script, and obtain key configuration data reported by the host when executing the detection script.

[0045] Optionally, the generated detection script is sent to the corresponding hosts, which are devices running the components to be detected, such as physical servers, virtual machines, or containers. Through appropriate deployment mechanisms (such as remote script execution tools, automated operation and maintenance platforms, etc.), ensure that the detection script can be correctly executed on the target host. After the host executes the detection script, it will collect relevant data of key configuration items according to the requirements of the script and report this data.

[0046] S206: Determine the risk level of the key configuration item according to the key configuration data, and determine the component risk of the component to be detected according to the key configuration data and risk levels of all the key configuration items.

[0047] Optionally, based on the key configuration data reported by the host, a risk assessment is performed on each key configuration item, and the risk level of each key configuration item is determined. After that, the key configuration data of all key configuration items and their respective risk levels are comprehensively considered to determine the overall risk of the component to be detected.

[0048] In the above-mentioned component risk acquisition method, by dynamically generating a detection script based on the key configuration items of the component and sending the detection script to the corresponding host, it is possible to adapt to the configuration requirements for component security in different scenarios, quickly adjust the detection script, and monitor the changes in component configuration in real time. Then, according to the risk level of the key configuration items, the component risk of the component to be detected is determined, which can effectively realize real-time monitoring of the key configuration of the component and component risk grading, and timely discover potential risks in the component configuration, thereby ensuring the stability of the component.

[0049] In an exemplary embodiment, the step of generating a detection script based on key configuration items includes: for each key configuration item, generating a script unit of the key configuration item according to the detection logic defined by the user for the key configuration item; and combining the script units of all key configuration items to obtain a detection script.

[0050] Optionally, the common compliance standards of database pre-set components cover a variety of key configuration items, such as configuration code, configuration name, deployment mode, etc. These key configuration items each have specific attributes and important significance in component operation and compliance. Users can define the detection rules and script logic for each key configuration item according to their own needs and understanding of component operation and compliance requirements. Based on the detection logic defined by the user for each key configuration item, an independent script unit is generated for each key configuration item through the corresponding programming language or script writing tool. The function of this script unit is to specifically detect whether the key configuration item meets the set detection logic requirements. After the corresponding script unit is generated for each key configuration item, these scattered script units are combined so that each script unit can work together in a certain order or logical relationship to form a complete detection script. When executing the detection script, each key configuration item will be detected in turn, and the key configuration item will be judged whether it meets the requirements based on the detection logic set in each script unit, so as to comprehensively evaluate the compliance status of the database pre-set component.

[0051] In this embodiment, by generating a detection script based on the detection logic of key configuration items defined by the user, the detection logic of key configuration items can be flexibly adjusted to effectively cope with complex and ever-changing environmental changes. Moreover, the generated detection script can directly detect those configurations that are critical to component operation and compliance, avoiding unnecessary detection of insignificant configurations, thereby improving detection efficiency.

[0052] In an exemplary embodiment, the method further includes: assigning a version number to the detection script and adding a header comment to obtain a target file; performing a hash calculation on the target file, and saving the target file and the calculated hash value to a file library.

[0053] Optionally, the version number is an important mark for identifying different stages and states of the detection script. The header comment is a piece of explanatory text placed at the beginning of the detection script to provide key information about the detection script. After the version number is assigned to the detection script, the header comment is added to the beginning of the script to obtain the target file. After that, the target file is hashed, and the target file and the calculated hash value are saved to the file library, wherein the hash calculation is an algorithmic process that converts data of any length into a hash value of a fixed length. For files with different contents, even if there are only slight differences, the calculated hash values ​​will be very different. By performing hash calculation on the target file, a hash value that uniquely identifies the current state of the target file is obtained. After the hash calculation is completed, the target file and the calculated hash value will be saved together in the file library, wherein the file library is a storage system for storing various types of files and related information. In the file library, the target file and its corresponding hash value will be stored in association so that it can be easily obtained and compared when needed later.

[0054] In this embodiment, by assigning a version number to the detection script and adding a header comment to obtain the target file, and performing a hash calculation on the target file, it is possible to promptly detect whether the target file has been changed, so that the latest target file can be sent to the host to ensure the validity of the key configuration data reported by the host.

[0055] In an exemplary embodiment, the step of sending the detection script to the corresponding host includes: obtaining the current script loaded on the host where the component to be detected is deployed; when the version number of the current script is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, sending the detection script to the host through an agent program.

[0056] Optionally, each host on which the component to be detected is deployed has a loaded script for detecting the key configuration of the component. When the version number of the current script obtained from the host is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, it means that the detection script of the component has been modified. At this time, the current latest detection script is sent to the host through the agent program to ensure that the host uses the latest and correct detection script.

[0057] In this embodiment, by sending the current latest detection script to the host when the version number or hash value changes, it can always ensure that the detection script loaded on the host where the component to be detected is deployed is the latest version, thereby ensuring accurate detection of the configuration data of the key configuration of the component. At the same time, unnecessary script sending can be avoided, so that the host can focus more on executing the detection task, thereby improving the execution efficiency of the entire detection process.

[0058] In an exemplary embodiment, the step of determining the risk level of a key configuration item based on key configuration data includes: for each key configuration item, obtaining a reference risk range of the key configuration item; the reference risk range includes a low risk range, a medium risk range, and a high risk range; based on the key configuration data of the key configuration item, determining a target risk range corresponding to the key configuration item, and using the risk level corresponding to the target risk range as the risk level of the key configuration item.

[0059] Optionally, for the reported key configuration data, after data cleaning, the detection value of each key configuration item is marked with a risk level according to the pre-set configuration item risk grading standard. For each key configuration item, its reference risk range is pre-defined, and the target risk range corresponding to the key configuration item is determined based on the key configuration data of the key configuration item, and the risk level corresponding to the target risk range is used as the risk level of the key configuration item. In addition, by storing these key configuration data with risk level labels in the database, and each data set is associated with a specific collection time point, the risk status of the key configuration of the component at different time points can be recorded, providing a data basis for subsequent risk analysis and trend tracking.

[0060] In this embodiment, by clarifying the risk scope and level classification standard of each key configuration item, a more accurate assessment of the risk of the component can be made, thereby effectively realizing real-time monitoring of the key configuration of the component and component risk classification, and improving the accuracy of component risk detection.

[0061] In an exemplary embodiment, the step of determining the component risk of the component to be detected based on the key configuration data and risk levels of all key configuration items includes: standardizing the key configuration data of all key configuration items to obtain feature data; inputting the feature data and the corresponding risk level into a classification model, and outputting the component risk of the component to be detected; the component risk includes low risk, medium risk and high risk.

[0062] Optionally, when evaluating the overall risk of the component to be tested, the key configuration data of different key configuration items must be processed first. Since these data may have different dimensions, ranges, and data types, the purpose of standardization is to convert these different types of data into comparable forms, namely feature data. Common standardization methods include normalization (mapping data to the 0-1 interval) and standardization (making the data have zero mean and unit variance). The feature data and the corresponding risk level are input into the classification model, and the component risk of the component to be tested is output. The classification model is a tool built on the principles of machine learning or statistics. It can predict the category to which it belongs based on the input data characteristics, that is, the component risk level of the component to be tested, such as low risk, medium risk or high risk.

[0063] Exemplarily, the component risk is graded by the random forest algorithm. First, according to different scenario strategies, the configuration items that affect the component risk grading mark are selected as important features, and the detection values ​​of each configuration item and the corresponding risk level labels are imported. After the random forest classifier is trained and its performance is optimized, the model can be used to perform risk grading on the newly acquired data about the key configuration of the component. Soft voting is a way for the random forest algorithm to make classification decisions. For each new data sample to be graded, each decision tree will give a prediction result about the risk level of the sample (i.e., low risk, medium risk or high risk). Then, through soft voting, the final risk level of the sample is comprehensively obtained according to the prediction results of each decision tree and their weights in the model, thereby realizing the component risk grading of the feature data. After the grading process, a key configuration compliance test report of the component is generated from high to low according to the risk level, including the test results, repair measures and historical collection records, which can be notified to the operation and maintenance personnel by email or other instant notification methods, so that the operation and maintenance personnel can quickly identify and prioritize high-risk component configuration items according to the report to reduce the exposure time of security threats.

[0064] In this embodiment, by considering the data and risk levels of all key configuration items, the risk assessment of the component to be inspected can be performed as a whole, thereby more accurately reflecting the actual risk status of the component, thereby promptly handling the security risk of the component and ensuring the stability of the component.

[0065] In an exemplary embodiment, as shown in FIG3 , a component risk acquisition method is provided, the method comprising the following steps:

[0066] (1) Common compliance standards for database pre-configured components cover a variety of key configuration items, such as configuration code, configuration name, deployment mode, etc. Users can manage key configuration items through the key configuration monitoring module and define the detection rules and script logic of key configuration items through the security policy management module.

[0067] (2) The security policy management module generates an independent script unit for each key configuration item based on the detection rules defined by the user, assembles the script units to be executed through the master script assembler, obtains the detection script, assigns a version number to the detection script, adds a header comment, and uploads it to the file library for storage after hash calculation.

[0068] (3) The collection task scheduler obtains the target host where the target component has been deployed, calls the file library to send the detection script to the target host, and sends a synchronization instruction to the target host, instructing the target host to execute the detection script, and detects the key configuration items through the key configuration collector, and reports them to the message cluster through the detection data generator.

[0069] (4) The data processor monitors the message cluster in real time to obtain the key configuration data reported by the target host and saves the key configuration data to the database.

[0070] (5) The risk assessment module conducts risk assessment on the key configuration items according to the reference risk range of the key configuration items, obtains the risk level of each key configuration item, and combines the risk levels of all key configuration items to obtain the component risk of the component to be tested, such as low risk, medium risk or high risk, and feeds back the risk results to the user.

[0071] In this embodiment, by dynamically generating a detection script based on the key configuration items of the component and sending the detection script to the corresponding host, it is possible to adapt to the configuration requirements for component security in different scenarios, quickly adjust the detection script, monitor changes in component configuration in real time, and then determine the component risk of the component to be detected based on the risk level of the key configuration items. This can effectively achieve real-time monitoring of the key configuration of the component and component risk grading, and promptly discover potential risks in the component configuration, thereby ensuring the stability of the component.

[0072] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0073] Based on the same inventive concept, the embodiment of the present application also provides a component risk acquisition device for implementing the component risk acquisition method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more component risk acquisition device embodiments provided below can refer to the limitations of the component risk acquisition method above, and will not be repeated here.

[0074] In an exemplary embodiment, as shown in FIG4 , a component risk acquisition device is provided, comprising: a configuration acquisition module 10, a data acquisition module 20 and a risk determination module 30, wherein:

[0075] The configuration acquisition module 10 is used to acquire key configuration items of the component to be detected and generate a detection script according to the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment.

[0076] The data acquisition module 20 is used to send the detection script to the corresponding host to instruct the host to execute the detection script, and obtain key configuration data reported by the host when executing the detection script.

[0077] The risk determination module 30 is used to determine the risk level of the key configuration items according to the key configuration data, and to determine the component risk of the component to be detected according to the key configuration data and risk levels of all the key configuration items.

[0078] In an exemplary embodiment, the configuration acquisition module 10 is further configured to generate a script unit of each key configuration item according to the detection logic defined by the user for the key configuration item; and combine the script units of all key configuration items to obtain a detection script.

[0079] In an exemplary embodiment, the configuration acquisition module 10 is also used to assign a version number to the detection script and add a header comment to obtain a target file; perform hash calculation on the target file, and save the target file and the calculated hash value to a file library.

[0080] In an exemplary embodiment, the data acquisition module 20 is used to obtain the current script loaded on the host where the component to be detected is deployed; when the version number of the current script is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, the detection script is sent to the host through the agent program.

[0081] In an exemplary embodiment, the risk determination module 30 is used to obtain a reference risk range of the key configuration item for each key configuration item; the reference risk range includes a low risk range, a medium risk range and a high risk range; according to the key configuration data of the key configuration item, the target risk range corresponding to the key configuration item is determined, and the risk level corresponding to the target risk range is used as the risk level of the key configuration item.

[0082] In an exemplary embodiment, the risk determination module 30 is used to standardize the key configuration data of all key configuration items to obtain characteristic data; input the characteristic data and the corresponding risk level into the classification model, and output the component risk of the component to be detected; the component risk includes low risk, medium risk and high risk.

[0083] Each module in the above-mentioned component risk acquisition device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0084] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a component risk acquisition method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0085] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0086] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: obtaining key configuration items of a component to be detected, and generating a detection script based on the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment; sending the detection script to a corresponding host to instruct the host to execute the detection script, and obtaining key configuration data reported by the host when executing the detection script; determining the risk level of the key configuration item based on the key configuration data, and determining the component risk of the component to be detected based on the key configuration data and risk levels of all key configuration items.

[0087] In one embodiment, generating a detection script based on key configuration items when a processor executes a computer program includes: for each key configuration item, generating a script unit of the key configuration item according to the detection logic defined by the user for the key configuration item; and combining the script units of all key configuration items to obtain a detection script.

[0088] In one embodiment, when the processor executes the computer program, the following steps are also implemented: assigning a version number to the detection script and adding a header comment to obtain a target file; performing a hash calculation on the target file, and saving the target file and the calculated hash value to a file library.

[0089] In one embodiment, the execution of a computer program by a processor involves sending a detection script to a corresponding host, including: obtaining a current script loaded on the host where the component to be detected is deployed; when the version number of the current script is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, sending the detection script to the host through an agent program.

[0090] In one embodiment, determining the risk level of a key configuration item based on key configuration data when a processor executes a computer program includes: obtaining a reference risk range of the key configuration item for each key configuration item; the reference risk range includes a low risk range, a medium risk range, and a high risk range; determining a target risk range corresponding to the key configuration item based on the key configuration data of the key configuration item, and using the risk level corresponding to the target risk range as the risk level of the key configuration item.

[0091] In one embodiment, when a processor executes a computer program, the component risk of the component to be detected is determined based on the key configuration data and risk levels of all key configuration items, including: standardizing the key configuration data of all key configuration items to obtain feature data; inputting the feature data and the corresponding risk level into a classification model, and outputting the component risk of the component to be detected; the component risk includes low risk, medium risk and high risk.

[0092] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: obtaining key configuration items of a component to be detected, and generating a detection script based on the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment; sending the detection script to a corresponding host to instruct the host to execute the detection script, and obtaining key configuration data reported by the host when executing the detection script; determining the risk level of the key configuration item based on the key configuration data, and determining the component risk of the component to be detected based on the key configuration data and risk levels of all key configuration items.

[0093] In one embodiment, when a computer program is executed by a processor, generating a detection script based on key configuration items includes: for each key configuration item, generating a script unit of the key configuration item according to the detection logic defined by the user for the key configuration item; and combining the script units of all key configuration items to obtain a detection script.

[0094] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: assigning a version number to the detection script and adding a header comment to obtain a target file; performing a hash calculation on the target file, and saving the target file and the calculated hash value to a file library.

[0095] In one embodiment, the computer program executed by the processor involves sending the detection script to the corresponding host, including: obtaining the current script loaded on the host where the component to be detected is deployed; when the version number of the current script is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, sending the detection script to the host through an agent program.

[0096] In one embodiment, the computer program, when executed by a processor, involves determining the risk level of a key configuration item based on key configuration data, including: for each key configuration item, obtaining a reference risk range of the key configuration item; the reference risk range includes a low risk range, a medium risk range, and a high risk range; based on the key configuration data of the key configuration item, determining a target risk range corresponding to the key configuration item, and using the risk level corresponding to the target risk range as the risk level of the key configuration item.

[0097] In one embodiment, when a computer program is executed by a processor, the component risk of the component to be detected is determined based on the key configuration data and risk levels of all key configuration items, including: standardizing the key configuration data of all key configuration items to obtain feature data; inputting the feature data and the corresponding risk level into a classification model, and outputting the component risk of the component to be detected; the component risk includes low risk, medium risk and high risk.

[0098] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: obtaining key configuration items of a component to be detected, and generating a detection script based on the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment; sending the detection script to a corresponding host to instruct the host to execute the detection script, and obtaining key configuration data reported by the host when executing the detection script; determining the risk level of the key configuration item based on the key configuration data, and determining the component risk of the component to be detected based on the key configuration data and risk levels of all key configuration items.

[0099] In one embodiment, when a computer program is executed by a processor, generating a detection script based on key configuration items includes: for each key configuration item, generating a script unit of the key configuration item according to the detection logic defined by the user for the key configuration item; and combining the script units of all key configuration items to obtain a detection script.

[0100] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: assigning a version number to the detection script and adding a header comment to obtain a target file; performing a hash calculation on the target file, and saving the target file and the calculated hash value to a file library.

[0101] In one embodiment, the computer program executed by the processor involves sending the detection script to the corresponding host, including: obtaining the current script loaded on the host where the component to be detected is deployed; when the version number of the current script is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, sending the detection script to the host through an agent program.

[0102] In one embodiment, the computer program, when executed by a processor, involves determining the risk level of a key configuration item based on key configuration data, including: for each key configuration item, obtaining a reference risk range of the key configuration item; the reference risk range includes a low risk range, a medium risk range, and a high risk range; based on the key configuration data of the key configuration item, determining a target risk range corresponding to the key configuration item, and using the risk level corresponding to the target risk range as the risk level of the key configuration item.

[0103] In one embodiment, when a computer program is executed by a processor, the component risk of the component to be detected is determined based on the key configuration data and risk levels of all key configuration items, including: standardizing the key configuration data of all key configuration items to obtain feature data; inputting the feature data and the corresponding risk level into a classification model, and outputting the component risk of the component to be detected; the component risk includes low risk, medium risk and high risk.

[0104] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0105] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0106] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A component risk acquisition method, characterized in that: The method comprises: Acquire key configuration items of the component to be detected, and generate a detection script according to the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment; Sending the detection script to a corresponding host to instruct the host to execute the detection script, and obtaining key configuration data reported by the host when executing the detection script; The risk level of the key configuration item is determined according to the key configuration data, and the component risk of the component to be detected is determined according to the key configuration data and risk levels of all key configuration items.

2. The method according to claim 1, characterized in that The generating a detection script according to the key configuration items includes: For each key configuration item, according to the detection logic defined by the user for the key configuration item, a script unit of the key configuration item is generated; The script units of all key configuration items are combined to obtain the detection script.

3. The method according to claim 2, characterized in that The method further comprises: Assign a version number to the detection script and add a header comment to obtain a target file; A hash calculation is performed on the target file, and the target file and the calculated hash value are saved in a file library.

4. The method according to claim 3, characterized in that The sending of the detection script to the corresponding host includes: Obtain the current script loaded on the host where the component to be detected is deployed; When the version number of the current script is inconsistent with the version number of the detection script, or the hash value of the current script is inconsistent with the hash value of the detection script, the detection script is sent to the host through an agent program.

5. The method according to claim 1, characterized in that: The determining the risk level of the key configuration item according to the key configuration data includes: For each key configuration item, obtain a reference risk range of the key configuration item; the reference risk range includes a low risk range, a medium risk range, and a high risk range; According to the key configuration data of the key configuration item, a target risk range corresponding to the key configuration item is determined, and a risk level corresponding to the target risk range is used as the risk level of the key configuration item.

6. The method according to claim 1, characterized in that Determining the component risk of the component to be detected according to the key configuration data and risk levels of all key configuration items includes: Standardize the key configuration data of all key configuration items to obtain feature data; The characteristic data and the corresponding risk level are input into a classification model, and the component risk of the component to be detected is output; the component risk includes low risk, medium risk and high risk.

7. A component risk acquisition device, characterized in that: The device comprises: A configuration acquisition module, used to acquire key configuration items of the component to be detected, and generate a detection script according to the key configuration items; the key configuration items include multiple add-ons of the component to be detected in the current IT environment; A data acquisition module, used to send the detection script to a corresponding host to instruct the host to execute the detection script, and to acquire key configuration data reported by the host when executing the detection script; The risk determination module is used to determine the risk level of the key configuration item according to the key configuration data, and determine the component risk of the component to be detected according to the key configuration data and risk levels of all key configuration items.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images