Change risk control method and device, equipment, storage medium and program product

Abstract

The invention discloses a change risk control method and device, equipment, a storage medium and a program product, and relates to the technical field of operation and maintenance management, and the change risk control method comprises the steps: receiving a change operation process initiated by a user; based on a preset change risk identification rule, carrying out risk identification on the change operation process to obtain a change risk report, the risk identification rule at least comprising a static rule and a dynamic scene identification rule; and generating a change risk control mode according to the change risk report. According to the method and the device, the change risk control based on dynamic and static risk identification is realized, the problem that the related technology depends on a manual judgment mode too much to carry out change risk control is solved, the efficiency of change risk control is improved, and the protection capability of change risk control is enhanced.

Description

Technical Field

[0001] The present application relates to the field of operation and maintenance management technology, and in particular to a change risk control method, device, equipment, storage medium and program product. Background Art

[0002] With the widespread use of cloud services, the number of applications and infrastructure has increased after being migrated to the cloud, resulting in a larger number of application release changes and infrastructure maintenance changes. Frequent changes increase the probability of availability incidents and pose a threat to the stable operation of business systems.

[0003] In related technologies, changes in application releases and infrastructure maintenance in production environments are mainly controlled through hierarchical management and manual approval, which greatly relies on the experience and technical level of the approvers, is inefficient, and is prone to risks such as misoperation.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a change risk control method, device, equipment, storage medium and program product, aiming to solve the technical problem that related technologies rely too much on manual judgment to perform change risk control.

[0006] To achieve the above objectives, the present application proposes a change risk control method, which includes:

[0007] Receive change operation procedures initiated by users;

[0008] Based on preset change risk identification rules, risk identification is performed on the change operation process to obtain a change risk report, wherein the risk identification rules at least include static rules and dynamic scenario identification rules;

[0009] A change risk control method is generated based on the change risk report.

[0010] In one embodiment, before the step of performing risk identification on the change operation process based on a preset change risk identification rule to obtain a change risk report, the step further includes:

[0011] Obtaining a rule registration configuration, wherein the rule registration configuration includes at least a change element configuration, an element constraint relationship configuration, a risk identification interface configuration, and a change risk control instruction;

[0012] Generate the static rules based on the change element configuration, element constraint relationship configuration and change risk management and control instructions;

[0013] The dynamic scenario recognition rules are generated based on the risk identification interface configuration and the risk control change instruction.

[0014] In one embodiment, the step of performing risk identification on the change operation process based on a preset change risk identification rule to obtain a change risk report includes:

[0015] Based on the static rules, static risk identification is performed on the change operation process to obtain a static risk identification result;

[0016] Based on the dynamic scenario identification rule, dynamically identify the risks of the change operation process to obtain a dynamic risk identification result;

[0017] A change risk report is obtained based on the static risk identification results and the dynamic risk identification results.

[0018] In one embodiment, the static rules include a number of change factor verification rules.

[0019] The step of performing static risk identification on the change operation process based on the static rules to obtain a static risk identification result includes:

[0020] Matching the preset control conditions of the plurality of change element verification rules with the change elements of the change operation process to obtain a static rule matching result;

[0021] According to the static rule matching result, a static risk identification result is obtained.

[0022] In one embodiment, the change elements of the change operation process include at least one or more of change operation personnel, change time window, change operation object and change operation, and the change element verification rules include at least one or more of time window verification rules, change operation verification rules, personnel information verification rules, change asset verification rules, impact scope verification rules and change attribute verification rules.

[0023] In one embodiment, the dynamic scene recognition rules include several dynamic scene interfaces.

[0024] The step of performing dynamic risk identification on the change operation process based on the dynamic scenario identification rule to obtain a dynamic risk identification result includes:

[0025] Generate a dynamic scene interface request according to the change elements of the change operation process;

[0026] Inputting the dynamic scene interface request into the plurality of dynamic scene interfaces to execute the dynamic scene, and obtaining a dynamic scene execution result;

[0027] According to the dynamic scenario execution result, a dynamic risk identification result is obtained.

[0028] In addition, to achieve the above purpose, the present application also proposes a change risk control device, the change risk control device comprising:

[0029] A change receiving module is used to receive the change operation process initiated by the user;

[0030] A risk identification module, configured to identify risks of the change operation process based on preset change risk identification rules to obtain a change risk report, wherein the risk identification rules include at least static rules and dynamic scenario identification rules;

[0031] The risk control module is used to generate a change risk control method according to the change risk report.

[0032] In addition, to achieve the above-mentioned purpose, the present application also proposes a change risk control device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the change risk control method described above.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the change risk control method described above are implemented.

[0034] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the change risk control method described above are implemented.

[0035] The present application provides a change risk control method, which receives the change operation process initiated by the user to collect detailed information on the change operation that the user needs to perform; uses pre-defined change risk identification rules to identify the risk of the change process operation initiated by the user, and obtains a change risk report to identify the potential risks in the user's change operation process; generates a control method for responding to the change risk based on the change risk report obtained by risk identification, so as to formulate a control method for potential risks, thereby ensuring the progress of the change operation. Change risk control based on dynamic and static risk identification is realized, which solves the problem that related technologies rely too much on manual judgment to perform change risk control, improves the efficiency of change risk control, and enhances the protection capability of change risk control. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] Figure 1 A flowchart of the first embodiment of the risk control method for the present application;

[0039] Figure 2 A flow chart of the second embodiment of the risk control method for the present application;

[0040] Figure 3 A schematic diagram of the asynchronous risk control process provided for the third embodiment of the risk control method for the present application;

[0041] Figure 4 A schematic diagram of a rule registration page provided for the third embodiment of the risk control method for the present application;

[0042] Figure 5 A schematic diagram of the static rule execution process provided for the third embodiment of the risk control method for the present application;

[0043] Figure 6 A schematic diagram of a flow chart of dynamic scene recognition provided in the third embodiment of the risk control method for the present application;

[0044] Figure 7 A schematic diagram of the module structure of the risk control device modified for the embodiment of the present application;

[0045] Figure 8 This is a schematic diagram of the device structure of the hardware operating environment involved in the risk control method for changing the embodiment of the present application.

[0046] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0048] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0049] The main solution of the embodiment of the present application is: receiving a change operation process initiated by a user; based on preset change risk identification rules, performing risk identification on the change operation process to obtain a change risk report, wherein the risk identification rules include at least static rules and dynamic scenario identification rules; and generating a change risk control method based on the change risk report.

[0050] Due to the existing technology, application release changes and infrastructure maintenance changes in the current production environment are mainly carried out through hierarchical management and manual approval. It is highly dependent on the experience and skill level of the approvers. The information that the system can provide for approval is also very scarce, with only basic change elements. At present, the industry has not yet built a dedicated tool platform for change risk control, using automation, big data and other means to solve the current problem of excessive reliance on manual judgment. In addition, the impact analysis before the administrator makes the change is incomplete, lacking specific data to determine which business systems are affected, and thus unable to notify the administrators of the affected systems in real time to observe and verify in time.

[0051] This application solves the problem that related technologies rely too much on manual judgment to perform change risk control through change risk control based on dynamic and static risk identification, improves the efficiency of change risk control, and enhances the protection capability of change risk control.

[0052] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a change risk control device, etc. The following takes the change risk control device as an example to illustrate this embodiment and the following embodiments.

[0053] Based on this, the present application embodiment provides a change risk control method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the risk control method for change of this application.

[0054] In this embodiment, the change risk control method includes steps S10 to S30:

[0055] Step S10, receiving a change operation process initiated by a user;

[0056] It should be noted that the change operation process refers to a series of operations that the user wants to perform, which are aimed at changing the status of an existing system, service or product, and can be collected through the user interface, API call or automated script.

[0057] It is understandable that in order to understand the user's needs and the context of the change so that the subsequent steps can accurately identify risks, it is first necessary to collect the user's upcoming change operation process.

[0058] Step S20, based on a preset change risk identification rule, risk identification is performed on the change operation process to obtain a change risk report, wherein the risk identification rule includes at least a static rule and a dynamic scenario identification rule;

[0059] It should be noted that the change risk identification rules refer to the standards or criteria used to identify potential risks in the change operation process. Static rules refer to rules that do not change with changes in the environment, and can include parameter constraints involved in various changes. Dynamic scenario identification rules refer to rules that change according to the current environment and conditions, and can include interfaces with upstream and downstream business systems to further identify potential risks in dynamic scenarios.

[0060] It can be understood that in order to identify and assess the potential risks that may arise from changes so that appropriate preventive measures can be taken before implementing the changes, predefined rules are used to identify potential risks in the change operation process.

[0061] Step S30: generating a change risk control method according to the change risk report.

[0062] It should be noted that the change risk report contains detailed records of the risks identified in the change operation process and their potential impacts. Change risk control methods refer to the strategies or measures taken to reduce or eliminate risks, such as prohibiting changes.

[0063] It is understandable that according to the risks identified in the risk report, corresponding control measures or mitigation strategies are formulated to adapt to different change scenarios. Whether it is standardized or non-standardized changes, risks can be identified in a timely manner and appropriate control measures can be taken, which not only improves the success rate of the change, but also reduces potential negative impacts and ensures the stability and security of the change process.

[0064] In a feasible implementation manner, before the step of performing risk identification on the change operation process based on a preset change risk identification rule and obtaining a change risk report, the step further includes:

[0065] Step S201, obtaining a rule registration configuration, wherein the rule registration configuration at least includes a change element configuration, an element constraint relationship configuration, a risk identification interface configuration, and a change risk control instruction;

[0066] It should be noted that the change factor configuration defines the key factors that need to be considered in the change operation process. The factor constraint relationship configuration defines the dependencies and constraints between the change factors. The risk identification interface configuration defines how to identify risks through the interfaces of different risk identification scenarios. The change risk management instructions provide guidance for risk control in the change operation process.

[0067] In addition, it should be noted that the rule registration configuration can be configured by collecting parameter attributes of each connected business system or application, and configured by the user according to various parameter attributes, risk control requirements, risk control processing and other contents.

[0068] It can be understood that in order to provide the necessary information for rule registration so as to generate static and dynamic rules in subsequent steps and obtain the rule registration configuration, the rule registration configuration may include the configuration of change risk identification rule-related attributes such as change elements, element constraint relationships, risk identification interfaces, and change risk management instructions.

[0069] Step S202, generating the static rules based on the change element configuration, element constraint relationship configuration and change risk management and control instructions;

[0070] It should be noted that static rules are usually developed based on historical data, rules of thumb or standard operating procedures. They can be risk identification rules for relevant content that does not change with environmental changes, or they can be risk identification rules for inherent risks that are not affected by dynamic scenario changes.

[0071] It can be understood that in order to verify the legality and controllability of the parameters of the change risk, rules for identifying static risks are generated based on the change element configuration, element constraint relationship configuration and change risk management instructions in the rule registration configuration.

[0072] Step S203: generating the dynamic scenario recognition rules based on the risk recognition interface configuration and the risk control change instruction.

[0073] It should be noted that dynamic scene recognition rules refer to rules that change according to the current environment and conditions, and can exist in the form of API interfaces and scripts.

[0074] It can be understood that in order to create a flexible risk identification rule so that risk identification can adapt to changing environments and conditions, dynamic scenario identification rules for risk identification are generated based on risk identification interface configuration and change risk management instructions.

[0075] In this implementation, through automated configuration and rule generation, it is possible to quickly respond to standardized and repetitive changes, improve the efficiency and consistency of the entire risk identification process, which not only increases the success rate of changes, reduces potential negative impacts, but also ensures the stability and security of the change process.

[0076] This embodiment provides a change risk control method, which collects detailed information about the change operation that the user needs to perform by receiving the change operation process initiated by the user; uses pre-defined change risk identification rules to identify the risk of the change process operation initiated by the user, and obtains a change risk report to identify the potential risks in the user's change operation process; generates a control method for responding to the change risk based on the change risk report obtained by risk identification, so as to formulate a control method for potential risks, thereby ensuring the progress of the change operation. Change risk control based on dynamic and static risk identification is realized, which solves the problem that related technologies rely too much on manual judgment to perform change risk control, improves the efficiency of change risk control, and enhances the protection capability of change risk control.

[0077] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the first embodiment can refer to the above introduction, and will not be repeated in the following. Figure 2 , Figure 2 This is a flow chart of the second embodiment of the risk control method for this application.

[0078] In this embodiment, the step of performing risk identification on the change operation process based on a preset change risk identification rule to obtain a change risk report includes:

[0079] Step S204, based on the static rules, static risk identification is performed on the change operation process to obtain a static risk identification result;

[0080] It can be understood that in order to identify those risks that are inherent in the characteristics of the change operation process itself, which are predictable and can be identified through analysis by static rules, predefined static rules are used to analyze the risks in the change operation process to obtain static risk identification results.

[0081] Step S205, based on the dynamic scene recognition rule, dynamic risk recognition is performed on the change operation process to obtain a dynamic risk recognition result;

[0082] It is understandable that in order to identify risks caused by changes in the external environment or specific scenario conditions, these risks may need to be analyzed in combination with real-time dynamic scenarios to identify them, and dynamic scenario identification rules can be used to analyze the risks in the change operation process to obtain dynamic risk identification results.

[0083] Step S206: obtaining a change risk report according to the static risk identification result and the dynamic risk identification result.

[0084] It is understandable that in order to help understand all potential risks in the change operation process and formulate risk management measures accordingly, a comprehensive change risk report is generated by combining the static risk identification results and the dynamic risk identification results.

[0085] In a feasible implementation manner, the static rules include a number of change element verification rules, and the step of performing static risk identification on the change operation process based on the static rules to obtain a static risk identification result includes:

[0086] Step S2041, matching the preset control conditions of the plurality of change element verification rules with the change elements of the change operation process to obtain a static rule matching result;

[0087] It should be noted that the change element verification rules refer to the predefined rules used to verify whether the change-related elements in the change operation process meet specific control conditions. The preset control conditions refer to the conditions set in the change element verification rules to evaluate whether the change elements are compliant. The change elements of the change operation process refer to the key elements or components involved in the actual change operation process, which can include the parameters and operations of the change.

[0088] It can be understood that in order to identify elements in the change operation process that may violate the preset control conditions, thereby evaluating the compliance and potential risks of the change operation process, the control conditions defined in the static rules are matched with the elements in the actual change operation process to obtain the static rule matching results, and determine whether there is a match or violation of the control conditions that requires control.

[0089] Step S2042, obtaining a static risk identification result according to the static rule matching result.

[0090] It can be understood that in order to evaluate the static risk level in the change operation process, the potential static risks in the change operation process are determined according to the static rule matching results, thereby obtaining a static risk identification result.

[0091] In this implementation, by matching the preset control conditions with the change elements of the change operation process, potential compliance issues and risk points can be identified. Then, based on the matching results, the risk level of the change operation process can be evaluated and the corresponding risk identification results can be generated. The necessary static risk identification results in comprehensive risk identification are provided, so that effective risk mitigation measures can be formulated to ensure the smooth progress of the change operation process and reduce the potential negative impact of the change operation.

[0092] In a feasible implementation, the change elements of the change operation process include at least one or more of the change operation personnel, the change time window, the change operation object and the change operation, and the change element verification rules include at least one or more of the time window verification rules, the change operation verification rules, the personnel information verification rules, the change asset verification rules, the impact scope verification rules and the change attribute verification rules.

[0093] It should be noted that the change operator refers to the personnel, office groups, teams, departments, etc. involved in the change operation. The change time window refers to the time range for the change operation. The change operation object refers to the physical machine, virtual machine, database, cloud service, cluster and other resources involved in the change operation. The change operation involves the specific execution method and process of the change. The time window verification rule refers to the rule for verifying whether the change operation is carried out within the allowed time range. The change operation verification rule refers to the rule for verifying whether the basic attributes, classification and risk level of the change operation meet the requirements. The personnel information verification rule refers to the rule for verifying whether the personnel who perform the change operation have the corresponding authority and qualifications. The change asset verification rule refers to the rule for verifying whether the assets affected by the change operation are correct or within the predefined range. The impact scope verification rule refers to the rule for verifying the scope that the change operation may affect (such as system, service unit, etc.). The change attribute verification rule refers to the rule for verifying other attributes of the change operation, such as urgency, importance, etc.

[0094] In this implementation, it is possible to ensure that the change elements of the change operation process are accurately matched with the preset verification rules, thereby identifying potential compliance issues and risk points, ensuring that every aspect of the change operation process has been properly reviewed and evaluated, and ensuring the compliance and security of the change operation process.

[0095] In a feasible implementation manner, the dynamic scene recognition rule includes a plurality of dynamic scene interfaces, and the step of performing dynamic risk recognition on the change operation process based on the dynamic scene recognition rule to obtain a dynamic risk recognition result includes:

[0096] Step S2051, generating a dynamic scene interface request according to the change elements of the change operation process;

[0097] It is understandable that in order to obtain specific risk assessment information in the current environment or scenario, which may include real-time data or risk indicators calculated based on current conditions, it is necessary to construct one or more dynamic scenario interface requests based on the specific change elements of the change operation process (such as change operators, change time windows, etc.). These requests will be sent to different dynamic scenario interfaces for execution.

[0098] Step S2052, inputting the dynamic scene interface request into the plurality of dynamic scene interfaces to perform dynamic scene execution, and obtaining a dynamic scene execution result;

[0099] It should be noted that the dynamic scenario interface refers to the interface that provides risk assessment in a specific scenario, which can be internally developed or a third-party service. The dynamic scenario execution result refers to the result returned after the dynamic scenario interface processes the request, reflecting the risk assessment under the current environment and conditions.

[0100] It can be understood that in order to utilize the computing power of external systems or services and obtain risk assessment results based on the current environment and conditions, the generated requests are input into different dynamic scenario interfaces respectively, the scenario logic defined by the interface is executed, and the dynamic scenario execution results returned by the interface are obtained.

[0101] Step S2053, obtaining a dynamic risk identification result according to the dynamic scenario execution result.

[0102] It can be understood that in order to convert the risk assessment provided by the dynamic scenario interface into a specific risk identification result for the changed operation process, the obtained dynamic scenario execution result is converted into a specific risk assessment result.

[0103] In this embodiment, by performing risk identification for dynamic scenarios through a dynamic scenario interface, a risk assessment based on the current environment and conditions can be obtained, ensuring that the risks of changing the operation process under different environments and conditions are accurately identified, which not only improves the real-time and accuracy of risk identification, but also improves the ability to deal with change risks.

[0104] In this embodiment, by simultaneously processing the inherent risks in the change operation process and the dynamic risks caused by environmental changes, predictable risk points and risks that may change with time and conditions are identified, and finally the dynamic and static risk identification results are integrated to generate a comprehensive change risk report, providing decision makers with the necessary information so that they can formulate effective risk mitigation measures, which not only improves the accuracy and comprehensiveness of risk identification, but also improves the ability to deal with change risks, thereby ensuring the smooth progress of the change operation process and reducing potential negative impacts.

[0105] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those of the first and second embodiments mentioned above can be referred to the above introduction and will not be repeated later.

[0106] For example, in order to help understand the implementation process of the change risk control method obtained by combining the first embodiment and the second embodiment, please refer to Figure 3 , Figure 3A schematic diagram of the asynchronous risk control process provided for the third embodiment of the risk control method for this application. Specifically, the following steps are included:

[0107] a) The user initiates the change operation process on the change automation platform, pre-stores the information of each element of the change into the change risk control platform database, and the change risk control platform returns the identification ID;

[0108] b) Change the automation platform and wait for 3 seconds, then query the rule execution result according to the identification ID;

[0109] c) If the rules have been executed, a risk report will be compiled based on the results of the risk control instructions to trigger the control method;

[0110] d) If the execution is not completed, the user is prompted that risk monitoring is in progress and there is no need to wait for the result, allowing the bill of lading to generate a change order;

[0111] e) After the risk control system has completed the backend processing, the results will be pushed to the change automation platform and a notification will be sent to the user to remind him that the risk monitoring has been completed.

[0112] Furthermore, in order to automatically identify change risks by means of automation and big data, this embodiment will build system tools to provide external capabilities such as rule configuration, risk identification, and risk management. The system divides the change risk control platform into two modules: change risk control and change risk identification, using the idea of ​​​​layering and division of responsibilities.

[0113] Among them, the change risk control module focuses on risk control measures at each stage of the change, uses various data to assist in judging change risks, and issues specific change control instructions. The change risk identification module uses a self-developed rule engine, combined with change automation capabilities, and outputs a change risk list according to the agreed change elements. Specifically:

[0114] 1. Change risk control module

[0115] Based on the change availability event analysis, the five major elements of the change are summarized: change operator, change time window, change operation object and change operation. The constraint relationship between the elements can be called risk control rules. The change risk control module provides a visual rule registration page and can generate change risk control instructions based on the change risk list, such as: prohibition of change, risk escalation, approval escalation and other operations. The change risk control module can include: automatic generation of rule registration page, rule registration and risk control:

[0116] a) Automatic generation of rule registration page: Due to the diversity of change scenarios, in order to reduce repeated development caused by demand changes, the various control attributes involved are abstracted into parsable data structures and stored in the database. When rule registration is required, the front end directly generates the risk control registration front end page by parsing the configuration in the database. Through database configuration, operations such as adding, deleting, and merging change dimensions can be quickly and efficiently implemented, reducing repeated development caused by demand changes at the front end and improving the coverage of change scenarios.

[0117] 1. The data structure includes:

[0118] i. Classify attributes and define control dimensions to facilitate the distinction of object attributes;

[0119] ii. Classification type, which defines whether the control dimension supports multi-parameter configuration and the relationship between parameters.

[0120] 2. Object properties include:

[0121] i. Parameter ID, which defines a unique identifier;

[0122] ii. Parameter value, which defines the risk data threshold that needs to be verified;

[0123] iii. Parameter type, define whether the attribute is displayed as a text box, drop-down box, or Radio;

[0124] iv. Whether it is required or not, define the necessary conditions for rule configuration;

[0125] v. Constraints, define whether the attribute is configured with conditions;

[0126] vi. Enumeration list, defines a selectable enumeration data list, which only works under the drop-down box condition;

[0127] vii. Prompt information: define additional information about attribute components to reduce user learning and usage costs.

[0128] b) Rule registration: Figure 4 As shown, Figure 4 A schematic diagram of the rule registration page provided for the third embodiment of the risk control method for this application. The rule registration is divided into eight parts of the configuration process, including:

[0129] i. Basic information (required): define the scope of application of the rules and change the control method;

[0130] ii. Time control (optional): defines the change window, allowing configuration of time range and period expression;

[0131] iii. Operation control (optional): defines change operations and allows configuration of basic attributes, classification, risk level, etc. of change operations;

[0132] iv. Personnel control (optional): Define the change executor, allowing configuration of individuals, office groups, teams, and departments;

[0133] v. Asset management (optional): defines the change objects and allows configuration of in-bank assets, including: physical machines, virtual machines, databases, cloud services, clusters and other resources;

[0134] vi. Impact analysis and control (optional): define the scope of impact of the change and allow configuration of information such as the affected systems and service units;

[0135] vii. Job control (optional): defines the entire change job, allowing configuration of change type, source system, execution method and other information;

[0136] viii.Risk identification atom (optional): defines risk identification scenarios, which are registered to the change automation platform through API or script.

[0137] c) Risk control: Change control instructions can be implemented based on the change risk report. The specific control methods are:

[0138] i. Prohibit changes: directly prohibit the execution of the change;

[0139] ii. Risk level adjustment: Set the change risk level to one of low, medium, high, important, or major;

[0140] iii. Risk level increase: Based on the current risk level, the risk level will be increased by one level;

[0141] iv. Change approval flow: modify the approval flow of the change, such as circuit breaker approval or upgrade to center leader approval;

[0142] v. Pop-up prompt: a pop-up prompt will appear when submitting changes, and you can customize the prompt content;

[0143] vi. Change title: You can add custom content to the change title;

[0144] vii. Notification: Different users can be notified at various stages of the change.

[0145] It provides scalable change rule registration capabilities for operation and maintenance change scenarios, which can make risk control judgments based on fixed dimensions (time, operation, personnel, work, impact analysis), as well as conduct targeted analysis for specific operation and maintenance scenarios.

[0146] 2. Change Risk Identification Module

[0147] The change factors are input into the rule engine, and the change risk report is output after the rule engine runs, which includes the following steps: first, filter the rules according to the scope of the change object. Here, they are classified according to the technology stack. On the one hand, it improves the efficiency of rule execution, and on the other hand, executes unique APIs for specific scenarios to improve the reliability of risk results; secondly, divide the screened rules into static rules and dynamic scenario identification, and input the change factor execution rules respectively; finally, count the hit rules, and after matching all the rules, count the hit rules and control methods, record them in the risk report, output the risk report, and execute the highest priority control measures according to the priority of the risk control measures to reduce the risks brought by the change itself.

[0148] Among them, the change risk identification module can include: static rule execution and dynamic scenario identification:

[0149] a) Static rule execution: Figure 5 As shown, Figure 5 A schematic diagram of the static rule execution process provided for the third embodiment of the change risk control method of this application. Static rule execution refers to matching the change elements according to the preset control conditions. The control conditions may include:

[0150] i. According to the time control configuration, determine whether the change window is met, and support matching using periodic expressions

[0151] ii. According to the operation control configuration, determine whether the attributes of the change operation, including id, operation risk, operation classification, etc., meet the conditions;

[0152] iii. According to the personnel control configuration, determine whether the changed personnel meet the conditions such as ID and room group;

[0153] iv. According to the asset control configuration, determine whether the changed object is a preset asset object or whether it has a specified asset tag;

[0154] v.According to the impact analysis control configuration, obtain the impact analysis data of the changed object and determine whether the change affects important systems / subsystems or important infrastructure;

[0155] vi. Based on the job control configuration, determine other attributes of the change itself, such as whether it is executed immediately, whether it is an emergency operation, whether the change comes from a specific system, etc.;

[0156] b) Dynamic scene recognition: Figure 6 As shown, Figure 6A flow chart of dynamic scene identification provided for the third embodiment of the change risk control method of this application. Dynamic scene identification refers to passing the change element to the API according to the preset risk identification API, obtaining the interface return, and parsing whether there is a risk in the change element according to the agreed format, and outputting the change risk report. Specifically, it includes the following steps:

[0157] i. According to the change factor classification, filter out the rules that meet the scope, remove duplicates and summarize all API interfaces to be executed.

[0158] ii. Create 50 thread pools to asynchronously execute the API interface, query the API interface execution return every 5 seconds, and store the execution results in the database.

[0159] iii. After all APIs are executed, determine whether there are risks in the execution results, discard the abnormal results of API execution, summarize all risk items to generate a risk report, and output the highest priority control method.

[0160] In this embodiment, by providing an extensible rule configuration page, it has the advantages of low usage cost and good extensibility; it adopts a layered architecture with clear responsibilities and convenient expansion; it uses an asynchronous method to identify various risks existing in the changes of various elements, and issues specific change control instructions in a timely manner, improves concurrency capabilities and optimizes user interaction experience; summarizes post-change risk events, accumulates change risk experience, drives the improvement of the rule system, and realizes a closed-loop risk control process.

[0161] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the risk control method of the present application. More simple changes based on this technical concept are all within the scope of protection of the present application.

[0162] This application also provides a change risk control device, please refer to Figure 7 , the change risk control device comprises:

[0163] The change receiving module 10 is used to receive the change operation process initiated by the user;

[0164] A risk identification module 20, configured to identify risks of the change operation process based on preset change risk identification rules to obtain a change risk report, wherein the risk identification rules include at least static rules and dynamic scenario identification rules;

[0165] The risk control module 30 is used to generate a change risk control method according to the change risk report.

[0166] Optionally, the risk identification module 20 is further used to:

[0167] Obtaining a rule registration configuration, wherein the rule registration configuration includes at least a change element configuration, an element constraint relationship configuration, a risk identification interface configuration, and a change risk control instruction;

[0168] Generate the static rules based on the change element configuration, element constraint relationship configuration and change risk management and control instructions;

[0169] The dynamic scenario recognition rules are generated based on the risk identification interface configuration and the risk control change instruction.

[0170] Optionally, the risk identification module 20 is further used to:

[0171] Based on the static rules, static risk identification is performed on the change operation process to obtain a static risk identification result;

[0172] Based on the dynamic scenario identification rule, dynamically identify the risks of the change operation process to obtain a dynamic risk identification result;

[0173] A change risk report is obtained based on the static risk identification results and the dynamic risk identification results.

[0174] Optionally, the static rule includes a plurality of change factor verification rules, and the risk identification module 20 is further used for:

[0175] Matching the preset control conditions of the plurality of change element verification rules with the change elements of the change operation process to obtain a static rule matching result;

[0176] According to the static rule matching results, the static risk identification results are obtained.

[0177] Optionally, the change elements of the change operation process include at least one or more of change operation personnel, change time window, change operation object and change operation, and the change element verification rules include at least one or more of time window verification rules, change operation verification rules, personnel information verification rules, change asset verification rules, impact scope verification rules and change attribute verification rules.

[0178] Optionally, the dynamic scene recognition rule includes several dynamic scene interfaces, and the risk recognition module 20 is further used for:

[0179] Generate a dynamic scene interface request according to the change elements of the change operation process;

[0180] Inputting the dynamic scene interface request into the plurality of dynamic scene interfaces to execute the dynamic scene, and obtaining a dynamic scene execution result;

[0181] According to the dynamic scenario execution result, a dynamic risk identification result is obtained.

[0182] The change risk control device provided by the present application adopts the change risk control method in the above embodiment, which can solve the technical problem that the related technology relies too much on manual judgment to control the change risk. Compared with the prior art, the beneficial effects of the change risk control device provided by the present application are the same as the beneficial effects of the change risk control method provided by the above embodiment, and the other technical features in the change risk control device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0183] The present application provides a change risk control device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the change risk control method in the above-mentioned first embodiment.

[0184] Reference below Figure 8 , which shows a schematic diagram of the structure of a change risk control device suitable for implementing the embodiment of the present application. The change risk control device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The change risk control device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0185] like Figure 8As shown, the change risk control device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the change risk control device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the change risk control device to communicate with other devices wirelessly or by wire to exchange data. Although the change risk control device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0186] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0187] The change risk control device provided by the present application adopts the change risk control method in the above embodiment, which can solve the technical problem that the related technology relies too much on manual judgment to control the change risk. Compared with the prior art, the beneficial effects of the change risk control device provided by the present application are the same as the beneficial effects of the change risk control method provided by the above embodiment, and the other technical features in the change risk control device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0188] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0189] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0190] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the change risk control method in the above-mentioned embodiment.

[0191] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0192] The computer-readable storage medium may be included in the change risk control device; or may exist independently without being assembled into the change risk control device.

[0193] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the change risk control device, the change risk control device: receives the change operation process initiated by the user; based on the preset change risk identification rules, performs risk identification on the change operation process to obtain a change risk report, and the risk identification rules at least include static rules and dynamic scenario identification rules; and generates a change risk control method according to the change risk report.

[0194] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0195] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0196] The modules involved in the embodiments of the present application may be implemented by software or hardware, wherein the name of the module does not limit the unit itself in some cases.

[0197] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned change risk control method, and can solve the technical problem that the related art relies too much on manual judgment to control change risk. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the change risk control method provided by the above-mentioned embodiment, and will not be repeated here.

[0198] The present application also provides a computer program product, including a computer program, which implements the steps of the change risk control method as described above when executed by a processor.

[0199] The computer program product provided by this application can solve the technical problem that the related art relies too much on manual judgment to control the change risk. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as those of the change risk control method provided by the above embodiment, which will not be elaborated here.

[0200] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A change risk control method, characterized in that: The method comprises: Receive change operation procedures initiated by users; Based on preset change risk identification rules, risk identification is performed on the change operation process to obtain a change risk report, wherein the risk identification rules at least include static rules and dynamic scenario identification rules; A change risk control method is generated based on the change risk report.

2. The method according to claim 1, characterized in that: Before the step of performing risk identification on the change operation process based on the preset change risk identification rules to obtain a change risk report, the step further includes: Obtaining a rule registration configuration, wherein the rule registration configuration includes at least a change element configuration, an element constraint relationship configuration, a risk identification interface configuration, and a change risk control instruction; Generate the static rules based on the change element configuration, element constraint relationship configuration and change risk management and control instructions; The dynamic scenario recognition rules are generated based on the risk identification interface configuration and the risk control change instruction.

3. The method according to claim 1, characterized in that: The step of performing risk identification on the change operation process based on the preset change risk identification rules to obtain a change risk report includes: Based on the static rules, static risk identification is performed on the change operation process to obtain a static risk identification result; Based on the dynamic scenario identification rule, dynamically identify the risks of the change operation process to obtain a dynamic risk identification result; A change risk report is obtained based on the static risk identification results and the dynamic risk identification results.

4. The method according to claim 3, characterized in that: The static rules include several change factor verification rules. The step of performing static risk identification on the change operation process based on the static rules to obtain a static risk identification result includes: Matching the preset control conditions of the plurality of change element verification rules with the change elements of the change operation process to obtain a static rule matching result; According to the static rule matching result, a static risk identification result is obtained.

5. The method according to claim 4, characterized in that: The change elements of the change operation process include at least one or more of the change operation personnel, the change time window, the change operation object and the change operation, and the change element verification rules include at least one or more of the time window verification rule, the change operation verification rule, the personnel information verification rule, the change asset verification rule, the impact scope verification rule and the change attribute verification rule.

6. The method according to claim 3, characterized in that: The dynamic scene recognition rules include several dynamic scene interfaces. The step of performing dynamic risk identification on the change operation process based on the dynamic scenario identification rule to obtain a dynamic risk identification result includes: Generate a dynamic scene interface request according to the change elements of the change operation process; Inputting the dynamic scene interface request into the plurality of dynamic scene interfaces to execute the dynamic scene, and obtaining a dynamic scene execution result; According to the dynamic scenario execution result, a dynamic risk identification result is obtained.

7. A change risk control device, characterized in that: The device comprises: A change receiving module is used to receive the change operation process initiated by the user; A risk identification module, configured to identify risks of the change operation process based on preset change risk identification rules to obtain a change risk report, wherein the risk identification rules include at least static rules and dynamic scenario identification rules; The risk control module is used to generate a change risk control method according to the change risk report.

8. A change risk control device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the change risk control method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the change risk control method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the change risk control method according to any one of claims 1 to 6 are implemented.

Images