A multi-dimensional evaluation method for Xinxing environment migration

Abstract

The application discloses a kind of multi-dimensional evaluation methods of Xinyuan environment migration, specifically related to evaluation field;The application is built by constructing the evaluation index system covering infrastructure, application system, data resources and security compliance, and is realized by instruction set detection, binary analysis and equal protection compliance inspection comprehensive scanning;AHP-entropy weight hybrid model is used to dynamically calculate weight, and weight rebalancing is triggered based on volatility rate;By combining static scanning and dynamic probe, compatibility, performance and security difference are quantitatively analyzed;Finally, a visual risk assessment report is generated, which integrates data from each stage to calculate compatibility score, performance loss rate and security level, provides instruction level difference comparison, performance flame chart and vulnerability attack path interactive view, and outputs migration suggestions including priority modification list, NEON instruction optimization scheme and phased reinforcement plan.

Description

Technical Field

[0001] This invention relates to the field of evaluation technology, and more specifically, to a multi-dimensional evaluation method for migration in the information technology innovation environment. Background Technology

[0002] In today's digital age, information technology application innovation (ITAI) has become a key strategy for promoting national technological self-reliance and ensuring national information security. With the intensification of global technological competition and the urgent domestic demand for independently controllable technologies, the ITAI industry has ushered in unprecedented development opportunities. Key industries such as government, finance, telecommunications, and energy are accelerating their ITAI transformation, gradually achieving domestic substitution for everything from chips and operating systems to databases, middleware, and various application software. Against this backdrop, a large number of traditional business systems based on the x86 architecture need to migrate to domestically developed ITAI environments (such as ARM and LoongArch architectures).

[0003] However, it still has some shortcomings in actual use. For example, the assessment of information technology innovation migration mainly relies on human experience and lacks systematic quantitative analysis tools, resulting in high migration costs, long cycles and uncontrollable risks. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a multi-dimensional evaluation method for migration in the information technology innovation environment, so as to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] S1: Construct an evaluation indicator system that includes the infrastructure layer, application system layer, data resource layer, and security compliance layer;

[0007] S2: Calculate the weight coefficients of each level of indicators through the dynamic weight allocation module;

[0008] S3: Employ a quantitative evaluation engine to conduct multi-dimensional comparative analysis of the source environment and the target information technology innovation environment;

[0009] S4: Generates a visual assessment report based on the migration risk assessment model, which includes compatibility scores, performance degradation rates, and security levels.

[0010] Preferably, in step S1, based on a comprehensive scan and analysis of the source environment and the target information technology innovation environment: at the infrastructure layer, through CPUID instruction set detection and / proc / cpuinfo parsing, the differences in the coverage of SIMD instruction sets under x86 and ARM architectures, as well as the missing AVX / AVX2 and NEON instructions, are compared; at the same time, the sysfs interface of the Linux kernel is used to monitor the driver adaptation status of PCIe / USB devices in real time, and the number of driver loading failures and the corresponding device IDs are recorded;

[0011] At the application system layer, a combination of static analysis and dynamic tracing is used. The objdump and readelf tools are used to parse the .dynamic section of the ELF file, count the number of unresolved symbols, and strace is used to trace system calls to analyze API call failure cases caused by architectural differences.

[0012] Preferably, in step S2, an initial judgment matrix is ​​constructed based on the Analytic Hierarchy Process (AHP), and domain experts compare the importance of the infrastructure layer (weight benchmark 30%), application system layer (25%), data resource layer (20%) and security compliance layer (25%) in pairs to form an initial weight distribution on a scale of 1-9.

[0013] To eliminate subjective bias, the system synchronously introduces the entropy weight method to correct the objective weights of the indicators: by collecting sample data of historical migration projects, the information entropy of each indicator is calculated.

[0014] For key domestic performance indicators (such as Kylin OS compatibility), the system sets a hard weight lower limit of 40% and dynamically updates the weights of related indicators through a Bayesian network. For example, when the peripheral driver compatibility rate is detected to be below 85%, the weight of the relevant CPU instruction set indicator is automatically increased by 20%. After all weight coefficients pass the consistency check (CR<0.1), they are written to the weight configuration library by the distributed computing nodes, and a timestamped weight change log is generated for audit traceability.

[0015] Preferably, in step S3, the static scanning phase deploys distributed scanning nodes to perform full asset discovery in the source environment, uses an improved ELF parser to disassemble binary files, and constructs a knowledge graph containing function call relationships, symbol table dependencies, and instruction features; for Java / Python interpreted applications, cross-platform sensitive operation features are extracted using bytecode analysis tools, including JNI calls and system command execution.

[0016] The dynamic probe system adopts a modular design and includes the following core components:

[0017] Kernel-level probes use eBPF technology to implant detection hooks at system call entry points, capturing differences in parameters and return values ​​of file operations and network communication behaviors in real time.

[0018] The runtime analyzer injects bytecode probes into the JVM / .NET managed environment to monitor abnormal call patterns of cross-platform APIs;

[0019] Hardware performance counters collect microarchitecture metrics such as CPI and cache hit rate via the PMU interface. The probe system is specifically optimized for typical differences in the domestic IT innovation environment: when NEON instruction conversion under the ARM architecture is detected, test vectors are automatically injected to verify the loss of computational accuracy.

[0020] The quantitative comparison engine employs a multi-stage processing pipeline: in the preprocessing stage, static scan results are converted into standardized metrics through feature engineering; in the dynamic analysis stage, runtime metrics collected by probes are stored using a time-series database, and performance deviation rates are calculated using a sliding window algorithm; the security comparison uses ATT&CK matrix modeling to map detected configuration differences to TLS 1.0 and employs corresponding CRIME attack risk attack techniques.

[0021] The final quantitative report includes a compatibility matrix, which shows the degree of matching of each component in three dimensions: ABI, API, and behavior.

[0022] Preferably, in step S4, the evaluation results from each previous stage are integrated: the instruction set compatibility analysis of the infrastructure layer, the dynamic link library adaptation of the application system layer, the verification error rate of the data resource layer, and the national cryptographic algorithm coverage data of the security compliance layer are comprehensively calculated using a weighted decision model; the compatibility score adopts a percentage system, of which hardware compatibility accounts for 35%, including CPU instruction set matching degree and driver adaptation rate; software compatibility accounts for 45%, including binary compatibility and middleware dependency; and data compatibility accounts for 20%. Finally, the comprehensive score of the current environment is obtained through a formula. The specific calculation scheme for the compatibility score is as follows:

[0023] Where D represents the compatibility score, E represents the sub-item score, and F represents the dynamic weight. Represented as an architecture correction factor;

[0024] The system integrates the detection results of static scanning and dynamic probes: on the one hand, it uses cross-compilation performance analysis data based on the LLVM compiler, and on the other hand, it combines performance probe data from actual operation in the target environment to predict the performance loss rate of each business component through regression models; the report specifically marks high-loss components and displays specific bottlenecks, such as the lack of specific CRC32 instruction acceleration under the ARM architecture; the security level assessment adopts the scoring system of the Information Security Classified Protection 2.0, mapping the previously detected cryptographic algorithm usage and audit log integrity data to five security levels, and generating reinforcement recommendations containing a specific vulnerability list.

[0025] The report's visualization employs an interactive design: the main dashboard uses a "traffic light" format to visually display the status of three core indicators: compatibility (yellow warning), performance (green, meeting standards), and security (red, high risk). Drill down to view detailed analysis at each level. The compatibility dimension provides an instruction-level difference comparison view, using a code difference comparator to visually display the assembly code segments that need modification. Performance analysis uses flame graphs to display function-level time consumption distribution and marks hot functions caused by cross-architecture differences.

[0026] The technical effects and advantages of this invention are as follows:

[0027] 1. Establish an evaluation indicator system covering four levels: infrastructure, application systems, data resources, and security compliance. Use various technical means to conduct a comprehensive scan and analysis of the source environment and the target information technology innovation environment to ensure the comprehensiveness and systematicness of the evaluation and to leave no key factors that may affect the migration out of the way.

[0028] 2. Precise detection methods are employed in each level of the assessment. For example, at the infrastructure layer, CPUID instruction set detection, / proc / cpuinfo parsing, and sysfs interface monitoring are used to accurately compare differences in different architectures and device driver adaptation status. At the application system layer, static analysis and dynamic tracing are combined to accurately count the number of unresolved symbols and analyze API call failure cases. At the data resource layer, specific SQL commands and verification algorithms are used to accurately establish performance benchmarks and calculate error rates. At the security and compliance layer, in accordance with the Cybersecurity Classified Protection 2.0 standard, system service configurations are accurately detected and vulnerabilities are scanned, thereby providing accurate data support for the assessment. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] Please see Figure 1 As shown, this invention provides a multi-dimensional evaluation method for migration in the information technology innovation environment, including:

[0032] S1: Construct an evaluation indicator system that includes the infrastructure layer, application system layer, data resource layer, and security compliance layer;

[0033] In step S1, based on a comprehensive scan and analysis of the source environment and the target information technology innovation environment: at the infrastructure layer, through CPUID instruction set detection and / proc / cpuinfo parsing, the coverage differences of SIMD instruction sets under x86 and ARM architectures, as well as the missing AVX / AVX2 and NEON instructions, are compared; at the same time, the sysfs interface of the Linux kernel is used to monitor the driver adaptation status of PCIe / USB devices in real time, and the number of driver loading failures and the corresponding device IDs are recorded.

[0034] At the application system layer, a combination of static analysis and dynamic tracing is used. The objdump and readelf tools are used to parse the .dynamic section of the ELF file, count the number of unresolved symbols, and strace is used to trace system calls to analyze API call failure cases caused by architectural differences.

[0035] The data resource layer establishes a performance benchmark by executing SQL commands SELECT COUNT(*) and EXPLAIN ANALYZE on the source database, conducts comparative tests in the target environment, and calculates the deviation rate of query response time. Simultaneously, it employs a block-by-block CRC32 checksum algorithm to verify BLOB fields, setting an error threshold of no more than 0.005%.

[0036] The security compliance layer assessment relies on the Cybersecurity Classified Protection 2.0 standard, and uses automated scripts to detect system service configurations, including but not limited to checking whether the encryption algorithm configuration in / etc / ssh / sshd_config complies with the national cryptographic standard, whether the retention period of audit logs meets the 180-day requirement, and using the OpenSCAP tool to scan for system vulnerabilities.

[0037] S2: Calculate the weight coefficients of each level of indicators through the dynamic weight allocation module;

[0038] In step S2, an initial judgment matrix is ​​constructed based on the Analytic Hierarchy Process (AHP). Domain experts compare the importance of the infrastructure layer (weight benchmark 30%), application system layer (25%), data resource layer (20%), and security compliance layer (25%) in pairs to form an initial weight distribution on a scale of 1-9.

[0039] To eliminate subjective bias, the system synchronously introduces the entropy weight method to correct the objective weights of the indicators: by collecting sample data from historical migration projects, the information entropy of each indicator is calculated. The specific method for calculating information entropy is as follows:

[0040] ,in, Represented as information entropy, Let be the standardized value of the i-th sample on the j-th indicator, and k be the proportionality constant.

[0041] Finally, the entropy weight is obtained, and the specific method for calculating the entropy weight is as follows:

[0042] ,in, Represented as entropy weight, Represented as information entropy;

[0043] The dynamic adjustment process employs a sliding window mechanism. After each evaluation cycle (typically 24 hours), the indicator volatility is recalculated. Since an evaluation cycle is 24 hours, the specific calculation method for indicator volatility is as follows:

[0044] ,in, Expressed as index volatility, This is represented as the index value at time point t. This represents the mean of the indicator, and n represents the total number of data points.

[0045] When the hardware compatibility index of the infrastructure layer fluctuates by more than 15%, the weight rebalancing algorithm is triggered. The specific calculation method of the weight rebalancing algorithm is as follows:

[0046] ,in, Represented as the updated weights, Represented as the old weights, Represented as real-time weights, Represented as a smoothing factor;

[0047] For key domestic performance indicators (such as Kylin OS compatibility), the system sets a hard weight lower limit of 40% and dynamically updates the weights of related indicators through a Bayesian network. For example, when the peripheral driver compatibility rate is detected to be below 85%, the weight of the relevant CPU instruction set indicator is automatically increased by 20%. After all weight coefficients pass the consistency check (CR<0.1), they are written to the weight configuration library by the distributed computing nodes, and a timestamped weight change log is generated for audit traceability.

[0048] S3: Employ a quantitative evaluation engine to conduct multi-dimensional comparative analysis of the source environment and the target information technology innovation environment;

[0049] In step S3, the static scanning phase deploys distributed scanning nodes to perform full asset discovery in the source environment, uses an improved ELF parser to disassemble binary files, and constructs a knowledge graph containing function call relationships, symbol table dependencies, and instruction features. For Java / Python interpreted applications, cross-platform sensitive operation features are extracted using bytecode analysis tools. Sensitive operation features include JNI calls and system command execution.

[0050] The dynamic probe system adopts a modular design and includes the following core components:

[0051] Kernel-level probes use eBPF technology to implant detection hooks at system call entry points, capturing differences in parameters and return values ​​of file operations and network communication behaviors in real time.

[0052] The runtime analyzer injects bytecode probes into the JVM / .NET managed environment to monitor abnormal call patterns of cross-platform APIs;

[0053] Hardware performance counters collect microarchitecture metrics such as CPI and cache hit rate via the PMU interface. The probe system is specifically optimized for typical differences in the domestic IT innovation environment: when NEON instruction conversion under the ARM architecture is detected, test vectors are automatically injected to verify the loss of computational accuracy.

[0054] The quantitative comparison engine employs a multi-stage processing pipeline: in the preprocessing stage, static scan results are converted into standardized metrics through feature engineering; in the dynamic analysis stage, runtime metrics collected by probes are stored using a time-series database, and performance deviation rates are calculated using a sliding window algorithm; the security comparison uses ATT&CK matrix modeling to map detected configuration differences to TLS 1.0 and employs corresponding CRIME attack risk attack techniques.

[0055] The final quantitative report includes: a compatibility matrix, which shows the matching degree of each component in three dimensions: ABI, API, and behavior;

[0056] The performance degradation spectrum visually displays the loss of each subsystem in terms of IPC, latency, and other indicators.

[0057] Safety gap analysis uses CVSS scores to quantify the risk level of non-compliance items;

[0058] All data is presented through a visualization platform, which supports drilling down to specific problem commands or system calls, providing precise positioning for migration and transformation.

[0059] S4: Generates a visual assessment report based on the migration risk assessment model, which includes compatibility scores, performance degradation rates, and security levels.

[0060] In step S4, the evaluation results from each previous stage are integrated: the instruction set compatibility analysis of the infrastructure layer, the dynamic link library adaptation of the application system layer, the verification error rate of the data resource layer, and the national cryptographic algorithm coverage data of the security compliance layer are comprehensively calculated using a weighted decision model; the compatibility score adopts a percentage system, of which hardware compatibility accounts for 35%, including CPU instruction set matching degree and driver adaptation rate; software compatibility accounts for 45%, including binary compatibility and middleware dependency; and data compatibility accounts for 20%. Finally, the comprehensive score of the current environment is obtained through a formula. The specific calculation scheme for the compatibility score is as follows:

[0061] Where D represents the compatibility score, E represents the sub-item score, and F represents the dynamic weight. Represented as an architecture correction factor;

[0062] The system integrates the detection results of static scanning and dynamic probes: on the one hand, it uses cross-compilation performance analysis data based on the LLVM compiler, and on the other hand, it combines performance probe data from actual operation in the target environment to predict the performance loss rate of each business component through regression models; the report specifically marks high-loss components and displays specific bottlenecks, such as the lack of specific CRC32 instruction acceleration under the ARM architecture; the security level assessment adopts the scoring system of the Information Security Classified Protection 2.0, mapping the previously detected cryptographic algorithm usage and audit log integrity data to five security levels, and generating reinforcement recommendations containing a specific vulnerability list.

[0063] The report's visualization employs an interactive design: the main dashboard uses a "traffic light" format to visually display the status of three core indicators: compatibility (yellow warning), performance (green, meeting standards), and security (red, high risk). Drill down to view detailed analysis at each level. The compatibility dimension provides an instruction-level difference comparison view, using a code difference comparator to visually display the assembly code segments that need modification; performance analysis uses flame graphs to show function-level time distribution and highlights hotspot functions caused by cross-architecture differences; the security assessment visualizes the vulnerability exploitation chain through an attack path graph, particularly highlighting key risks involving domestically produced components; the automatically generated migration path suggestions include:

[0064] The priority list of modifications prioritizes addressing three high-risk compatibility issues that could impact business continuity.

[0065] For performance optimization, it is recommended to rewrite modules with losses exceeding 20% ​​using ARM NEON instructions;

[0066] The security hardening plan is phased, such as replacing the cryptographic algorithm in the first week and fixing high-risk vulnerabilities within two weeks.

[0067] All recommendations include estimated workload and impact analysis, and support drag-and-drop interactive adjustments to the migration roadmap. The report concludes with a simulation and prediction function, allowing users to adjust various parameters and view changes in risk assessment in real time, and supports exporting standardized XML / JSON documents that meet cybersecurity standards.

[0068] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A multi-dimensional evaluation method for Xinyi environment migration, characterized in that, Comprise: S1: build an evaluation index system comprising infrastructure layer, application system layer, data resource layer and security compliance layer; S2: calculate the weight coefficient of each level index through a dynamic weight distribution module; S3: adopt a quantitative evaluation engine to perform multi-dimensional comparison and analysis on the source environment and the target Xingcheng environment; In the step S3, the static scanning stage deploys distributed scanning nodes to perform full-quantity asset discovery on the source environment, uses an improved ELF parser to disassemble binary files, and constructs a knowledge graph comprising function call relationship, symbol table dependency and instruction characteristics; for Java / Python interpreted applications, cross-platform sensitive operation features are extracted through a bytecode analysis tool, and the sensitive operation features include JNI call and system command execution; The dynamic probe system adopts modular design and comprises the following core components: The kernel-level probe implants a detection hook at the system call entry point through eBPF technology, and captures the parameters and return value differences of file operations and network communication behaviors in real time; The runtime analyzer injects bytecode probes in the JVM / .NET managed environment to monitor abnormal call patterns of cross-platform APIs; The hardware performance counter collects CPI and cache hit rate microarchitecture indicators through the PMU interface; S4: generate a visual evaluation report comprising compatibility score, performance loss rate and security level based on the migration risk evaluation model; In the step S4, integrate the evaluation results of each stage: integrate the instruction set compatibility analysis of the infrastructure layer, the dynamic link library adaptation of the application system layer, the verification error rate of the data resource layer, and the national cryptographic algorithm coverage rate data of the security compliance layer, and perform comprehensive calculation through a weighted decision model; Fuse the detection results of static scanning and dynamic probe: on the one hand, based on the cross-compilation performance analysis data of the LLVM compiler, on the other hand, combined with the performance probe data actually running in the target environment, predict the performance loss rate of each business component through a regression model; the report specially marks out high-loss components, and displays the specific bottleneck points, including the lack of specific CRC32 instruction acceleration under ARM architecture; the security level evaluation adopts the scoring system of EP2.0, maps the detected cryptographic algorithm usage, audit log integrity data to five security levels, and generates reinforcement suggestions comprising a specific vulnerability list.

2. The method of claim 1, wherein: In the step S1, based on the comprehensive scanning and analysis of the source environment and the target Xingcheng environment: in the infrastructure layer, detect and analyze the differences in the coverage of SIMD instruction sets under x86 and ARM architectures, and the lack of AVX / AVX2 and NEON instructions through CPUID instruction set detection and / proc / cpuinfo analysis; at the same time, use the sysfs interface of the Linux kernel to monitor the driving adaptation state of PCIe / USB devices in real time, record the number of failed driver loading and the corresponding device ID; At the application system layer, a combination of static analysis and dynamic tracking is adopted, the objdump and readelf tools are used to analyze the.dynamic section of the ELF file, the number of unresolved symbols is counted, and the strace is used to track system calls to analyze the API call failure cases caused by architecture differences.

3. The method of claim 2, wherein: The data resource layer establishes performance benchmarks by executing SELECT COUNT(*) and EXPLAIN ANALYZE SQL commands on the source database, conducts comparative tests in the target environment, calculates the deviation rate of query response time, and uses the block CRC32 checking algorithm to check the BLOB field block by block, with an error threshold of not more than 0.005%; The evaluation of the security compliance layer relies on the EP2.0 standard, detects system service configurations through automated scripts, including but not limited to checking whether the encryption algorithm configuration in / etc / ssh / sshd_config meets the national standard, whether the audit log retention period meets the 180-day requirement, and scanning system vulnerabilities using the OpenSCAP tool.

4. The method of claim 1, wherein: In step S2, an initial judgment matrix is constructed based on the analytic hierarchy process, and domain experts compare the importance of the infrastructure layer, application system layer, data resource layer, and security compliance layer pairwise to form an initial weight distribution with a 1-9 scale; To eliminate subjective bias, the system synchronously introduces the entropy weight method to correct the objective weight of the index: by collecting sample data from historical migration projects, the information entropy of each index is calculated, and the calculation method of the information entropy is as follows: wherein, is expressed as information entropy, is expressed as the normalized value of the ith sample on the jth index, and k is expressed as a proportional constant; Finally, the entropy weight is obtained, and the calculation method of the entropy weight is as follows: wherein, is expressed as an entropy weight, is expressed as an information entropy; The dynamic adjustment process uses a sliding window mechanism, and the index volatility is recalculated after each evaluation period, which is 24 hours. The calculation method of the index volatility is as follows: wherein, is expressed as an index volatility, is expressed as an index value at the tth time point, is expressed as an index mean, n is expressed as the total number of data points.

5. The method of claim 1, wherein: In step S3, the static scanning stage deploys distributed scanning nodes to perform full asset discovery on the source environment, uses an improved ELF parser to disassemble binary files, and constructs a knowledge graph containing function call relationships, symbol table dependencies, and instruction characteristics. For Java / Python interpreted applications, cross-platform sensitive operation features are extracted through bytecode analysis tools, including JNI calls and system command executions.

Images