Risk state assessment method

Abstract

The invention discloses a risk state assessment method. The method comprises the following steps: determining an execution mode of a target operation; when the execution mode is the imperative execution mode, determining an operation type of the target operation and operation description information matched with the target operation, and determining a risk state of the target operation according to the operation type and the operation description information; under the condition that the execution mode is a script type execution mode, determining an auditing state of an execution script matched with the target operation, and determining a risk state of the target operation according to the auditing state and the content information of the execution script; and determining a target risk state of the target operation according to at least one risk state matched with the target operation in the target detection period. Through the method and the device, the problems of high operation risk assessment difficulty and low risk assessment efficiency in related technologies are solved.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method for assessing risk status. Background Art

[0002] The mainstream operating system for data center open platforms is mainly Linux, with a wide range of daily operation and maintenance management, a large number of emergency changes, complex implementation steps, and covering many important business application scenarios. With the promotion of applications and the transformation of domestic architectures, more and more application architectures tend to be distributed cluster deployments, and the operation and maintenance model has also changed from the previous single-machine to cluster scale.

[0003] While potential single-node failures can be quickly isolated within a distributed cluster framework, system-level failures in batch operations can disrupt regional operations, creating a chain reaction that can have a significant impact on the financial sector. Furthermore, the increasing complexity of application architectures complicates troubleshooting across the transaction chain, hindering rapid business recovery. This means that existing technologies present technical challenges: difficulty in assessing operational risk and low risk assessment efficiency.

[0004] Currently, no effective solution has been proposed to address the difficulties in assessing operational risks and the low efficiency of risk assessment in relevant technologies. Summary of the Invention

[0005] The main purpose of this application is to provide a risk status assessment method to solve the problems of difficulty in assessing operational risks and low risk assessment efficiency in related technologies.

[0006] To achieve the above-mentioned purpose, according to one aspect of the present application, a risk status assessment method is provided. The method includes: determining the execution mode of the target operation; when the execution mode is an imperative execution mode, determining the operation type of the target operation and the operation description information matching the target operation, and determining the risk status of the target operation based on the operation type and the operation description information, wherein the operation description information is used to indicate the execution compliance of the target operation; when the execution mode is a scripted execution mode, determining the audit status of the execution script matching the target operation, and determining the risk status of the target operation based on the audit status and the content information of the execution script, wherein the content information is used to indicate the content security of the execution script; and determining the target risk status of the target operation based on at least one risk status matching the target operation within the target detection period.

[0007] To achieve the above-mentioned purpose, according to another aspect of the present application, a risk status assessment device is provided. The device includes: a first determination unit, which determines the execution mode of the target operation; a second determination unit, which, when the execution mode is an imperative execution mode, determines the operation type of the target operation and the operation description information that matches the target operation, and determines the risk status of the target operation based on the operation type and the operation description information, wherein the operation description information is used to indicate the execution compliance of the target operation; a third determination unit, which, when the execution mode is a scripted execution mode, determines the audit status of the execution script that matches the target operation, and determines the risk status of the target operation based on the audit status and content information of the execution script, wherein the content information is used to indicate the content security of the execution script; and a fourth determination unit, which determines the target risk status of the target operation based on at least one risk status that matches the target operation within a target detection period.

[0008] Optionally, the above-mentioned second determination unit includes: a first matching module, used to determine that the target operation is in a low-risk state when the operation type of the target operation is a query type; when the operation type of the target operation is an adjustment type and the event number indicated by the operation description information matching the target operation is obtained, determine that the target operation is in a first-risk state; when the operation type of the target operation is an adjustment type and the event number indicated by the operation description information matching the target operation is not obtained, determine that the target operation is in a second-risk state, wherein the risk level of the second risk state is greater than that of the first risk state.

[0009] Optionally, the above-mentioned third determination unit includes: a second matching module, used to determine that the target operation is in a low-risk state when the audit status of the execution script matching the target operation is approved and there is no sensitive information in the content information of the execution script; determine that the target operation is in a third-risk state when the audit status of the execution script matching the target operation is unaudited and there is no sensitive information in the content information of the execution script; determine that the target operation is in a fourth-risk state when the audit status of the execution script matching the target operation is unaudited and there is sensitive information in the content information of the execution script, wherein the risk level of the fourth risk state is greater than that of the third risk state.

[0010] Optionally, the above-mentioned first matching module is also used to determine a business execution window that matches the target operation based on the operation type, wherein the business execution window is a safe time period for executing the target operation; when the execution time of the target operation is within the business execution window, the target operation is determined to be in the second low-risk state; when the execution time of the target operation is not within the business execution window, the target operation is determined to be in the second high-risk state.

[0011] Optionally, the above-mentioned fourth determination unit is also used to determine at least one risk score that matches at least one risk state within the target detection cycle, and determine the target risk state that matches the target operation based on the cumulative calculation result of the at least one risk score; determine at least one risk score that matches at least one risk state within the target detection cycle, determine the average risk score that matches the target detection cycle based on the at least one risk score, and determine the target risk state that matches the target operation based on the average risk score.

[0012] Optionally, the above-mentioned fourth determination unit includes a detection module for determining a monitoring window that matches the target operation based on the execution time of the target operation; when a first number of abnormal indicators are detected in the monitoring window and the abnormal indicators have not recovered to normal performance indicators, the application that matches the target operation is determined to be a first risk application, and a risk score of a first value is increased for the target operation; when a second number of abnormal indicators are detected in the monitoring window and a third number of abnormal indicators are recovered to normal performance indicators, the application that matches the target operation is determined to be a second risk application, and a risk score of a second value is increased for the target operation, wherein the risk level of the first risk application is higher than that of the second risk application, the second number is greater than or equal to the third number, and the first value is greater than the second value.

[0013] Optionally, the fourth determination unit includes: a trigger module, configured to determine resource usage based on target performance indicator data; and trigger a risk identification task when the resource usage is greater than a preset threshold.

[0014] In an embodiment of the present application, by determining the execution mode of the target operation, risk assessment can perform more targeted analysis for different execution modes, thereby enhancing the accuracy of the assessment; when the execution mode is an imperative execution mode, the operation type of the target operation and the operation description information matching the target operation are determined, and the risk status of the target operation is determined based on the operation type and the operation description information; when the execution mode is a scripted execution mode, the audit status of the execution script matching the target operation is determined, and the risk status of the target operation is determined based on the audit status and the content information of the execution script; the purpose of determining the target risk status of the target operation based on at least one risk status matching the target operation within the target detection cycle is achieved, thereby achieving the technical effect of performing risk assessment simply and accurately, and thus solving the technical problem of low risk assessment efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0016] Figure 1A hardware structure block diagram of a computer terminal for implementing a risk assessment method is shown;

[0017] Figure 2 is a flow chart of a risk status assessment method provided according to an embodiment of the present application;

[0018] Figure 3 is a logic diagram of a risk status assessment method provided in an embodiment of the present application;

[0019] Figure 4 is a logic diagram of a risk status assessment method provided in an embodiment of the present application;

[0020] Figure 5 is a schematic diagram of a risk status assessment device provided according to an embodiment of the present application;

[0021] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] Example 1

[0025] According to an embodiment of the present application, a method embodiment for assessing risk status is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0026] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a risk status assessment method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (illustrated as 102a, 102b, ..., 102n in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0027] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0028] Memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the risk status assessment method in the embodiments of the present application. Processor 102 executes the software programs and modules stored in memory 104 to perform various functional applications and data processing, thereby implementing the risk status assessment method described above. Memory 104 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, memory 104 may further include memory remotely located relative to processor 102, and such remote memory may be connected to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0029] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0030] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0031] Under the above operating environment, this application provides Figure 2 The risk status shown is assessed using the method. Figure 2 This is a flowchart of the risk status assessment method according to Example 1 of the present application.

[0032] Step S101, determining the execution mode of the target operation;

[0033] Step S102: If the execution mode is the imperative execution mode, determine the operation type of the target operation and the operation description information that matches the target operation, and determine the risk status of the target operation based on the operation type and the operation description information, wherein the operation description information is used to indicate the execution compliance of the target operation;

[0034] Step S103: If the execution mode is script-based, determining the audit status of the execution script that matches the target operation, and determining the risk status of the target operation based on the audit status and content information of the execution script, wherein the content information indicates the content security of the execution script;

[0035] Step S104: determining a target risk state of the target operation according to at least one risk state that matches the target operation within the target detection period.

[0036] As an optional implementation, in step S101 above, the specific execution mode of the target operation is first determined, that is, whether the operation is executed through direct command input or through a script file. For example, the command-based execution mode may be that the operation and maintenance personnel directly enter commands in the Linux command line interface to perform the operation. This method is usually used for single, immediate task execution; the script-based execution mode may be that the operation and maintenance personnel write or use pre-prepared scripts to batch or automatically execute a series of operations. This method is often used for complex operation and maintenance tasks such as system configuration updates and data backups.

[0037] Furthermore, in step S102, when the execution mode is an imperative execution mode, the operation type of the target operation and the operation description information matching the target operation are determined, and the risk status of the target operation is determined based on the operation type and the operation description information, wherein the operation description information is used to indicate the execution compliance of the target operation.

[0038] Optionally, the above operation types include but are not limited to: query operations are used to obtain system status, configuration information or data, etc., which usually have little impact on the system; change operations include modifying system configuration, updating software versions, etc. Such operations may cause significant changes to the system operating environment and have higher potential risks; emergency operations are emergency measures taken in the event of system failure or crisis, such as restarting services, restoring data, etc. Such operations must be performed within specific authorization and time windows to avoid exacerbating the problem.

[0039] The aforementioned operation description information may include, but is not limited to, a description of the target operation's background, purpose, expected and actual results, as well as details on whether it meets company or industry compliance requirements, to assess the compliance and potential risks of the operation. The aforementioned risk status may be specifically expressed in the form of a risk level (low, medium, high) or a risk score, and is not specifically limited here.

[0040] It should be noted that this application can enrich the operation record information based on the login user ID, user organization mapping relationship table, session ID and other information, call the platform's event single interface according to the operation object IP and operation time to obtain the event single number information, and then distinguish pure command operations and script operations from the operation records, distinguish high-risk commands and routine inspection commands for command operations, and count the number of times based on the time dimension; for script operations, the executable program or script can be intelligently extracted according to the suffix name.

[0041] The top 10 high-level commands' operation objects and operation time periods are used to indicate operational risks. The configuration management module interface is called to obtain the application and application level to which the operation object belongs. The operation type is identified as operation or query based on the operation command. The first field of the associated event number is then used to further identify whether the operation type is emergency or change.

[0042] The user information and data involved in this application are fully authorized information and data. Specifically, the user information and data involved in this application (including but not limited to log information data, operation data) are all authorized by the user or fully authorized information and data.

[0043] Optionally, in the above step S103, when the execution mode is a script-based execution mode, the audit status of the execution script matching the target operation is determined, and the risk status of the target operation is determined based on the audit status and the content information of the execution script, wherein the content information is used to indicate the content security of the execution script.

[0044] In an optional implementation, the above-mentioned audit status may be whether the execution script has undergone a formal audit process, including script validity check, security assessment and compliance review; the above-mentioned content information includes but is not limited to the specific commands and logic contained in the execution script, which is used to evaluate the content security of the script, including whether there are high-risk commands, sensitive information leakage (such as plaintext passwords), and deviations from the expected operation objectives.

[0045] As an optional implementation, in the above step S104, the target risk state of the target operation is determined according to at least one risk state that matches the target operation within the target detection period.

[0046] Specifically, the above-mentioned target detection cycle can be a time window set by the operation and maintenance system, which is used to collect and analyze the operation and maintenance operation data and related risk status of a specific operating system or server within the cycle. The cycle length should be adjusted according to specific business needs and system change frequency (such as 5 minutes, 1 hour); the above-mentioned target risk status is the final risk status of the target operation determined by the system through analysis and integration of all risk status within the cycle. For example: if a high-risk status greater than a preset threshold is detected within the cycle, even if some operations are assessed as low risk, the target risk status may also be determined as high risk.

[0047] Through the above implementation, the execution mode of the target operation is determined, so that the risk assessment can perform more targeted analysis for different execution modes, thereby enhancing the accuracy of the assessment; when the execution mode is an imperative execution mode, the operation type of the target operation and the operation description information matching the target operation are determined, and the risk status of the target operation is determined based on the operation type and the operation description information; when the execution mode is a scripted execution mode, the audit status of the execution script matching the target operation is determined, and the risk status of the target operation is determined based on the audit status and the content information of the execution script; the purpose of determining the target risk status of the target operation based on at least one risk status matching the target operation within the target detection cycle is achieved, thereby achieving the technical effect of automatic and accurate risk assessment, and thus solving the technical problem of low risk assessment efficiency.

[0048] Optionally, in the risk assessment method provided in the embodiment of the present application, determining the operation type of the target operation and operation description information matching the target operation, and determining the risk status of the target operation based on the operation type and the operation description information includes:

[0049] S1, when the operation type of the target operation is a query type, determining that the target operation is in a low-risk state;

[0050] S2: if the operation type of the target operation is adjustment and the event ticket number indicated by the operation description information matching the target operation is obtained, determine that the target operation is in the first risk state;

[0051] S3. When the operation type of the target operation is adjustment and the event number indicated by the operation description information matching the target operation is not obtained, determine that the target operation is in a second risk state, wherein the risk level of the second risk state is greater than that of the first risk state.

[0052] In step S1 above, if the target operation is of the query type, the target operation is determined to be in a low-risk state. For example, if the target operation is to view system logs, monitor resource usage, or query a database, it corresponds to a query type operation. This indicates that the target operation poses a low risk to the system when executed and generally does not cause system failures or data security issues. Therefore, query operations are classified as low-risk by default due to their limited impact on the system status.

[0053] Further in the above step S2, when the operation type of the target operation is an adjustment type and the event number indicated by the operation description information matching the target operation is obtained, the target operation is determined to be in the first risk state; the above adjustment type operation involves modifications to the system or data, such as updating the software version, modifying the configuration file, or restarting the service; the above event number can be a unique identifier used in IT operation and maintenance to track and manage important operations or changes. If the event number is matched, it means that the operation has passed the internal approval process and has a certain degree of security.

[0054] As an optional implementation, for example, the operations personnel plan to update the software version on the server during off-peak business hours to fix known security vulnerabilities. First, the operations personnel create a change event ticket in the management platform, detailing the reason for the change, expected results, and operation steps, and recording the relevant operation description information in the event ticket. After obtaining approval and obtaining the event ticket number, the operations personnel perform the update operation. According to step S2, because the operation type is adjustment and there is an event ticket number that matches the operation, the system marks it as the first risk state.

[0055] In the above step S3, when the operation type of the target operation is adjustment type and the event number indicated by the operation description information matching the target operation is not obtained, the target operation is determined to be in the second risk state, wherein the risk level of the second risk state is greater than that of the first risk state.

[0056] As an alternative implementation, the operations personnel performed an untested software package update on the production server without creating an incident ticket. In step S3, because this was an adjustment operation and lacked a supporting incident ticket, the system marked it as a second risk state, a higher risk level than the state in step S2.

[0057] Specifically, query commands / scripts are assessed as risk-free. Operational commands / scripts that cannot be linked to an incident ticket are assessed as medium-to-high risk. If they contain a high-risk command, they are considered high-risk; otherwise, they are considered medium-risk. Operations associated with incident tickets are assessed as medium-to-low risk. If they contain a high-risk command, they are considered medium-risk; otherwise, they are considered low-risk.

[0058] Through these technical features, the system intelligently schedules resources based on the classification of operation types, ensuring that monitoring is focused on operations that may impact system stability, rather than treating all operations equally. This optimizes overall resource utilization. Furthermore, by associating operation types with event ticket numbers as a basis for risk assessment, the system intelligently distinguishes between planned and unplanned operations, balancing operational flexibility with risk control.

[0059] Optionally, in the risk assessment method provided in the embodiment of the present application, determining the audit status of the execution script matching the target operation, and determining the risk status of the target operation based on the audit status and content information of the execution script, includes:

[0060] S1: If the audit status of the execution script matching the target operation is approved and there is no sensitive information in the content of the execution script, the target operation is determined to be in a low-risk state;

[0061] S2: If the audit status of the execution script matching the target operation is unaudited and the content of the execution script does not contain sensitive information, determine that the target operation is in a third risk state;

[0062] S3: When the audit status of the execution script matching the target operation is unaudited and there is sensitive information in the content information of the execution script, the target operation is determined to be in a fourth risk state, wherein the risk level of the fourth risk state is greater than that of the third risk state.

[0063] In the above step S1, if the audit status of the execution script matching the target operation is approved and there is no sensitive information in the content information of the execution script, the target operation is determined to be in a low-risk state;

[0064] Optionally, the execution script can be a file consisting of a series of predefined commands and logic, used for automated operation and maintenance operations, such as system configuration updates, data backups, service restarts, etc. The audit status includes: approved: the script has passed the formal audit process and is considered safe, compliant, and functionally correct; unaudited: the script has not undergone a formal audit process and may contain untested commands or logic, posing unknown risks. The content information refers to the specific commands and logic in the execution script, as well as any sensitive information that may be contained, such as passwords, private keys, high-risk commands, etc.; the sensitive information in the script may refer to any information that may pose a threat to system security, including but not limited to plaintext passwords, encrypted private keys, high-risk commands, etc. Improper use or leakage of this information may result in data corruption, system crashes, or unauthorized access.

[0065] As an optional implementation, when a script passes review and contains no sensitive information, the target operation is deemed to have minimal impact on the system and is considered low risk. This approach ensures that the script has not only undergone a formal review process but also contains no sensitive information. This dual guarantee reduces the compliance and security risks introduced by the operation, allowing the system to trust the execution of such scripts and assign them a "low risk" status.

[0066] In the above step S2, if the audit status of the execution script matching the target operation is unaudited and there is no sensitive information in the content information of the execution script, the target operation is determined to be in the third risk state;

[0067] As an optional implementation, if the operation and maintenance personnel use an unaudited script to upgrade the system and no sensitive information is found when analyzing the script content, the target operation is further marked as a "third risk state".

[0068] In the above step S3, when the audit status of the execution script matching the target operation is unaudited and there is sensitive information in the content information of the execution script, the target operation is determined to be in the fourth risk state, wherein the risk level of the fourth risk state is greater than that of the third risk state.

[0069] As an optional implementation, when executing a data query script, the system detects that the script contains plaintext password access to the production database, and further marks the target operation as the "fourth risk state", that is, a risk state with a higher risk level than the situation in step S3.

[0070] Specifically, scripts in unmanaged script repositories or the latest versions of non-script repositories are assessed as medium-to-high risk. If the script content contains plaintext passwords or high-risk commands, it is identified as a high-risk script; otherwise, it is identified as medium-risk. Operational scripts that have been approved and released by the script repository are assessed as low risk, and query scripts are assessed as no risk. Through the above implementation, a hierarchical risk assessment mechanism based on script review status and content security reduces the difficulty of assessing operational risks and improves the efficiency of risk assessment.

[0071] Optionally, in the risk assessment method provided in an embodiment of the present application, when the operation type of the target operation is adjustment and the event ticket number indicated by the operation description information matching the target operation is not obtained, determining that the target operation is in the second risk state further includes:

[0072] S1, determining a service execution window that matches the target operation according to the operation type, wherein the service execution window is a safe time period for executing the target operation;

[0073] S2, when the execution time of the target operation is within the business execution window, determining that the target operation is in the second lowest risk state;

[0074] S3: If the execution time of the target operation is not within the business execution window, the target operation is determined to be in the second highest risk state.

[0075] Optionally, query operations correspond to query windows and can be executed all day long, emergency operations correspond to emergency windows and can be safely executed, and change operations correspond to change windows, which are low-peak business hours.

[0076] The following is a complete implementation to illustrate the above process: Assume that an operations and maintenance personnel in a bank data center plans to perform a software package update operation on a production server, but forgets to submit an incident ticket for formal approval.

[0077] Determining the target operation's operation type and incident ticket status: The operations personnel logged into the target server and attempted to update the software package. The system immediately identified this as an adjustment operation, but because no incident ticket matching the operation description was found, the target operation entered the initial assessment phase of the "Second Risk Status."

[0078] Determine the business execution window that matches the target operation: The system automatically identifies the business execution window based on the type of software package update operation. For example, it can be set to 11:00 PM to 3:00 AM every night. During this period, the business load is the lowest, making it suitable for operations that may have a significant impact on the system.

[0079] Assess the impact of operation time on risk status: If the operation time is within the business execution window: Assume that the operation and maintenance personnel plan to perform a software package update at 23:30 in the evening, that is, during the business execution window, the system will determine the final risk status of the target operation as "the second lowest risk status", confirming that the target operation is relatively safe to perform during the business off-peak period.

[0080] The operation time is outside the business execution window: If the operation and maintenance personnel try to perform the same software package update operation at 10:00 am, which is during the business peak and outside the safe business execution window, the system will immediately mark it as "the second highest risk status" and prompt them to wait for a suitable time window or reissue an incident ticket and obtain approval before continuing the operation.

[0081] Through the above implementation method, by defining and monitoring the business execution window, refined management of operation time is achieved, the accuracy and efficiency of risk assessment are improved, the compliance and security of operations are strengthened, and the negative impact that may be caused by performing high-risk operations during business peak periods is avoided. It also optimizes resource allocation, reduces the false alarm rate, and improves the work efficiency of operation and maintenance personnel.

[0082] Optionally, in the risk assessment method provided in the embodiment of the present application, determining the target risk state of the target operation based on at least one risk state that matches the target operation within the target detection period includes at least one of the following:

[0083] Method 1: Determine at least one risk score that matches at least one risk state within a target detection period, and determine a target risk state that matches the target operation based on an accumulated calculation result of the at least one risk score;

[0084] As an optional implementation, for example, the target detection cycle is one week. During the week, the system continuously monitors various indicators related to software upgrade operations: upgrade operations performed outside the specified time window are marked as high-risk, with a risk score of 4; unaudited scripts used during the upgrade process are marked as medium-risk, with a risk score of 2; and the version update of the software itself is considered to be low-risk, with a risk score of 1.

[0085] Assuming that 3 high-risk events, 10 medium-risk events, and 100 low-risk events are monitored within a week, the cumulative risk score is (3*4+10*2+100*1=132). If it exceeds the set high-risk threshold, the operation is determined to be in a high-risk state.

[0086] Method 2: Determine at least one risk score that matches at least one risk state within a target detection period, determine an average risk score that matches the target detection period based on the at least one risk score, and determine a target risk state that matches the target operation based on the average risk score.

[0087] As another optional implementation, assuming that a total of 113 risk events are monitored within a week, according to the above risk score allocation, the total risk score is 132, then the average risk score is approximately 1.16. If the average risk score does not reach the preset high-risk threshold, the target risk status of the software upgrade operation is determined to be "medium risk", that is, from an overall perspective, the operation is still within a relatively controllable risk range.

[0088] Optionally, in the risk assessment method provided in the embodiment of the present application, before determining the target risk state of the target operation based on at least one risk state that matches the target operation within the target detection period, the method further includes:

[0089] S1, determine the monitoring window that matches the target operation based on the execution time of the target operation;

[0090] S2: if a first number of abnormal indicators are detected within the monitoring window and none of the abnormal indicators have recovered to normal performance indicators, determine that the application matching the target operation is a first risk application, and increase a risk score of the target operation by a first value;

[0091] S3, when it is detected that a second number of abnormal indicators exist in the monitoring window and the third number of abnormal indicators returns to normal performance indicators, the application matching the target operation is determined to be a second risk application, and a second value of risk score is added to the target operation, wherein the risk level of the first risk application is higher than that of the second risk application, the second number is greater than or equal to the third number, and the first value is greater than the second value.

[0092] In the above step S1, the above execution time is the execution time when the target operation actually starts; the above monitoring window may cover a period of time from before the operation starts to after the operation ends;

[0093] In the above step S2, when a first number of abnormal indicators are detected in the monitoring window and none of the abnormal indicators have recovered to normal performance indicators, the application matching the target operation is determined to be a first risk application, and a risk score of a first value is added to the target operation.

[0094] Alternatively, for example, if CPU usage exceeds 90% (one abnormal indicator) and I / O response time increases significantly (another abnormal indicator) continuously within a monitoring window, and neither abnormal indicator returns to normal levels after the monitoring window ends, the trading system associated with the update operation is marked as a first-risk application, and a first-value risk score is added to the risk status of the target operation.

[0095] In the above step S3, when a second number of abnormal indicators are detected in the monitoring window and the third number of abnormal indicators are restored to normal performance indicators, the application matching the target operation is determined to be a second risk application, and a second value of risk score is added to the target operation, wherein the risk level of the first risk application is higher than that of the second risk application, the second number is greater than or equal to the third number, and the first value is greater than the second value.

[0096] Optionally, for example, within the monitoring window, another department's mail service system also has a short period of high memory usage (one of the abnormal indicators), but due to the non-core nature of the mail service and the system's own elasticity, this abnormal indicator returns to normal before the end of the monitoring window. Therefore, the mail service system is regarded as a second risk application, and a lower second value risk score is added to the risk status of the target operation.

[0097] Specifically, for an operation and maintenance operation object with abnormal performance capacity and multiple indicators such as monitoring alarm indicators that have not returned to normal, the object is evaluated as a high-risk application, and the operation and maintenance operations related to the object within the monitoring window are evaluated as high-risk operations; for an operation and maintenance operation object with abnormal performance capacity or monitoring alarm indicators where a single indicator has not returned to normal, the object is evaluated as a medium-risk application, and the operation and maintenance operations related to the object within the monitoring window are evaluated as medium-risk operations; for an operation and maintenance operation object with abnormal performance capacity or monitoring alarm indicators that have abnormal fluctuations but automatically recover within the window, the object is evaluated as a low-risk application, and the operation and maintenance operations related to the object within the monitoring window are evaluated as low-risk operations; for an operation and maintenance operation object without abnormal performance capacity or monitoring alarms, the object is evaluated as a risk-free application.

[0098] Through the above-mentioned technical features recorded in this application, the risk level may change over time according to the actual operating conditions and business needs of the application. The risk status of the target operation is dynamically determined by the risk level of the application, thereby improving the accuracy and efficiency of risk assessment.

[0099] Optionally, in the risk assessment method provided in the embodiment of the present application, before determining the execution mode of the target operation, the method further includes:

[0100] S1, determining resource usage based on target performance indicator data;

[0101] S2, when the resource usage exceeds the preset threshold, a risk identification task is triggered.

[0102] Optionally, the above-mentioned target performance indicator data includes but is not limited to CPU usage, memory usage, disk I / O, network bandwidth usage, etc. The above-mentioned resource usage reflects the resource consumption status of the system at a specific time point or time period, including but not limited to statistical average, maximum value or real-time reading and other methods.

[0103] As an optional implementation method, the above process S1-S2 is explained, and the average CPU usage in the last 5 minutes is calculated to determine the current resource usage; if the current resource usage exceeds the preset threshold, the risk identification task is triggered.

[0104] The following logic diagram Figure 3 Description of this application:

[0105] Figure 3 This paper describes a Linux operation risk identification system based on operation and maintenance data. The system is mainly divided into five modules: data collection, data processing, risk identification, risk assessment and risk prevention. It aims to discover and evaluate potential risks in Linux operations through multi-dimensional analysis to ensure business continuity and system stability.

[0106] Data Collection Module: This module collects various log information, performance data, monitoring alarms, and event ticket information related to the technology management platform from the Linux operating system. This data can be automatically collected from Linux servers, monitoring platforms, and management platforms, providing the raw data source for subsequent analysis.

[0107] Data processing module: Receives information from the data acquisition module, and cleans, parses, and pre-processes it. For example, the information in the operation log is mapped to specific users and events, and command operations and script operations are distinguished to prepare more structured and analysis-friendly data for risk identification. Specifically, the operation record information can be enriched based on information such as the login user ID, user organization mapping relationship table, and session ID. The event single interface of the technology management work platform is called according to the operation object IP and operation time to obtain the event number information. Pure command operations and script operations are distinguished from the operation records. For command operations, high-risk commands and routine inspection commands are distinguished, and the number of times is counted according to the time dimension; for script operations, the executable program or script is intelligently extracted according to the suffix name.

[0108] Risk Identification Module: Utilizes processed data to intelligently identify risk points in operations and maintenance. This includes, but is not limited to, the use of high-risk commands, the execution of unapproved scripts, abnormal performance and capacity indicators, and frequent monitoring alarms. The module analyzes the operation type, time window, and associated incident ticket number to determine compliance and risk.

[0109] Specifically, it can prompt operational risks based on the operation objects and operation time periods of the top 10 high-level commands, call the module interface of the configuration management system to obtain the application and application level to which the operation object belongs, identify the operation type as operation class or query class based on the operation command; and call the script library to determine whether the execution script of the target operation is an approved script.

[0110] Risk Assessment: Based on risk identification results, the module quantitatively assesses the risk level of each operation and maintenance operation. The assessment logic comprehensively considers the operation type, risk status, and business impact. Based on the assessment results, the operation is labeled as no risk, low risk, medium risk, or high risk.

[0111] Specifically, the fields at the beginning of the associated event number are combined to further identify whether it is an emergency or change type. If there is no associated event number, the time window of different operation types is used to identify whether the application has risky operations outside the specified time period. At the same time, for script-type operations, the file name is parsed to identify whether it is an operation type or a query type, and the managed scripts in the script management library are synchronously associated to perform an md5 check to identify whether it is an unreviewed and released risk script. For unreviewed scripts, the script content is also obtained to detect whether it contains plaintext passwords or high-risk commands to further identify whether it is a high-risk script.

[0112] Risk Prevention Module: Based on the output of the risk assessment, appropriate risk prevention measures are taken. This can include automatically suppressing alarm storms, optimizing high-risk scripts, adjusting operation time windows, or reminding operations personnel to pay attention to the compliance and security of specific operations, thereby reducing potential risks.

[0113] In terms of performance and capacity, system performance data such as CPU, memory, swap space, and disk IO on Linux servers is regularly collected and incorporated into a time series database. Within the time series database, the mean and peak values ​​of each performance and capacity indicator are dynamically calculated within a rolling window according to the time dimension. Through interface calls, resource usage of the server within the statistical window can be dynamically and in real time queried. If the mean or peak value of server resource usage exceeds the indicator threshold, resource consumption risk identification is triggered. The server regularly collects monitoring indicator script results, compares them against the monitoring threshold, and generates alarms that are sent to the centralized monitoring platform. Centralized monitoring alarms are categorized and counted based on the monitoring indicators, and the top 10 monitoring indicator types and server IP information with the highest number of alarms are counted.

[0114] The performance monitoring and collection function logic diagram is as follows: Figure 4 As shown, the operation and maintenance operation data collection terminal collects operation and maintenance operation data, which is then sent to the "data lake." Operation and maintenance operation feature extraction and analysis includes parsing operation commands, identifying operation types (such as query, change, and emergency response), counting operation frequencies, and associating operations with event numbers. Feature extraction and analysis is the basis for identifying operation and maintenance operation risks. Through such analysis, the connection between operation behaviors and potential risks can be established.

[0115] The performance and capacity data collection terminal collects performance indicator data and then performs performance and capacity time series data analysis. The data is dynamically analyzed according to time windows. Performance and capacity indicator warnings are based on the results of time series data analysis. When it is detected that the performance indicator exceeds the preset threshold or shows an abnormal growth trend, the system will trigger a performance and capacity indicator warning.

[0116] The centralized monitoring alarm platform can receive alarm information from the server, including performance alarms, system event alarms, security alarms, etc. The alarm information usually includes the description of the problem, severity level and occurrence time. Alarm aggregation classification, such as by alarm type, application, server IP and other dimensions, is counted and abnormal alarm reminders are issued.

[0117] It is understandable that in order to address the risk of indicator alarm storms, the alarm volume of each monitoring indicator is scanned periodically within a controllable threshold, and abnormal growth trends are discovered through curve fitting estimation. An indicator alarm storm alarm and email notification are aggregated to promptly remind operation and maintenance personnel to clean up historical alarms or temporarily close related indicators to solve the storm problem as an emergency measure.

[0118] For risky O&M targets with frequent alarms and a large number of alarm servers, we implement an alarm suppression strategy to accurately and effectively indicate the risk of a storm. We also deploy corresponding diagnostic checks and emergency response scripts, suppressing the alarm storm while triggering detection to fully and accurately determine the scope of anomalies and identify the impact. Detecting diagnostic keywords triggers an emergency response to promptly and effectively address the alarm.

[0119] For script-related risks, unmanaged scripts in production operations are discovered in a timely manner, and operation and maintenance personnel are reminded to manage and approve them. For inconsistent script versions, batch updates are performed on a daily basis or scripts are automatically updated as tasks are scheduled to ensure that production scripts are up to date. For performance or monitoring anomaly risks brought about by script execution, attention is paid to information such as abnormal output and execution time of script execution, and keywords such as abnormal errors or timeouts are captured to promptly remind script authors and operators to optimize script logic.

[0120] For command-related risks, high-frequency, medium- and high-risk operation commands are prompted to operations and maintenance personnel, refined into automated scripts, and recommended that these operations be scenario-based, solidifying scenario-driven program behavior to reduce the risk of human operation. For query-related risks, query items are refined into menus, creating menu-based query functionality, reducing the probability of system performance anomalies or large-scale failures caused by batch query operations.

[0121] The risk status assessment method provided in the embodiment of the present application determines the execution mode of the target operation, so that the risk assessment can perform more targeted analysis for different execution modes, thereby enhancing the accuracy of the assessment; when the execution mode is an imperative execution mode, the operation type of the target operation and the operation description information matching the target operation are determined, and the risk status of the target operation is determined based on the operation type and the operation description information; when the execution mode is a scripted execution mode, the audit status of the execution script matching the target operation is determined, and the risk status of the target operation is determined based on the audit status and the content information of the execution script; the purpose of determining the target risk status of the target operation based on at least one risk status matching the target operation within the target detection cycle is achieved, thereby achieving the technical effect of automatic and accurate risk assessment, and thus solving the technical problem of low risk assessment efficiency.

[0122] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0123] Example 2

[0124] The present application also provides a risk status assessment device. It should be noted that the risk status assessment device of the present application can be used to execute the risk status assessment method provided in the present application. The following describes the risk status assessment device provided in the present application.

[0125] According to an embodiment of the present application, a device for implementing the above-mentioned risk status assessment method is also provided, such as Figure 5 As shown, the apparatus includes: a first determining unit 502, which determines an execution mode of a target operation;

[0126] The second determining unit 504 determines, when the execution mode is the imperative execution mode, an operation type of the target operation and operation description information matching the target operation, and determines a risk status of the target operation based on the operation type and the operation description information, wherein the operation description information is used to indicate the execution compliance of the target operation;

[0127] The third determining unit 506 determines the audit status of the execution script matching the target operation when the execution mode is the script-based execution mode, and determines the risk status of the target operation based on the audit status and content information of the execution script, wherein the content information indicates the content security of the execution script;

[0128] The fourth determining unit 508 determines a target risk state of the target operation according to at least one risk state that matches the target operation within the target detection period.

[0129] The risk status assessment device provided in the embodiment of the present application determines the execution mode of the target operation, so that the risk assessment can perform more targeted analysis for different execution modes, thereby enhancing the accuracy of the assessment; when the execution mode is an imperative execution mode, the operation type of the target operation and the operation description information matching the target operation are determined, and the risk status of the target operation is determined based on the operation type and the operation description information; when the execution mode is a scripted execution mode, the audit status of the execution script matching the target operation is determined, and the risk status of the target operation is determined based on the audit status and the content information of the execution script; the purpose of determining the target risk status of the target operation based on at least one risk status matching the target operation within the target detection cycle is achieved, thereby realizing the technical effect of automatic and accurate risk assessment, and thus solving the technical problem of low risk assessment efficiency.

[0130] Optionally, in the risk status assessment device provided in an embodiment of the present application, the above-mentioned second determination unit includes: a first matching module, used to determine that the target operation is in a low-risk state when the operation type of the target operation is a query type; when the operation type of the target operation is an adjustment type and the event number indicated by the operation description information matching the target operation is obtained, determine that the target operation is in a first risk state; when the operation type of the target operation is an adjustment type and the event number indicated by the operation description information matching the target operation is not obtained, determine that the target operation is in a second risk state, wherein the risk level of the second risk state is greater than that of the first risk state.

[0131] Optionally, the above-mentioned third determination unit includes: a second matching module, used to determine that the target operation is in a low-risk state when the audit status of the execution script matching the target operation is approved and there is no sensitive information in the content information of the execution script; determine that the target operation is in a third-risk state when the audit status of the execution script matching the target operation is unaudited and there is no sensitive information in the content information of the execution script; determine that the target operation is in a fourth-risk state when the audit status of the execution script matching the target operation is unaudited and there is sensitive information in the content information of the execution script, wherein the risk level of the fourth risk state is greater than that of the third risk state.

[0132] Optionally, the above-mentioned first matching module is also used to determine a business execution window that matches the target operation based on the operation type, wherein the business execution window is a safe time period for executing the target operation; when the execution time of the target operation is within the business execution window, the target operation is determined to be in the second low-risk state; when the execution time of the target operation is not within the business execution window, the target operation is determined to be in the second high-risk state.

[0133] Optionally, the above-mentioned fourth determination unit is also used to determine at least one risk score that matches at least one risk state within the target detection cycle, and determine the target risk state that matches the target operation based on the cumulative calculation result of the at least one risk score; determine at least one risk score that matches at least one risk state within the target detection cycle, determine the average risk score that matches the target detection cycle based on the at least one risk score, and determine the target risk state that matches the target operation based on the average risk score.

[0134] Optionally, the above-mentioned fourth determination unit includes a detection module for determining a monitoring window that matches the target operation based on the execution time of the target operation; when a first number of abnormal indicators are detected in the monitoring window and the abnormal indicators have not recovered to normal performance indicators, the application that matches the target operation is determined to be a first risk application, and a risk score of a first value is increased for the target operation; when a second number of abnormal indicators are detected in the monitoring window and a third number of abnormal indicators are recovered to normal performance indicators, the application that matches the target operation is determined to be a second risk application, and a risk score of a second value is increased for the target operation, wherein the risk level of the first risk application is higher than that of the second risk application, the second number is greater than or equal to the third number, and the first value is greater than the second value.

[0135] Optionally, the fourth determination unit includes: a trigger module, configured to determine resource usage based on target performance indicator data; and trigger a risk identification task when the resource usage is greater than a preset threshold.

[0136] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiment 1. It should be noted that the above modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be run as part of the device in the computer terminal 10 provided in the first embodiment.

[0137] Example 3

[0138] An embodiment of the present application may provide an electronic device, Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 Only one is shown) processor 602, memory 604, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0139] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, implementing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0140] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine the execution mode of the target operation; when the execution mode is an imperative execution mode, determine the operation type of the target operation and the operation description information matching the target operation, and determine the risk status of the target operation based on the operation type and the operation description information, wherein the operation description information is used to indicate the execution compliance of the target operation; when the execution mode is a scripted execution mode, determine the audit status of the execution script matching the target operation, and determine the risk status of the target operation based on the audit status and the content information of the execution script, wherein the content information is used to indicate the content security of the execution script; determine the target risk status of the target operation based on at least one risk status matching the target operation within the target detection cycle.

[0141] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the operation type of the target operation is a query type, determine that the target operation is in a low-risk state; when the operation type of the target operation is an adjustment type, and the event number indicated by the operation description information matching the target operation is obtained, determine that the target operation is in a first-risk state; when the operation type of the target operation is an adjustment type, and the event number indicated by the operation description information matching the target operation is not obtained, determine that the target operation is in a second-risk state, wherein the risk level of the second risk state is greater than that of the first risk state.

[0142] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the audit status of the execution script matching the target operation is audit passed and there is no sensitive information in the content information of the execution script, the target operation is determined to be in a low-risk state; when the audit status of the execution script matching the target operation is unaudited and there is no sensitive information in the content information of the execution script, the target operation is determined to be in a third risk state; when the audit status of the execution script matching the target operation is unaudited and there is sensitive information in the content information of the execution script, the target operation is determined to be in a fourth risk state, wherein the risk level of the fourth risk state is greater than that of the third risk state.

[0143] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine the business execution window that matches the target operation based on the operation type, wherein the business execution window is a safe time period for executing the target operation; when the execution time of the target operation is within the business execution window, determine the target operation to be in the second lowest risk state; when the execution time of the target operation is not within the business execution window, determine the target operation to be in the second highest risk state.

[0144] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determining at least one risk score that matches at least one risk state within the target detection cycle, and determining the target risk state that matches the target operation based on the cumulative calculation result of the at least one risk score; determining at least one risk score that matches at least one risk state within the target detection cycle, determining the average risk score that matches the target detection cycle based on the at least one risk score, and determining the target risk state that matches the target operation based on the average risk score.

[0145] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine a monitoring window that matches the target operation based on the execution time of the target operation; when a first number of abnormal indicators are detected in the monitoring window and the abnormal indicators have not recovered to normal performance indicators, determine that the application that matches the target operation is a first risk application, and increase the risk score of the target operation by a first value; when a second number of abnormal indicators are detected in the monitoring window and a third number of abnormal indicators are recovered to normal performance indicators, determine that the application that matches the target operation is a second risk application, and increase the risk score of the target operation by a second value, wherein the risk level of the first risk application is higher than that of the second risk application, the second number is greater than or equal to the third number, and the first value is greater than the second value.

[0146] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine the resource usage based on the target performance indicator data; and trigger the risk identification task when the resource usage is greater than a preset threshold.

[0147] By adopting the embodiments of the present application, by determining the execution mode of the target operation, risk assessment can perform more targeted analysis for different execution modes, thereby enhancing the accuracy of the assessment; when the execution mode is an imperative execution mode, the operation type of the target operation and the operation description information matching the target operation are determined, and the risk status of the target operation is determined based on the operation type and the operation description information; when the execution mode is a scripted execution mode, the audit status of the execution script matching the target operation is determined, and the risk status of the target operation is determined based on the audit status and the content information of the execution script; the purpose of determining the target risk status of the target operation based on at least one risk status matching the target operation within the target detection cycle is achieved, thereby achieving the technical effect of automatic and accurate risk assessment, and thus solving the technical problem of low risk assessment efficiency.

[0148] It can be understood by those skilled in the art that Figure 6 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, or other terminal devices. Figure 6 It does not limit the structure of the above electronic device. For example, the electronic device may also include Figure 6 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 6 Different configurations shown.

[0149] A person skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0150] Example 4

[0151] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the risk status assessment method provided in the first embodiment.

[0152] Optionally, in this embodiment, the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0153] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the method for assessing a risk status.

[0154] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0155] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0156] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0157] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0158] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0159] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0160] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for assessing risk status, characterized in that: include: Determine the execution mode of the target operation; When the execution mode is the imperative execution mode, determining an operation type of the target operation and operation description information matching the target operation, and determining a risk status of the target operation according to the operation type and the operation description information, wherein the operation description information is used to indicate execution compliance of the target operation; When the execution mode is a scripted execution mode, determining an audit status of an execution script that matches the target operation, and determining the risk status of the target operation based on the audit status and content information of the execution script, wherein the content information is used to indicate content security of the execution script; A target risk state of the target operation is determined according to at least one risk state that matches the target operation within a target detection period.

2. The method according to claim 1, characterized in that The determining the operation type of the target operation and operation description information matching the target operation, and determining the risk status of the target operation according to the operation type and the operation description information includes: When the operation type of the target operation is a query type, determining that the target operation is in a low-risk state; When the operation type of the target operation is adjustment and an event ticket number indicated by the operation description information matching the target operation is obtained, determining that the target operation is in a first risk state; When the operation type of the target operation is the adjustment type and the event number indicated by the operation description information matching the target operation is not obtained, the target operation is determined to be in a second risk state, wherein the risk level of the second risk state is greater than that of the first risk state.

3. The method according to claim 1, characterized in that The determining of the audit status of the execution script matching the target operation, and determining the risk status of the target operation according to the audit status and content information of the execution script, includes: When the audit status of the execution script matching the target operation is approved and no sensitive information is included in the content information of the execution script, determining that the target operation is in a low-risk state; When the audit status of the execution script matching the target operation is an unaudited state and the sensitive information does not exist in the content information of the execution script, determining that the target operation is in a third risk state; When the audit status of the execution script matching the target operation is the unaudited status and the sensitive information exists in the content information of the execution script, the target operation is determined to be in a fourth risk state, wherein the risk level of the fourth risk state is greater than that of the third risk state.

4. The method according to claim 2, characterized in that When the operation type of the target operation is the adjustment type and the event ticket number indicated by the operation description information matching the target operation is not obtained, determining that the target operation is in the second risk state further includes: Determining a service execution window that matches the target operation according to the operation type, wherein the service execution window is a safe time period for executing the target operation; When the execution time of the target operation is within the service execution window, determining that the target operation is in a second low-risk state; When the execution time of the target operation is not within the service execution window, the target operation is determined to be in a second high-risk state.

5. The method according to claim 1, wherein Determining the target risk state of the target operation according to at least one risk state that matches the target operation within a target detection period includes at least one of the following: Determining at least one risk score that matches at least one of the risk states within the target detection period, and determining the target risk state that matches the target operation based on an accumulated calculation result of the at least one risk score; Determine at least one risk score that matches at least one risk state within the target detection period, determine an average risk score that matches the target detection period based on the at least one risk score, and determine the target risk state that matches the target operation based on the average risk score.

6. The method according to claim 1, wherein Before determining the target risk state of the target operation based on at least one risk state matching the target operation within the target detection period, the method further includes: Determining a monitoring window that matches the target operation according to the execution time of the target operation; When a first number of abnormal indicators are detected within the monitoring window and none of the abnormal indicators have recovered to normal performance indicators, determining that an application matching the target operation is a first risk application, and increasing a risk score of a first value for the target operation; When it is detected that a second number of abnormal indicators exist in the monitoring window and the third number of abnormal indicators recovers to the normal performance indicators, the application matching the target operation is determined to be a second risk application, and the risk score of the target operation is increased by a second value, wherein the risk level of the first risk application is higher than that of the second risk application, the second number is greater than or equal to the third number, and the first value is greater than the second value.

7. The method according to claim 1, characterized in that Before determining the execution mode of the target operation, the method further includes: Determine resource usage based on target performance indicator data; When the resource usage is greater than a preset threshold, a risk identification task is triggered.

8. A risk status assessment device, characterized in that: include: a first determining unit, determining an execution mode of a target operation; a second determining unit, when the execution mode is the imperative execution mode, determining an operation type of the target operation and operation description information matching the target operation, and determining a risk status of the target operation based on the operation type and the operation description information, wherein the operation description information is used to indicate execution compliance of the target operation; a third determining unit, which, when the execution mode is the scripted execution mode, determines an audit status of an execution script that matches the target operation, and determines the risk status of the target operation based on the audit status and content information of the execution script, wherein the content information is used to indicate content security of the execution script; A fourth determining unit determines a target risk state of the target operation according to at least one risk state that matches the target operation within a target detection period.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: a memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 7 when running.

11. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images