Security platform upgrading optimization method and system based on software architecture

Abstract

The invention relates to a security platform upgrading optimization method and system based on a software architecture. The method comprises the steps that after current operation state data of system components are obtained, deep mining and feature classification are conducted through a data analysis algorithm, and a target component list needing to be upgraded is accurately recognized; based on the version information, the function features and the dependency graph in the list, intelligently matching an optimal upgrade resource package combination from a preset upgrade resource library; then, according to the optimal upgrading resource bundle combination, updating the target component by adopting an incremental updating technology in combination with a difference comparison algorithm, and generating component state data containing digital fingerprints; and finally, comparing the digital fingerprint of the component state data with an expected version fingerprint through Hash check, and generating an adaptive upgrade data packet through conflict detection and version compatibility processing. By adopting the method, efficient, accurate and stable upgrading of the security platform can be realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of computer software, and particularly relates to a security platform upgrade optimization method and system based on a software architecture. BACKGROUND

[0002] With the improvement of the complexity of the software architecture, the security platform needs to cope with upgrade requirements such as component iteration, function expansion and security reinforcement during the running process. At present, the security platform upgrade mainly depends on manual screening of upgrade components, and the current running state data of the system components are insufficiently mined, so it is difficult to accurately locate the target components that need to be upgraded. In the upgrade resource matching stage, there is a lack of system integration analysis of the component version information, function characteristics and dependency graph, which leads to poor adaptability of the resource package. When the upgrade is executed, the full update mode is inefficient, and there is a lack of accurate update mechanism based on the incremental update technology and the difference comparison algorithm. At the same time, the consistency check and conflict processing capability of the component state data during the upgrade process is insufficient, and system stability problems are easily caused by version incompatibility. These problems make the security platform upgrade cycle long and costly, and it is difficult to meet the efficient and safe upgrade requirements. SUMMARY

[0003] Therefore, it is necessary to provide a security platform upgrade optimization method and system based on a software architecture, which can realize efficient, accurate and stable upgrade of the security platform.

[0004] In a first aspect, the application provides a security platform upgrade optimization method based on a software architecture, which comprises the following steps.

[0005] The current running state data of the system components are obtained, and the data analysis algorithm is used for deep mining and feature classification to obtain a list of target components that need to be upgraded.

[0006] Based on the version information, function characteristics and dependency graph of the list of target components, the optimal upgrade resource package combination is intelligently matched from a preset upgrade resource library.

[0007] The incremental update technology combined with the difference comparison algorithm is used to execute the update of the target components according to the optimal upgrade resource package combination, and the component state data containing the digital fingerprint is generated.

[0008] The digital fingerprint of the component state data is compared with the expected version fingerprint through the hash check, and the adaptive upgrade data package is generated through the conflict detection and version compatibility processing.

[0009] In one of the embodiments, the data analysis algorithm is used for deep mining and feature classification to obtain the list of target components that need to be upgraded, which comprises the following steps.

[0010] The current running state data is preprocessed to remove noise and redundant information to obtain a standardized state data set. The current running state data includes performance indicators and fault records of the components.

[0011] Based on the state data set, key indicator features and event features are extracted, and a feature fusion algorithm is used to integrate and form a running feature set of the components.

[0012] Based on the running feature set, a clustering algorithm is used for classification to determine an abnormal component list.

[0013] The abnormal component list is compared with the historical performance benchmark to calculate the performance degradation rate, and components with performance degradation exceeding a preset threshold are marked to obtain an upgrade target.

[0014] A multi-dimensional evaluation model is constructed to analyze the running feature data of the upgrade target, calculate a comprehensive score, and generate an upgrade priority ranking.

[0015] Based on the upgrade priority ranking, a target component list is obtained, which includes component identifiers, current version information, performance degradation parameters, associated dependent components, and estimated upgrade duration.

[0016] In one embodiment, the comprehensive score is calculated by the following formula:

[0017]

[0018] where S represents the comprehensive score, ω i represents the dynamic weight of the i-th evaluation dimension, which is calculated by the improved entropy weight method, x' i represents the standardized feature value of the i-th dimension, and a represents the actual performance degradation rate of the component, β represents the preset performance degradation threshold, and γ represents the business topology importance.

[0019] In one embodiment, based on the version information, functional features, and dependency graph of the target component list, the optimal upgrade resource package combination is intelligently matched from a preset upgrade resource library, including:

[0020] Based on the target component list, real-time version information is obtained, component configuration files are parsed to extract functional feature parameters, and interaction interfaces and data flow conversion links between components are scanned to generate a dependency graph. Real-time version information is used to determine the current state of the component.

[0021] Based on the real-time version information and functional feature parameters, a compatibility constraint matrix between components is constructed, and compatibility matching results are obtained by calculating similarity and rule matching.

[0022] Based on the dependency graph, a graph traversal algorithm is used to extract the dependency hierarchy between components to determine the upgrade priority order.

[0023] If the compatibility matching result meets the preset threshold, all candidate resource package combinations that meet the component function requirement and version adaptation condition are filtered from the preset upgrade resource based on the target component list.

[0024] A multi-objective optimization model is constructed by combining the candidate resource package combination with the upgrade priority order, and a machine learning algorithm is used for optimization matching to obtain an optimal upgrade resource package combination; the multi-objective optimization model takes the upgrade priority satisfaction degree, the component compatibility improvement value, and the resource package adaptation efficiency as core optimization targets, and balances the constraint relationship between the targets through weight distribution.

[0025] In one embodiment, the similarity is calculated using the following formula:

[0026]

[0027] where Compatibility(C i , C j ) represents the component compatibility similarity, VerDiff(v i , v j ) represents the version difference degree, represents the functional feature cosine similarity, IntMatch(I i , I j ) represents the interface matching degree, p and m represent trainable weight parameters, f i and f j represent the component function feature vectors extracted through the configuration file, and I i and I j represent the component interface description set.

[0028] In one embodiment, according to the optimal upgrade resource package combination, an incremental update technique is used in combination with a difference comparison algorithm to perform an update on the target component, and component state data containing digital fingerprints is generated, including:

[0029] The current version data of the target component is obtained; the current version data contains the initial state information and baseline configuration parameters of the component.

[0030] Based on the current version data and the optimal upgrade resource package combination, version difference features are extracted through the incremental update technique to generate structured difference data containing field-level change identifiers.

[0031] A bidirectional comparison algorithm is used to perform path deduction on the structured difference data to obtain update path data of the target component.

[0032] If the update path data meets the preset update condition, state synchronization is performed based on the update path data to generate component state data containing digital fingerprints.

[0033] In one embodiment, the digital fingerprint of the component state data is compared with the expected version fingerprint by hash check, and the adapted upgrade data package is generated through conflict detection and version compatibility processing, including:

[0034] The digital fingerprint of the component state data is compared with the expected version fingerprint by hash check, and the conflict detection result is obtained; the conflict detection result contains the conflict position and type identification.

[0035] Based on the conflict detection result, the difference reconciliation is performed by using the version compatibility processing logic to generate the adapted upgrade version data.

[0036] The version adaptability parameter of the upgrade version data is parsed, and the adaptability check value is obtained by weighting algorithm and normalization conversion.

[0037] Based on the adaptability check value, the final upgrade data package is generated in combination with the conflict detection result and the upgrade version data features.

[0038] In a second aspect, the application further provides a software architecture-based security platform upgrade optimization system, which comprises:

[0039] A target component identification module is configured to obtain the current running state data of system components, perform deep mining and feature classification by using a data analysis algorithm, and obtain a target component list to be upgraded.

[0040] An upgrade resource matching module is configured to intelligently match an optimal upgrade resource package combination from a preset upgrade resource library based on the version information, functional features and dependency graph of the target component list.

[0041] A component update execution module is configured to perform update on the target component by using an incremental update technology in combination with a difference comparison algorithm according to the optimal upgrade resource package combination, and generate component state data containing a digital fingerprint.

[0042] An upgrade data package generation module is configured to compare the digital fingerprint of the component state data with the expected version fingerprint by hash check, and generate an adapted upgrade data package through conflict detection and version compatibility processing.

[0043] In a third aspect, the application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the foregoing method when executing the computer program.

[0044] In a fourth aspect, the application further provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the foregoing method.

[0045] The software architecture-based security platform upgrade optimization method, system, computer device and storage medium, after obtaining the current running state data of the system components, first uses a data analysis algorithm to perform deep mining and feature classification, accurately identifies the target component list that needs to be upgraded, then based on the version information, functional features and dependency graph in the list, intelligently matches the optimal upgrade resource package combination from the preset upgrade resource library, then according to the optimal upgrade resource package combination, uses the incremental update technology combined with the difference comparison algorithm to perform update on the target component, generates component state data containing digital fingerprints, and finally through the hash check, compares the digital fingerprints of the component state data with the expected version fingerprints, and after conflict detection and version compatibility processing, generates an adaptive upgrade data package. Using the method can realize security platform upgrade optimization through the orderly flow of data flow, and form a complete closed loop from target component identification to upgrade data package generation. Through data analysis, the upgrade target is accurately positioned, avoiding blind upgrade; relying on component features and dependency relationship to match the optimal resource package improves resource adaptability; with the help of incremental update and difference comparison, the update efficiency is improved and resource consumption is reduced; through hash check and conflict processing, the upgrade compatibility and security are guaranteed, and finally the efficient, accurate and stable upgrade of the security platform is realized. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiment or related art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0047] Figure 1 A flow chart of a software architecture-based security platform upgrade optimization method provided by an embodiment of the present application;

[0048] Figure 2 A structural block diagram of a software architecture-based security platform upgrade optimization system provided by an embodiment of the present application;

[0049] Figure 3 A comparison diagram before and after the software architecture-based security platform upgrade optimization provided by an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0051] In one of the embodiments, as Figure 1As shown, the application provides a software architecture-based security platform upgrade optimization method, which can include the following steps:

[0052] Step S101, obtain the current running state data of system components, use data analysis algorithm for deep mining and feature classification, and obtain the target component list to be upgraded.

[0053] Specifically, first, the current running state data of system components is obtained, which covers the performance indicators (such as response time, resource occupancy rate) and fault records (such as error code, abnormal triggering time) of the components; the obtained data is preprocessed, interference information is removed by a denoising algorithm, redundant data is cleaned and repeated data is removed, and a standardized state data set is obtained; based on the state data set, key indicator features (such as performance threshold breakthrough frequency) and event features (such as fault associated event sequence) are extracted, and a feature fusion algorithm (such as weighted feature splicing) is used to integrate and form a running feature set of the components; a clustering algorithm (such as K-means) is used to classify the running feature set, and an abnormal component list deviating from the normal running mode is identified; the abnormal component list is compared with historical performance benchmark data, the performance decay rate (decay rate = (historical benchmark performance - current performance) / historical benchmark performance) of each component is calculated, and the components with performance decay rate exceeding a preset threshold are marked as target components to be upgraded; a multi-dimensional evaluation model (evaluation dimensions include performance decay degree, fault influence range, and business correlation degree) is constructed, the comprehensive scores of each target component to be upgraded are calculated, and an upgrade priority ranking is generated, and finally a target component list containing component identification, current version information, performance decay parameters, associated dependent components, and estimated upgrade duration is obtained.

[0054] Step S102, based on the version information, functional features and dependency graph of the target component list, the optimal upgrade resource package combination is intelligently matched from a preset upgrade resource library.

[0055] Specifically, based on the target component list, the real-time version information (including major version number, minor version number, patch version number) of each component is obtained through interface call, the functional feature parameters (such as supported encryption algorithm, maximum concurrent processing capacity) are extracted by parsing the component configuration file (such as XML, JSON format), and the dependency graph (nodes represent components, edges represent dependency relationships) is generated by scanning the API call records and data transmission logs between components; according to the real-time version information and functional feature parameters, a compatibility constraint matrix between components is constructed (matrix elements represent the compatibility level between components), compatibility matching is performed through a similarity calculation formula, and a compatibility matching result is obtained; according to the dependency graph, a graph traversal algorithm (such as depth-first search) is used to extract the dependency level (such as direct dependency, indirect dependency) between components, and the upgrade priority order (upstream components in the dependency chain are upgraded first) is determined; if the compatibility matching result meets the preset threshold, all candidate resource package combinations that meet the component functional requirements (such as functional parameter matching) and version adaptation conditions (such as major version number compatibility) are selected from the preset upgrade resource library; the candidate resource package combination is combined with the upgrade priority order, a multi-objective optimization model is constructed with the core objectives of upgrade priority satisfaction, component compatibility improvement value, and resource package adaptation efficiency, and a machine learning algorithm (such as reinforcement learning) is used for optimization matching to obtain the optimal upgrade resource package combination.

[0056] In step S103, according to the optimal upgrade resource package combination, an incremental update technique is used in combination with a difference comparison algorithm to perform an update on the target component, and component state data containing a digital fingerprint is generated.

[0057] Further, the current version data of the target component is obtained, which includes the initial state information (such as installation time, initial configuration parameters) and baseline configuration parameters (such as default running threshold, basic function switch state) of the component; based on the current version data and the optimal upgrade resource package combination, version difference features (such as new fields, modified function logic, deleted configuration items) are extracted through an incremental update technique (such as incremental extraction based on binary difference), and structured difference data containing field-level change identifiers (such as "add", "modify", "delete" labels) are generated; the structured difference data is subjected to a bidirectional comparison algorithm (simultaneous comparison from the current version and the target version to the intermediate version) for path deduction to determine the update path data of the component from the current state to the target state (including the operation sequence to be performed, the data change order); if the update path data meets the preset update conditions (such as no circular dependency, operation permission verification passed), state synchronization is performed based on the update path data (such as applying changes in order, verifying the operation result at each step), and component state data containing a digital fingerprint (such as SHA-256 hash value) is generated (this data records the complete configuration, running parameters and state identifier of the component after the update).

[0058] In step S104, the digital fingerprint of the component state data is compared with the expected version fingerprint through hash check, and the adapted upgrade data packet is generated through conflict detection and version compatibility processing.

[0059] Specifically, the digital fingerprint of the component state data is compared with the expected version fingerprint (preset target version hash value) through hash check (e.g., calculating the hash difference between the two), to obtain a conflict detection result (including the specific field position of the conflict, and a conflict type identifier (e.g., version number mismatch, configuration item conflict)); based on the conflict detection result, a version compatibility processing logic (e.g., retaining high-priority configurations, merging compatible functional parameters) is used to perform difference reconciliation, to generate an adapted upgrade version data (including reconciled configuration parameters and functional modules); the version adaptability parameters (e.g., compatibility with the system kernel, resource occupation increment) of the upgrade version data are parsed, an adaptability score is calculated through a weighting algorithm (each parameter is assigned a weight according to its importance), and a normalized conversion (mapping the score to the [0, 1] interval) is performed to obtain an adaptability check value; based on the adaptability check value, the conflict detection result (e.g., the type of the conflict that has been resolved) and the upgrade version data features (e.g., data size, functional module integrity) are combined to generate a final upgrade data packet (including executable update instructions, check files, and rollback plans).

[0060] The above-mentioned method for upgrading and optimizing a security platform based on a software architecture comprises the following steps: after obtaining the current running state data of system components, the data is analyzed in depth and classified by a data analysis algorithm to accurately identify a list of target components that need to be upgraded; based on the version information, functional features, and dependency relationship graph in the list, the optimal upgrade resource package combination is intelligently matched from a preset upgrade resource library; then, according to the optimal upgrade resource package combination, the target components are updated using an incremental update technique combined with a difference comparison algorithm to generate component state data containing a digital fingerprint; finally, the digital fingerprint of the component state data is compared with the expected version fingerprint through hash check, and the adapted upgrade data packet is generated through conflict detection and version compatibility processing. This method can realize the upgrading and optimization of a security platform through the orderly flow of data streams, forming a complete closed loop from target component identification to upgrade data packet generation. Through data analysis, the upgrade target is accurately located, avoiding blind upgrading; relying on the matching of component features and dependency relationships, the optimal resource package is matched to improve resource adaptability; with the help of incremental updating and difference comparison, the updating efficiency is improved and resource consumption is reduced; through hash check and conflict processing, the upgrade compatibility and safety are guaranteed, and finally the efficient, accurate, and stable upgrading of a security platform is realized.

[0061] In one embodiment, the data analysis algorithm is used to perform in-depth mining and feature classification to obtain a list of target components that need to be upgraded, which can include the following steps:

[0062] Step S201, the current running state data is preprocessed to remove noise and redundant information to obtain a standardized state data set; the current running state data includes performance indicators and fault records of the components.

[0063] Step S202, key indicator features and event features are extracted based on the state data set, and a feature fusion algorithm is used to integrate and form a running feature set of the components.

[0064] Preferably, the key indicator features are extracted from the state data set, reflecting quantitative indicators of the core running state of the components, such as response time, resource occupancy rate, error rate, and other directly quantifiable performance parameters.

[0065] The event features are extracted from the state data set, and the unstructured or semi-structured information related to the abnormal running of the components, such as fault occurrence time, error code, and abnormal trigger condition, is described as event information.

[0066] Specifically, the algorithm for integrating the key indicator features and the event features is to form a unified feature set (i.e., the running feature set) that can fully represent the running state of the components through weighted combination, feature splicing, etc.

[0067] Step S203, based on the running feature set, a clustering algorithm is used for classification to determine the list of abnormal components.

[0068] The clustering algorithm calculates the similarity of different component features in the running feature set, and groups components with similar features into a class, thereby distinguishing components that deviate from the normal mode and forming the list of abnormal components.

[0069] Step S204, the list of abnormal components is compared with the historical performance benchmark to calculate the performance degradation rate, and components with performance degradation exceeding a preset threshold are marked to obtain the upgrade target.

[0070] The historical performance benchmark is the historical performance data of the components in the normal running state (such as average response time, resource occupancy level during stable operation, etc.), which is used as a reference standard for judging whether the current component performance is degraded.

[0071] The performance degradation rate is an index for quantifying the degree of performance degradation of the components, and the calculation formula is (historical benchmark performance-current performance) / historical benchmark performance, reflecting the degradation proportion of the current performance of the components relative to the historical normal state.

[0072] Step S205, a multi-dimensional evaluation model is constructed to analyze the running feature data of the upgrade target, calculate the comprehensive score, and generate an upgrade priority ranking.

[0073] The multi-dimensional evaluation model evaluates the target to be upgraded from performance degradation degree, fault influence range, business correlation importance and other dimensions, and reflects the urgency and necessity of component upgrade through the comprehensive score.

[0074] In step S206, based on the upgrade priority ranking, a target component list containing component identification, current version information, performance degradation parameter, associated dependent components and estimated upgrade duration is obtained.

[0075] Specifically, the current running state data of the system components (including performance indicators and fault records) are preprocessed to obtain a standardized state data set by removing noise and redundant information; based on the state data set, key indicator features and event features are extracted respectively, and feature fusion algorithm is used to integrate and form a running feature set of the components; a clustering algorithm is used to classify the running feature set to determine an abnormal component list; the abnormal component list is compared with the historical performance benchmark to calculate the performance degradation rate, and components with performance decline exceeding a preset threshold are marked as targets to be upgraded; a multi-dimensional evaluation model is constructed to analyze the running feature data of the targets to be upgraded, and a comprehensive score is calculated to generate an upgrade priority ranking; finally, based on the upgrade priority ranking, a target component list containing component identification, current version information, performance degradation parameter, associated dependent components and estimated upgrade duration is obtained.

[0076] Through layer-by-layer processing and analysis of the original running state data, the embodiment realizes complete flow from data collection to generation of the target component list, ensuring accurate identification of components to be upgraded. The preprocessing step improves data quality; feature extraction and fusion enhance the representation ability of component running state; clustering classification and performance degradation rate calculation realize accurate screening of abnormal components; multi-dimensional evaluation and priority ranking ensure the rationality and orderliness of the upgrade targets, and the finally generated target component list provides clear and detailed basis for subsequent upgrade resource matching and execution, effectively avoiding the blindness and disorderliness of the upgrade.

[0077] In one embodiment, the comprehensive score can be calculated by the following formula:

[0078]

[0079] wherein S represents the comprehensive score, ω i represents the dynamic weight of the i-th evaluation dimension, which is calculated by improving the entropy weight method, x' i represents the standardized feature value of the i-th dimension, and a represents the actual performance degradation rate of the component, β represents the preset performance degradation threshold, and γ represents the business topology importance.

[0080] Preferably, the gamma service topology importance is used to quantify the core degree and influence range of the component in the service topology structure.

[0081] gamma = a * degree centrality + b * betweenness centrality + c * dependency strength coefficient

[0082] wherein the degree centrality represents the proportion of the number of adjacent components directly connected to the component in the topology, and the value range is [0, 1], and the higher the value, the more business nodes directly associated with the component. Degree k represents the number of adjacent components directly connected to the component (in-degree + out-degree), and N represents the total number of components in the service topology.

[0083] The betweenness centrality represents the probability of the component as a "pivot" of the shortest path between any two components, and the value range is [0, 1], and the higher the value, the stronger the irreplaceability of the component in the global service flow. Betweenness wherein σ st represents the total number of shortest paths from component s to component t, σ st (v) the number of shortest paths from component s to component t passing through the current component v.

[0084] The dependency strength coefficient is based on the weight given by the business level (such as core business / non-core business) supported by the component, and the value range is [0, m]. Dependency wherein m represents the total number of businesses supported by the component, ω i represents the priority weight of the i-th business (core business takes 1.0, non-core business takes 0.3-0.7, and is set according to the actual scene), r i represents the dependency degree of the i-th business on the component (complete dependency takes 1.0, partial dependency takes 0.5, and weak dependency takes 0.1).

[0085] a, b, c represent normalization coefficients (satisfying a+b+c=1), which are adjusted according to the business scene:

[0086] If local connection is emphasized (such as distributed system nodes), a=0.4, b=0.3, and c=0.3 can be set.

[0087] a=0.4, b=0.3, and c=0.3.

[0088] If global path is emphasized (such as network routing devices), a=0.2, b=0.5, and c=0.3 can be set.

[0089] a=0.2, b=0.5, and c=0.3.

[0090] The embodiment introduces dynamic weights calculated by improved entropy weight method, can dynamically adjust the weight proportion according to the actual influence degree of each evaluation dimension, avoids the limitation of fixed weight; combined with the standardized eigenvalue, the comparability processing of different dimension characteristics is realized; at the same time, the ratio of actual performance attenuation rate and preset performance attenuation threshold, business topology importance and other key parameters are introduced, the pertinence of evaluation is strengthened from the performance attenuation degree and the importance of business association. The formula can carry out multi-dimensional and dynamic comprehensive quantitative evaluation on the target to be upgraded, so that the comprehensive score generated can more accurately reflect the urgency and necessity of component upgrade, provide scientific and objective basis for subsequent upgrade priority sorting, and then improve the rationality of target component list and the orderliness of upgrade work.

[0091] In one embodiment, based on the version information, functional characteristics and dependency graph of the target component list, the optimal upgrade resource package combination is intelligently matched from the preset upgrade resource library, which can include the following steps:

[0092] Step S301, based on the target component list, real-time version information is obtained, functional characteristic parameters are extracted by analyzing the component configuration file, and a dependency graph is generated by scanning the interactive interface and data flow transfer link between components; the real-time version information is used to determine the current state of the component.

[0093] Preferably, the real-time version information refers to the current version number (such as the major version number, the minor version number, the patch version) and the update time of the component obtained from the target component list, etc. Dynamic information is used to accurately locate the current state of the component.

[0094] The functional characteristic parameters are the parameters (such as supported encryption algorithm type, maximum concurrent processing capacity, interface protocol version, etc.) representing the functional properties of the component extracted by analyzing the component configuration file (such as XML, JSON format), which is used to evaluate the functional adaptability of the component.

[0095] The dependency graph is a topological graph constructed by taking components as nodes and interactive interfaces and data flow transfer links between components as edges, which directly / indirectly presents the dependency relationship between components (such as A component needs to call the interface of B component to run).

[0096] Step S302, according to the real-time version information and the functional characteristic parameters, a compatibility constraint matrix between components is constructed, and the compatibility matching result is obtained by calculating the similarity and rule matching.

[0097] The compatibility constraint matrix records the compatibility rules between different components in the form of matrix (the matrix element represents the compatibility level of component i and component j, such as “fully compatible”, “partially compatible”, “incompatible”).

[0098] Step S303, the dependency hierarchy between components is extracted according to the dependency graph using a graph traversal algorithm to determine the upgrade priority order.

[0099] The dependency hierarchy is based on the dependency graph, and the hierarchical position (such as the basic layer, the application layer, and the core layer) of the component in the dependency chain is extracted by the graph traversal algorithm (such as breadth-first search). The higher the level, the more the component is depended on by other components.

[0100] Step S304, if the compatibility matching result meets the preset threshold, all candidate resource package combinations that meet the component function demand and version adaptation condition are filtered out from the preset upgrade resource based on the target component list.

[0101] Step S305, combine the candidate resource package combination with the upgrade priority order to construct a multi-objective optimization model, and use a machine learning algorithm for optimization matching to obtain the optimal upgrade resource package combination; the multi-objective optimization model takes the upgrade priority satisfaction degree, the component compatibility improvement value, and the resource package adaptation efficiency as the core optimization targets, and balances the constraint relationship between each target through weight distribution.

[0102] Further, the multi-objective optimization model simultaneously optimizes the mathematical models of the upgrade priority satisfaction degree (the upgrade order meets the priority), the component compatibility improvement value (the upgrade compatibility level improvement amplitude), and the resource package adaptation efficiency (the resource package download and deployment time consumption), and balances the priority of each target through weight distribution.

[0103] Specifically, based on the target component list, real-time version information is obtained, the component configuration file is parsed to extract the functional feature parameters, the dependency relationship graph is generated by scanning the interactive interface and data flow transfer link between components, and the real-time version information is used to determine the current state of the component; a compatibility constraint matrix between components is constructed according to the real-time version information and the functional feature parameters, and a compatibility matching result is obtained by calculating the similarity and rule matching; the dependency hierarchy between components is extracted according to the dependency graph using a graph traversal algorithm to determine the upgrade priority order; if the compatibility matching result meets the preset threshold, all candidate resource package combinations that meet the component function demand and version adaptation condition are filtered out from the preset upgrade resource based on the target component list; combine the candidate resource package combination with the upgrade priority order to construct a multi-objective optimization model, and use a machine learning algorithm for optimization matching to obtain the optimal upgrade resource package combination, the multi-objective optimization model takes the upgrade priority satisfaction degree, the component compatibility improvement value, and the resource package adaptation efficiency as the core optimization targets, and balances the constraint relationship between each target through weight distribution.

[0104] The embodiment realizes the complete link from component state awareness to accurate matching of upgrade resources. Real-time version information and extraction of functional feature parameters ensure the accuracy of component state evaluation; construction of compatibility constraint matrix and dependency graph provides a logical basis for resource screening; determination of upgrade priority order ensures priority upgrade of core components; application of multi-objective optimization model balances multiple constraint conditions in the upgrade process, so that the final generated optimal upgrade resource package combination meets functional requirements while taking into account compatibility and efficiency, effectively improving the accuracy and reliability of the security platform upgrade.

[0105] In one embodiment, similarity can be calculated using the following formula:

[0106]

[0107] where Compatibility(C i , C j ) represents component compatibility similarity, VerDiff(v i , v j ) represents version difference, CosSim(f i , f j ) represents functional feature cosine similarity, IntMatch(I i , I j ) represents interface matching degree, and p, m represent trainable weight parameters. i j

[0108] Preferably, the version difference is calculated as follows:

[0109]

[0110] Functional feature cosine similarity:

[0111]

[0112] Interface matching degree:

[0113]

[0114] where p, m, p represent trainable weight parameters, M, m, p represent version number normalization factors (usually the maximum possible value of each part),

[0115] ​​​​​The embodiment integrates the indicators of version difference degree, functional feature cosine similarity and interface matching degree, and dynamically adjusts the importance of each dimension by using trainable weight parameters, to realize comprehensive and accurate quantitative evaluation of component compatibility. The formula captures the risk of version mismatch between components through version difference degree, measures the semantic similarity of functional features by using cosine similarity, and verifies the feasibility of interaction between components by combining interface matching degree, to ensure the integrity of compatibility evaluation. The trainable weight parameters can automatically optimize the influence of each indicator according to the actual business scenario (such as increasing the weight of alpha in scenarios with high version stability requirements), enhancing the adaptability and flexibility of the formula. Overall, the formula provides a scientific and dynamic quantitative method for component compatibility evaluation, effectively improving the accuracy of upgrade resource package matching and reducing the risk of upgrade failure due to compatibility problems, providing strong support for the stable operation of the system security platform.

[0116] In one embodiment, the update is performed on the target component according to the optimal upgrade resource package combination using the incremental update technology combined with the difference comparison algorithm, and the component state data containing the digital fingerprint is generated, which can include the following steps:

[0117] Step S401, obtaining the current version data of the target component; the current version data contains the initial state information and baseline configuration parameters of the component.

[0118] The current version data refers to the complete state data set of the target component before updating, which contains initial state information (such as component installation time, initial deployment configuration, historical update record, etc. basic attributes) and baseline configuration parameters (such as system default running threshold, basic function switch state, initial setting of security policy, etc. reference configuration).

[0119] Step S402, extracting version difference features based on the current version data and the optimal upgrade resource package combination through the incremental update technology, and generating structured difference data containing field-level change identifiers.

[0120] Preferably, the incremental update technology is a technology that only transmits and updates the difference between the current version and the target version, without transmitting the complete new version data. By extracting version difference features (such as new fields, modified code segments, deleted configuration items), efficient updating can be achieved, which can reduce data transmission volume and update time consumption.

[0121] The version difference feature is the specific difference content between the current version data and the version corresponding to the optimal upgrade resource package combination, including field-level changes such as addition, modification and deletion, and is the core processing object of incremental update.

[0122] Step S403, performing path deduction on the structured difference data using a bidirectional comparison algorithm to obtain the update path data of the target component.

[0123] The bidirectional comparison algorithm simultaneously starts from the current version data and the target version data, and performs difference comparison to the intermediate state. Through bidirectional verification, the integrity of difference identification is ensured, and the omissions or misjudgments that may occur in one-way comparison are avoided.

[0124] In step S404, if the update path data meets the preset update condition, state synchronization is performed based on the update path data to generate component state data containing digital fingerprints.

[0125] The preset update condition is a standard for judging whether the update path is feasible, including operation permission verification, no circular dependency, resource occupation threshold, etc., to ensure that the update process does not negatively affect system stability.

[0126] State synchronization performs specific update operations according to the update path data, so that the actual state of the target component is consistent with the target state corresponding to the optimal upgrade resource package combination. The process includes data writing, configuration taking effect, and function module replacement.

[0127] The digital fingerprint is a unique identifier obtained by calculating the state data of the component after update through a hash algorithm (such as SHA-256), which is used to accurately identify the current state of the component.

[0128] Specifically, the current version data of the target component is obtained, which contains the initial state information and baseline configuration parameters of the component; based on the current version data and the optimal upgrade resource package combination, version difference features are extracted through incremental update technology to generate structured difference data containing field-level change identifiers; the structured difference data is subjected to bidirectional comparison algorithm for path deduction to obtain update path data of the target component; if the update path data meets the preset update condition, state synchronization is performed based on the update path data to generate component state data containing digital fingerprints. The component state data records the complete state data set after the component is updated, including the updated configuration parameters, function module information, and corresponding digital fingerprints.

[0129] This embodiment only processes version differences through incremental update technology, reducing data transmission volume and update time, and improving update efficiency; the structured difference data with field-level change identifiers makes the change content clear and traceable, facilitating accurate positioning of the update point; the path deduction of the bidirectional comparison algorithm ensures the rationality and feasibility of the update path, reducing the probability of update errors; the preset update condition verification and digital fingerprint generation ensure the accuracy of state synchronization and the uniqueness of component state, effectively avoiding data inconsistency problems during the update process, and enhancing the reliability and security of component update.

[0130] In one of the embodiments, the generation of the adapted upgrade data package through the hash check comparison of the digital fingerprint of the component state data with the expected version fingerprint, the conflict detection and the version compatibility processing can include the following steps:

[0131] In step S501, the hash check comparison of the digital fingerprint of the component state data with the expected version fingerprint is performed to obtain a conflict detection result; the conflict detection result contains the conflict position and type identification.

[0132] The expected version fingerprint is a digital fingerprint that the component should have after being upgraded to a target version, and is used as a benchmark for measuring whether the component is successfully upgraded to an expected state.

[0133] Further, the process of comparing the digital fingerprint of the component state data with the expected version fingerprint through hash value comparison judges whether the actual state of the component is consistent with the expected state by calculating the hash difference value.

[0134] In step S502, the difference reconciliation is performed based on the conflict detection result using the version compatibility processing logic to generate the adapted upgrade version data.

[0135] The version compatibility processing logic is a set of rules and methods for reconciling conflicts, which takes the form of retaining high-priority configurations, merging compatible parameters, and replacing incompatible modules, etc. to solve the difference between the component state and the expected version according to the conflict type and position. According to the version compatibility processing logic, the identified differences in the conflict detection result are adjusted and fused to make the component state close to the expected version to generate the adapted upgrade version data.

[0136] In step S503, the version adaptability parameters of the upgrade version data are parsed, and the adaptability check value is obtained through the weighting algorithm and normalization conversion.

[0137] The version adaptability parameters are used to measure the degree of adaptation of the version to the system, such as the compatibility with the system kernel, the resource occupation increment, and the function module matching degree, etc.

[0138] The adaptability check value is obtained after the weighting algorithm and normalization conversion, and is used to quantitatively represent the degree of adaptation of the upgrade version data to the system. The closer the value is to 1, the better the adaptability.

[0139] In step S504, the final upgrade data package is generated based on the adaptability check value in combination with the conflict detection result and the upgrade version data features.

[0140] The upgrade version data features are the attributes possessed by the upgrade version data, such as the data size, the function module integrity, and the update time, etc., which are factors to be considered when generating the final upgrade data package.

[0141] The upgrade data package is generated by upgrading the comprehensive adaptability check value, the conflict detection result and the upgrade version data feature, and can be directly used for component upgrade, and contains update instructions, check files, adaptability parameters and the like.

[0142] Specifically, the hash check comparison is performed on the digital fingerprint of the component state data and the expected version fingerprint, to obtain a conflict detection result containing a conflict position and a type identifier; based on the conflict detection result, a version compatibility processing logic is used to perform difference reconciliation to generate adapted upgrade version data; the version adaptability parameters of the upgrade version data are parsed, and an adaptability check value is obtained through a weighting algorithm and normalization conversion; based on the adaptability check value, the conflict detection result and the upgrade version data feature are combined to generate the final upgrade data package.

[0143] The hash check comparison in this embodiment can accurately locate the position and type of the conflict, and provides a clear direction for difference reconciliation; the version compatibility processing logic ensures the adaptability of the upgrade version data by systematically reconciling the differences; the adaptability check value obtained through the weighting algorithm and the normalization conversion realizes the quantitative evaluation of the adaptation degree of the upgrade version data; and the final upgrade data package generated by combining multi-dimensional information ensures its compatibility and security with the system, effectively reduces the risk of running abnormally after upgrading, and improves the overall reliability of the security platform upgrade.

[0144] In one of the embodiments, as shown in Figure 2 The application also provides a security platform upgrade optimization system based on a software architecture, which can include:

[0145] A target component identification module 601 is configured to obtain current running state data of system components, perform deep mining and feature classification by using a data analysis algorithm, and obtain a list of target components to be upgraded.

[0146] An upgrade resource matching module 602 is configured to intelligently match an optimal upgrade resource package combination from a preset upgrade resource library based on version information, functional features and dependency relationship graphs of the list of target components.

[0147] A component update execution module 603 is configured to perform update on the target components by using an incremental update technology in combination with a difference comparison algorithm according to the optimal upgrade resource package combination, and generate component state data containing a digital fingerprint.

[0148] An upgrade data package generation module 604 is configured to perform hash check comparison on the digital fingerprint of the component state data and the expected version fingerprint, and generate an adapted upgrade data package through conflict detection and version compatibility processing.

[0149] The above-mentioned software architecture-based security platform upgrade optimization system, the target component identification module obtains the current running state data of the system components, uses a data analysis algorithm for deep mining and feature classification, and obtains a list of target components that need to be upgraded; the upgrade resource matching module intelligently matches the optimal upgrade resource package combination from the preset upgrade resource library based on the version information, functional features and dependency graph of the target component list; the component update execution module executes the update on the target component according to the optimal upgrade resource package combination, using the incremental update technology combined with the difference comparison algorithm, and generates component state data containing digital fingerprints; the upgrade data package generation module compares the digital fingerprints of the component state data with the expected version fingerprints through hash check, and generates an adaptive upgrade data package through conflict detection and version compatibility processing.

[0150] In one embodiment, as shown in FIG. 1, Figure 3 The application also provides a comparison before and after the upgrade optimization of the security platform based on the rail transit CC / ZC software, which can include:

[0151] In the rail transit signal system, the security platform needs to support the stable operation of the CC (computer interlocking) and ZC (zone controller) software, and the two have different functions but share some basic modules (such as electronic map data). The present application provides a method for upgrading and optimizing the system, and the specific process is as follows:

[0152] 1. Target component identification

[0153] The current running state data (including response time, fault code, resource occupancy rate, etc.) of the CC software, ZC software and underlying security platform are obtained, and after pre-processing to remove noise, key indicator features (such as CC interlocking logic execution time consumption, ZC train position update frequency) and event features (such as electronic map data loading failure records) are extracted, and a running feature set is formed through a feature fusion algorithm. Abnormal components (such as ZC software response delay due to redundant electronic map data) are identified using a clustering algorithm, the performance decay rate is calculated by comparing the historical performance benchmark (ZC response time is 35% higher than the benchmark value, exceeding the preset threshold of 20%), and the business topology importance (ZC is a core component, γ = 0.8) is combined, and the target for upgrading is determined to be the ZC software and the associated electronic map module through a comprehensive scoring formula.

[0154] 2. Upgrade resource matching

[0155] Based on the target component list, the functional feature parameters (such as the maximum number of trains supported) are obtained by parsing the ZC software configuration file, and the interface calling link with the security platform is scanned to generate a dependency graph (ZC depends on the communication module of the security platform and the electronic map basic framework). A compatibility constraint matrix is constructed, and the matching degree of the candidate resource package and the ZC software is calculated by a similarity formula: version difference VerDiff = 0.1 (major version consistent), functional feature cosine similarity cosθ = 0.92 (high parameter matching degree), interface matching degree IntMatch = 0.85 (communication protocol compatible), and the final compatibility similarity score is 0.88, which meets the preset threshold 0.8. Combined with the dependency level (the electronic map basic framework is prior to the ZC special module), the optimal resource package combination containing the electronic map simplified package and the ZC function patch is selected from the resource library.

[0156] 3. Component update execution

[0157] The current version data of the ZC software (including initial configuration and baseline parameters) is obtained, and the difference features (such as electronic map redundant data deletion and ZC position calculation module optimization) of the optimal resource package are extracted by incremental update technology to generate structured difference data (marked "delete field A" and "modify function B"). A bidirectional comparison algorithm is used to deduce the update path (update the electronic map basic framework first, then apply the ZC patch), verify the path without circular dependency, and execute state synchronization to generate component state data containing digital fingerprints (SHA-256 value).

[0158] 4. Upgrade data packet generation

[0159] The digital fingerprints of the component state data are compared with the expected version fingerprints, and it is found that the electronic map sub-data check conflict (position information field does not match). The ZC special sub-data (data 2) is retained using version compatibility processing logic, and the upgrade version data is generated. The adaptability parameters (resource occupation is reduced by 15%, and the compatibility with the CC software is 98%) are parsed, and the adaptability check value 0.92 is obtained by weighted calculation, and finally the upgrade data packet containing the electronic map simplified package, the ZC patch and the conflict processing log is generated.

[0160] Implementation effect: Through module splitting (separation of public electronic map framework and special sub-data) and incremental update, the ZC software upgrade time is shortened from 4 hours of full update to 45 minutes, avoiding the replacement of the entire security platform due to local upgrade, and balancing the upgrade efficiency and network security risk by manual checking of key version nodes, significantly reducing the upgrade maintenance pressure in the multi-train scenario.

[0161] The embodiment realizes accurate positioning of the upgrade target through the target component identification module, avoids invalid upgrade, the upgrade resource matching module improves the adaptability of the resource package and reduces resource waste, the component update execution module improves the update efficiency and reduces the system burden by means of incremental update and difference comparison, the upgrade data package generation module guarantees the safety and stability of the upgrade through verification and compatibility processing, and finally realizes efficient, accurate and reliable safety platform upgrade, and meets the needs of fast iteration and stable operation of the safety platform.

[0162] It should be understood that, although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0163] In one embodiment, a computer device is provided, comprising a memory and a processor, the memory stores a computer program, and the processor implements the steps of the software architecture-based safety platform upgrade optimization method and system as described above when executing the computer program.

[0164] In one embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the steps in the above method embodiments.

[0165] For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can be referred to the part of the method embodiment. The device embodiments described above are only schematic, wherein the components described as separate components can or can not be physically separate, and the components displayed as a unit can or can not be a physical unit, i.e. they can be located in one place, or also distributed on multiple network units. According to actual needs, part or all of the modules can be selected to achieve the purpose of the present disclosure. Those skilled in the art can understand and implement it without creative labor.

[0166] The above-described embodiments only express several implementation manners of the application, the description is more specific and detailed, but it cannot be understood as the limitation of the patent scope of the application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the application, several modifications and improvements can be made, which are within the protection scope of the application.

Claims

1. A software architecture-based security platform upgrade optimization method, characterized in that, The method comprises: obtaining current running state data of system components, performing deep mining and feature classification by using a data analysis algorithm to obtain a target component list to be upgraded; based on version information, functional features and dependency graph of the target component list, intelligently matching an optimal upgrade resource package combination from a preset upgrade resource library; according to the optimal upgrade resource package combination, performing update on the target component by using an incremental update technology combined with a difference comparison algorithm, and generating component state data containing a digital fingerprint; by comparing the digital fingerprint of the component state data with an expected version fingerprint through hash check, generating an adapted upgrade data package after conflict detection and version compatibility processing.

2. The method of claim 1, wherein, The deep mining and feature classification by using a data analysis algorithm to obtain a target component list to be upgraded comprises: preprocessing the current running state data to remove noise and redundant information to obtain a standardized state data set; the current running state data includes performance indicators and fault records of components; based on the state data set, extracting key indicator features and event features respectively, and integrating them into a running feature set of components by using a feature fusion algorithm; based on the running feature set, performing classification by using a clustering algorithm to determine an abnormal component list; comparing the abnormal component list with historical performance benchmarks, calculating a performance decay rate, marking components with performance decline exceeding a preset threshold to obtain an upgrade target; constructing a multi-dimensional evaluation model to analyze the running feature data of the upgrade target, calculating a comprehensive score to generate an upgrade priority ranking; based on the upgrade priority ranking, obtaining a target component list containing component identifiers, current version information, performance decay parameters, associated dependent components and estimated upgrade time.

3. The method of claim 2, wherein, The comprehensive score is calculated by the following formula: wherein S represents the comprehensive score, ω i represents the dynamic weight of the i-th evaluation dimension, calculated by improving the entropy weight method, x' i represents the standardized eigenvalue of the i-th dimension, and α represents the actual performance degradation rate of the component, β represents the preset performance degradation threshold, and γ represents the service topology importance degree.

4. The method of claim 1, wherein, based on the version information, functional features and dependency graph of the target component list, intelligently matching an optimal upgrade resource package combination from a preset upgrade resource library, comprises: based on the target component list, obtaining real-time version information, analyzing component configuration files to extract functional feature parameters, and scanning interactive interfaces and data flow conversion links between components to generate a dependency graph; the real-time version information is used to determine the current state of the components; based on the real-time version information and functional feature parameters, constructing a compatibility constraint matrix between components, and obtaining a compatibility matching result by calculating similarity and rule matching; based on the dependency graph, extracting dependency levels between components by using a graph traversal algorithm to determine an upgrade priority order; if the compatibility matching result meets a preset threshold, based on the target component list, filtering all candidate resource package combinations that meet the functional requirements and version adaptation conditions of the components from the preset upgrade resources; constructing a multi-objective optimization model by combining the candidate resource package combinations with the upgrade priority order, and obtaining an optimal upgrade resource package combination by using a machine learning algorithm for optimization matching; the multi-objective optimization model takes upgrade priority satisfaction, component compatibility improvement value and resource package adaptation efficiency as core optimization objectives, and balances the constraint relationship between objectives through weight allocation.

5. The method of claim 4, wherein, The similarity is calculated by the following formula: Compatibility(C i , C j ) represents the component compatibility similarity, VerDiff(v i , v j ) represents the version difference degree, IntMatch(I i , I j ) represents the interface matching degree, and ρ and μ represent trainable weight parameters. f i and f j represent the component function feature vectors extracted through the configuration file, and I i and I j represent the component interface description set.

6. The method of claim 1, wherein, The method comprises the following steps: obtaining the current version data of the target component; the current version data comprises initial state information and baseline configuration parameters of the component; extracting version difference features based on the current version data and the optimal upgrade resource package combination through the incremental update technology, and generating structured difference data containing field-level change identifiers; performing path deduction on the structured difference data using a bidirectional comparison algorithm to obtain update path data of the target component; if the update path data meets the preset update condition, performing state synchronization based on the update path data to generate component state data containing digital fingerprints.

7. The method of claim 1, wherein, The method comprises the following steps: performing hash check comparison between the digital fingerprints of the component state data and the expected version fingerprints, and generating an adaptive upgrade data package through conflict detection and version compatibility processing, comprising: performing hash check comparison between the digital fingerprints of the component state data and the expected version fingerprints, and obtaining a conflict detection result; the conflict detection result comprises a conflict position and a type identifier; performing difference reconciliation based on the conflict detection result using version compatibility processing logic to generate an adaptive upgrade version data; analyzing version adaptability parameters of the upgrade version data, and obtaining an adaptability check value through a weighting algorithm and normalization conversion; 8. A software architecture based security platform upgrade optimization system, characterized in that, based on the adaptability check value, combining the conflict detection result and the upgrade version data features to generate the final upgrade data package. The system comprises: a target component identification module for obtaining current running state data of system components, using data analysis algorithms for deep mining and feature classification to obtain a list of target components to be upgraded; an upgrade resource matching module for intelligently matching the optimal upgrade resource package combination from the preset upgrade resource library based on the version information, functional features and dependency graph of the target component list; a component update execution module for performing updates on target components using incremental update technology combined with difference comparison algorithms based on the optimal upgrade resource package combination to generate component state data containing digital fingerprints; 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. an upgrade data package generation module for performing hash check comparison between the digital fingerprints of the component state data and the expected version fingerprints, and generating an adaptive upgrade data package through conflict detection and version compatibility processing.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The processor executes the computer program to realize the steps of the method of any one of claims 1 to 7. The computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 7.

Images