System risk disposal method and device, equipment and storage medium

Abstract

The invention provides a system risk disposal method and device, equipment and a storage medium, and can be applied to the technical field of computers. The method comprises the following steps: in response to a monitored system risk event, obtaining risk feature information of the system risk event; based on the risk feature information, judging whether a pre-configured disposal rule matched with the risk feature information exists or not; if the matched pre-configured processing rule exists, generating a first processing instruction according to the pre-configured processing rule; if the matched pre-configured disposal rule does not exist, a risk disposal model is utilized to process the risk feature information to obtain a second disposal instruction, and the risk disposal model is obtained based on historical risk feature information and corresponding historical disposal record training; and executing the first processing instruction or the second processing instruction to process the system risk event.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a system risk management method, apparatus, equipment, medium, and program product. Background Technology

[0002] In some examples, the monitoring and handling of system risks are often disconnected. Monitoring tools primarily detect and alert on risks, while subsequent handling relies heavily on manual intervention or automated scripts based on simple rules. Such pre-defined static rules are insufficient to cover the complex and ever-changing unknown risk scenarios that arise during system operation, resulting in incomplete handling coverage, delayed responses, and poor adaptability. This prevents the formation of a closed loop of perception, decision-making, and execution, hindering the effective improvement of operational automation and system stability. Summary of the Invention

[0003] In view of the above problems, this disclosure provides methods, apparatus, equipment, media and program products for handling system risks.

[0004] According to a first aspect of this disclosure, a system risk handling method is provided, comprising: in response to monitoring a system risk event, acquiring risk characteristic information of the system risk event; based on the risk characteristic information, determining whether there is a pre-configured handling rule matching the risk characteristic information; if there is a matching pre-configured handling rule, generating a first handling instruction according to the pre-configured handling rule; if there is no matching pre-configured handling rule, processing the risk characteristic information using a risk handling model to obtain a second handling instruction, wherein the risk handling model is trained based on historical risk characteristic information and corresponding historical handling records; and executing the first handling instruction or the second handling instruction to handle the system risk event.

[0005] According to embodiments of this disclosure, determining whether a pre-configured handling rule matches the risk characteristic information based on risk characteristic information includes: querying the corresponding handling rule field from a pre-configured operation and maintenance job definition table based on the risk type information indicated by the risk characteristic information; if a valid handling rule field corresponding to the risk type information is found, it is determined that a pre-configured handling rule matches the risk characteristic information.

[0006] According to embodiments of this disclosure, based on the risk type indicated by the risk characteristic information, the corresponding handling rule field is queried from the pre-configured operation and maintenance job definition table, including: matching the risk type information with the inspection rule parameters of multiple job entries in the operation and maintenance job definition table; if a target job entry is matched, the handling method field, handling rule field, and handling processing class field of the target job entry are read as valid handling rule fields.

[0007] According to an embodiment of this disclosure, generating a first disposal instruction based on a pre-configured disposal rule includes: determining a disposal operation type based on a disposal method field in the pre-configured disposal rule; invoking a processing program corresponding to a disposal processing class field in the pre-configured disposal rule based on the disposal operation type; and generating a first disposal instruction by parsing the disposal rule field in the pre-configured disposal rule through the processing program.

[0008] According to embodiments of this disclosure, processing risk characteristic information using a risk management model to obtain a second management instruction includes: preprocessing the risk characteristic information by replacing dynamic parameters with constant markers to obtain standardized risk information; inputting the standardized risk information into the risk management model to obtain management measures output by the risk management model; and generating a second management instruction based on the management measures.

[0009] According to embodiments of this disclosure, after executing the first handling instruction or the second handling instruction, the method further includes: obtaining alarm information of the system risk event, information of the executed handling instruction, and information of the handling result; storing the alarm information, information of the executed handling instruction, and information of the handling result in a handling record log table; and generating an analysis report of the system risk event based on the handling record log table.

[0010] According to embodiments of this disclosure, in response to the detection of a system risk event, obtaining risk characteristic information of the system risk event includes: triggering a system check task according to pre-configured timed task rules; executing the system check task to obtain system operation data; comparing the system operation data with predefined check rule parameters; when the system operation data does not meet the check rule parameters, determining that a system risk event has been detected, and generating corresponding risk characteristic information.

[0011] A second aspect of this disclosure provides a system risk handling apparatus, comprising: an acquisition module, configured to acquire risk characteristic information of a system risk event in response to monitoring a system risk event; a judgment module, configured to determine whether a pre-configured handling rule matching the risk characteristic information exists based on the risk characteristic information; a first generation module, configured to generate a first handling instruction according to the pre-configured handling rule if a matching pre-configured handling rule exists; a second generation module, configured to process the risk characteristic information using a risk handling model to obtain a second handling instruction if no matching pre-configured handling rule exists, wherein the risk handling model is trained based on historical risk characteristic information and corresponding historical handling records; and an execution module, configured to execute the first handling instruction or the second handling instruction to handle the system risk event.

[0012] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the methods described above.

[0013] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0014] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0015] Based on the system risk handling methods, devices, equipment, media, and program products provided in this disclosure, proactive perception and precise location of system risks are achieved through real-time monitoring and acquisition of risk characteristic information, laying a data foundation for subsequent handling. By determining whether pre-configured handling rules exist, a rapid channel for known risks is formed, enabling immediate matching of predetermined strategies and significantly improving the handling efficiency of routine problems. If a rule match is successful, a first handling instruction is generated according to the rule, reducing the cost of manual intervention and response delay. For unknown or complex risks not covered by the rules, a risk handling model trained based on historical data is introduced for analysis to generate a second handling instruction, expanding the system's handling capability boundaries. By executing the generated handling instruction, a closed-loop operation is completed, ensuring that the risk is effectively eliminated. This application achieves simultaneous improvement in handling efficiency and quality, forming a complete automated closed loop from risk perception and intelligent decision-making to automatic execution, significantly enhancing the system's robustness and self-healing capabilities, while reducing operational complexity and the risk of human error. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustrations depict application scenarios of system risk mitigation methods, apparatuses, devices, media, and program products according to embodiments of this disclosure.

[0018] Figure 2 A flowchart illustrating a system risk mitigation method according to an embodiment of this disclosure is shown schematically.

[0019] Figure 3 A flowchart illustrating a system risk management method according to another embodiment of this disclosure is shown.

[0020] Figure 4 A schematic diagram illustrating the structure of a system risk management apparatus according to an embodiment of the present disclosure is shown; and

[0021] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a system risk mitigation method according to an embodiment of the present disclosure. Detailed Implementation

[0022] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0025] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0026] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary measures have been taken, and they do not violate public order and good morals.

[0027] It should be noted that in the embodiments of this disclosure, certain existing solutions in the industry, such as software, components, and models, may be mentioned. These should be considered as exemplary, and their purpose is merely to illustrate the feasibility of implementing the technical solutions of this disclosure, but does not mean that the applicant has already used or necessarily used such solutions. The embodiments of this disclosure provide a method for handling system risks.

[0028] Figure 1The illustration shows an application scenario diagram of the system risk handling method, apparatus, device, medium, and program product according to embodiments of the present disclosure.

[0029] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0030] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0031] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0032] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0033] It should be noted that the system risk handling method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the system risk handling device provided in this disclosure embodiment can generally be located in server 105. The system risk handling method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the system risk handling device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0035] The following will be based on Figure 1 The described scene, through Figures 2-5 The system risk mitigation method of the disclosed embodiments is described in detail.

[0036] Figure 2 A flowchart illustrating a system risk mitigation method according to an embodiment of this disclosure is shown schematically.

[0037] like Figure 2 As shown, the system risk handling method of this embodiment includes operations S210 to S250.

[0038] When operating S210, in response to the detection of a system risk event, risk characteristic information of the system risk event is obtained.

[0039] In the embodiments of this application, a system risk event refers to an abnormal state that affects the stability, security or performance of the system, such as the server's central processing unit utilization rate continuously exceeding 95%, the database connection pool being exhausted, or the loss of critical business files.

[0040] In the embodiments of this application, risk characteristic information is a set of key data used to describe the essential attributes of risk events in the system. Risk characteristic information may include risk type (such as performance bottleneck, resource exhaustion, data anomaly), risk source (such as a server, a database, or an application process), and risk indicators (such as specific processor utilization values ​​or lost file paths).

[0041] In the embodiments of this application, in response to the detection of a system risk event, risk characteristic information of the system risk event is obtained. The system can detect the occurrence of an abnormal state actively or passively, and then extract the core information that can characterize the abnormal state to provide a basis for subsequent decision-making.

[0042] For example, if a scheduled check task finds that the "tablespace utilization" of the "order database" has reached 98%, then this anomaly is a system risk event. The risk characteristics obtained may include: risk type "resource exhaustion", risk source "order database", and risk indicator "tablespace utilization: 98%".

[0043] In operation S220, based on risk characteristic information, it is determined whether there are pre-configured handling rules that match the risk characteristic information.

[0044] In the embodiments of this application, pre-configured handling rules refer to a set of handling strategies predefined by operations and maintenance personnel based on historical experience for specific types of foreseeable risks. A complete rule may include triggering conditions (such as matching which risk characteristics) and handling content (such as what operation to perform).

[0045] In the embodiments of this application, based on risk characteristic information, it is determined whether there is a pre-configured handling rule that matches the risk characteristic information. The system compares the risk characteristic information with the triggering conditions of all pre-configured handling rules in the rule base.

[0046] For example, if the system compares risk characteristic information with the rule base and finds a pre-configured rule whose trigger condition is "when the order database tablespace utilization rate is >95%", then it is determined that there is a matching pre-configured handling rule.

[0047] When operating S230, if a matching pre-configured handling rule exists, a first handling instruction is generated according to the pre-configured handling rule.

[0048] In the embodiments of this application, the first handling instruction refers to the operation command that the system automatically generates based on the content of the pre-configured rule when the risk hits the pre-configured rule, and that can be understood by the underlying execution engine.

[0049] In the embodiments of this application, if a matching pre-configured handling rule exists, a first handling instruction is generated according to the pre-configured handling rule. The method of this embodiment is a rapid handling channel for known and common risks. The system directly calls the handling logic defined in the matching pre-configured handling rule and converts it into specific, executable instructions.

[0050] In operation S240, if there is no matching pre-configured handling rule, the risk handling model is used to process the risk feature information to obtain the second handling instruction. The risk handling model is trained based on historical risk feature information and corresponding historical handling records.

[0051] In the embodiments of this application, the risk management model is a decision-making model built based on machine learning or artificial intelligence technology. By learning and analyzing massive amounts of historical risk data and its proven effective countermeasures, it has the ability to provide management suggestions for unknown risks.

[0052] In the embodiments of this application, the second disposal instruction refers to an executable operation command recommended and generated by the risk disposal model after analysis when the risk cannot match any pre-configured rules.

[0053] In the embodiments of this application, if no matching pre-configured handling rule exists, the risk characteristic information is processed using a risk handling model to obtain a second handling instruction. When the rule base cannot cover the current risk, the system inputs the risk characteristic information into a pre-trained risk handling model, which performs reasoning analysis and outputs a suggested handling measure, which the system then uses to generate an instruction.

[0054] For example, the system detects an error log it has never seen before, and there is no matching entry in the rule base. The system inputs this error information into the risk handling model, and the model, based on its learned knowledge, outputs a handling suggestion: "Execute the database repair command." The system then generates a second handling instruction based on this suggestion.

[0055] During operation S250, a first or second handling instruction is executed to handle system risk events.

[0056] In the embodiments of this application, execution refers to the specific process by which the system calls the corresponding executor to run the disposal instructions. Disposal refers to the act of actually eliminating or mitigating system risk events and restoring the system to a normal state by executing instructions.

[0057] In the embodiments of this application, a first handling instruction or a second handling instruction is executed to handle system risk events. Regardless of whether the instruction originates from a rule (first handling instruction) or a model (second handling instruction), the system will deliver it to the underlying execution engine for implementation.

[0058] Through the embodiments of this application, pre-configured rules enable rapid response and automatic repair of known risks, greatly improving handling efficiency and reliability. The risk handling model endows the system with intelligent decision-making capabilities to cope with unknown and complex risks, effectively expanding the coverage of automated operation and maintenance and reducing the risk of handling failure due to missing rules. The method of this embodiment forms a complete closed loop from risk perception and intelligent decision-making to automatic execution, significantly improving the system's self-healing ability and overall stability, and reducing operation and maintenance costs and human error.

[0059] Figure 3 A flowchart illustrating a system risk management method according to another embodiment of this disclosure is shown.

[0060] like Figure 3 As shown, based on risk characteristic information, it is determined whether there are pre-configured handling rules that match the risk characteristic information, including operations S310 to S320.

[0061] When operating S310, based on the risk type information indicated by the risk characteristic information, the corresponding handling rule field is queried from the pre-configured operation and maintenance job definition table.

[0062] In the embodiments of this application, risk type information refers to the core identifier extracted from risk feature information for classification. It indicates the nature of the risk, such as "file does not exist," "structured query language execution error," or "processor utilization exceeds threshold." Risk type information is a key index for rule matching.

[0063] In the embodiments of this application, the operation and maintenance job definition table is a pre-created structured data table stored in a database, used to centrally store all executable operation and maintenance inspection jobs and their corresponding handling rule definitions. Each entry in the operation and maintenance job definition table represents an independent, configurable operation and maintenance job unit.

[0064] In the embodiments of this application, the disposal rule field refers to the specific data column in the operation and maintenance job definition table that defines how to carry out disposal, such as fields such as "disposal method", "disposal rule", and "disposal processing type".

[0065] In the embodiments of this application, based on the risk type information indicated by the risk characteristic information, the corresponding handling rule field is queried from the pre-configured operation and maintenance job definition table. The system first parses the "risk type information" from the risk characteristic information as a query condition. Using this condition, a search is performed in the "operation and maintenance job definition table" to find the field content associated with that risk type that contains specific handling definitions.

[0066] For example, the risk characteristic information indicates that the risk type is "file does not exist". The system then uses this type as a condition to scan the operation and maintenance job definition table, look for job entries that define file checks in the check rule parameters, and obtain their corresponding handling rule fields.

[0067] When operating S320, if a valid handling rule field corresponding to the risk type information is found, it is determined that there is a pre-configured handling rule that matches the risk characteristic information.

[0068] In the embodiments of this application, a valid handling rule field refers to a handling rule field that is not empty, has the correct format, and whose corresponding job status is active. A valid handling rule field indicates that the handling rule is currently available.

[0069] In the embodiments of this application, if a valid handling rule field corresponding to the risk type information is found, it is determined that a pre-configured handling rule matching the risk characteristic information exists. The system verifies the validity of the query results. If a valid field is found, it means that there is a ready-made, directly applicable handling rule, thus determining a successful match.

[0070] For example, the system finds a job entry for "lost log files" in the operation and maintenance job definition table, with the handling method field valued as "script", the handling rule field value as a valid script path, and the status field as "effective". The system then determines that this is a valid handling rule field and that a matching pre-configured handling rule exists.

[0071] Through the embodiments of this application, by introducing an operation and maintenance job definition table for structured querying, the rule matching process is made specific and manageable, realizing centralized configuration and accurate and efficient matching of disposal rules, and providing a clear and reliable basis for the generation of the first disposal instruction.

[0072] In some embodiments, based on the risk type indicated by the risk characteristic information, the corresponding handling rule field is queried from the pre-configured operation and maintenance job definition table, including: matching the risk type information with the inspection rule parameters of multiple job entries in the operation and maintenance job definition table; if a target job entry is matched, the handling method field, handling rule field and handling processing class field of the target job entry are read as valid handling rule fields.

[0073] In the embodiments of this application, a job entry refers to a row of records in the operation and maintenance job definition table, representing an independent and complete operation and maintenance check job configuration.

[0074] In the embodiments of this application, the inspection rule parameters refer to the specific configuration information in the job entry used to define the inspection content and inspection standards. The inspection rule parameters can be stored in a specific field (e.g., the "job rule" field) in the form of key-value pairs or structured data. The inspection rule parameters describe the target object and judgment criteria of the inspection.

[0075] In the embodiments of this application, risk type information is matched with the inspection rule parameters of multiple job entries in the operation and maintenance job definition table. The system compares the identified risk type information with the inspection rule parameters configured in each job entry in the operation and maintenance job definition table to find entries whose inspection targets match the current risk type.

[0076] For example, the risk type information is "file does not exist". The system will iterate through the operation and maintenance job definition table and check the inspection rule parameters of each job entry one by one.

[0077] In the embodiments of this application, the target job entry refers to the job entry in the operation and maintenance job definition table whose inspection rule parameters successfully match the current risk type information. The disposal method field is a field that specifies the disposal operation type, and the disposal method field may include "database operation", "script execution", "interface call", etc.

[0078] In embodiments of this application, the disposal rule field includes fields specifying the content of the disposal operation. For example, the disposal rule field may include a database operation statement for deleting data, the path of a server script, the address of an application programming interface, etc. The disposal processing class field specifies that a particular program class is responsible for performing this disposal operation, and its value is the fully qualified name of that program class.

[0079] In the embodiments of this application, if a target job entry is matched, the disposal method field, disposal rule field, and disposal processing class field of the target job entry are read as valid disposal rule fields. When a target job entry is matched, the system extracts three key pieces of information related to disposal from the entry: disposal method (how to dispose of), disposal rule (what to dispose of), and disposal processing class (who executes it). These three together constitute a complete and executable disposal rule definition.

[0080] Through the embodiments of this application, by accurately matching the risk type with the inspection rule parameters of the work item, the accuracy of rule lookup is ensured, and the three key fields required for handling are fully read, thereby improving the reliability and accuracy of the system risk handling method of this embodiment.

[0081] In some embodiments, generating a first disposal instruction based on pre-configured disposal rules includes: determining the disposal operation type based on the disposal method field in the pre-configured disposal rules; invoking a processing program corresponding to the disposal processing class field in the pre-configured disposal rules based on the disposal operation type; and generating the first disposal instruction by parsing the disposal rule field in the pre-configured disposal rules through the processing program.

[0082] In the embodiments of this application, the disposal method field refers to the data read from the operation and maintenance job definition table, which is used to indicate the macro category of the disposal operation, and its value determines the basic path of subsequent processing.

[0083] In the embodiments of this application, the disposal operation type is a specific operation category determined by the value of the disposal method field. For example, the disposal operation type may include "execute database operation statements", "execute server scripts", "call application programming interfaces", etc.

[0084] In the embodiments of this application, the disposal operation type is determined based on the disposal method field in the pre-configured disposal rules. The system first parses the pre-configured disposal rules, extracts the value of the "disposal method field", and determines the basic type of operation to be used for this disposal based on the value.

[0085] For example, if the value of the disposal method field is "database operation" read from the rule, the system determines that the disposal operation type is to execute a database operation statement.

[0086] In the embodiments of this application, the disposal processing class field refers to the identification information of a specific program class specified in the rule. The disposal processing class field contains the core logic for handling specific types of operations.

[0087] In the embodiments of this application, a processing program refers to a specific program object that is dynamically loaded and instantiated through mechanisms such as reflection based on the identification information of the processing class field. This object has the ability to perform corresponding processing operations.

[0088] In the embodiments of this application, based on the type of disposal operation, the processing program corresponding to the disposal processing class field in the pre-configured disposal rules is invoked. After determining the operation type, the system determines and starts a program specifically responsible for handling that type of operation based on the "disposal processing class field" information in the rules.

[0089] In the embodiments of this application, the disposal rule field refers to the data containing the specific operation content in the rule. The disposal rule field is the "script" or "command" that the processing program needs to parse and execute. The first disposal instruction is a specific command generated by the processing program that can be directly understood and executed by the underlying system.

[0090] In the embodiments of this application, a processing program parses the processing rule field in the pre-configured processing rules to generate a first processing instruction. The invoked processing program receives the content of the "processing rule field", parses, verifies, and formats it according to its own logic (such as a database operation processor or a script execution processor), and outputs a precise instruction.

[0091] Through the embodiments of this application, by explicitly calling a proprietary processing program based on the disposal method and parsing specific rules to generate instructions, the accuracy and executability of the first disposal instruction generation are ensured, the disposal process is standardized and automated, and the reliability of the system response is improved.

[0092] In some embodiments, processing risk characteristic information using a risk management model to obtain a second management instruction includes: preprocessing the risk characteristic information by replacing the dynamic parameters therein with constant markers to obtain standardized risk information; inputting the standardized risk information into the risk management model to obtain management measures output by the risk management model; and generating a second management instruction based on the management measures.

[0093] In the embodiments of this application, dynamic parameters refer to specific values, identifiers, or paths in the risk characteristic information that change with the specific scenario in which the risk occurs. For example, dynamic parameters may include specific timestamps, process identifiers, Internet Protocol addresses, server hostnames, file paths, database names, table names, etc. Dynamic parameters are unique and specific values ​​for each risk event.

[0094] In the embodiments of this application, constant markers refer to fixed symbols or placeholders used to uniformly represent a certain type of dynamic parameter. The function of constant markers is to erase specific numerical differences and abstract a common pattern.

[0095] In the embodiments of this application, standardized risk information refers to risk description information that has been preprocessed, in which dynamic parameters have been replaced with constant labels. Standardized risk information strips away specific environmental details irrelevant to the essence of the problem, while retaining the structured logical characteristics of the risk event.

[0096] In the embodiments of this application, risk characteristic information is preprocessed by replacing dynamic parameters with constant labels to obtain standardized risk information. Since risk management models need to learn general patterns from massive amounts of historical data, and the dynamic parameters in the original risk characteristic information introduce a large amount of noise, making it difficult for the model to effectively generalize, the steps in this embodiment clean and standardize the original information, replacing specific, volatile dynamic parameters with uniform constant labels that represent their type.

[0097] In the embodiments of this application, the risk management model is an intelligent analysis model built based on machine learning algorithms (such as natural language processing, sequence models, etc.). The risk management model is trained on massive amounts of historical risk feature information and their corresponding valid historical management records, thereby learning the mapping relationship between risk patterns and recommended management measures.

[0098] In the embodiments of this application, the remedial measures refer to the suggested operational plan description output by the risk remediation model after reasoning and calculation based on the input standardized risk information. The remedial measures can be a general operation instruction, such as "restart the [service name] service", "clean up the temporary tables in the [database]", "check the permissions of the [file path]", etc.

[0099] In the embodiments of this application, standardized risk information is input into a risk management model to obtain the management measures output by the model. The system inputs the standardized risk information into a pre-trained risk management model. The model identifies the risk pattern represented by the information and, based on knowledge learned from historical experience, infers the most likely effective response strategy, i.e., outputs the management measures.

[0100] For example, input the standardized risk information "file [path] does not exist" into the model. By learning from historical records, the model discovers that such problems are usually caused by "accidental file deletion" or "missing mount point," and the corresponding effective remedial measures are "restore [path] from backup" and "remount [disk] to [path]," respectively. The model can output one of these measures as the appropriate remedial action based on its confidence level.

[0101] In the embodiments of this application, a second handling instruction is generated based on the handling measures. The second handling instruction refers to a specific, executable operation command generated by the system based on the handling measures output by the risk handling model and the specific context of the current risk event. The handling measures output by the model are a template or scheme containing constant markers. The system needs to fill back the previously replaced dynamic parameters into this template to form an executable instruction specific to the current scenario.

[0102] Through the embodiments of this application, preprocessing improves the efficiency and accuracy of the model in recognizing general patterns, while the model realizes the ability to learn from historical experience and generate disposal strategies. The method of this embodiment significantly expands the coverage and intelligence level of automated operation and maintenance.

[0103] In some embodiments, after executing the first or second handling instruction, the method further includes: obtaining alarm information of the system risk event, information of the executed handling instruction, and information of the handling result; storing the alarm information, information of the executed handling instruction, and information of the handling result in a handling log table; and generating an analysis report of the system risk event based on the handling log table.

[0104] In the embodiments of this application, alarm information refers to the alarm details generated when a system risk event is triggered. Alarm information may include alarm content, alarm level, alarm time, and the risk source involved.

[0105] In the embodiments of this application, the disposal instruction information refers to the specific operation instruction content generated and executed in response to risk events in the system. For example, the disposal instruction information may include executed database operation statements, server script commands, or application interface addresses called.

[0106] In the embodiments of this application, the processing result information refers to the result feedback obtained after executing the processing instruction. For example, the processing result information may include status indicators such as "execution successful" or "execution failed", as well as possible execution output logs or error information.

[0107] In the embodiments of this application, alarm information of system risk events, executed handling instructions, and handling results are acquired. After the handling action is completed, the system collects and integrates key data elements from the entire risk handling process to prepare materials for subsequent recording and analysis.

[0108] In the embodiments of this application, the disposal record log table is a pre-designed data table used to record the complete disposal sequence of each system risk event in chronological order.

[0109] In the embodiments of this application, alarm information, executed handling instructions, and handling results are associated and stored in the handling record log table. The system treats alarm, instruction, and result information as a logical whole, associates them through a common risk event identifier, and writes them into the same record in the handling record log table, forming a complete handling log.

[0110] For example, the system adds a new record to the handling record log table. This record contains the alarm information, handling instruction information, and handling result information mentioned in the example above, and links them together with a unique event number.

[0111] In the embodiments of this application, the analysis report refers to a document or data view generated based on historical data in the disposal record log table through statistical, inductive, or correlation analysis, used to summarize the risk disposal situation, analyze the root causes of problems, or evaluate the disposal effect.

[0112] In the embodiments of this application, an analysis report on system risk events is generated based on the handling record log table. The system can query the handling record log table periodically or irregularly to perform aggregated analysis on the data. For example, it can statistically analyze the frequency of occurrence of a certain type of risk, evaluate the effectiveness of different handling plans, identify high-frequency risk sources, and finally present the analysis results in the form of a report.

[0113] For example, the system automatically generates a report every week, pointing out that "Server A" is the source of the most frequent processor alarms this week, and that the "Restart Service" script has a 100% success rate in handling the issue, suggesting that the server's hardware resources or application load be checked.

[0114] Through the embodiments of this application, by fully recording the information of the entire disposal chain and generating analysis reports, the traceability and auditability of the disposal process are achieved, providing data support for optimizing disposal rules and analyzing system weaknesses, and forming a closed loop of continuous improvement in operation and maintenance.

[0115] In some embodiments, in response to the detection of a system risk event, the risk characteristic information of the system risk event is obtained, including: triggering a system check task according to a pre-configured scheduled task rule; executing the system check task to obtain system operation data; comparing the system operation data with predefined check rule parameters; when the system operation data does not meet the check rule parameters, determining that a system risk event has been detected, and generating corresponding risk characteristic information.

[0116] In the embodiments of this application, the scheduled task rule refers to a pre-set plan rule that controls when the inspection task is executed. The scheduled task rule can specify the execution cycle or specific time point of the inspection task, such as "execute once every 5 minutes" or "execute at 2:00 AM every day".

[0117] In the embodiments of this application, a system check task refers to a packaged program unit used to detect specific system indicators or states. Each check task has a clear check objective, such as checking the database connection status, checking disk space usage, or checking whether a specific process is alive.

[0118] In the embodiments of this application, a system check task is triggered according to pre-configured scheduled task rules. The system's built-in scheduled task scheduler runs continuously and automatically starts the corresponding system check task at a specified time point according to the preset scheduled task rules, thereby initiating a round of risk detection.

[0119] For example, a scheduled task rule is set to "execute once every 30 minutes". Based on this rule, the scheduler will automatically trigger a system check task called "check database tablespace usage" every 30 minutes.

[0120] In the embodiments of this application, system operation data refers to the raw data results obtained by querying system status, executing probe commands, or accessing monitoring interfaces during the execution of system inspection tasks. System operation data can reflect the actual operating status of a certain aspect of the system.

[0121] In the embodiments of this application, a system check task is performed to obtain system operation data. The triggered system check task starts running, which collects real-time status information of the target system components by performing predefined check operations, and returns this information as system operation data.

[0122] In the embodiments of this application, system operation data is compared with predefined inspection rule parameters. When the system operation data does not meet the inspection rule parameters, a system risk event is detected, and corresponding risk characteristic information is generated. Inspection rule parameters refer to normal thresholds or compliance standards pre-set for each system inspection task.

[0123] In the embodiments of this application, the system compares the acquired real-time system operation data with predefined inspection rule parameters (such as "tablespace utilization should not exceed 90%). If the data indicates an abnormal state (such as a tablespace utilization of 95%), it is determined that a system risk event has been detected, and risk characteristic information for subsequent handling is generated based on this abnormal data.

[0124] For example, the check rule parameter is set to "tablespace utilization threshold: 90%". When the system operation data shows that the utilization rate of a certain critical tablespace is 95%, the system determines this as an anomaly and generates risk characteristic information, which may include: risk type "insufficient resources", risk source "this tablespace", and risk indicator "utilization rate: 95%".

[0125] Through the embodiments of this application, pre-configured timed tasks are used to proactively perform checks and compare data, thereby achieving proactive and periodic detection of system risks. This enables the timely discovery of potential hidden dangers, avoids the delay of passively waiting for alarms, and improves the efficiency of the system risk handling method of this embodiment.

[0126] Based on the above-described system risk mitigation methods, this disclosure also provides a system risk mitigation device. The following will be combined with... Figure 4 The device is described in detail.

[0127] Figure 4 A schematic block diagram of a system risk management apparatus according to an embodiment of the present disclosure is shown.

[0128] like Figure 4 As shown, the system risk handling device 400 of this embodiment includes an acquisition module 410, a judgment module 420, a first generation module 430, a second generation module 440, and an execution module 450.

[0129] The acquisition module 410 is used to acquire risk characteristic information of a system risk event in response to the detection of such an event. In one embodiment, the acquisition module 410 may be used to perform the operation S210 described above, which will not be repeated here.

[0130] The judgment module 420 is used to determine, based on the risk characteristic information, whether there is a pre-configured treatment rule that matches the risk characteristic information. In one embodiment, the judgment module 420 can be used to execute the operation S220 described above, which will not be repeated here.

[0131] The first generation module 430 is used to generate a first processing instruction according to a pre-configured processing rule if a matching pre-configured processing rule exists. In one embodiment, the first generation module 430 can be used to execute the operation S230 described above, which will not be repeated here.

[0132] The second generation module 440 is used to process risk characteristic information using a risk handling model to obtain a second handling instruction if no matching pre-configured handling rule exists. The risk handling model is trained based on historical risk characteristic information and corresponding historical handling records. In one embodiment, the second generation module 440 can be used to execute the operation S240 described above, which will not be repeated here.

[0133] The execution module 450 is used to execute a first handling instruction or a second handling instruction to handle system risk events. In one embodiment, the execution module 450 can be used to execute the operation S250 described above, which will not be repeated here.

[0134] According to embodiments of this disclosure, pre-configured rules enable rapid response and automatic repair of known risks, significantly improving handling efficiency and reliability. The risk handling model endows the system with intelligent decision-making capabilities to cope with unknown and complex risks, effectively expanding the coverage of automated operation and maintenance and reducing the risk of handling failures due to missing rules. The method of this embodiment forms a complete closed loop from risk perception and intelligent decision-making to automatic execution, greatly improving the system's self-healing ability and overall stability, and reducing operation and maintenance costs and human error.

[0135] According to embodiments of this disclosure, any multiple modules among the acquisition module 410, judgment module 420, first generation module 430, second generation module 440, and execution module 450 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the acquisition module 410, judgment module 420, first generation module 430, second generation module 440, and execution module 450 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the acquisition module 410, the judgment module 420, the first generation module 430, the second generation module 440, and the execution module 450 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0136] In some embodiments, the determination module includes: a query submodule, used to query the corresponding handling rule field from the pre-configured operation and maintenance job definition table based on the risk type information indicated by the risk characteristic information; and a determination submodule, used to determine that there exists a pre-configured handling rule that matches the risk characteristic information if a valid handling rule field corresponding to the risk type information is found.

[0137] In some embodiments, the query submodule includes: a matching unit, used to match risk type information with the inspection rule parameters of multiple job entries in the operation and maintenance job definition table; and a processing unit, used to read the disposal method field, disposal rule field, and disposal processing class field of the target job entry as valid disposal rule fields if a target job entry is matched.

[0138] In some embodiments, the first generation module includes: a determining submodule, configured to determine the disposal operation type based on the disposal method field in the pre-configured disposal rule; a calling submodule, configured to call the processing program corresponding to the disposal processing class field in the pre-configured disposal rule based on the disposal operation type; and a first generation submodule, configured to parse the disposal rule field in the pre-configured disposal rule through the processing program to generate a first disposal instruction.

[0139] In some embodiments, the second generation module includes: a first processing submodule, used to preprocess the risk feature information, replacing the dynamic parameters therein with constant markers to obtain standardized risk information; a second processing submodule, used to input the standardized risk information into a risk management model to obtain management measures output by the risk management model; and a second generation submodule, used to generate a second management instruction based on the management measures.

[0140] In some embodiments, the apparatus further includes: a processing module, configured to acquire alarm information of the system risk event, executed handling instruction information, and handling result information after executing the first handling instruction or the second handling instruction; a storage module, configured to associate and store the alarm information, executed handling instruction information, and handling result information in a handling record log table; and a third generation module, configured to generate an analysis report of the system risk event based on the handling record log table.

[0141] In some embodiments, the acquisition module includes: a third processing submodule, used to trigger a system check task according to a pre-configured timed task rule; a fourth processing submodule, used to execute the system check task and acquire system operation data; and a fifth processing submodule, used to compare the system operation data with predefined check rule parameters, and when the system operation data does not meet the check rule parameters, to determine that a system risk event has been monitored and to generate corresponding risk feature information.

[0142] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a system risk mitigation method according to an embodiment of the present disclosure.

[0143] like Figure 5As shown, an electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0144] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 502 and / or RAM 503. It should be noted that programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

[0145] According to embodiments of this disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0146] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0147] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0148] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the item recommendation method provided in the embodiments of this disclosure.

[0149] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0150] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0151] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0152] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0153] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0154] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0155] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for handling systemic risks, characterized in that, The method includes: In response to the detection of a system risk event, the risk characteristic information of the system risk event is obtained; Based on the risk characteristic information, determine whether there is a pre-configured handling rule that matches the risk characteristic information; If a matching pre-configured handling rule exists, a first handling instruction is generated according to the pre-configured handling rule; If no matching pre-configured handling rule exists, the risk characteristic information is processed using a risk handling model to obtain a second handling instruction, wherein the risk handling model is trained based on historical risk characteristic information and corresponding historical handling records; Execute the first handling instruction or the second handling instruction to handle the system risk event.

2. The method according to claim 1, characterized in that, The step of determining whether a pre-configured handling rule matches the risk characteristic information includes: Based on the risk type information indicated by the risk characteristic information, the corresponding handling rule field is queried from the pre-configured operation and maintenance job definition table; If a valid handling rule field corresponding to the risk type information is found, it is determined that there is a pre-configured handling rule that matches the risk characteristic information.

3. The method according to claim 2, characterized in that, The step of querying the corresponding handling rule field from the pre-configured operation and maintenance job definition table based on the risk type indicated by the risk characteristic information includes: The risk type information is matched with the inspection rule parameters of multiple job entries in the operation and maintenance job definition table; If a target job entry is matched, the processing method field, processing rule field, and processing class field of the target job entry are read as the valid processing rule field.

4. The method according to claim 1, characterized in that, The step of generating a first processing instruction according to the pre-configured processing rules includes: The type of disposal operation is determined based on the disposal method field in the pre-configured disposal rules; Based on the disposal operation type, the processing program corresponding to the disposal processing class field in the pre-configured disposal rule is invoked; The processing program parses the processing rule field in the pre-configured processing rule to generate the first processing instruction.

5. The method according to claim 1, characterized in that, The process of using a risk management model to process the risk characteristic information to obtain a second management instruction includes: The risk feature information is preprocessed by replacing the dynamic parameters with constant markers to obtain standardized risk information. The standardized risk information is input into the risk management model to obtain the management measures output by the risk management model; The second disposal instruction is generated based on the disposal measures.

6. The method according to claim 1, characterized in that, After executing the first disposal instruction or the second disposal instruction, the method further includes: Obtain alarm information, executed handling instructions, and handling results information for the system risk events; The alarm information, the executed handling instructions, and the handling results are associated and stored in the handling record log table; An analysis report of the system risk event is generated based on the aforementioned handling record log table.

7. The method according to claim 1, characterized in that, The step of responding to the detection of a system risk event by obtaining the risk characteristic information of the system risk event includes: Trigger system check tasks according to pre-configured scheduled task rules; Perform the system check task to obtain system operation data; The system operation data is compared with predefined inspection rule parameters. When the system operation data does not meet the inspection rule parameters, a system risk event is detected, and corresponding risk feature information is generated.

8. A system risk management device, characterized in that, The device includes: The acquisition module is used to acquire risk characteristic information of a system risk event in response to the detection of such event. The judgment module is used to determine, based on the risk feature information, whether there is a pre-configured handling rule that matches the risk feature information; The first generation module is used to generate a first processing instruction according to the pre-configured processing rule if a matching pre-configured processing rule exists. The second generation module is used to process the risk feature information using a risk handling model to obtain a second handling instruction if no matching pre-configured handling rule exists. The risk handling model is trained based on historical risk feature information and corresponding historical handling records. An execution module is used to execute the first handling instruction or the second handling instruction to handle the system risk event.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images