Software migration evaluation method and device and electronic equipment

Abstract

The invention relates to a software migration evaluation method and device and electronic equipment, and the method comprises the steps: obtaining to-be-migrated software, and an original environment and a target environment of the software; determining a dependency graph and component data of the software; according to the dependency graph, the component data, the original environment and the target environment, determining evaluation data of the software on at least one of the following evaluation dimensions: a compatibility dimension, a migration workload dimension, a vulnerability dimension and a compliance dimension; determining a migration evaluation report of the software according to the evaluation data on the at least one evaluation dimension; according to the method, the software can be evaluated in one evaluation dimension in combination with the dependency graph and the component data of the software, and then the migration evaluation report is generated, so that comprehensive evaluation before migration of the software is realized, the evaluation accuracy is improved, and the evaluation efficiency is improved.

Description

Technical Field

[0001] This disclosure relates to the field of software migration technology, and in particular to a software migration assessment method, apparatus, and electronic device. Background Technology

[0002] The current software migration process includes the following steps: assessing the difficulty of software migration, determining alternative software solutions, migrating the software to an independent and controllable platform based on the alternative solutions, performing database migration, application optimization, and testing and verification to complete the software migration process.

[0003] The above approach focuses primarily on the difficulty of database migration or application optimization when assessing the difficulty of software migration. This approach is incomplete, has low accuracy, and is inefficient. Summary of the Invention

[0004] This disclosure provides a software migration assessment method, apparatus, and electronic device.

[0005] According to a first aspect of the present disclosure, a software migration assessment method is provided, the method comprising: acquiring software to be migrated, and the original environment and target environment of the software; determining the dependency graph and component data of the software; determining assessment data of the software on at least one of the following assessment dimensions based on the dependency graph, the component data, the original environment and the target environment: compatibility dimension, migration workload dimension, vulnerability dimension and compliance dimension; and determining a migration assessment report of the software based on the assessment data on the at least one assessment dimension.

[0006] In one embodiment of this disclosure, determining the dependency graph and component data of the software includes: performing dependency analysis on the software code using a code analysis tool to obtain at least one dependency in the software; determining the dependency graph based on the at least one dependency; and extracting and combining open-source components and / or third-party components called in the software to obtain the component data.

[0007] In one embodiment of this disclosure, the step of extracting and combining open-source components and / or third-party components called in the software to obtain the component data includes: performing third-party component extraction processing on the software code according to a code understanding model to obtain the third-party components called in the software; performing open-source component extraction processing on the software code according to open-source component fingerprint information to obtain the open-source components called in the software; and combining the third-party components and the open-source components to obtain the component data.

[0008] In one embodiment of this disclosure, the method for determining the software's evaluation data in the compatibility dimension includes: obtaining a compatibility mapping table; the compatibility mapping table includes dependency mapping relationships between the original environment and the target environment, and difference information between each dependency in the dependency mapping relationship; determining the compatibility evaluation result corresponding to each dependency in the dependency graph based on the compatibility mapping table and the dependency graph; the compatibility evaluation result indicates whether the dependency is compatible, needs to be replaced, or needs to be refactored; and determining the software's evaluation data in the compatibility dimension based on the compatibility evaluation results corresponding to each dependency in the dependency graph.

[0009] In one embodiment of this disclosure, the method for determining the evaluation data of the software in the dimension of migration workload includes: predicting the migration workload of the software when migrating from the original environment to the target environment based on the compatibility evaluation results corresponding to each dependency in the dependency graph and the migration workload prediction model; the migration workload includes at least one of the following: number of lines of code modification, scope of code impact, and testing cost; and determining the evaluation data of the software in the dimension of migration workload based on the migration workload.

[0010] In one embodiment of this disclosure, the method for determining the software's vulnerability assessment data includes: determining component vulnerability data in the software based on a vulnerability knowledge graph in the target environment and the component data; performing security testing on the software code according to a static application security testing strategy to obtain non-component vulnerability data in the software; determining remediation suggestions corresponding to the component vulnerability data and the non-component vulnerability data based on the component vulnerability data, the non-component vulnerability data, and a remediation suggestion model; and determining the software's vulnerability assessment data based on the component vulnerability data, the remediation suggestions corresponding to the component vulnerability data, the non-component vulnerability data, and the remediation suggestions corresponding to the non-component vulnerability data.

[0011] In one embodiment of this disclosure, the component data includes open-source component data; the method for determining the software's compliance evaluation data includes: obtaining an open-source component knowledge graph; the open-source component knowledge graph includes license information of at least one open-source component in the original environment and the target environment; based on the open-source component data and the license information of the open-source components in the open-source component data in the original environment and the target environment, determining at least one of the following information: a license conflict list, compliance status rating information, recommended alternative components, and compliance remediation suggestions; and determining the software's compliance evaluation data based on the at least one piece of information.

[0012] In one embodiment of this disclosure, determining the migration assessment report of the software based on assessment data on the at least one assessment dimension includes: determining an assessment score on the at least one assessment dimension based on the assessment data on the at least one assessment dimension; determining a software migration feasibility rating based on the assessment scores on the at least one dimension; generating migration assessment data of the software based on the assessment data on the at least one assessment dimension and an assessment report generation model; and determining the migration assessment report based on the software migration feasibility rating and the migration assessment data.

[0013] According to a second aspect of the present disclosure, a software migration assessment apparatus is also provided. The apparatus includes: an acquisition module for acquiring software to be migrated, as well as the original environment and target environment of the software; a first determination module for determining the dependency graph and component data of the software; a second determination module for determining assessment data of the software on at least one of the following assessment dimensions based on the dependency graph, the component data, the original environment, and the target environment: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension; and a third determination module for determining a migration assessment report of the software based on the assessment data on the at least one assessment dimension.

[0014] According to a third aspect of the present disclosure, an electronic device is also provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to: implement the steps of the software migration evaluation method as described above.

[0015] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium is also provided, wherein when instructions in the storage medium are executed by a processor, the processor is able to perform the software migration evaluation method as described above.

[0016] The technical solutions provided by the embodiments of this disclosure bring at least the following beneficial effects: By acquiring the software to be migrated, along with its original and target environments; determining the software's dependency graph and component data; and based on the dependency graph, component data, original environment, and target environment, determining evaluation data for the software across at least one of the following evaluation dimensions: compatibility, migration workload, vulnerabilities, and compliance; and generating a migration evaluation report based on the evaluation data across at least one evaluation dimension, the system can combine the software's dependency graph and component data to perform an evaluation across one evaluation dimension, thereby generating a migration evaluation report. This achieves a comprehensive evaluation of the software before migration, improving evaluation accuracy and efficiency.

[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0019] Figure 1 This is a flowchart of a software migration evaluation method according to an embodiment of the present disclosure; Figure 2 This is a flowchart of a software migration evaluation method according to an embodiment of the present disclosure; Figure 3 This is a flowchart illustrating the software migration assessment process. Figure 4 This is a schematic diagram of the structure of a software migration evaluation apparatus according to an embodiment of the present disclosure; Figure 5 This is a structural block diagram of an electronic device according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0021] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0022] The current software migration process includes the following steps: assessing the difficulty of software migration, determining alternative software solutions, migrating the software to an independent and controllable platform based on the alternative solutions, performing database migration, application optimization, and testing and verification to complete the software migration process.

[0023] The above approach focuses primarily on the difficulty of database migration or application optimization when assessing the difficulty of software migration. This approach is incomplete, has low accuracy, and is inefficient.

[0024] Figure 1This is a flowchart of a software migration assessment method according to an embodiment of the present disclosure. It should be noted that the software migration assessment method of this embodiment can be applied to a software migration assessment device, which can be configured in an electronic device to enable the electronic device to perform software migration assessment functions.

[0025] The electronic device can be any device with computing capabilities, such as a terminal device, server, or platform. The following embodiments use an electronic device as an example for illustration.

[0026] like Figure 1 As shown, the method includes the following steps: Step 101: Obtain the software to be migrated, as well as the software's original environment and target environment.

[0027] In this embodiment of the disclosure, the original environment can refer to the environment in which the software was previously deployed. The target environment can refer to the environment in which the software is to be deployed. The environment can be characterized by at least one of the following: CPU architecture, operating system, database, and middleware. Different environments differ in at least one of the above-mentioned aspects.

[0028] Step 102: Determine the software dependency graph and component data.

[0029] In this embodiment of the disclosure, the software dependency graph may include various dependencies within the software and the dependencies between these dependencies. The component data may include various components within the software. These components may include, for example, third-party components or open-source components. The component data may also include license information for each component.

[0030] Step 103: Based on the dependency graph, component data, original environment, and target environment, determine the evaluation data of the software in at least one of the following evaluation dimensions: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension.

[0031] In this embodiment of the disclosure, the evaluation data on the compatibility dimension is used to indicate the compatibility of each dependency in the dependency graph between the original environment and the target environment. The compatibility of each dependency between the original and target environments includes, for example, the compatibility of the CPU architecture of each dependency in the original environment with the CPU architecture in the target environment, the compatibility of the operating system of each dependency in the original environment with the operating system in the target environment, the compatibility of the database of each dependency in the original environment with the database in the target environment, and the compatibility of the middleware of each dependency in the original environment with the middleware in the target environment.

[0032] In this embodiment of the disclosure, the evaluation data for the compatibility dimension can be determined based on the dependency graph, the original environment, and the target environment. The determination of the evaluation data for the compatibility dimension may include the following process: obtaining a compatibility mapping table; the compatibility mapping table includes the dependency mapping relationship between the original environment and the target environment, and the difference information between each dependency in the dependency mapping relationship; determining the compatibility evaluation result corresponding to each dependency in the dependency graph based on the compatibility mapping table and the dependency graph; the compatibility evaluation result indicates whether the dependency is compatible, needs to be replaced, or needs to be refactored; and determining the software's evaluation data for the compatibility dimension based on the compatibility evaluation results corresponding to each dependency in the dependency graph.

[0033] The compatibility mapping table can include dependency mappings between any two environments. These two environments can be the software's original environment and a target environment. The dependency mappings can be between dependencies that perform the same functionality in both environments. For example, if dependency A exists in the original environment and dependency B exists in the target environment, when the software needs to be migrated from the original environment to the target environment, dependency A in the software code can be replaced with dependency B. This allows the re-deployed software to perform the functionality of dependency A when deployed in the target environment.

[0034] This includes information on the differences between dependencies, such as differences in API descriptions. Specifically, for dependency A in the software code, compatibility means that when the software is deployed to the target environment, dependency A can perform its functionality at runtime; incompatibility means that when the software is deployed to the target environment, dependency A has difficulty performing its functionality at runtime. For dependency A in the software code, replacement means that dependency A can be replaced with a dependency B that has a mapping relationship, so that when the software is deployed to the target environment, dependency B can perform the functionality of dependency A at runtime.

[0035] In the context of software code, refactoring refers to the process where, in the dependency mapping relationship between the original environment and the target environment, there is no dependency B that has a mapping relationship with dependency A. Therefore, in the target environment, the dependency needs to be refactored based on the functionality of dependency A to obtain dependency C, which is used to implement the functionality of dependency A.

[0036] In this embodiment of the disclosure, the software's evaluation data in terms of compatibility may include the compatibility evaluation results corresponding to each dependency in the dependency graph, and the dependencies for replacement or reconstruction determined based on the compatibility evaluation results.

[0037] In this embodiment of the disclosure, the method for determining the evaluation data of the software in the dimension of migration workload may include the following process: predicting the migration workload of the software when migrating from the original environment to the target environment based on the compatibility evaluation results corresponding to each dependency in the dependency graph and the migration workload prediction model; the migration workload includes at least one of the following: number of lines of code modification, scope of code impact, and testing cost; and determining the evaluation data of the software in the dimension of migration workload based on the migration workload.

[0038] Specifically, for each dependency, the electronic device can input the compatibility assessment results and dependency graph corresponding to the dependency into the migration workload prediction model, so that the migration workload prediction model can predict the number of lines of code modification, the scope of code impact, and the testing cost when the dependency changes; then, by combining the number of lines of code modification, the scope of code impact, and the testing cost when each dependency changes, the migration workload is determined; and this migration workload is determined as the evaluation data of the software in the migration workload dimension.

[0039] When determining the number of lines of code to be modified, the scope of code impact, and the testing cost when a dependency changes, at least one of the following factors can be considered: the complexity of the code related to the dependency, the dependency level, and the frequency of function calls.

[0040] In this embodiment of the disclosure, the method for determining the evaluation data of the software in terms of vulnerabilities includes: determining component vulnerability data in the software based on the vulnerability knowledge graph and component data in the target environment; performing security testing on the software code according to the static application security testing strategy to obtain non-component vulnerability data in the software; determining remediation suggestions corresponding to the component vulnerability data and the remediation suggestions corresponding to the non-component vulnerability data based on the component vulnerability data, the non-component vulnerability data, and the remediation suggestion model; and determining the evaluation data of the software in terms of vulnerabilities based on the component vulnerability data, the remediation suggestions corresponding to the component vulnerability data, the non-component vulnerability data, and the remediation suggestions corresponding to the non-component vulnerability data.

[0041] The vulnerability knowledge graph can include multi-dimensional relationships between vulnerability ID, vulnerability type, vulnerability score, affected component version, and remediation recommendations. The vulnerability type describes the defect type that causes the vulnerability corresponding to the vulnerability ID. The affected component version refers to the open-source component with the vulnerability corresponding to the vulnerability ID and its version.

[0042] Non-component vulnerability data refers to vulnerability data in the code of software, excluding the code of the components. Electronic devices can use static application security testing strategies to track high-risk operations caused by sensitive inputs in this part of the code, thereby identifying the vulnerability data. Vulnerabilities involved in non-component vulnerability data include, for example, Structured Query Language (SQL) injection, buffer overflows, and privilege escalation.

[0043] In this embodiment of the disclosure, the component data may include open-source component data and third-party component data; the method for determining the software's evaluation data in the compliance dimension may include the following process: obtaining an open-source component knowledge graph; the open-source component knowledge graph includes license information of at least one open-source component in the original environment and the target environment; based on the open-source component data and the license information of the open-source component in the open-source component data in the original environment and the target environment, determining at least one of the following information: a license conflict list, compliance status rating information, recommended alternative components, and compliance remediation suggestions; based on at least one piece of information, determining the software's evaluation data in the compliance dimension.

[0044] The license information for the same open-source component may differ or conflict between the original environment and the target environment.

[0045] Among them, electronic devices can determine the list of license conflicts and the recommended alternative components for open source components in case of conflicts based on the license information of each open source component in the original environment and the target environment.

[0046] Among them, electronic devices can query the organization's policy and rule base based on the license information of open-source components in the original and target environments, and obtain compliance status rating information and compliance remediation suggestions.

[0047] Step 104: Determine the software migration assessment report based on the assessment data in at least one assessment dimension.

[0048] In this embodiment of the disclosure, the electronic device can combine evaluation data from at least one evaluation dimension to obtain a software migration evaluation report.

[0049] In the software migration assessment method of this disclosure, the software to be migrated, its original environment, and its target environment are obtained; the software's dependency graph and component data are determined; based on the dependency graph, component data, original environment, and target environment, assessment data for the software is determined on at least one of the following assessment dimensions: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension; based on the assessment data on at least one assessment dimension, a software migration assessment report is determined; wherein, by combining the software's dependency graph and component data, an assessment on one assessment dimension of the software can be performed, thereby generating a migration assessment report, achieving a comprehensive assessment of the software before migration, improving assessment accuracy and efficiency.

[0050] Figure 2 This is a flowchart of a software migration assessment method according to an embodiment of the present disclosure. It should be noted that the software migration assessment method of this embodiment can be applied to a software migration assessment device, which can be configured in an electronic device to enable the electronic device to perform software migration assessment functions.

[0051] The electronic device can be any device with computing capabilities, such as a terminal device, server, or platform. The following embodiments use an electronic device as an example for illustration.

[0052] like Figure 2 As shown, the method includes the following steps: Step 201: Obtain the software to be migrated, as well as the software's original environment and target environment.

[0053] Step 202: Perform dependency analysis on the software code using a code analysis tool to obtain at least one dependency in the software.

[0054] In this embodiment of the disclosure, the electronic device can call a code analysis tool to analyze and process the software code to obtain standard import statements and package management configuration files in the code; extract dependencies from the standard import statements and package management configuration files, and determine the dependency relationships between each dependency.

[0055] Step 203: Determine the dependency graph based on at least one dependency.

[0056] In this embodiment of the disclosure, the electronic device can construct a dependency graph with each dependency as a node and the dependency relationship between each dependency as an edge.

[0057] Step 204: Extract the open-source components and / or third-party components called in the software and combine them to obtain component data.

[0058] In this embodiment of the disclosure, the electronic device may perform step 204 as follows: extract third-party components from the software code based on the code understanding model to obtain the third-party components called in the software; extract open-source components from the software code based on the open-source component fingerprint information to obtain the open-source components called in the software; and combine the third-party components and the open-source components to obtain component data.

[0059] The process by which electronic devices extract third-party components from software code using a code understanding model to obtain the third-party components called in the software can be as follows: inputting the software code into the code understanding model, obtaining information such as the identifier of the third-party components output by the code understanding model, and determining the third-party components called in the software based on the identifier of the third-party components.

[0060] The process by which an electronic device extracts open-source components from the software code based on the fingerprint information of the open-source components to obtain the open-source components called in the software can be as follows: First, identify each code segment in the software code. Second, for each code segment, perform fingerprint extraction processing on the code segment to obtain the fingerprint information of the code segment. Third, compare the fingerprint information with the component fingerprint information of each open-source component to determine the first component fingerprint information that matches the fingerprint information. Finally, identify the open-source component to which the first component fingerprint information belongs as the open-source component called in the software.

[0061] Step 205: Based on the dependency graph, component data, original environment, and target environment, determine the evaluation data of the software in at least one of the following evaluation dimensions: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension.

[0062] Step 206: Determine the software migration assessment report based on the assessment data in at least one assessment dimension.

[0063] In this embodiment of the disclosure, the electronic device performing step 206 may, for example, determine an evaluation score for at least one evaluation dimension based on evaluation data for at least one evaluation dimension; determine a software migration feasibility rating based on the evaluation score for at least one dimension; generate software migration evaluation data based on the evaluation data for at least one evaluation dimension and an evaluation report generation model; and determine a migration evaluation report based on the software migration feasibility rating and the migration evaluation data.

[0064] Specifically, for each evaluation dimension, the electronic device can input the evaluation data for that evaluation dimension into the evaluation model corresponding to that evaluation dimension, obtain the evaluation score for that evaluation dimension output by the evaluation model, determine the weight of each evaluation dimension, perform weighted summation on the evaluation scores for each evaluation dimension based on the weight of each evaluation dimension, and obtain the software migration evaluation score; and determine the software migration feasibility rating based on the correspondence between the software migration evaluation score and the feasibility rating.

[0065] The software migration assessment data may include at least one of the following: migration workload, vulnerability distribution map, remediation suggestion list, migration path recommendation, compliance documentation, etc. For the assessment report generation model, prompt text can be set to indicate the content to be generated and the input content to be referenced when generating the content. Correspondingly, assessment data from each assessment dimension and the prompt text can be input into the assessment report generation model to obtain the migration assessment data output by the model; a software migration feasibility rating is added to the migration assessment data to obtain the migration assessment report.

[0066] It should be noted that for details regarding steps 201, 205, and 206, please refer to [the relevant documentation / reference]. Figure 1 Steps 101, 103 to 104 in the illustrated embodiment will not be described in detail here.

[0067] In the software migration assessment method of this disclosure, the following steps are taken: First, the software to be migrated, its original environment, and its target environment are obtained. Then, dependency analysis is performed on the software's code using a code analysis tool to obtain at least one dependency in the software. Based on the at least one dependency, a dependency graph is determined. Open-source components and / or third-party components called in the software are extracted and combined to obtain component data. Based on the dependency graph, component data, original environment, and target environment, assessment data for the software is determined on at least one of the following assessment dimensions: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension. Based on the assessment data on at least one assessment dimension, a software migration assessment report is determined. The method of extracting dependencies from the software using a code analysis tool to generate a dependency graph and extracting open-source components and / or third-party components called in the software to obtain component data improves the accuracy of the dependency graph and component data, thereby further improving assessment accuracy and efficiency.

[0068] The following example illustrates this. For example... Figure 3 The diagram shown illustrates the software migration assessment process. Figure 3 The process includes the following 5 steps: S1, source code (i.e., software code) dependency identification and open-source component analysis. This includes dependency extraction, open-source component identification, and license identification.

[0069] S2, target platform (i.e., target environment) compatibility assessment and migration workload prediction. This involves knowledge base (i.e., compatibility mapping table) querying, dependency hierarchy analysis, and API difference matching.

[0070] S3 stands for Security Vulnerability Detection and Vulnerability Analysis. This includes static scanning, sensitive input tracking, and high-risk pattern recognition.

[0071] S4, open-source component compliance review and license conflict detection. This includes Software Bill of Materials (SBOM) generation, clause and policy comparison, and violation identification.

[0072] S5 integrates migration assessment and intelligent repair suggestion generation. This includes scoring system integration, repair suggestion generation, and visual repair display.

[0073] Figure 4 This is a schematic diagram of the structure of a software migration evaluation apparatus according to an embodiment of the present disclosure.

[0074] like Figure 4 As shown, the software migration evaluation device may include: an acquisition module 401, a first determination module 402, a second determination module 403, and a third determination module 404.

[0075] The system includes: an acquisition module 401 for acquiring the software to be migrated, as well as the original environment and target environment of the software; a first determination module 402 for determining the dependency graph and component data of the software; a second determination module 403 for determining the evaluation data of the software on at least one of the following evaluation dimensions based on the dependency graph, the component data, the original environment, and the target environment: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension; and a third determination module 404 for determining the migration evaluation report of the software based on the evaluation data on the at least one evaluation dimension.

[0076] In one embodiment of this disclosure, the first determining module 402 is specifically configured to: perform dependency analysis on the software code using a code analysis tool to obtain at least one dependency in the software; determine the dependency graph based on the at least one dependency; and extract and combine open-source components and / or third-party components called in the software to obtain the component data.

[0077] In one embodiment of this disclosure, the first determining module 402 is further configured to: perform third-party component extraction processing on the code of the software according to the code understanding model to obtain the third-party components called in the software; perform open-source component extraction processing on the code of the software according to the open-source component fingerprint information to obtain the open-source components called in the software; and perform combination processing on the third-party components and the open-source components to obtain the component data.

[0078] In one embodiment of this disclosure, the second determining module 403 is specifically configured to: obtain a compatibility mapping table; the compatibility mapping table includes dependency mapping relationships between the original environment and the target environment, and difference information between each dependency in the dependency mapping relationships; determine the compatibility evaluation result corresponding to each dependency in the dependency graph based on the compatibility mapping table and the dependency graph; the compatibility evaluation result indicates whether the dependency is compatible, needs to be replaced, or needs to be refactored; and determine the software's evaluation data in the compatibility dimension based on the compatibility evaluation results corresponding to each dependency in the dependency graph.

[0079] In one embodiment of this disclosure, the second determining module 403 is specifically used to predict the migration workload of the software when migrating from the original environment to the target environment based on the compatibility evaluation results corresponding to each dependency in the dependency graph and the migration workload prediction model; the migration workload includes at least one of the following: number of lines of code modification, scope of code impact, and testing cost; and determine the evaluation data of the software in the migration workload dimension based on the migration workload.

[0080] In one embodiment of this disclosure, the second determining module 403 is specifically configured to: determine component vulnerability data in the software based on the vulnerability knowledge graph in the target environment and the component data; perform security testing on the software code according to a static application security testing strategy to obtain non-component vulnerability data in the software; determine remediation suggestions corresponding to the component vulnerability data and the non-component vulnerability data based on the component vulnerability data, the non-component vulnerability data, and the remediation suggestion model; and determine the software's evaluation data in the vulnerability dimension based on the component vulnerability data, the remediation suggestions corresponding to the component vulnerability data, the non-component vulnerability data, and the remediation suggestions corresponding to the non-component vulnerability data.

[0081] In one embodiment of this disclosure, the component data includes open-source component data; the second determining module 403 is specifically used to obtain an open-source component knowledge graph; the open-source component knowledge graph includes license information of at least one open-source component in the original environment and the target environment; based on the open-source component data and the license information of the open-source components in the open-source component data in the original environment and the target environment, at least one of the following information is determined: a license conflict list, compliance status rating information, recommended alternative components, and compliance remediation suggestions; based on the at least one piece of information, the software's evaluation data in the compliance dimension is determined.

[0082] In one embodiment of this disclosure, the third determining module 404 is specifically configured to: determine an evaluation score on the at least one evaluation dimension based on the evaluation data on the at least one evaluation dimension; determine a software migration feasibility rating based on the evaluation score on the at least one dimension; generate migration evaluation data for the software based on the evaluation data on the at least one evaluation dimension and an evaluation report generation model; and determine a migration evaluation report based on the software migration feasibility rating and the migration evaluation data.

[0083] In the software migration assessment apparatus of this disclosure, the software to be migrated, its original environment, and its target environment are acquired; the software's dependency graph and component data are determined; based on the dependency graph, component data, original environment, and target environment, assessment data for the software is determined in at least one of the following assessment dimensions: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension; based on the assessment data in at least one assessment dimension, a software migration assessment report is determined; wherein, by combining the software's dependency graph and component data, an assessment of the software is performed in one assessment dimension, thereby generating a migration assessment report, achieving a comprehensive assessment of the software before migration, improving assessment accuracy and efficiency.

[0084] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, and disclosure of users' personal information are all carried out with the consent of the users, and all comply with the provisions of relevant laws and regulations, and do not violate public order and good morals.

[0085] According to a third aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing processor-executable instructions, wherein the processor is configured to implement the software migration evaluation method as described above.

[0086] To implement the above embodiments, this disclosure also proposes a storage medium.

[0087] When the instructions in the storage medium are executed by the processor, the processor is able to perform the software migration evaluation method as described above.

[0088] To implement the above embodiments, this disclosure also provides a computer program product.

[0089] When the computer program product is executed by the processor of the electronic device, it enables the electronic device to perform the above-described method.

[0090] Figure 5 This is a structural block diagram of an electronic device according to an exemplary embodiment. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0091] like Figure 5 As shown, the electronic device 1000 includes a processor 111, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 112 or a program loaded from memory 116 into random access memory (RAM) 113. The RAM 113 also stores various programs and data required for the operation of the electronic device 1000. The processor 111, ROM 112, and RAM 113 are interconnected via a bus 114. An input / output (I / O) interface 115 is also connected to the bus 114.

[0092] The following components are connected to I / O interface 115: memory 116 including hard disks, etc.; and communication section 117 including network interface cards such as local area network (LAN) cards, modems, etc., communication section 117 performs communication processing via a network such as the Internet; and driver 118 is also connected to I / O interface 115 as needed.

[0093] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 117. When the computer program is executed by processor 111, it performs the functions defined in the methods of this disclosure.

[0094] In an exemplary embodiment, a storage medium including instructions is also provided, such as a memory including instructions, which can be executed by the processor 111 of the electronic device 1000 to perform the above-described method. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0095] In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can transmit, propagate, or transfer a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wireline, optical fiber, RF, etc., or any suitable combination thereof.

[0096] Furthermore, the term “exemplary” is used herein to mean serving as an example, instance, or illustration. Any aspect or design described herein as “exemplary” is not necessarily to be construed as advantageous compared to other aspects or designs. Rather, the use of the term “exemplary” is intended to present the concept in a concrete manner. As used herein, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or.” That is, unless otherwise specified or clear from the context, “X applies A or B” is intended to mean any of the natural inclusive arrangements. That is, “X applies A or B” satisfies any of the foregoing instances if X applies A; X applies B; or both X applies A and B. Additionally, unless otherwise specified or clear from the context to refer to the singular form, the articles “a” and “an” as used in this application and the appended claims are generally understood to mean “one or more.”

[0097] Similarly, although this disclosure has been shown and described with respect to one or more implementations, equivalent variations and modifications will occur to those skilled in the art upon reading and understanding this specification and the accompanying drawings. This disclosure includes all such modifications and variations and is limited only by the scope of the claims. In particular, with respect to the various functions performed by the components described above (e.g., elements, resources, etc.), unless otherwise indicated, the terminology used to describe such components is intended to correspond to any component (functionally equivalent) that performs the specific function of the described component, even if structurally not equivalent to the disclosed structure. Furthermore, although specific features of this disclosure may have been disclosed with respect to only one of several implementations, such features may be combined with one or more other features of other implementations, as may be desired and advantageous to any given or particular application. Moreover, with regard to the terms “comprising,” “owning,” “having,” “having,” or variations thereof as used in the detailed description or claims, such terms are intended to be inclusive in a manner similar to the term “including.”

[0098] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0099] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A software migration evaluation method, characterized in that, The method includes: Obtain the software to be migrated, as well as the original environment and target environment of the software; Determine the dependency graph and component data of the software; Based on the dependency graph, the component data, the original environment, and the target environment, the evaluation data of the software is determined on at least one of the following evaluation dimensions: compatibility dimension, migration workload dimension, vulnerability dimension, and compliance dimension. Based on the evaluation data in at least one evaluation dimension, a migration evaluation report for the software is determined.

2. The method according to claim 1, characterized in that, The process of determining the software's dependency graph and component data includes: The software code is analyzed for dependencies using code analysis tools to obtain at least one dependency in the software. The dependency graph is determined based on the at least one dependency. Extract the open-source components and / or third-party components called in the software and combine them to obtain the component data.

3. The method according to claim 2, characterized in that, The step of extracting and combining open-source and / or third-party components called in the software to obtain the component data includes: The code understanding model is used to extract third-party components from the software code to obtain the third-party components called in the software. The open-source component fingerprint information is used to extract the open-source components from the software code to obtain the open-source components called in the software. The third-party component and the open-source component are combined to obtain the component data.

4. The method according to claim 1, characterized in that, The methods for determining the evaluation data of the software in the compatibility dimension include: Obtain a compatibility mapping table; the compatibility mapping table includes the dependency mapping relationship between the original environment and the target environment, as well as the difference information between each dependency in the dependency mapping relationship; Based on the compatibility mapping table and the dependency graph, the compatibility evaluation result corresponding to each dependency in the dependency graph is determined; the compatibility evaluation result indicates whether the dependency is compatible, needs to be replaced, or needs to be refactored. Based on the compatibility evaluation results corresponding to each dependency in the dependency graph, the evaluation data of the software in the compatibility dimension is determined.

5. The method according to claim 4, characterized in that, The method for determining the evaluation data of the software in terms of migration workload includes: Based on the compatibility assessment results corresponding to each dependency in the dependency graph and the migration workload prediction model, the migration workload when the software is migrated from the original environment to the target environment is predicted; the migration workload includes at least one of the following: number of lines of code modification, scope of code impact, and testing cost. Based on the migration workload, the evaluation data of the software in the migration workload dimension is determined.

6. The method according to claim 1, characterized in that, The methods for determining the assessment data of the software in terms of vulnerabilities include: Based on the vulnerability knowledge graph in the target environment and the component data, the component vulnerability data in the software is determined; According to the static application security testing strategy, the software code is subjected to security testing to obtain non-component vulnerability data in the software. Based on the component vulnerability data, the non-component vulnerability data, and the remediation suggestion model, determine the remediation suggestions corresponding to the component vulnerability data and the remediation suggestions corresponding to the non-component vulnerability data; Based on the component vulnerability data, the corresponding remediation suggestions, the non-component vulnerability data, and the corresponding remediation suggestions, the evaluation data of the software in terms of vulnerabilities is determined.

7. The method according to claim 1, characterized in that, The component data includes open-source component data; the methods for determining the software's compliance assessment data include: Obtain an open-source component knowledge graph; the open-source component knowledge graph includes license information of at least one open-source component in the original environment and the target environment; Based on the open-source component data and the license information of the open-source components in the open-source component data in the original environment and the target environment, determine at least one of the following information: license conflict list, compliance status rating information, recommended alternative components, and compliance remediation suggestions; Based on the at least one piece of information, determine the evaluation data of the software in the compliance dimension.

8. The method according to claim 1, characterized in that, The step of determining the migration assessment report of the software based on the assessment data on at least one assessment dimension includes: Based on the evaluation data in the at least one evaluation dimension, determine the evaluation score in the at least one evaluation dimension; The software migration feasibility rating is determined based on the evaluation scores on at least one of the aforementioned dimensions; Based on the assessment data in at least one assessment dimension and the assessment report generation model, the migration assessment data of the software is generated; Based on the software migration feasibility rating and the migration assessment data, the migration assessment report is determined.

9. A software migration evaluation device, characterized in that, The device includes: The acquisition module is used to acquire the software to be migrated, as well as the original environment and target environment of the software; The first determining module is used to determine the dependency graph and component data of the software; The second determining module is used to determine the evaluation data of the software on at least one of the following evaluation dimensions based on the dependency graph, the component data, the original environment and the target environment: compatibility dimension, migration workload dimension, vulnerability dimension and compliance dimension. The third determining module is used to determine the migration assessment report of the software based on the assessment data on the at least one assessment dimension.

10. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured as follows: The steps of implementing the software migration evaluation method as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium, wherein instructions in the storage medium, when executed by a processor, enable the processor to perform the software migration evaluation method as described in any one of claims 1 to 8.

Images