Risk assessment method for system migration associated party

Abstract

The invention relates to the technical field of security protection, is suitable for the financial field, and provides a risk assessment method for a system migration associated party, and the method comprises the steps: obtaining traffic information; based on the flow information, determining an IP address pair of bidirectional communication of the to-be-migrated system within a specified time period and first attribute information of the IP address pair; performing clustering processing on all the IP address pairs based on the first attribute information to obtain a plurality of IP address pair clusters, and extracting second attribute information of each IP address pair cluster for each IP address pair cluster; selecting a target cluster of which the second attribute information meets a predetermined high-frequency access condition from the plurality of IP address pair clusters; for each IP address in the target cluster, determining the risk degree of the IP address through a predetermined risk assessment strategy; and determining the risk level of the IP address according to the risk level corresponding to the risk degree. According to the scheme, automatic and accurate identification and evaluation of the system migration associated parties and the potential risks thereof are realized.

Description

Technical Field

[0001] This application relates to the field of security protection technology, applicable to the financial sector, and particularly to a risk assessment method for stakeholders in system migration. Background Technology

[0002] Currently, China's financial sector is facing serious security issues. To ensure the security of the financial system, a large-scale system migration and localization transformation are necessary.

[0003] System migration methods in related technologies often rely on manually reviewing historical architecture documents and static configuration data to identify related systems of the system to be migrated. However, this manual approach has significant shortcomings. Specifically, historical architecture documents are frequently missing or outdated, making it difficult to comprehensively and accurately reflect the dependencies between systems. Furthermore, manual review is inefficient and prone to overlooking key stakeholders, significantly increasing the risk of system migration failure. This overall migration assessment process cannot effectively identify stakeholders and therefore cannot detect potential risks during the migration process, thus affecting the security of the system migration.

[0004] Therefore, how to automatically and efficiently identify related parties in a financial system during migration, and promptly detect the risk level of these related parties to the system migration, has become an urgent technical problem to be solved. Summary of the Invention

[0005] This application provides a risk assessment method for related parties in system migration, aiming to solve the technical problem in the related art of efficiently and accurately identifying related parties of the financial system and the risks brought by related parties during the migration of the financial system.

[0006] In a first aspect, embodiments of this application provide a risk assessment method for stakeholders involved in system migration, including: Obtain traffic information of the network traffic management and distribution devices of the system to be migrated within a specified time period; Based on the traffic information, determine the IP address pairs that have bidirectional communication in the system to be migrated during the specified time period and the first attribute information of the IP address pairs, wherein the first attribute information is used to reflect the performance characteristics of the bidirectional communication behavior of the IP address pairs during the specified time period. Based on the first attribute information, all the IP address pairs are clustered to obtain multiple IP address pair clusters. For each IP address pair cluster, the second attribute information of the IP address pair cluster is extracted. The second attribute information is used to reflect the performance characteristics of the IP address pair cluster that are related to the IP address access frequency. Among the multiple IP address pairs, select the target cluster whose second attribute information satisfies the predetermined high-frequency access conditions; For each IP address within the target cluster, the risk level of the IP address is determined using a predetermined risk assessment strategy. The risk level corresponding to the risk degree is used to determine the risk level of the IP address.

[0007] Optionally, in one embodiment of this application, obtaining the traffic information of the network traffic management and distribution device of the system to be migrated within a specified time period includes: The F5 load balancer captures the network traffic management and distribution equipment of the system to be migrated within a specified time period, wherein the length of the specified time period is determined based on the risk level of the target migration task of the system to be migrated.

[0008] In one embodiment of this application, optionally, the first attribute information includes multiple items from the following: access frequency of bidirectional communication between the IP address pairs, single session duration, total session duration, communication protocol type, and communication port distribution. Then, the step of clustering all the IP address pairs based on the first attribute information to obtain multiple IP address pair clusters includes: Using each of the first attribute information items as a clustering reference dimension, the K-means clustering algorithm is used to cluster all the IP address pairs that have bidirectional communication in the system to be migrated within the specified time period, resulting in multiple IP address pair clusters.

[0009] Optionally, in one embodiment of this application, extracting the second attribute information of the IP address pair cluster includes: Extract the average access frequency of each IP address pair within the cluster, the total number of communication events occurring per unit time within the cluster, the proportion of IP addresses with high-frequency communication within the cluster, and the proportion of concentrated occurrence periods of communication events within the cluster.

[0010] In one embodiment of this application, optionally, selecting a target cluster from the plurality of IP address pair clusters whose second attribute information satisfies a predetermined high-frequency access condition includes: Among the multiple IP address pairs, select a target cluster whose second attribute information satisfies one or more of the following predetermined high-frequency access conditions. The average access frequency of each IP address pair within the cluster is greater than or equal to a specified access frequency threshold. The total number of communication events occurring within the cluster per unit time is greater than or equal to a specified threshold for the number of communication events. The proportion of IP addresses that engage in high-frequency communication within the cluster is greater than or equal to a first proportion threshold. The proportion of concentrated occurrence periods of the intra-cluster communication events is greater than or equal to the second proportion threshold.

[0011] In one embodiment of this application, optionally, before determining the risk level of the IP address through a predetermined risk assessment strategy, the method further includes: For each IP address within the target cluster, the third attribute information of the IP address is queried through the UCMDB interface. The third attribute information is used to reflect the performance characteristics of the IP address in terms of infrastructure configuration and business affiliation, including the business system, application level, person in charge, and deployment environment of the IP address. Based on the third attribute information, IP addresses of a specified type are identified and deleted from the target cluster. The specified type of IP address includes: IP addresses with environment type identifier of test environment, IP addresses with environment type identifier of development environment, and IP addresses with application layer identifier of production environment are identified and retained in the target cluster.

[0012] Optionally, in one embodiment of this application, determining the risk level of the IP address through a predetermined risk assessment strategy includes: The product of the access frequency of the IP address and the total session duration is used as the overall risk coefficient. The overall risk coefficient is determined as the ratio of the amount of data generated by the IP address during the total session duration, and this ratio is used as the risk level of the IP address.

[0013] Optionally, in one embodiment of this application, determining the risk level of the IP address through a predetermined risk assessment strategy includes: Based on the first attribute information of the IP address pair to which the IP address belongs, the second attribute information of the IP address pair cluster to which the IP address belongs, and the third attribute information of the IP address, a multidimensional risk feature vector of the IP address is determined. Using the multidimensional risk feature vector as input information for a predetermined risk assessment model, the risk level of the IP address is determined through the predetermined risk assessment model. The predetermined risk assessment model is used to reflect the correlation between the multidimensional features of the IP address and the risk level of the IP address when the system to be migrated is migrated by the target migration task.

[0014] Secondly, embodiments of this application provide a risk assessment device for parties involved in system migration, including: The traffic information acquisition unit is used to acquire the traffic information of the network traffic management and distribution equipment of the system to be migrated within a specified time period. The first attribute information determination unit is used to determine, based on the traffic information, the IP address pairs that have bidirectional communication in the system to be migrated during the specified time period and the first attribute information of the IP address pairs, wherein the first attribute information is used to reflect the performance characteristics of the bidirectional communication behavior of the IP address pairs during the specified time period. A clustering unit is used to perform clustering processing on all the IP address pairs based on the first attribute information to obtain multiple IP address pair clusters; The second attribute information determination unit is used to extract the second attribute information of each IP address pair cluster, wherein the second attribute information is used to reflect the performance characteristics of the IP address pair cluster related to the IP address access frequency. The target cluster filtering unit is used to select, from among the multiple IP address pair clusters, the target cluster whose second attribute information satisfies the predetermined high-frequency access conditions; The risk determination unit is used to determine the risk level of each IP address within the target cluster using a predetermined risk assessment strategy. A risk level determination unit is used to determine the risk level of the IP address by assigning the risk level corresponding to the risk degree.

[0015] Optionally, in one embodiment of this application, the traffic information acquisition unit is configured to: capture the traffic information of the network traffic management and distribution device of the system to be migrated within a specified time period through an F5 load balancer, wherein the length of the specified time period is determined based on the risk level of the target migration task of the system to be migrated.

[0016] Optionally, in one embodiment of this application, the first attribute information includes multiple items among the following: access frequency of bidirectional communication between the IP address pairs, duration of a single session, total session duration, communication protocol type, and communication port distribution. In this case, the clustering unit is used to: use each item of the first attribute information as a clustering reference dimension, and use the K-means clustering algorithm to cluster all the IP address pairs that have bidirectional communication in the system to be migrated within the specified time period to obtain multiple IP address pair clusters.

[0017] In one embodiment of this application, optionally, the second attribute information determining unit is used to: extract the average access frequency of each IP address pair within the IP address pair cluster, the total number of communication events occurring within the cluster per unit time, the proportion of IP addresses that have high-frequency communication within the cluster, and the proportion of concentrated occurrence time periods of communication events within the cluster.

[0018] In one embodiment of this application, optionally, the target cluster filtering unit is configured to: select, from a plurality of IP address pair clusters, a target cluster whose second attribute information satisfies one or more of the following predetermined high-frequency access conditions: the average access frequency of each IP address pair within the cluster is greater than or equal to a specified access frequency threshold; the total number of communication events occurring within the cluster per unit time is greater than or equal to a specified communication event number threshold; the proportion of IP addresses in the cluster that experience high-frequency communication is greater than or equal to a first proportion threshold; and the proportion of concentrated occurrence periods of communication events within the cluster is greater than or equal to a second proportion threshold.

[0019] Optionally, in one embodiment of this application, the device further includes: The third attribute information determination unit is used to query the third attribute information of each IP address in the target cluster through the UCMDB interface before determining the risk level of the IP address. The third attribute information is used to reflect the performance characteristics of the IP address in terms of infrastructure configuration and business affiliation, including the business system, application level, person in charge and deployment environment of the IP address. The target cluster internal filtering unit is used to identify and delete IP addresses of a specified type in the target cluster by combining the third attribute information. The specified type of IP address includes: IP addresses with environment type identifier of test environment, IP addresses with environment type identifier of development environment, and IP addresses with application layer identifier of production environment in the target cluster.

[0020] Optionally, in one embodiment of this application, the risk determination unit includes: The first risk calculation unit is used to obtain the product of the access frequency of the IP address and the total session duration as the overall risk coefficient, and to determine the ratio of the overall risk coefficient to the amount of data generated by the IP address within the total session duration as the risk level of the IP address.

[0021] Optionally, in one embodiment of this application, the risk determination unit includes: The second risk calculation unit is used to determine a multidimensional risk feature vector of the IP address based on the first attribute information of the IP address pair to which the IP address belongs, the second attribute information of the IP address pair cluster to which the IP address belongs, and the third attribute information of the IP address. The multidimensional risk feature vector is used as input information for a predetermined risk assessment model to determine the risk level of the IP address. The predetermined risk assessment model is used to reflect the correlation between the multidimensional features of the IP address and the risk level of the IP address when the system to be migrated is migrated by the target migration task.

[0022] Thirdly, embodiments of this application provide a computer device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being configured to perform the method described in the first aspect above.

[0023] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions for performing the method described in the first aspect above.

[0024] The above technical solution addresses the technical challenge of efficiently and accurately identifying related parties and the risks they pose during the migration of financial systems. By collecting real-time network traffic information before system migration, it identifies and clusters related parties communicating with the system to be migrated, thereby filtering out high-frequency access target clusters and quantifying the migration risks of related parties within each cluster. This achieves automatic and accurate identification and assessment of migration related parties and their potential risks, avoiding the omissions of related parties and inaccurate risk assessments caused by manual sorting in other technologies. This significantly improves the security and increases the efficiency of the financial system migration process. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A flowchart is shown for a risk assessment method for system migration stakeholders according to an embodiment of this application; Figure 2A flowchart is shown for a risk assessment method for system migration stakeholders according to another embodiment of this application; Figure 3 A block diagram of a computer device according to one embodiment of this application is shown; Figure 4 A block diagram of a computer device according to another embodiment of this application is shown. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] Figure 1 A flowchart of a risk assessment method for system migration stakeholders according to an embodiment of this application is shown.

[0029] like Figure 1 As shown, a risk assessment method for system migration stakeholders according to an embodiment of this application includes: Step 102: Obtain the network traffic management and distribution device of the system to be migrated within a specified time period.

[0030] A system to be migrated refers to a financial system whose underlying hardware and software platforms need to be replaced to improve security. The network traffic management and distribution equipment of the system to be migrated is used to receive, analyze, schedule, and forward network data flowing through it to achieve load balancing and ensure efficient network services. The designated time period is the stage for assessing the risks of stakeholders involved in the system migration before the migration. In short, the traffic information from the network traffic management and distribution equipment of the system to be migrated during the designated time period reflects the communication status between the system to be migrated and its stakeholders, and this communication status can serve as a basis for identifying the stakeholders of the system to be migrated.

[0031] It should be noted that the entity executing this application can be the system to be migrated itself, a working system specifically used for migration, or external tools such as scripts.

[0032] Step 104: Based on the traffic information, determine the IP address pairs that have bidirectional communication in the system to be migrated within the specified time period and the first attribute information of the IP address pairs.

[0033] An IP address pair refers to two IP addresses that engage in bidirectional communication within the system to be migrated during a specified time period. Traffic information may involve multiple IP address pairs. Next, the first attribute information of each IP address pair is obtained. That is, based on the communication between the system to be migrated and its related parties as reflected in the traffic information, the characteristics of the bidirectional communication behavior between the system to be migrated and each related party are determined. Specifically, the first attribute information can be said to reflect the characteristics of the bidirectional communication behavior of the IP address pair within the specified time period.

[0034] Step 106: Based on the first attribute information, cluster all the IP address pairs to obtain multiple IP address pair clusters, and for each IP address pair cluster, extract the second attribute information of the IP address pair cluster.

[0035] Optionally, the first attribute information of an IP address pair includes, but is not limited to, multiple factors such as the access frequency of bidirectional communication between the IP address pair, the duration of a single session, the total session duration, the communication protocol type, and the distribution of communication ports. These multiple first attribute information factors reflect the communication performance of the system to be migrated and its related parties across multiple communication behavior dimensions. Based on the first attribute information, all IP address pairs are clustered, that is, multiple communication behavior dimensions are considered simultaneously for clustering, grouping IP address pairs with similar communication performance into a single cluster. In other words, each IP address pair cluster is a set of IP address pairs with similar communication performance.

[0036] Next, the second attribute information of the IP address pair clusters is extracted. This second attribute information reflects the performance characteristics of the IP address pair clusters related to the IP address access frequency. In other words, for each cluster of clustered IP address pairs, the performance characteristics related to the IP address access frequency of each cluster are extracted as a basis for determining whether the cluster is accessed frequently. Specifically, the higher the access frequency of an IP address pair cluster, the greater the risk posed by the associated parties corresponding to its IP addresses to the subsequent system migration work.

[0037] In one possible design, the second attribute information includes, but is not limited to: the average access frequency of each IP address pair within the IP address pair cluster, the total number of communication events occurring per unit time within the cluster, the proportion of IP addresses within the cluster experiencing high-frequency communication, and the proportion of concentrated periods of communication events within the cluster. Each item of the second attribute information reflects the frequency of access to the IP address pair cluster in a communication performance dimension. It can be said that the higher the frequency of access to the IP address pair cluster, the greater the risk posed by the associated parties corresponding to the IP addresses within it to the subsequent system migration work. Therefore, the second attribute information serves as the basis for screening IP address pair clusters that pose a high risk to the subsequent system migration work.

[0038] Step 108: Select a target cluster from the multiple IP address pairs that satisfies the predetermined high-frequency access conditions based on the second attribute information.

[0039] The predetermined high-frequency access condition refers to the high-frequency access level required when a cluster of IP address pairs poses a high risk to the subsequent system migration. Specifically, among multiple IP address pair clusters, a target cluster is selected that satisfies one or more of the following predetermined high-frequency access conditions: the average access frequency of each IP address pair within the cluster is greater than or equal to a specified access frequency threshold; the total number of communication events occurring within the cluster per unit time is greater than or equal to a specified communication event number threshold; the proportion of IP addresses in the cluster that engage in high-frequency communication is greater than or equal to a first proportion threshold; and the proportion of concentrated occurrence periods of communication events within the cluster is greater than or equal to a second proportion threshold.

[0040] Therefore, by setting multiple conditions to quantify the level of high-frequency access, IP address pairs with high-frequency communication characteristics can be accurately screened from all IP address pairs, serving as the main focus of subsequent risk assessment of related parties.

[0041] Step 110: For each IP address within the target cluster, determine the risk level of the IP address using a predetermined risk assessment strategy.

[0042] At this point, for the selected target clusters, the risk level of each IP address's associated party to this migration operation can be verified.

[0043] In one possible design, the product of the IP address's access frequency and the total session duration is used as the overall risk coefficient. The ratio of this overall risk coefficient to the amount of data generated by the IP address within the total session duration is then determined as the IP address's risk level. In other words, the IP address's risk level K is set as (IP address access frequency × IP address total session duration) ÷ IP address amount of data generated within the total session duration. This calculation method quantifies the relationship between the communication frequency, communication duration, and data interaction scale between the stakeholders and the system to be migrated, transforming this abstract relationship into a concrete risk coefficient, thus achieving an objective assessment of the stakeholders' potential impact on this system migration.

[0044] In another possible design, a multidimensional risk feature vector of the IP address is determined based on the first attribute information of the IP address pair to which the IP address belongs, the second attribute information of the IP address cluster to which the IP address belongs, and the third attribute information of the IP address. The multidimensional risk feature vector is then used as input information for a predetermined risk assessment model, and the risk level of the IP address is determined through the predetermined risk assessment model.

[0045] Specifically, the first attribute information of the IP address pair to which the IP address belongs, the second attribute information of the IP address cluster to which the IP address belongs, and the third attribute information of the IP address can be encoded and normalized respectively to obtain a set of feature values ​​for multiple attribute information. Next, a feature value matrix is ​​constructed based on the feature value set, where the element in the m-th row and n-th column of the feature value matrix is ​​the square root of the product of the feature values ​​of the m-th and n-th attribute information among all the attribute information of the first, second, and third attribute information. Further, the elements of the feature value matrix are weighted, with the weight of each element equal to the average weight of the two attribute information of that element.

[0046] Thus, based on the weighted eigenvalue matrix, the multidimensional risk feature vector of the IP address is determined. Specifically, the elements of each column of the weighted eigenvalue matrix are aggregated by summation or averaging to obtain a one-dimensional vector representing the comprehensive risk of the IP address, i.e., the multidimensional risk feature vector of the IP address.

[0047] Finally, the multidimensional risk feature vector of the IP address is input into a predetermined risk assessment model, which calculates the risk level of the associated party to which the IP address belongs in this migration. The predetermined risk assessment model reflects the correlation between the multidimensional features of the IP address and its associated party, which combine the first attribute information of the IP address pair, the second attribute information of the IP address cluster, and the third attribute information of the IP address, and the risk level of the IP address when the system to be migrated is migrated by the target migration task. This model is trained using the multidimensional risk feature vector of IP addresses from historical data and known risk level scores.

[0048] Step 112: Determine the risk level of the IP address by assigning the risk level to the risk degree.

[0049] Here, the predetermined risk range to which the risk level belongs can be determined, and the risk level corresponding to the predetermined risk range can be used to determine the risk level of the IP address.

[0050] In one possible design, a three-level risk warning system is established for the risk level K. The first level is red, K≥0.8, indicating a strong dependency, in which the related party and the system to be migrated need to be migrated synchronously. The second level is yellow, 0.3≤K<0.8, indicating a weak dependency, in which the related party and the system to be migrated can be migrated asynchronously. The third level is green, K<0.3, indicating a non-critical dependency, in which the related party does not need to be migrated.

[0051] The above technical solution, by collecting real-time network traffic information before system migration, identifies and clusters the related parties communicating with the system to be migrated, thereby filtering out the target clusters with high-frequency access and quantifying the migration risks of the related parties within the clusters. This achieves automatic and accurate identification and assessment of the migration related parties and their potential risks of the system to be migrated, avoiding the defects of related parties being missed and risk assessments being inaccurate due to manual sorting in related technologies. It significantly improves the security of the financial system migration process and increases migration efficiency.

[0052] In a real-world scenario, Bank A plans to migrate its core transaction system from a foreign commercial platform to a domestically developed software and hardware platform. To ensure the security of the migration process, it is necessary to accurately identify all stakeholders who have business interactions with the core transaction system and their migration risks.

[0053] First, during the assessment phase prior to the migration of the core transaction system, a complete seven-day production network traffic mirror was obtained using an F5 load balancer deployed in front of the core transaction system. This seven-day traffic information fully recorded the actual communication between the core transaction system and all external services.

[0054] Next, by analyzing the traffic information over the past seven days, all IP address pairs that engaged in bidirectional communication with the core transaction system were automatically identified. These included communication connections with the payment clearing system, customer points system, and risk control system. The access frequency, session duration, and port used for each communication pair were extracted as primary attributes, objectively reflecting the interactive behavior characteristics between systems. Subsequently, all IP address pairs were clustered based on these primary attributes, forming multiple clusters with similar communication patterns. For each cluster, secondary attributes such as average access frequency and the total number of communication events per unit time were further calculated to characterize the access activity of each cluster.

[0055] At this point, a few target clusters that meet the preset high-frequency access criteria can be selected. High-frequency access criteria could include an average access frequency exceeding five times per minute and over 70% of the IPs belonging to high-frequency communication. The related parties corresponding to these target clusters, such as payment clearing systems and real-time risk control systems, are identified as potentially high-risk entities requiring close monitoring during the migration process due to their extremely frequent interactions with the core transaction system.

[0056] Then, for each IP address within the target cluster, i.e., each associated system, a predetermined risk assessment strategy is used for calculation. For example, for the IP of the payment clearing system, a higher risk level K value is calculated using a formula based on its high access frequency, long total session duration, and amount of interactive data.

[0057] Finally, based on the calculated risk level K, a risk level is automatically assigned to each related party: the payment and settlement system is marked as a red alert because the K value is greater than 0.8, the customer points system is marked as a yellow alert because the K value is between 0.3 and 0.8, and the internal log system is marked as a green alert because the K value is less than 0.3.

[0058] Based on this classification result, the migration team was able to develop differentiated and precise migration strategies and contingency plans, thereby significantly improving the overall success rate and security of this core system localization migration.

[0059] Figure 2 A flowchart of a risk assessment method for system migration stakeholders according to another embodiment of this application is shown.

[0060] like Figure 2 As shown, a risk assessment method for system migration stakeholders according to another embodiment of this application includes: Step 202: Capture the network traffic management and distribution equipment of the system to be migrated within a specified time period using the F5 load balancer.

[0061] The F5 load balancer can distribute and schedule network traffic entering and leaving the system, ensuring that requests are reasonably allocated to multiple servers to improve system processing capacity. Therefore, the F5 load balancer can capture all traffic information of the system to be migrated within a specified time period, which can be used to identify the communication status between the system to be migrated and related parties.

[0062] Specifically, the length of the specified time period is determined based on the risk level of the target migration task of the system to be migrated. The higher the risk level of the target migration task, the more traffic needs to be captured to verify the migration risk of related parties, and the longer the specified time period will be. Therefore, the traffic collection cycle can be dynamically adjusted according to the risk level of the migration task, ensuring a more thorough and comprehensive analysis of related party behavior for high-risk migration tasks, thereby improving the accuracy of risk assessment.

[0063] Step 204: Based on the traffic information, determine the IP address pairs that have bidirectional communication in the system to be migrated within the specified time period and the first attribute information of the IP address pairs.

[0064] Step 206: Based on the first attribute information, cluster all the IP address pairs to obtain multiple IP address pair clusters.

[0065] Step 208: For each IP address pair cluster, extract the average access frequency of each IP address pair within the cluster, the total number of communication events occurring per unit time within the cluster, the proportion of IP addresses with high-frequency communication within the cluster, and the proportion of concentrated occurrence time periods of communication events within the cluster.

[0066] Each secondary attribute reflects the frequency of IP address pair cluster access in a communication performance dimension. In other words, the higher the frequency of IP address pair cluster access, the greater the risk posed by the associated parties within that IP address to the subsequent system migration. Therefore, this secondary attribute information serves as the basis for screening IP address pair clusters that pose a high risk to the subsequent system migration.

[0067] Step 210: Select a target cluster from the multiple IP address pairs that satisfies the predetermined high-frequency access conditions based on the second attribute information.

[0068] Step 212: For each IP address within the target cluster, query the third attribute information of the IP address through the UCMDB interface.

[0069] Step 214: In conjunction with the third attribute information, identify and delete IP addresses of a specified type in the target cluster, wherein the specified type of IP address includes: IP addresses with environment type identifier as test environment, IP addresses with environment type identifier as development environment, and IP addresses with application layer identifier as production environment identified in the target cluster.

[0070] After identifying the target cluster, the associated parties corresponding to the IP addresses within the target cluster can be further filtered, using third-attribute information as the basis for this further filtering. This third-attribute information reflects the performance characteristics of the IP address in terms of infrastructure configuration and business affiliation, including the business system, application level, responsible person, and deployment environment of the IP address. In other words, obtaining third-attribute information is to confirm the actual business entity represented by the IP address within the target cluster, such as the production system or responsible person, and to filter out non-production environment interference items, such as test and development environment IPs, based on business attributes such as deployment environment and application level. This ensures that subsequent risk assessments and even migration work are conducted specifically for the production system's associated parties, improving the accuracy of associated party identification and thus facilitating more efficient identification of migration risks.

[0071] Step 216: For each IP address within the target cluster, determine the risk level of the IP address using a predetermined risk assessment strategy.

[0072] Step 218: Determine the risk level of the IP address by assigning the risk level to the risk degree.

[0073] The above technical solution uses three layers of attribute information to screen the related parties communicating with the system to be migrated, which improves the accuracy of risk related party identification and provides more accurate decision-making basis with actual business relevance for risk identification, thus helping to ensure the safe migration process.

[0074] In addition, embodiments of this application provide a risk assessment device for parties involved in system migration, including: The traffic information acquisition unit is used to acquire the traffic information of the network traffic management and distribution equipment of the system to be migrated within a specified time period. The first attribute information determination unit is used to determine, based on the traffic information, the IP address pairs that have bidirectional communication in the system to be migrated during the specified time period and the first attribute information of the IP address pairs, wherein the first attribute information is used to reflect the performance characteristics of the bidirectional communication behavior of the IP address pairs during the specified time period. A clustering unit is used to perform clustering processing on all the IP address pairs based on the first attribute information to obtain multiple IP address pair clusters; The second attribute information determination unit is used to extract the second attribute information of each IP address pair cluster, wherein the second attribute information is used to reflect the performance characteristics of the IP address pair cluster related to the IP address access frequency. The target cluster filtering unit is used to select, from among the multiple IP address pair clusters, the target cluster whose second attribute information satisfies the predetermined high-frequency access conditions; The risk determination unit is used to determine the risk level of each IP address within the target cluster using a predetermined risk assessment strategy. A risk level determination unit is used to determine the risk level of the IP address by assigning the risk level corresponding to the risk degree.

[0075] Optionally, in one embodiment of this application, the traffic information acquisition unit is configured to: capture the traffic information of the network traffic management and distribution device of the system to be migrated within a specified time period through an F5 load balancer, wherein the length of the specified time period is determined based on the risk level of the target migration task of the system to be migrated.

[0076] Optionally, in one embodiment of this application, the first attribute information includes multiple items among the following: access frequency of bidirectional communication between the IP address pairs, duration of a single session, total session duration, communication protocol type, and communication port distribution. In this case, the clustering unit is used to: use each item of the first attribute information as a clustering reference dimension, and use the K-means clustering algorithm to cluster all the IP address pairs that have bidirectional communication in the system to be migrated within the specified time period to obtain multiple IP address pair clusters.

[0077] In one embodiment of this application, optionally, the second attribute information determining unit is used to: extract the average access frequency of each IP address pair within the IP address pair cluster, the total number of communication events occurring within the cluster per unit time, the proportion of IP addresses that have high-frequency communication within the cluster, and the proportion of concentrated occurrence time periods of communication events within the cluster.

[0078] In one embodiment of this application, optionally, the target cluster filtering unit is configured to: select, from a plurality of IP address pair clusters, a target cluster whose second attribute information satisfies one or more of the following predetermined high-frequency access conditions: the average access frequency of each IP address pair within the cluster is greater than or equal to a specified access frequency threshold; the total number of communication events occurring within the cluster per unit time is greater than or equal to a specified communication event number threshold; the proportion of IP addresses in the cluster that experience high-frequency communication is greater than or equal to a first proportion threshold; and the proportion of concentrated occurrence periods of communication events within the cluster is greater than or equal to a second proportion threshold.

[0079] Optionally, in one embodiment of this application, the device further includes: The third attribute information determination unit is used to query the third attribute information of each IP address in the target cluster through the UCMDB interface before determining the risk level of the IP address. The third attribute information is used to reflect the performance characteristics of the IP address in terms of infrastructure configuration and business affiliation, including the business system, application level, person in charge and deployment environment of the IP address. The target cluster internal filtering unit is used to identify and delete IP addresses of a specified type in the target cluster by combining the third attribute information. The specified type of IP address includes: IP addresses with environment type identifier of test environment, IP addresses with environment type identifier of development environment, and IP addresses with application layer identifier of production environment in the target cluster.

[0080] Optionally, in one embodiment of this application, the risk determination unit includes: The first risk calculation unit is used to obtain the product of the access frequency of the IP address and the total session duration as the overall risk coefficient, and to determine the ratio of the overall risk coefficient to the amount of data generated by the IP address within the total session duration as the risk level of the IP address.

[0081] Optionally, in one embodiment of this application, the risk determination unit includes: The second risk calculation unit is used to determine a multidimensional risk feature vector of the IP address based on the first attribute information of the IP address pair to which the IP address belongs, the second attribute information of the IP address pair cluster to which the IP address belongs, and the third attribute information of the IP address. The multidimensional risk feature vector is used as input information for a predetermined risk assessment model to determine the risk level of the IP address. The predetermined risk assessment model is used to reflect the correlation between the multidimensional features of the IP address and the risk level of the IP address when the system to be migrated is migrated by the target migration task.

[0082] The device uses the solution described in any one of the above embodiments, and therefore has all the above-mentioned technical effects, which will not be repeated here.

[0083] In another embodiment, this application provides a computer device, which may be a server, and its internal structure diagram may be as follows. Figure 3 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it can implement the methods described in any of the above embodiments.

[0084] In one embodiment, this application also provides a computer device, which can be a client, and its internal structure diagram can be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it can implement the methods described in any of the above embodiments.

[0085] Any of the computer devices described in the embodiments of this application exist in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include smartphones, multimedia phones, feature phones, and low-end phones.

[0086] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, etc.

[0087] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players, handheld game consoles, e-books, as well as smart toys, wearable devices, and portable car navigation devices.

[0088] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0089] (5) Other electronic devices with data interaction functions.

[0090] Additionally, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which are used to perform the following steps: Obtain traffic information of the network traffic management and distribution devices of the system to be migrated within a specified time period; Based on the traffic information, determine the IP address pairs that have bidirectional communication in the system to be migrated during the specified time period and the first attribute information of the IP address pairs, wherein the first attribute information is used to reflect the performance characteristics of the bidirectional communication behavior of the IP address pairs during the specified time period. Based on the first attribute information, all the IP address pairs are clustered to obtain multiple IP address pair clusters. For each IP address pair cluster, the second attribute information of the IP address pair cluster is extracted. The second attribute information is used to reflect the performance characteristics of the IP address pair cluster that are related to the IP address access frequency. Among the multiple IP address pairs, select the target cluster whose second attribute information satisfies the predetermined high-frequency access conditions; For each IP address within the target cluster, the risk level of the IP address is determined using a predetermined risk assessment strategy. The risk level corresponding to the risk degree is used to determine the risk level of the IP address.

[0091] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0092] The technical solution of this application has been described in detail above with reference to the accompanying drawings. The technical solution of this application, by collecting real-time network traffic information before system migration, identifies and clusters the related parties communicating with the system to be migrated, thereby screening out the target clusters with high-frequency access and quantifying the migration risk of the related parties within the cluster. This achieves automatic and accurate identification and assessment of the migration related parties and their potential risks of the system to be migrated, avoiding the defects of related parties being missed and risk assessments being inaccurate due to manual sorting in related technologies, significantly improving the security of the financial system migration process and increasing migration efficiency.

[0093] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0094] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0096] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0097] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0098] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A risk assessment method for stakeholders in system migration, characterized in that, include: Obtain traffic information of the network traffic management and distribution devices of the system to be migrated within a specified time period; Based on the traffic information, determine the IP address pairs that have bidirectional communication in the system to be migrated during the specified time period and the first attribute information of the IP address pairs, wherein the first attribute information is used to reflect the performance characteristics of the bidirectional communication behavior of the IP address pairs during the specified time period. Based on the first attribute information, all the IP address pairs are clustered to obtain multiple IP address pair clusters. For each IP address pair cluster, the second attribute information of the IP address pair cluster is extracted. The second attribute information is used to reflect the performance characteristics of the IP address pair cluster that are related to the IP address access frequency. Among the multiple IP address pairs, select the target cluster whose second attribute information satisfies the predetermined high-frequency access conditions; For each IP address within the target cluster, the risk level of the IP address is determined using a predetermined risk assessment strategy. The risk level corresponding to the risk degree is used to determine the risk level of the IP address.

2. The method according to claim 1, characterized in that, The acquisition of network traffic management and distribution device traffic information of the system to be migrated within a specified time period includes: The F5 load balancer captures the network traffic management and distribution equipment of the system to be migrated within a specified time period, wherein the length of the specified time period is determined based on the risk level of the target migration task of the system to be migrated.

3. The method according to claim 1, characterized in that, The first attribute information includes multiple factors such as the access frequency of bidirectional communication between the IP address pairs, the duration of a single session, the total session duration, the communication protocol type, and the distribution of communication ports. Then, based on the first attribute information, clustering is performed on all the IP address pairs to obtain multiple IP address pair clusters, including: Using each of the first attribute information items as a clustering reference dimension, the K-means clustering algorithm is used to cluster all the IP address pairs that have bidirectional communication in the system to be migrated within the specified time period, resulting in multiple IP address pair clusters.

4. The method according to claim 2, characterized in that, The extraction of the second attribute information of the IP address pair cluster includes: Extract the average access frequency of each IP address pair within the cluster, the total number of communication events occurring per unit time within the cluster, the proportion of IP addresses with high-frequency communication within the cluster, and the proportion of concentrated occurrence periods of communication events within the cluster.

5. The method according to claim 4, characterized in that, Selecting a target cluster from among the multiple IP address pair clusters whose second attribute information satisfies a predetermined high-frequency access condition includes: Among the multiple IP address pairs, select a target cluster whose second attribute information satisfies one or more of the following predetermined high-frequency access conditions. The average access frequency of each IP address pair within the cluster is greater than or equal to a specified access frequency threshold. The total number of communication events occurring within the cluster per unit time is greater than or equal to a specified threshold for the number of communication events. The proportion of IP addresses that engage in high-frequency communication within the cluster is greater than or equal to a first proportion threshold. The proportion of concentrated occurrence periods of the intra-cluster communication events is greater than or equal to the second proportion threshold.

6. The method according to any one of claims 1 to 5, characterized in that, Before determining the risk level of the IP address through a predetermined risk assessment strategy, the method further includes: For each IP address within the target cluster, the third attribute information of the IP address is queried through the UCMDB interface. The third attribute information is used to reflect the performance characteristics of the IP address in terms of infrastructure configuration and business affiliation, including the business system, application level, person in charge, and deployment environment of the IP address. Based on the third attribute information, IP addresses of a specified type are identified and deleted from the target cluster. The specified type of IP address includes: IP addresses with environment type identifier of test environment, IP addresses with environment type identifier of development environment, and IP addresses with application layer identifier of production environment are identified and retained in the target cluster.

7. The method according to claim 6, characterized in that, The process of determining the risk level of the IP address through a predetermined risk assessment strategy includes: The product of the access frequency of the IP address and the total session duration is used as the overall risk coefficient. The overall risk coefficient is determined as the ratio of the amount of data generated by the IP address during the total session duration, and this ratio is used as the risk level of the IP address.

8. The method according to claim 6, characterized in that, The process of determining the risk level of the IP address through a predetermined risk assessment strategy includes: Based on the first attribute information of the IP address pair to which the IP address belongs, the second attribute information of the IP address pair cluster to which the IP address belongs, and the third attribute information of the IP address, a multidimensional risk feature vector of the IP address is determined. Using the multidimensional risk feature vector as input information for a predetermined risk assessment model, the risk level of the IP address is determined through the predetermined risk assessment model. The predetermined risk assessment model is used to reflect the correlation between the multidimensional features of the IP address and the risk level of the IP address when the system to be migrated is migrated by the target migration task.

9. A computer device, characterized in that, include: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, the instructions being configured to cause the processor to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions configured to perform the method as described in any one of claims 1 to 8.

Images