Information technology system change risk prediction method, device, equipment and program product

Abstract

The embodiment of the application relates to the field of financial technology and the related field, and in particular to an information technology system change risk prediction method, device, equipment and program product. Including: acquiring multi-source heterogeneous data corresponding to information technology system change, the multi-source heterogeneous data including at least one of change description text, code change information, system topology data and historical change record; performing feature extraction on the multi-source heterogeneous data to obtain a corresponding standardized feature vector; performing risk feature interaction modeling based on the standardized feature vector to generate a high-order feature representation; performing risk prediction based on the high-order feature representation through a machine learning model to obtain a risk prediction result. The accuracy of information technology system change risk assessment is improved.

Description

Technical Field

[0001] This application relates to the field of financial technology or other related fields, and in particular to a method, apparatus, equipment and program product for predicting the risk of changes in information technology systems. Background Technology

[0002] In enterprise information technology (IT) operations, change risk assessment typically employs manual review, rule-based scoring, or machine learning models based on historical characteristics to analyze change requests.

[0003] However, the above-mentioned solutions have limited feature fusion capabilities when faced with multi-source heterogeneous data such as text, code, system topology, and historical records. This makes it difficult to accurately characterize complex dependencies and nonlinear interactions, thus limiting the accuracy, comprehensiveness, and adaptability of risk assessment.

[0004] Therefore, improving the accuracy of IT change risk assessment is a technical problem that needs to be solved. Summary of the Invention

[0005] This application provides a method for predicting the risks of IT system changes, in order to solve the problem of low accuracy in IT change risk assessment.

[0006] This application provides a method for predicting the risks of changes in an information technology system, the method comprising:

[0007] Obtain multi-source heterogeneous data corresponding to changes in information technology systems. The multi-source heterogeneous data includes at least one of the following: change description text, code change information, system topology data, and historical change records.

[0008] Feature extraction is performed on multi-source heterogeneous data to obtain the corresponding standardized feature vectors;

[0009] Risk feature interaction modeling is performed based on standardized feature vectors to generate high-order feature representations;

[0010] Risk prediction results are obtained by using a machine learning model based on high-order feature representation.

[0011] In one possible embodiment, feature extraction of multi-source heterogeneous data includes:

[0012] Perform semantic parsing on the change description text to generate text embedding vectors; and / or,

[0013] Perform structured analysis on code change information to generate code complexity metrics; and / or,

[0014] Dependency modeling is performed on the system topology data to generate a system dependency strength vector; and / or,

[0015] Statistical features are extracted from historical change records to generate historical change statistical features.

[0016] In one possible embodiment, prior to the feature extraction step on the multi-source heterogeneous data, the method further includes:

[0017] Generate contextual feature vectors based on change type, historical success rate of the change team, and urgency of the change.

[0018] The contribution weights of text embedding vector, code complexity index, system dependency strength vector and / or historical change statistics are dynamically adjusted based on the context feature vector.

[0019] In one possible embodiment, the step of performing risk feature interaction modeling based on standardized feature vectors includes:

[0020] The interaction weights of text embedding vectors, code complexity metrics, system dependency strength vectors, and / or historical change statistics are calculated using a multi-head self-attention mechanism.

[0021] High-order feature representations are generated based on interactive weights.

[0022] In one possible embodiment, after obtaining the risk prediction result by performing risk prediction based on high-order feature representation using a machine learning model, the method further includes:

[0023] Risk confidence intervals are generated based on predictions from machine learning models;

[0024] The decision threshold for risk scoring is adjusted based on the risk confidence interval.

[0025] In one possible embodiment, risk prediction is performed based on high-order feature representations using a machine learning model, including:

[0026] The multi-head self-attention mechanism and machine learning model are iteratively updated using an alternating optimization strategy, which includes:

[0027] A fixed multi-head self-attention mechanism is used to train a machine learning model using its output high-order features.

[0028] A fixed machine learning model is used, and its predictions are used as soft labels to optimize the multi-head self-attention mechanism.

[0029] In one possible embodiment, feature extraction of multi-source heterogeneous data includes:

[0030] Perform entity recognition on the change description text to extract risk-related entities; and / or,

[0031] Perform syntax tree analysis on code change information to quantify the complexity of code changes; and / or,

[0032] Graph neural network modeling is performed on the system topology data to generate topology embedding vectors. And / or,

[0033] In one possible embodiment, risk prediction is performed based on high-order feature representation using a machine learning model to obtain risk prediction results, including:

[0034] The higher-order feature representation is concatenated with the original features to generate the final input feature vector.

[0035] Risk prediction results are obtained by using a machine learning model to perform risk prediction based on the final input feature vector.

[0036] In a second aspect, embodiments of this application provide an electronic device, including: a memory and a processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory, causing the processor to perform the method as described in any of the first aspects.

[0037] Thirdly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any of the first aspects.

[0038] The risk prediction method, apparatus, equipment, storage medium, and program products provided in this application acquire multi-source heterogeneous data corresponding to changes in information technology systems, and extract features from the multi-source heterogeneous data to obtain corresponding standardized feature vectors. This enables unified representation of different types of information, such as change description text, code change information, system topology data, and historical change records. By performing risk feature interaction modeling based on the standardized feature vectors to generate high-order feature representations, the ability to characterize complex dependencies and nonlinear interactions between multi-source data is enhanced. Furthermore, risk prediction is performed based on the high-order feature representations using a machine learning model to obtain risk prediction results. This improves the accuracy, comprehensiveness, and adaptability to different change scenarios in the risk assessment of information technology system changes. Attached Figure Description

[0039] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0040] Figure 1 A schematic diagram illustrating a scenario for a risk prediction method provided in an embodiment of this application;

[0041] Figure 2 A flowchart illustrating a risk prediction method provided in an embodiment of this application;

[0042] Figure 3 This is a schematic diagram of the structure of a risk prediction device provided in an embodiment of this application;

[0043] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0044] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0045] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0046] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse.

[0047] It should be noted that the risk prediction methods, devices, equipment, storage media and products provided in this application can be used in financial technology and related fields, as well as in any field other than financial technology and related fields. The application fields of the risk prediction methods, devices, equipment, storage media and products in this application are not limited.

[0048] Figure 1 This is a schematic diagram illustrating a scenario where the risk prediction method of this application is applied. For example... Figure 1 As shown, in a financial scenario, electronic devices can interact with users and communicate with data providers to obtain multi-source heterogeneous data. Electronic devices can also execute the risk prediction method of this application embodiment to provide interactive services to users.

[0049] In the field of IT operations and change management, enterprises typically need to conduct pre-operation risk assessments for operations such as application releases, database adjustments, configuration modifications, and network policy changes. The corresponding application scenarios are generally built within a system environment where change order systems, code repositories, configuration management libraries, system topology management platforms, and historical operations and maintenance record libraries operate collaboratively. This allows for the analysis of the business objects, technical objects, and scope of impact involved in a single change.

[0050] In existing technologies, common practices involve processing change requests through manual review, rule-based scoring, or machine learning models based on historical features. This typically involves extracting several features based on the change description, submitted code, system dependencies, and past change results, then scoring them according to preset rules, or inputting the features into a classification model to output a risk level.

[0051] However, in real-world enterprise scenarios, change information often includes heterogeneous data from multiple sources, such as text, code, topology, and historical records. These different data types also exhibit complex dependencies and non-linear interactions. Traditional solutions often employ simple feature concatenation, fixed weights, or static scoring methods, which struggle to fully preserve the relationships between various types of information and easily overlook cross-system impact paths and hidden risk factors.

[0052] Furthermore, existing solutions typically lack the ability to adjust the assessment focus as the change scenario changes, and are also unable to support the continuous optimization of risk outcomes. As a result, in high-frequency, complex, and cross-level IT change environments, risk prediction results are prone to being one-sided, lagging, or inaccurate, which in turn affects change approval, execution control, and business continuity assurance.

[0053] In light of this, improving the ability to integrate multi-source heterogeneous information in IT change risk assessment, and enhancing the ability to characterize complex relationships and the adaptability of risk prediction, has become an urgent technical problem to be solved. To address this issue, a method for predicting information technology system change risks is provided. In an enterprise IT change management scenario, at least one of the following is acquired: change description text, code change information, system topology data, and historical change records. Features are extracted from the multi-source heterogeneous data to obtain standardized feature vectors. Then, risk feature interaction modeling is performed based on the standardized feature vectors to generate high-order feature representations. Finally, a machine learning model is used to perform risk prediction based on these high-order feature representations, thereby improving the accuracy, comprehensiveness, and adaptability of the risk prediction results.

[0054] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0055] Figure 2 This is a flowchart illustrating a risk prediction method provided in an embodiment of this application, as shown below. Figure 2 As shown, the method includes:

[0056] S201: Obtain multi-source heterogeneous data corresponding to changes in the information technology system, wherein the multi-source heterogeneous data includes at least one of the following: change description text, code change information, system topology data, and historical change records.

[0057] Among them, multi-source heterogeneous data is used to carry the original information of a single information technology system change in different management systems, technical carriers, and operation records, so as to extract risk clues from different dimensions later. Change description text belongs to text input and is used to represent semantic content such as change target, change scope, change object, implementation window, and change reason; code change information belongs to code or script input and is used to represent the modification of source code, database script, configuration file, or automated deployment script; system topology data belongs to relational input and is used to represent the connection relationship, dependency relationship, and deployment relationship between applications, services, databases, network devices, middleware, and hosts; historical change records belong to time series and statistical input and are used to represent information such as the execution result, impact scope, rollback status, failure type, and approval record of past changes.

[0058] It is understood that "at least one" in this step means that the system can enter the subsequent process when it receives data from a single source or multiple sources. The executing entity can be a risk assessment service deployed in the enterprise change management platform, or an electronic device such as a server cluster that interfaces with the work order system, code repository, configuration management library and topology management platform. The specifics are not limited here.

[0059] Specifically, the electronic device can first receive a change identifier corresponding to the target change. The change identifier can be a work order number, a published task number, a code merge request number, or a database change order number. Then, based on the change identifier, a data collection task is created, and corresponding data is retrieved from multiple business systems through interface calls, message subscriptions, file reading, or database queries.

[0060] In one possible embodiment, the change description text can be obtained from a work order system or a release approval system, and the collected fields include title, body, implementation steps, impact description, rollback plan, and approval remarks; code change information can be obtained from a code repository, continuous integration system, or artifact management system, and the collected content includes submitted difference files, number of changed lines, add / delete / modify tags, affected module paths, script types, and submission instructions; system topology data can be obtained from a configuration management library, service governance platform, container orchestration platform, or network topology platform, and the collected content includes node identifiers, node types, edge relationships, upstream and downstream call chains, deployment instances, and environment affiliation; historical change records can be obtained from an operations and maintenance trace library, alarm platform, release record library, or fault replay library, and the collected content includes historical work order results, number of failures, number of rollbacks, abnormal alarm associations, execution duration, and affected business objects.

[0061] To ensure data from different sources can be correlated, a unified identifier mapping process is performed after collection. This maps application names, service numbers, repository paths, host identifiers, database instance names, and business system names to unified object codes. For cases where the same change involves multiple system objects, a set of changed objects is constructed, and the collection results are stored using a composite index of the change identifier and object code. For data with missing fields, inconsistent time formats, or different encoding formats, pre-cleaning processing is performed, including character set conversion, timestamp standardization, null value placeholders, duplicate record deduplication, and abnormal field filtering.

[0062] For example, if a network policy change does not have corresponding code change information, the system only retains the change description text, system topology data, and historical change records for subsequent steps. If an application release includes code modifications, configuration modifications, and database script changes, these are all categorized under code change information and their subtype tags are retained. This step obtains the original multi-source heterogeneous data set corresponding to a single change event and writes this data set to the feature extraction cache, triggering the next step.

[0063] Understandably, by collecting text, code, topology, and historical data around a unified change identifier, a cross-system correlation foundation can be established at the data entry stage. This allows subsequent processing to go beyond single work order content or static scoring fields, thus providing complete input for risk analysis in complex change scenarios. It should be understood that the above example is merely illustrative and not limiting.

[0064] S202: Extract features from multi-source heterogeneous data to obtain the corresponding standardized feature vectors.

[0065] The standardized feature vector is used to provide a unified representation of data from different sources and with different structures, enabling text features, code features, topological features, and historical features to participate in subsequent interactive modeling within the same computational framework. For different types of multi-source heterogeneous data, appropriate processing methods can be used to extract features that characterize their content and relationships, and then convert them into a unified standardized representation.

[0066] Understandably, the core of this step is not simply concatenating the original fields, but rather transforming heterogeneous information into a numerical feature representation that is comparable, fusionable, and input into the model.

[0067] Specifically, electronic devices can call the corresponding feature extraction submodule based on the data source type. For change description text, it can be cleaned, normalized, and encoded to extract text features reflecting the change content; for code change information, code features reflecting the scale, scope of impact, or complexity of the modification can be extracted based on the change content; for system topology data, topological features reflecting structural associations and dependencies can be extracted based on the relationships between system objects; and for historical change records, historical features reflecting historical execution and result patterns can be extracted.

[0068] After each feature is formed, it can be further standardized. If the output formats of different sub-modules are inconsistent, they are mapped to a unified representation. If the features are scalars or low-dimensional vectors, they are normalized, missing values ​​are filled in, and they are expanded. If the input data source is missing, placeholder vectors are used with labels to identify the source of the missing data during subsequent interactive modeling. For example, features from different data sources, after unified processing, can be combined in the order of the data sources into a feature sequence X = {x1, x2, ..., xn}, where n represents the number of data sources actually available for the current change or the number of predefined data slots, and xi represents the standardized feature vector of a single source. This feature sequence preserves the independent expression of each source while establishing the foundation for subsequent computational interaction relationships.

[0069] Understandably, by adopting corresponding data processing paths for text, code, topology, and historical records, and by forming standardized feature vectors through unified representation, multi-source heterogeneous data can be transformed into structurally consistent inputs, thereby supporting subsequent modeling of cross-source associations and implicit risk combinations.

[0070] S203: Based on standardized feature vectors, perform risk feature interaction modeling to generate high-order feature representations.

[0071] In this application, risk feature interaction modeling is used to explicitly characterize the correlation, coupling, and combined influence relationships between features from different sources. The higher-order feature representation is the comprehensive vector output by this modeling process, used to carry nonlinear interaction information across data sources. Although standardized feature vectors have transformed different types of data into a unified expression, if each vector is input independently into the prediction model, it is still difficult to characterize the linked risks corresponding to the simultaneous occurrence of, for example, "core database script modification" and "high centrality nodes in the topology," nor is it easy to represent the combined impact between "text containing urgent change semantics" and "high failure rate of similar historical changes." Therefore, this application establishes an interaction modeling layer on top of the standardized feature vectors, enabling the model to calculate the strength of correlation between different sources and output higher-order feature representations accordingly.

[0072] Specifically, the electronic device can input the feature sequence X obtained in step S102 into the interactive modeling module to calculate the correlation between features from different sources, and obtain the fused feature sequence based on the calculation results. To preserve the original source information, the interactive output can also perform a residual connection with the input feature sequence, and after normalization and feedforward processing, generate a stable fused representation.

[0073] After fusion, a pooling operation is performed on the fused feature sequence. The pooling method can be mean pooling, max pooling, or taking a specific aggregated label vector to obtain a fixed-length high-order feature representation h. This high-order feature representation can simultaneously retain the interaction results between the semantic information of the change description text, the structural information of the code change information, the dependency information of the system topology data, and the statistical information of the historical change records.

[0074] Understandably, risk feature interaction modeling achieves feature fusion by calculating the correlation between features from different sources. The interaction results reflect the degree of coupling between different risk cues, while higher-order feature representations compress and retain this coupling result. When semantic markers such as "core interface switching" and "database field adjustment" appear in the text, and the code-related features are high, topological features indicate that the affected node is located in a critical link, and historical features show a high rollback rate for similar changes, the model will pay more attention to the relevant features during the interaction modeling process, thereby highlighting the complex risk pattern in the higher-order feature representation.

[0075] This possible implementation allows risk prediction to move away from fixed weights or static concatenation, and instead form a dynamic risk expression based on the actual combination of characteristics of current changes. This enables a more complete capture of cross-system impact paths and hidden risk factors. It should be understood that the above example is merely illustrative and not limiting.

[0076] S204: Risk prediction is performed based on high-order feature representation using a machine learning model to obtain the risk prediction result.

[0077] In this application, a machine learning model is used to receive high-order feature representations and output risk prediction results for current information technology system changes. The risk prediction results can be risk probability, risk score, or risk level. The high-order feature representations are comprehensive inputs after interactive modeling, which can map text semantics, code complexity, system dependency structure, and historical result patterns to a unified risk space. Therefore, the machine learning model can learn the risk judgment boundary under complex change scenarios based on this.

[0078] It is understood that this step is not limited to a single model structure. Any model that can perform supervised learning prediction based on high-order feature representations can be applied to this application, including gradient boosting trees, deep neural networks, logistic regression models, or combinations of the above models.

[0079] Specifically, the electronic device can input the high-order feature representation h output in step S103 into the risk prediction model. In one possible embodiment, the risk prediction model includes an input layer, several processing layers, and an output layer. The output layer outputs risk probabilities; if discrete level output is required, the risk probabilities are mapped to low risk, medium risk, and high risk, or mapped to a risk score from 0 to 100, based on a preset threshold. During the training phase, a training set is constructed using historical samples labeled with real change results. The real labels can be determined based on whether the change failed, whether a rollback was triggered, whether an alarm was triggered, whether business interruption occurred, or whether it was marked as high risk in a review. During model training, the loss function between the predicted results and the real labels is used as the optimization objective, and the parameters are updated through a parameter update algorithm.

[0080] The execution result of this step is to generate risk prediction results that correspond one-to-one with the target change, and write these results back to the change order system, approval platform, or execution control system for subsequent approval decisions, canary release control, rollback triggering, or stricter monitoring strategy invocation. Based on the above analysis, by inputting high-order feature representations into a machine learning model to perform risk prediction, the interaction results between multi-source heterogeneous information can be transformed into a quantitative risk output. This allows the prediction results to be adaptively adjusted according to changes in feature combinations in the current change scenario, thereby improving the completeness and accuracy of risk identification in complex IT (Information Technology) change environments. It should be understood that the above example is for demonstration purposes only and is not limiting.

[0081] This application provides a method for predicting risks associated with information technology system changes. The method includes acquiring multi-source heterogeneous data corresponding to information technology system changes, wherein the multi-source heterogeneous data includes at least one of the following: change description text, code change information, system topology data, and historical change records. Features are extracted from the multi-source heterogeneous data to obtain corresponding standardized feature vectors. Risk feature interaction modeling is performed based on the standardized feature vectors to generate a high-order feature representation. Risk prediction is then performed using a machine learning model based on the high-order feature representation to obtain the risk prediction result. In this possible implementation, by uniformly collecting text, code, topology, and historical records around a single change event, extracting features from and uniformly representing the relevant data, modeling the interaction relationships between standardized feature vectors, and finally outputting risk probability, risk score, or risk level using a machine learning model, multi-source heterogeneous information can be uniformly integrated and dynamically analyzed in enterprise IT change management scenarios. This allows risk prediction to be based on the combined effects of cross-system correlation, nonlinear interaction, and historical patterns. This enables the joint characterization of complex dependency chains, composite modification actions, and similar historical failure modes, and the results can be directly used for change approval, execution control, and subsequent optimization processes, forming an implementable closed-loop risk assessment scheme.

[0082] In some embodiments, feature extraction of multi-source heterogeneous data includes:

[0083] Perform semantic parsing on the change description text to generate text embedding vectors; and / or,

[0084] Perform structured analysis on code change information to generate code complexity metrics; and / or,

[0085] Dependency modeling is performed on the system topology data to generate a system dependency strength vector; and / or,

[0086] Statistical features are extracted from historical change records to generate historical change statistical features.

[0087] The change description text can be segmented, entity recognized, and context encoded by a natural language processing model. The model can use a pre-trained encoder to map the text into a fixed-dimensional vector in order to preserve semantic associations. The code change information can be extracted from the code repository, configuration library, or script file, and structural features can be generated by parsing through an abstract syntax tree. The selected model is convenient for uniformly quantifying the change complexity of different languages ​​or different script forms.

[0088] System topology data can come from a configuration management repository or topology platform. By constructing a graph of nodes and edges, the in-degree, out-degree, centrality, and propagation strength along dependency chains of key nodes are calculated, and the results are encoded into vectors. Historical change records can be extracted from the operation and maintenance record repository, including time, type, result, affected objects, and handling methods. Statistical aggregation is performed according to change category, system category, and team dimension to form reusable historical change statistical features.

[0089] In this possible implementation, text semantics, code complexity, topological dependencies, and historical patterns are uniformly converted into vectorized representations, enabling subsequent models to consistently model multi-source heterogeneous information and enhance the ability to represent cross-system impact paths and hidden risk factors, thereby improving the accuracy and adaptability of change risk prediction results.

[0090] In some embodiments, prior to the feature extraction step of multi-source heterogeneous data, the method further includes:

[0091] S105. Generate contextual feature vectors based on change type, historical success rate of the change team, and urgency of the change.

[0092] S106. Dynamically adjust the contribution weights of text embedding vector, code complexity index, system dependency strength vector and / or historical change statistics feature based on context feature vector.

[0093] After generating the context feature vector, the system inputs this vector into the weight adjustment module to adaptively assign weights to the feature contributions from different data sources. The weight adjustment module can consist of a fully connected layer and a normalization unit. The fully connected layer calculates the original weights for each feature, while the normalization unit converts the original weights into comparable contribution weights. Alternatively, the context feature vector can be jointly calculated with the text embedding vector, code complexity index, system dependency strength vector, and historical change statistics, and then the calculation result is multiplied by the original weights to obtain the final contribution weights for each feature. The adjusted weights are used to change the participation intensity of different feature sources during subsequent feature extraction and fusion, ensuring that the same type of input has different degrees of influence under different change scenarios.

[0094] Specifically, when the change type is network configuration, the weight corresponding to the system dependency strength vector can be increased, while the weight corresponding to the code complexity metric can be decreased. When the change type is database upgrade and the urgency is high, the weights corresponding to both the code complexity metric and the system dependency strength vector can be increased accordingly. When the change team has a low historical success rate, the weight of historical change statistical features can be increased to make the model pay more attention to the correlation between historical execution results and risk information. The above weight adjustments make the subsequently extracted standardized feature vectors more closely fit the current change scenario, thereby providing more targeted input for risk feature interaction modeling.

[0095] In this possible implementation, through the aforementioned context modeling and dynamic weighting mechanism, the system can explicitly characterize the change scenario before feature extraction and adjust the contribution of each feature source accordingly. This allows the subsequently generated higher-order feature representation to more accurately reflect the risk focus of the current change, thereby improving the adaptability to complex change scenarios and the accuracy of risk prediction results.

[0096] In some embodiments, the step of performing risk feature interaction modeling based on standardized feature vectors includes: calculating the interaction weights of text embedding vectors, code complexity indicators, system dependency strength vectors, and / or historical change statistics features through a multi-head self-attention mechanism; and generating higher-order feature representations based on the interaction weights.

[0097] Specifically, the text embedding vector can be obtained from the change description text through semantic encoding; the code complexity index can be calculated from the syntax structure, nesting level, number of modified lines, or call density of the submitted code; the system dependency strength vector can be composed of the dependency edge weights, influence path lengths, or number of associated nodes in the system topology; and the historical change statistical features can be formed by statistically analyzing past change success rates, rollback frequencies, defect association times, and similar change risk results. Before entering interaction modeling, these features can undergo dimensional alignment and numerical standardization, and be organized into a unified feature sequence input to a multi-head self-attention module. Within the module, attention scores are generated through queries and key-value mappings. After Softmax (Softmax Function) normalization, the interaction weights between features are obtained. The weighted results are then concatenated or summed to output a higher-order feature representation. This higher-order feature representation can also be added to some of the original feature residuals to retain the original information. In practical applications, this module can be implemented using a Transformer-style attention layer. Other models of this component can also be selected in practical applications, and this application does not limit this choice.

[0098] In this possible implementation, multi-head self-attention is used to explicitly characterize the correlation and coupling between different risk features, so that the high-order feature representation simultaneously contains local correlation and cross-source interaction information, thereby improving the ability to represent implicit risk paths in complex change scenarios and providing more discriminative input features for subsequent risk prediction.

[0099] In some embodiments, after obtaining risk prediction results by performing risk prediction based on high-order feature representation using a machine learning model, the method further includes: generating a risk confidence interval based on the prediction results of the machine learning model; and adjusting the decision threshold of the risk score according to the risk confidence interval.

[0100] Specifically, the prediction results output by the machine learning model can be risk probability values, risk level scores, or a combination of both. The system inputs this output into the risk confidence interval calculation module, which can generate upper and lower bounds for the interval based on the model's probability distribution, repeated sampling results, or statistical estimation results. Repeated sampling can employ Monte Carlo sampling, Bootstrap resampling, or random model deactivation sampling methods to obtain a set of predicted values ​​after multiple inferences on the same high-order feature representation. Then, quantile intervals or mean-standard deviation intervals are calculated for the predicted values ​​to form the risk confidence interval. Statistical estimation can be based on calibration parameters from the training phase, mapping the predicted probability to the corresponding confidence range to ensure that the interval boundaries are consistent with the historical prediction error distribution.

[0101] After obtaining the risk confidence interval, the system uses the interval width or interval offset as the basis for threshold adjustment. When the aforementioned risk confidence interval is narrow, it indicates that the model output is relatively stable, and the decision threshold can remain at its original setting or be finely adjusted towards a lower risk tolerance. When the aforementioned risk confidence interval is wide, it indicates that the model uncertainty is high, and the decision threshold can be adjusted towards a higher risk sensitivity, causing more change requests to enter the manual review or further confirmation channel. Threshold adjustment can be accomplished through a preset mapping relationship, such as based on a correspondence table between interval width and threshold increment, or by modifying the original threshold based on linear functions or piecewise functions, thereby obtaining the final dynamic threshold used for risk scoring.

[0102] During operation, the system first obtains the risk prediction result for a single change based on high-order feature representation, then combines this result to generate a risk confidence interval, and feeds this interval back to the threshold adjustment module, so that the risk scoring criteria change synchronously with the prediction reliability. Therefore, the model output not only provides a risk judgment conclusion, but also provides the corresponding uncertainty range, thereby ensuring that the approval control and review triggering conditions are consistent with the prediction stability.

[0103] In this possible implementation, the risk scoring threshold is no longer fixed, but can be adaptively adjusted based on the reliability of the prediction. This allows high-confidence predictions to directly enter the corresponding handling logic, while low-confidence predictions can be identified in a timely manner and transferred to the review process, thereby improving the robustness of risk assessment and the consistency of change handling.

[0104] In some embodiments, risk prediction based on high-order feature representation using a machine learning model includes: iteratively updating a multi-head self-attention mechanism and a machine learning model through an alternating optimization strategy, wherein the alternating optimization strategy includes: fixing the multi-head self-attention mechanism and training the machine learning model with its output high-order features; fixing the machine learning model and optimizing the multi-head self-attention mechanism with its prediction results as soft labels.

[0105] Specifically, the parameters of the multi-head self-attention mechanism are first fixed, and its output high-order feature representation is used as input to the machine learning model. Labeled historical change samples are used to train the machine learning model, which can be a logistic regression model, a gradient boosting tree model, or a shallow neural network model. During training, risk level or whether risk has occurred is used as the supervision target, and its parameters are updated using cross-entropy loss or log loss. Then, the parameters of the machine learning model are fixed, and the risk probability output by the model for the current high-order feature representation is used as a soft label. The difference between this soft label and the prediction distribution output by the multi-head self-attention mechanism is used to calculate the loss function, and the parameters of the multi-head self-attention mechanism are updated accordingly, enabling it to learn a risk representation consistent with the machine learning model. For the soft label, the risk probability can be used directly, or a probability distribution can be formed after temperature scaling or label smoothing to enhance training stability. After multiple rounds of alternating optimization, the model parameters converge round by round between the two types of components, finally outputting the risk prediction result.

[0106] This possible implementation enables the multi-head self-attention mechanism to learn more stable high-order interaction representations under fixed conditions, while simultaneously allowing the machine learning model to output probabilistic signals that can be used to constrain feature representations under fixed conditions. This makes the mapping relationship between risk prediction results and multi-source heterogeneous features more consistent. Therefore, iterative updates of high-order feature representations and risk classification boundaries can be made synchronously, improving the accuracy and adaptability of risk prediction in complex changing scenarios.

[0107] In some embodiments, feature extraction of multi-source heterogeneous data includes:

[0108] Perform entity recognition on the change description text to extract risk-related entities; and / or,

[0109] Perform syntax tree analysis on code change information to quantify the complexity of code changes; and / or,

[0110] Graph neural network modeling is performed on the system topology data to generate topology embedding vectors.

[0111] The aforementioned feature extraction methods correspond to risk objects in text semantics, change complexity in code structure, and propagation relationships in system dependencies, respectively, enabling change information to form a computable and standardized representation before entering the risk assessment model. By inputting risk-related entities, complexity quantification results, and topological embedding vectors into subsequent interactive modeling units, the correlation information between multi-source heterogeneous data can be preserved, providing a more complete feature foundation for risk prediction.

[0112] In this possible implementation, implicit risk objects in the text, structural complexity in the code, and dependency propagation relationships in the topology can be encoded synchronously, thereby improving the ability to characterize cross-system impacts and implicit risk factors, making risk prediction results more comprehensive and more suitable for complex change scenarios.

[0113] In some embodiments, risk prediction is performed based on higher-order feature representations using a machine learning model to obtain risk prediction results, including: concatenating the higher-order feature representations with the original features to generate a final input feature vector; and performing risk prediction based on the final input feature vector using a machine learning model to obtain risk prediction results.

[0114] Among them, the machine learning model can be a classification model, a regression model or an ensemble learning model. The classification model can output the risk probability as the risk prediction result, and the regression model can output the continuous risk score as the risk prediction result.

[0115] Taking a change order as an example, if the higher-order feature representation reflects the interaction strength between code changes and system dependencies, while the original features retain code complexity and historical failure counts, then concatenating the two and inputting them into the model allows the model to simultaneously utilize the interaction relationships and basic statistical information to complete risk assessment. This joint input method of higher-order feature representation and original features enables the model to retain complex correlation information while maintaining direct utilization of the original information.

[0116] In this possible implementation, risk feature interaction modeling first extracts correlation patterns from multi-source heterogeneous data, then merges the resulting high-order feature representations with the uncompressed original features. This allows the prediction model to consider both abstract interaction relationships and single-source basic attributes when making decisions, thereby generating the final risk score. This approach makes the prediction results more comprehensive in responding to changes in content, system dependencies, and historical performance, thus improving the accuracy and stability of risk prediction results.

[0117] The following is a specific embodiment:

[0118] For example, an electronic device employs a three-layer structure to achieve intelligent feature fusion, as shown in the following example:

[0119] The first layer is the feature extraction and neighborhood enhancement coding layer, in which:

[0120] The multimodal change data parsing engine can use a domain-enhanced dual-channel BERT feature extractor encoder to perform semantic parsing on change request documents, convert them into embedded codes, and extract key entities and risk features.

[0121] Domain-specific pre-training can be performed on top of the domain-enhanced BERT model using 100,000+ IT change orders for further pre-training.

[0122] Electronic devices can design dedicated encoders for each type of feature, forcing the network to retain sufficient information. For example:

[0123] Text features can be extracted using semantic features extracted by an improved BERT-BiLSTM.

[0124] Code change characteristics can be analyzed based on AST (Abstract Syntax Tree) analysis to determine code complexity and impact.

[0125] The system topology characteristics can be derived from the application dependency strength calculated using the TDMA algorithm.

[0126] Historical change characteristics can be used to assess the success rate and scope of impact of similar changes.

[0127] Comparative learning can make the deep features of similar changes (such as those of the same type or within the same team) similar, while keeping different changes apart.

[0128] For change type prediction, electronic devices can determine specific locations on a mask, allowing the model to predict the change type (such as "database", "network", "application").

[0129] For influence range mask prediction, electronic devices can perform random mask service range descriptions, allowing the model to predict the influence service lines.

[0130] For terminology enhancement, electronic devices can build a domain dictionary containing 3,000+ IT change terms and assign domain weights to each term.

[0131] Second layer: Dynamic weight generation layer.

[0132] Electronic devices can dynamically calculate the contribution weights of each feature source based on the current change context:

[0133] The formula for calculating the weight is:

[0134] in, Let be the i-th feature source, c be the context representation, and f be the weight generation function, implemented through a small neural network.

[0135] For example, when a database changes, electronic devices can automatically increase the weight of code change features. When a network configuration changes, electronic devices can automatically increase the weight of system topology features.

[0136] The third layer: Feature calculation layer.

[0137] The prediction of the entire XGBoost model is a simple summation of the outputs of each tree:

[0138]

[0139] Where K is the total number of trees; This is the final predicted value; Return the index of the leaf node in the k-th tree to which sample x belongs. It is the population (predicted value) of this leaf node.

[0140] It is understood that the embodiments of this application aim to achieve end-to-end fine-tuning while optimizing the cross-attention network and XGBoost. Since the aforementioned XGBoost is non-differentiable, "alternating optimization + knowledge distillation" provides a collaborative training strategy: Alternating optimization: The deep network is fixed, and its output features are used to train XGBoost; the XGBoost is fixed, and its leaf features are used as auxiliary supervision for updating the deep network. Through multiple iterations, the cross-attention network continuously mimics the decision-making behavior of the current best XGBoost, while XGBoost can further improve using the high-order interaction features generated by the cross-attention network. The two mutually promote each other, ultimately achieving performance superior to any single model.

[0141] The collaborative training strategy consists of four stages:

[0142] 1. Initialization: First, train a teacher XGBoost baseline model using the original features; pre-train the student cross-attention network. (Including cross attention).

[0143] 2. First distillation: Have students... By mimicking the output (soft label) of the teacher's baseline XGBoost, preliminary aligned deep features are obtained.

[0144] 3. Alternating optimization loop (multiple rounds):

[0145] Step A (Update XGBoost): Fixed A new XGBoost is trained using its deep features plus the original features.

[0146] Step B (Update Deep Network): Fix the new XGBoost and use its output as a soft label distillation update. .

[0147] Because the student cross-attention network is differentiable, it can backpropagate to the cross-attention module to optimize the feature extractor. The optimized deep features are then concatenated with the original features to retrain a final XGBoost.

[0148] 4. Determine the final model: Use the model obtained in the last round. Inference is performed with XGBoost. This is equivalent to distilling the knowledge from XGBoost into the deep network, allowing the deep features to carry more information consistent with XGBoost preferences.

[0149] Specifically, it could be as follows:

[0150] 1. Initialization.

[0151] The electronic device first trains an XGBoost baseline model using the original features. Teachers and cross-attention networks.

[0152] (1) Training benchmark XGBoost ( )

[0153] Input: Original training data set ,in Labels for original features (such as code metrics, cyclomatic complexity, committer's historical failure rate, whether it's a core link, whether it's during peak periods, etc.). Indicates whether a failure was triggered (0 = change successful, 1 = failure was triggered).

[0154] Training: Train an XGBoost baseline model using the original features. Early stopping is used to prevent overfitting, and its performance on the validation set (e.g., AUC) is recorded.

[0155] Output: Model , and its predicted probability for each training sample. Soft labeling. This model serves as the benchmark for subsequent comparisons.

[0156] (2) Pre-trained cross-attention network ( )

[0157] Input: Using the same raw data Pre-trained cross-attention network (Using a supervised approach, predict risk labels and output deep features Z)

[0158] Cross-attention module: Multi-head self-attention, capturing interactions between features.

[0159] Network structure: Feedforward network (FFN) + residual connection.

[0160] Auxiliary classification head: a linear layer + sigmoid, which can be randomly initialized or pre-trained in a supervised manner for several rounds to give it a preliminary risk discrimination ability and output the risk probability q.

[0161] Training method: Supervised pre-training is performed using the original features and the true labels y. The loss function is binary cross-entropy (BCE). This stage allows... It has a preliminary ability to identify risks, but it may not be aligned with XGBoost.

[0162] Output: Deep feature Z (the dimension is usually smaller than the original feature, such as 64 dimensions).

[0163] This can provide a reasonable initial feature extractor for subsequent distillations, avoiding starting from complete randomness.

[0164] 2. First distillation (knowledge transfer).

[0165] (1) Generate soft tags

[0166] Use the trained XGB_base to predict all training samples to obtain soft labels:

[0167]

[0168] The soft label is a probability value between 0 and 1, which contains more information than the hard label (such as the uncertainty of the model).

[0169] (2) Design distillation loss

[0170] The loss function is used to quantify the difference between student output and teacher soft labels.

[0171] (With auxiliary classification head) Output for the same batch of sample datasets The goal of distillation is to make... near .

[0172] For distillation losses, commonly used loss functions can include:

[0173] Option 1: Mean Squared Error (MSE)

[0174]

[0175] The loss function is simple and straightforward, but sensitive to differences in probability values.

[0176] Option 2: Kullback-Leibler Divergence

[0177]

[0178] This loss function focuses more on matching the probability distribution, especially when the soft label is close to 0 or 1, the gradient is larger.

[0179] Pretreatment step: Temperature Scaling

[0180] Temperature softening preprocessing, while not a natural fit between the loss function and KL algorithm, controls the smoothness of the teacher's soft labels through the parameter T, helping students learn richer inter-class relationships in the network. To smooth the distribution and enhance gradient flow, a temperature parameter T>1 is introduced.

[0181]

[0182] Then electronic devices replace Calculate the KL divergence. The higher the temperature, the flatter the distribution, and the richer the inter-class relationships learned by the model.

[0183] Since the teacher model itself has already been calibrated for the first distillation, and the IT change risk scenario is a binary classification, temperature softening (2<=T<=3) + MSE should be used, which is simple to implement and has stable results. For fine-tuning, it can be switched to temperature softening + KL divergence, combined with temperature annealing (gradually reducing T from 3 to close to 1 during training).

[0184] At this point, the electronic device can obtain the total loss function of pure distillation. Ignoring real labels.

[0185] (3) Optimize the loss by mixing losses.

[0186] To prevent The potential error of overfitting XGB_base (i.e., label noise) can be addressed by adding supervision from real labels to the electronic device.

[0187]

[0188] Among them, the true label loss BCE is the binary cross-entropy, which guides AttnNet to directly optimize the original task. Loss of true label. Distillation loss.

[0189] in, This is a balance parameter, typically taken as 0.5~0.9, indicating the degree of importance placed on distillation losses. If the teacher network quality is very high (e.g., AUC > 0.95), it can be increased. (like =0.9), if the data noise is high, it should be reduced. (e.g., 0.5) allows the true labels to play a greater role. Generally =0.7 as the starting point.

[0190] (4) Training details.

[0191] The optimizer can be Adam with a learning rate of 1e-3, or 0.001.

[0192] Batch size can be 256~512.

[0193] Epochs can be 5 to 10 rounds, with an early stop (the distillation loss on the validation set no longer decreases).

[0194] Temperature annealing (if used): Initially T=3, multiplied by 0.9 each round, eventually decreasing to close to 1.

[0195] (5) The product after the first distillation.

[0196] The output after the first distillation includes the trained (Feature extraction section) Its output deep feature Z already carries the decision knowledge of XGB_base. This feature space enables XGBoost to make more accurate predictions.

[0197] 3. Alternate optimization loop

[0198] Alternating cycle:

[0199] Step A: Train XGBoost with a fixed network depth.

[0200] With the current deep network fixed, concatenate its output deep features with the original features to retrain a new XGBoost model.

[0201] Generate deep features: Input the training and validation sets into the current deep network. (Without updating parameters), obtain depth features. .

[0202] Feature concatenation: Constructing a new feature matrix (It can be a simple splicing or a weighted splicing).

[0203] Training the new XGBoost: Using Train a new XGBoost model XGBt. You can use the same hyperparameters as the baseline, or you can optimize them through cross-validation.

[0204] Performance tracking: Evaluate XGBt metrics such as AUC on the validation set to monitor convergence.

[0205] Step B: Fix XGBoost and update the deep network (knowledge distillation)

[0206] By fixing the current XGBoost and using its predicted probabilities for the training set as "soft labels," the deep network (and its auxiliary classification head) is guided to learn through knowledge distillation loss, making the deep features more suitable for XGBoost.

[0207] (1) Generate new soft labels: augment the features of the entire training set (or a batch) using the current XGBoost model XGBt. Perform predictions to obtain soft labels. (i.e., risk probability). These soft labels reflect XGB_new's joint decision-making knowledge of deep features + original features.

[0208] (2) Distillation of cross-attention networks Constructing the loss function for the deep network: Fix XGB_new, and train using a loss function similar to the first distillation (hybrid loss). Note this point. The input is still the original features. Output .

[0209] The loss function is:

[0210]

[0211] in The previous ones can be used. Or increase it appropriately (because XGB_new has higher quality at this time).

[0212] (3) Update the cross-attention network Deep Networks This is followed by an auxiliary classification head (such as a linear layer + sigmoid) to process the original features. Output prediction The parameters of AttnNet (including the attention module and auxiliary head) are updated via backpropagation. Note that the auxiliary head is only used to generate parameters during training. It will be discarded during reasoning.

[0213] The auxiliary head serves to enable the deep network to directly optimize the ground truth labels during distillation, preventing the deep network from merely mimicking XGBoost and losing its own discriminative ability. During the inference phase, we do not use the head, but only the deep features.

[0214] Backpropagation and update: using an optimizer (such as Adam) Gradient descent is performed using the parameters of Head. Due to distillation losses... It's a fixed value (generated by a fixed XGBoost), and the gradient passes normally. The loss is propagated back to the deep network. The distillation loss is differentiable with respect to the parameters of the deep network. Although XGBoost itself is not differentiable, its output is used as a fixed target (similar to a label), so no gradient is needed to pass through XGBoost. The deep network indirectly learns how to generate features favorable to XGBoost by fitting these soft labels.

[0215] To avoid overfitting the deep network portion, regularization techniques such as Dropout and early stopping should be used, especially when the distillation loss weights are large. XGBoost training should also control the number and depth of trees to prevent overfitting to noise in the deep features.

[0216] 4. Loop control.

[0217] Iteration: Repeat steps A and B multiple times until the performance of XGB_new on the validation set no longer improves.

[0218] After each round, record the performance (AUC, F1, etc.) of the current XGBoost model on the validation set, and save the current best result. And XGBoost. If performance no longer improves (or starts to decline) after two consecutive rounds, stop alternating and retain the model from the round that yielded the best validation performance. Convergence is usually achieved after 3-5 iterations.

[0219] 5. Final model.

[0220] The electronic device uses the cross-attention network obtained in the last round and XGBoost for inference (deep features + original features → XGBoost). Finally, a deep network is obtained in the last round (or the best-performing round). and XGBoost model .

[0221] During inference: For a new original sample X, first calculate the deep features. (Without using an auxiliary head), the original features are then spliced ​​together to obtain... Finally, use Output risk probability. This model combines high-order feature interaction capabilities with tabular data prediction accuracy.

[0222] Step 4: Execute changes based on dynamic risk assessment: In conjunction with the automated change management system, scientifically determine how to execute the change and whether to terminate or roll back based on the risk score from Step 3. Highlight potential risks to ensure change risks are controllable.

[0223] In this possible implementation, feature weights can be automatically adjusted according to different change types without manual intervention. It clearly shows the mutual influence between feature sources and clearly points out the main contributing factors of risk scoring. Compared with simple feature fusion, the accuracy of risk assessment is improved.

[0224] This application employs alternating optimization instead of joint training. This is because XGBoost and the neural network have different optimization objectives, and direct joint training can easily lead to conflicts. In step A, XGBoost typically improves performance after utilizing deep features; in step B, the deep network aligns with XGBoost through distillation, generating more suitable features. This alternating optimization mutually promotes each other, allowing each module to find a local optimum while the other remains fixed. Since each retraining of XGBoost generates new soft labels, the objective of the deep network also changes accordingly, making training dynamic but generally resulting in stable improvements. Soft labels serve as a "communication language," gradually narrowing the representational gap between the two.

[0225] Furthermore, distillation loss affects cross-attention networks. Instead of simply fitting hard labels, the soft labels learn the "decision boundary" of XGBoost. These soft labels carry richer information about the uncertainty of the samples compared to hard labels, which is beneficial to the cross-attention network. Generate smoother, more general features.

[0226] On the other hand, the initial AttnNet (after the first distillation) already provides XGBoost-friendly features, thus XGB_new outperforms XGB_base. The higher accuracy of XGB_new produces more reliable soft labels, which in turn guides the cross-attention network. Extract higher-quality features. By repeating this process, the model's performance spirals upward, eventually reaching a level that cannot be achieved through training alone.

[0227] Furthermore, XGBoost has a natural advantage over numerical features, missing values, and non-linear segmentation. By using deep features as additional input, XGBoost can autonomously decide how to use these features (e.g., prioritizing deep features in some trees and not using them in others) without being affected by the neural network optimization process.

[0228] This application provides a method for predicting information technology system change risks, applicable to change management scenarios in large enterprise IT operations environments. In this scenario, enterprises handle hundreds of IT changes daily, including database version upgrades, application deployments, and network policy adjustments. These changes may involve cross-system dependencies, complex code modifications, and hidden risks. Traditional methods rely on human experience or simple rule engines, cannot fully identify the potential impact of changes, and are prone to subjective risk assessments, omission of hidden dependencies, and poor dynamic adjustment capabilities.

[0229] This application can take a database version upgrade change request as an example to obtain multi-source heterogeneous data corresponding to the change. The multi-source heterogeneous data includes at least one of the following: change description text, code change information, system topology data, and historical change records. Combined with the change type of the current change, the historical success rate of the team executing the change, and the urgency of the change, a context feature vector is generated. The contribution weights of various subsequent features are dynamically configured based on the context feature vector, so that text features, code features, topology features, and historical statistical features participate in modeling according to their corresponding weights under different change scenarios. In this example, the change type is a database upgrade, and the dynamic weight generation function automatically increases the weights of code change features and system dependency features based on the context of the database upgrade.

[0230] The database version upgrade request's change description text is "Upgrade the database from MySQL 5.7 to 8.0, change the storage engine to InnoDB, and adjust the indexing strategy to optimize query performance." The system performs semantic parsing on this change description text, using a domain-enhanced dual-channel BERT encoder to extract semantic features, encoding the text content into text embedding vectors, and identifying entities in the text to extract risk-related entities. The entity identification results are then incorporated into the text feature representation. During parsing, the keywords "database upgrade" and "index adjustment" are identified as high-risk terms and assigned higher weights. Simultaneously, the version upgrade entity, storage engine adjustment entity, and indexing strategy adjustment entity in "upgrade the database from MySQL 5.7 to 8.0," "change the storage engine to InnoDB," and "adjust the indexing strategy to optimize query performance" are all treated as risk-related entities and incorporated into the text feature representation. After encoding, a standardized text representation is formed, including 64-dimensional text embeddings.

[0231] For code change information, the system performs structured analysis on the submitted SQL script and combines it with syntax tree analysis to quantify the complexity of the code changes, generating a code complexity metric. This SQL script contains numerous table structure modifications, including adding fields and adjusting indexes. AST analysis shows high complexity, with a function call chain depth of 5; furthermore, extracting complexity features through AST analysis yields a cyclomatic complexity of 8. The system encodes the function call chain depth of 5, the cyclomatic complexity of 8, and the structured results corresponding to table structure modifications, added fields, and index adjustments into a code complexity metric, forming a 12-dimensional code complexity metric vector.

[0232] For system topology data, the system models the dependencies between the database, core application services, caching system, and log service, calculates the degree of dependency between each system node, and forms a system dependency strength vector. Simultaneously, the topology structure is input into a graph neural network for modeling, generating a topology embedding vector. In this example, the database has strong dependencies on the core application services, caching system, and log service, and the dependency strength is calculated using the TDMA algorithm, with a dependency weight of 0.9 between the database and the core application services. Based on this, the system generates an 8-dimensional topology dependency strength representation and incorporates the dependency results obtained from the TDMA algorithm and the topology embedding vector output by the graph neural network into subsequent feature modeling.

[0233] For historical change records, the system performs statistical feature extraction to obtain historical change statistical features. The statistics include the number of historical failures, rollback status, frequency of similar changes, and related time-series distribution. In this example, similar changes had a 20% failure rate over the past year, and 60% of these failures were related to index strategy conflicts. The system statistically analyzes similar database version upgrade records from the past year in chronological order, extracting the 20% failure rate, the 60% proportion of failures related to index strategy conflicts, the frequency of similar changes, rollback records, and related time-series distribution, and incorporates these results into the historical change statistical features.

[0234] After extracting text features, risk-related entity features, code complexity metrics, system dependency strength vectors, topological embedding vectors, and historical change statistical features, the system aligns and standardizes these features to construct a standardized feature vector of uniform dimensions. This vector is then weighted according to the dynamic contribution weights given by the context feature vectors. In this example, the standardized feature vector includes at least 64-dimensional text embeddings, 12-dimensional code complexity metrics, and 8-dimensional topological dependency strength, and integrates historical change statistical features, risk-related entity features, and topological embedding vectors generated by a graph neural network. In the database upgrade scenario, code change features and system dependency features are assigned higher weights, and the feature weights corresponding to high-risk terms such as "database upgrade" and "index adjustment" in the text are increased accordingly.

[0235] In the risk feature interaction modeling process, the system inputs standardized features into the multi-head self-attention module of the cross-attention network, calculates the interaction weights between text features, code features, topological features, and historical features, and uses multiple attention heads to characterize cross-modal relationships from different subspaces. Then, based on the interaction weights, various features are aggregated to generate a high-order feature representation reflecting the higher-order relationships of multi-source heterogeneous data. In this example, the index adjustment feature in code changes corresponds to high-complexity information, and the database dependency strength feature in the system topology corresponds to a dependency weight of 0.9. The cross-attention network calculates their attention weight to be 0.75, indicating a coupling relationship between the code-side index adjustment and the topology-side database dependency. Simultaneously, the "index adjustment" in text semantics, the 60% index strategy conflict rate in historical statistics, and the topology dependency strength feature jointly participate in the multi-head self-attention interaction modeling to obtain a high-order feature representation for risk prediction.

[0236] In the risk prediction phase, the system concatenates the higher-order feature representation with the original features to generate the final input feature vector. This final input feature vector is then fed into the machine learning model, which outputs the corresponding risk prediction result. In this example, the machine learning model uses the XGBoost model. Based on the final input feature vector obtained by concatenating the higher-order feature vector with the original features, the XGBoost model outputs a risk probability of 0.8, indicating that the database upgrade from MySQL 5.7 to 8.0, the change of storage engine to InnoDB, and the adjustment of indexing strategy correspond to a higher risk. After obtaining the risk prediction result, the system generates a risk confidence interval based on the XGBoost model output and adjusts the decision threshold corresponding to the risk score according to the risk confidence interval. Simultaneously, it generates a risk score based on the final model output risk probability of 0.8 and highlights key risk factors, including indexing strategy conflicts and high database dependency intensity.

[0237] During the model training phase, an alternating optimization strategy is employed to iteratively update the multi-head self-attention mechanism and the machine learning model. In one iteration, the cross-attention network (i.e., the multi-head self-attention mechanism) is fixed, and its output high-order features are used to train the XGBoost model. In another iteration, the XGBoost model is fixed, and its predictions are used as soft labels. Knowledge distillation is used to back-optimize the multi-head self-attention mechanism in the cross-attention network. In this example, the alternating optimization loop iterates for three consecutive rounds. After three rounds, the model performance converges, thus causing the feature interaction modeling parameters and risk prediction parameters to converge together. During training and optimization, the visualization results of attention weights are used to locate key drivers of risk scoring, among which indexing strategy conflict is identified as one of the main driving factors.

[0238] During the implementation of the change, the monitoring system collects metrics such as CPU utilization and error logs in real time, which serve as runtime feedback data and participate in subsequent updates along with existing multi-source heterogeneous data. When an "index conflict" error log is triggered after the database version upgrade, the system incorporates this abnormal log into the real-time feedback module, automatically updates the domain dictionary, marks "index conflict" as a high-risk term, and enhances the text semantic parsing process based on the updated domain dictionary. Simultaneously, it fine-tunes the parameters of the cross-attention network to update the modeling results for risk association patterns such as "index adjustment," "index strategy conflict," and "high database dependency strength." The updated cross-attention network continues to operate in conjunction with the XGBoost model, enabling a continuous iterative process of "feature extraction - risk prediction - feature re-optimization" during the subsequent accumulation of historical data.

[0239] Figure 3 This is a schematic diagram of the structure of a risk prediction device provided in an embodiment of this application, as shown below. Figure 3 As shown, the risk prediction device 300 provided in this embodiment includes:

[0240] The acquisition module 301 is used to acquire multi-source heterogeneous data corresponding to changes in the information technology system. The multi-source heterogeneous data includes at least one of the following: change description text, code change information, system topology data, and historical change records.

[0241] Extraction module 302 is used to extract features from multi-source heterogeneous data to obtain corresponding standardized feature vectors;

[0242] The first generation module 303 is used to perform risk feature interaction modeling based on standardized feature vectors and generate high-order feature representations.

[0243] The prediction module 304 is used to perform risk prediction based on high-order feature representation through a machine learning model to obtain risk prediction results.

[0244] In one possible implementation, the extraction module 302 is specifically used to: perform semantic parsing on the change description text to generate a text embedding vector; and / or, perform structured analysis on the code change information to generate a code complexity index; and / or, perform dependency modeling on the system topology data to generate a system dependency strength vector; and / or, extract statistical features from historical change records to generate historical change statistical features.

[0245] In one possible implementation, the risk prediction device 300 further includes:

[0246] The second generation module 305 is used to generate a context feature vector based on the change type, the historical success rate of the change team, and the urgency of the change.

[0247] The adjustment module 306 is used to dynamically adjust the contribution weights of the text embedding vector, code complexity index, system dependency strength vector and / or historical change statistics feature based on the context feature vector.

[0248] In one possible implementation, the first generation module 303 is specifically used to: calculate the interaction weights of the text embedding vector, code complexity index, system dependency strength vector and / or historical change statistics feature through a multi-head self-attention mechanism; and generate a higher-order feature representation based on the interaction weights.

[0249] In one possible implementation, the prediction module 304 is specifically used to: generate a risk confidence interval based on the prediction results of the machine learning model; and adjust the decision threshold of the risk score according to the risk confidence interval.

[0250] In one possible implementation, the prediction module 304 is specifically used to iteratively update the multi-head self-attention mechanism and the machine learning model through an alternating optimization strategy, wherein the alternating optimization strategy includes: fixing the multi-head self-attention mechanism and training the machine learning model with its output high-order features; fixing the machine learning model and optimizing the multi-head self-attention mechanism with its prediction results as soft labels.

[0251] In one possible implementation, the extraction module 302 is specifically used to: perform entity recognition on the change description text and extract risk-related entities; and / or, perform syntax tree analysis on the code change information to quantify the complexity of the code change; and / or, perform graph neural network modeling on the system topology data to generate topology embedding vectors.

[0252] In one possible implementation, the prediction module 304 is specifically used to: concatenate the higher-order feature representation with the original features to generate the final input feature vector; and perform risk prediction based on the final input feature vector using a machine learning model to obtain the risk prediction result.

[0253] The risk prediction device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0254] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 400 may include a memory 401 and a processor 402. Optionally, the electronic device may also include a transceiver 403, wherein the memory 401 and the processor 402 communicate with each other; for example, the memory 401, the processor 402 and the transceiver 403 may communicate via a communication bus 404, the memory 401 is used to store a computer program, and the processor 402 executes the computer program to implement the method of the above embodiments.

[0255] Optionally, the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps in the method embodiments disclosed in this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0256] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the methods in any of the above method embodiments.

[0257] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the methods in any of the above method embodiments.

[0258] All or part of the steps in the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0259] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0260] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0261] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0262] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

[0263] In this application, the term "comprising" and its variations can refer to non-limiting inclusion; the term "or" and its variations can refer to "and / or". The terms "first", "second", etc., in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0264] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0265] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0266] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0267] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0268] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0269] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0270] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0271] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0272] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for predicting the risk of changes in an information technology system, characterized in that, The method includes: Obtain multi-source heterogeneous data corresponding to changes in the information technology system, wherein the multi-source heterogeneous data includes at least one of the following: change description text, code change information, system topology data, and historical change records; Feature extraction is performed on the multi-source heterogeneous data to obtain the corresponding standardized feature vectors; Risk feature interaction modeling is performed based on the standardized feature vectors to generate higher-order feature representations; Risk prediction results are obtained by performing risk prediction based on the higher-order feature representation using a machine learning model.

2. The method according to claim 1, characterized in that, The feature extraction of the multi-source heterogeneous data includes: Perform semantic parsing on the change description text to generate a text embedding vector; and / or, Perform structured analysis on the code change information to generate code complexity metrics; and / or, Dependency modeling is performed on the system topology data to generate a system dependency strength vector; and / or, Statistical features are extracted from the historical change records to generate historical change statistical features.

3. The method according to claim 2, characterized in that, Before the step of feature extraction from the multi-source heterogeneous data, the method further includes: Generate contextual feature vectors based on change type, historical success rate of the change team, and urgency of the change. The contribution weights of the text embedding vector, code complexity index, system dependency strength vector, and / or historical change statistics feature are dynamically adjusted based on the context feature vector.

4. The method according to claim 3, characterized in that, The step of performing risk feature interaction modeling based on the standardized feature vector includes: The interaction weights of the text embedding vector, the code complexity index, the system dependency strength vector, and / or the historical change statistics feature are calculated using a multi-head self-attention mechanism. A higher-order feature representation is generated based on the interaction weights.

5. The method according to claim 4, characterized in that, After obtaining the risk prediction result by performing risk prediction based on the higher-order feature representation using a machine learning model, the method further includes: Risk confidence intervals are generated based on the prediction results of the machine learning model; The decision threshold for risk scoring is adjusted based on the risk confidence interval.

6. The method according to claim 5, characterized in that, The risk prediction based on the higher-order feature representation using a machine learning model includes: The multi-head self-attention mechanism and the machine learning model are iteratively updated using an alternating optimization strategy, wherein the alternating optimization strategy includes: The multi-head self-attention mechanism is fixed, and its output high-order features are used to train a machine learning model. The machine learning model is fixed, and its prediction results are used as soft labels to optimize the multi-head self-attention mechanism.

7. The method according to claim 6, characterized in that, The feature extraction of the multi-source heterogeneous data includes: Entity recognition is performed on the change description text to extract risk-related entities; and / or, Perform syntax tree analysis on the code change information to quantify the complexity of the code changes; and / or, The system topology data is modeled using a graph neural network to generate topology embedding vectors.

8. The method according to claim 7, characterized in that, The step of performing risk prediction based on the higher-order feature representation using a machine learning model to obtain risk prediction results includes: The higher-order feature representation is concatenated with the original features to generate the final input feature vector; Risk prediction results are obtained by performing risk prediction based on the final input feature vector using a machine learning model.

9. A risk prediction device, characterized in that, The risk prediction device includes: The acquisition module is used to acquire multi-source heterogeneous data corresponding to changes in the information technology system. The multi-source heterogeneous data includes at least one of the following: change description text, code change information, system topology data, and historical change records. The extraction module is used to extract features from the multi-source heterogeneous data to obtain the corresponding standardized feature vectors; The first generation module is used to perform risk feature interaction modeling based on the standardized feature vector and generate a high-order feature representation. The prediction module is used to perform risk prediction based on the higher-order feature representation using a machine learning model, and obtain the risk prediction result.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images