Configuration change risk prediction method, apparatus, device, medium, and program product

Abstract

The application provides a network configuration change risk prediction method and device, equipment, a storage medium and a program product, which can be applied to the field of artificial intelligence technology. Specifically, it relates to the application of an artificial intelligence model in the field of financial technology. The method comprises the following steps: obtaining a network configuration to be changed and a pre-constructed multi-level topology graph; based on the multi-level topology graph, performing risk propagation path analysis on the network configuration to be changed to obtain M risk influence dimensions, wherein the M risk influence dimensions at least include the ranges of affected devices, links, routing domains, security domains, business links and business systems; inputting the multi-level topology graph and the M risk influence dimensions into a pre-constructed historical fault correlation model to obtain a dimension risk contribution value of each risk influence dimension; and calculating a risk score of the network configuration to be changed according to the dimension risk contribution value of each risk influence dimension.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, specifically to the application of artificial intelligence models in the field of financial technology, and more specifically to a method, apparatus, device, medium, and program product for predicting network configuration change risks. Background Technology

[0002] As the digital transformation of the financial industry continues to advance, the scale of commercial banks' network infrastructure is constantly expanding, and the network architecture is becoming increasingly complex. Currently, bank data centers commonly adopt deployment models such as active-active data centers, multi-region disaster recovery, cloud data centers, and multiple security domains. Network equipment types cover a wide range, including routers, switches, firewalls, load balancers, VPN devices, WAF devices, and SDN control devices, significantly increasing the complexity of network configuration. Against this backdrop, network configuration changes, including the addition, deletion, or modification of configuration parameters for routing policies, firewall policies, ACL policies, NAT policies, BGP policies, OSPF policies, and load balancing policies, are becoming increasingly frequent, often involving coordinated adjustments across devices, security domains, and data centers.

[0003] Currently, risk assessment for network configuration changes in bank network operations and maintenance systems primarily relies on manual review, expert judgment, and static rule verification. Operations and maintenance personnel identify risks associated with configuration changes through configuration comparison, experience-based judgment, and predefined static rules (such as illegal command identification, high-risk ACL checks, and weak security configuration checks). However, these methods can only identify explicit errors in the configuration text and cannot analyze the potential chain reactions in the network topology after the configuration change takes effect. Specifically, they cannot analyze the risk propagation path of the failure impact caused by the change along device connectivity, routing propagation, security domain access, and service call relationships.

[0004] Meanwhile, existing technologies lack systematic learning and utilization of historical failure events. While a large amount of historical configuration change records, failure event records, service interruption records, and rollback operation records have been accumulated during network operations and maintenance, this valuable historical data has not been effectively used to guide risk assessments for current configuration changes. Operations personnel cannot predict whether current changes might trigger similar risks based on the underlying failure patterns in historical incidents, leading to the recurrence of similar failures.

[0005] In summary, how to fully utilize network topology information and historical fault data to conduct multi-dimensional risk propagation analysis, historical fault correlation analysis, and business continuity impact prediction for changes to network configurations, and automatically generate quantifiable risk assessment results to improve the security, stability, and automation level of bank network configuration changes, has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] In view of the above problems, this application provides a method, apparatus, device, medium and program product for predicting network configuration change risks.

[0007] According to a first aspect of this application, a method for predicting network configuration change risks is provided, comprising: acquiring a network configuration to be changed and a pre-constructed multi-layer topology map, wherein the multi-layer topology map includes a physical topology layer, a logical topology layer, a security topology layer, and a service topology layer; performing risk propagation path analysis on the network configuration to be changed based on the multi-layer topology map to obtain M risk impact dimensions, wherein the M risk impact dimensions include at least the affected device range, link range, routing domain range, security domain range, service link range, and service system range, and M is an integer greater than or equal to 6; inputting the multi-layer topology map and the M risk impact dimensions into a pre-constructed historical fault association model to obtain a dimension risk contribution value for each of the risk impact dimensions; and calculating a risk score for the network configuration to be changed based on the dimension risk contribution values ​​for each of the risk impact dimensions.

[0008] According to an embodiment of this application, the network configuration change risk prediction method further includes: comparing the risk score with a pre-set risk threshold, and generating an alarm prompt and a configuration rollback policy if the risk score is greater than or equal to the risk threshold.

[0009] According to an embodiment of this application, the network configuration change risk prediction method further includes: generating a risk assessment report, wherein the risk assessment report includes at least one of a risk score, M risk impact dimensions, historical fault correlation analysis, and configuration rollback strategy, wherein the historical fault correlation analysis is obtained by comparing the network configuration to be changed with historical network configuration change records.

[0010] According to an embodiment of this application, the step of inputting the multi-level topology diagram and the M risk impact dimensions into a pre-constructed historical fault association model to obtain the dimension risk contribution value of each of the risk impact dimensions includes: counting the total number of devices, total number of links, total number of routing domains, total number of security domains, total number of service links, and total number of service systems in the multi-level topology diagram; counting the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, the number of security domains in the security domain range, the number of service links in the service link range, and the number of service systems in the service system range; and counting the total number of devices, total number of links, total number of routing domains, total number of security domains, total number of service links, total number of service systems, the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, and the number of service systems in the service system range based on the total number of devices, total number of links, total number of routing domains, total number of security domains, total number of service links, total number of service systems, the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, and the number of service systems in the multi-level topology diagram. Calculate the propagation impact degree of each of the M risk impact dimensions based on the number of security domains in the security domain scope, the number of business links in the business link scope, and the number of business systems in the business system scope; calculate the number of similarities between the M risk impact dimensions and the historical network configuration change records stored in the historical fault association model in each of the M risk impact dimensions; count the total number of devices, links, routing domains, security domains, business links, and business systems in the historical network configuration change records; calculate the historical failure rate of each of the M risk impact dimensions based on the number of similarities, the total number of devices, links, routing domains, security domains, business links, and business systems in the historical network configuration change records; and calculate the dimension risk contribution value based on the propagation impact degree and the historical failure rate of each of the M risk impact dimensions.

[0011] According to an embodiment of this application, the step of calculating the risk score of the network configuration to be changed based on the dimensional risk contribution value of each of the risk impact dimensions includes: calculating a network impact factor based on the dimensional risk contribution values ​​of the device range, the link range, and the routing domain range; calculating a historical failure correlation factor based on the historical failure rate of each of the risk impact dimensions; calculating a service continuity impact factor based on the dimensional risk contribution values ​​of the security domain range, the service link range, and the service system range; and calculating a risk score based on the network impact factor, the historical failure correlation factor, and the service continuity impact factor.

[0012] According to an embodiment of this application, the step of pre-constructing a historical fault association model includes: obtaining N historical network configuration change records, wherein the historical network configuration change records include change operation characteristics and fault event records caused by the changes, and the fault event records include equipment fault range, link fault range, routing domain fault range, security domain fault range, service link fault range, and service system fault range, where N is an integer greater than or equal to 5; vectorizing the change operation characteristics of each historical network configuration change record to generate a historical change feature vector, and labeling each historical network configuration change record with a fault tag according to the fault event records; associating and storing all the historical change feature vectors with their corresponding fault tags, configuring statistical functions and calculation functions, thereby constructing the historical fault association model.

[0013] A second aspect of this application provides a network configuration change risk prediction device, comprising: an acquisition module for acquiring a network configuration to be changed and a pre-constructed multi-layer topology map, wherein the multi-layer topology map includes a physical topology layer, a logical topology layer, a security topology layer, and a service topology layer; an analysis module for performing risk propagation path analysis on the network configuration to be changed based on the multi-layer topology map to obtain M risk impact dimensions, wherein the M risk impact dimensions include at least the affected device range, link range, routing domain range, security domain range, service link range, and service system range, and M is an integer greater than or equal to 6; a first calculation module for inputting the multi-layer topology map and the M risk impact dimensions into a pre-constructed historical fault association model to obtain a dimension risk contribution value for each of the risk impact dimensions; and a second calculation module for calculating a risk score for the network configuration to be changed based on the dimension risk contribution values ​​for each of the risk impact dimensions.

[0014] According to a third aspect of this application, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0015] According to a fourth aspect of this application, a computer-readable storage medium is also provided, on which a computer program or instructions are stored, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0016] According to a fifth aspect of this application, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0017] According to some embodiments of this application, by acquiring a multi-layered topology diagram including physical topology, logical topology, security topology, and service topology, and performing risk propagation path analysis on the network configuration to be changed based on this multi-layered topology diagram, the diffusion impact of configuration changes can be comprehensively captured from four dimensions: physical connectivity, routing logic, security isolation, and service bearing. This solves the problem in existing technologies that cannot analyze the risk propagation path after configuration changes, elevating risk assessment from single-point configuration checks to full-network impact analysis. By inputting the multi-layered topology diagram and M risk impact dimensions into a pre-built historical fault association model, the dimensional risk contribution value of each risk impact dimension is obtained. This achieves a structured fusion of historical fault experience and current topology propagation analysis, solving the problem in existing technologies that lack historical fault association learning capabilities. This enables risk assessment to perform quantitative reasoning based on historical accident patterns, avoiding the recurrence of similar faults. The M risk impact dimensions include at least the affected equipment scope, link scope, routing domain scope, security domain scope, business link scope, and business system scope. The introduction of the business link scope and business system scope enables the potential impact of configuration changes on the core transaction system, payment and settlement system, mobile banking system, and database system to be explicitly quantified and predicted. This solves the problem that existing technologies cannot assess the impact of configuration changes on the continuity of banking business, provides an objective and quantitative decision-making basis for configuration change approval, and effectively ensures the stable operation of banking business. Attached Figure Description

[0018] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 The illustration schematically depicts application scenarios of the network configuration change risk prediction method, apparatus, device, medium, and program products according to embodiments of this application.

[0020] Figure 2 A flowchart illustrating a network configuration change risk prediction method according to an embodiment of this application is shown.

[0021] Figure 3 A schematic block diagram of a network configuration change risk prediction device according to an embodiment of this application is shown.

[0022] Figure 4 A block diagram schematically illustrates an electronic device suitable for implementing a network configuration change risk prediction method according to an embodiment of this application. Detailed Implementation

[0023] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0024] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0027] As used in this paper, the term "model" refers to a model that learns the relationship between inputs and outputs from training data, enabling it to generate corresponding outputs for a given input after training. Model generation can be based on machine learning techniques. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs using multiple layers of processing units. A neural network model is an example of a deep learning-based model. In this paper, "model" may also be referred to as a "machine learning model," "learning model," "machine learning network," or "learning network," and these terms are used interchangeably.

[0028] It should be understood that machine learning generally includes three phases: training, testing, and application (also known as inference). In the training phase, a given model is trained using a large amount of training data, iteratively updating parameter values ​​until the model can consistently generate inferences that meet the expected goals from the training data. Through training, the model can be considered to have learned the relationship between inputs and outputs (also known as the input-output mapping) from the training data. The parameter values ​​of the trained model are determined. In the testing phase, test inputs are applied to the trained model to test whether it can provide the correct output, thus determining the model's performance. In the application phase, the model can be used to process actual inputs based on the trained parameter values ​​to determine the corresponding output.

[0029] Figure 1 The diagram illustrates an application scenario of the network configuration change risk prediction method according to an embodiment of this application. For example... Figure 1 As shown, application scenario 100 according to an embodiment of this application may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send information, etc.

[0030] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be electronic devices such as smartphones, wearable devices, personal computers, and smart interactive devices. A client application for the target application can be installed and run on the terminal device. This target application can include, but is not limited to, applications for network optimization. Furthermore, this embodiment does not limit the form of the target application, which may include, but is not limited to, applications, mini-programs, etc., installed on the terminal device, or even web pages.

[0031] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data. The server can be the backend server of the aforementioned target application, used to provide backend services to the clients of the target application.

[0032] It should be noted that the network configuration change risk prediction method provided in this application embodiment can generally be executed by server 105 and / or first terminal device 101, second terminal device 102, and third terminal device 103. Accordingly, the network configuration change risk prediction device provided in this application embodiment can generally be set in server 105 and / or first terminal device 101, second terminal device 102, and third terminal device 103.

[0033] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0034] Figure 2 A flowchart illustrating a network configuration change risk prediction method according to an embodiment of this application is shown. Figure 2 As shown, the network configuration change risk prediction method according to the embodiments of this application may include steps S210 to S240.

[0035] In step S210, the network configuration to be changed and the pre-built multi-layer topology map are obtained, wherein the multi-layer topology map includes a physical topology layer, a logical topology layer, a security topology layer and a service topology layer.

[0036] In step S220, based on the multi-level topology diagram, risk propagation path analysis is performed on the network configuration to be changed to obtain M risk impact dimensions. Among them, the M risk impact dimensions include at least the affected device range, link range, routing domain range, security domain range, service link range, and service system range, where M is an integer greater than or equal to 6.

[0037] In step S230, the multi-level topology diagram and M risk impact dimensions are input into the pre-built historical fault association model to obtain the dimension risk contribution value of each risk impact dimension.

[0038] In step S240, the risk score of the network configuration to be changed is calculated based on the dimensional risk contribution value of each risk impact dimension.

[0039] In some examples, the network configuration to be changed can be understood as at least one of the following configuration contents to be added, deleted, or modified during network operation and maintenance: configuration parameters, access control policies, routing policies, link policies, and security domain policies. Configuration parameters can be understood as various settings and variable values ​​required for the operation of network devices; they are the basic configuration for normal device operation and can include basic device parameters, interface parameters, system parameters, protocol parameters, and performance parameters, etc. Access control policies refer to a set of rules that define which network entities can access which network resources and the access conditions and actions; they can include ACL policies, firewall policies, user access control policies, application layer control policies, and NAT policies, etc. Routing policies can be understood as a set of policy rules that control the generation, publication, reception, filtering, and prioritization of routing information, used to determine the forwarding path of network packets between routers; they can include dynamic routing protocol configuration, route redistribution configuration, route filtering rules, and static route configuration, etc. Link policies can be understood as a set of policy rules that control network link status, primary / backup switching, traffic allocation, and link aggregation, used to determine the forwarding behavior of data frames on physical or logical links; they can include link redundancy policies, link aggregation policies, link primary / backup switching policies, and traffic allocation policies, etc. Security domain policy refers to a set of policies that define the division of security domains and the rules for mutual access permissions and traffic processing between security domains. It is used to achieve logical isolation and access control between different areas of the network. It can include security domain division configuration, inter-domain access control policy configuration, inter-security domain traffic processing configuration, intra-domain security policy configuration, and security domain and routing association configuration, etc.

[0040] The five types of network configurations mentioned above are not isolated from each other, but rather have a close hierarchical relationship and interaction. Configuration parameters are the foundation for all policy configurations, providing the parameter variables required for the operation of various policies; access control policies focus on permission management at the network security level; routing policies focus on path control at the network logic level; link policies focus on forwarding control at the physical or logical link level; and security domain policies focus on area isolation and inter-domain management at the security architecture level. When the network configuration to be changed involves any of the above categories of configuration content, its impact will propagate through the nodes and edges of the corresponding topology layer in the multi-layer topology graph, and will ultimately be reflected in M ​​risk impact dimensions.

[0041] In some examples, a multi-level topology diagram can be understood as a pre-constructed topology diagram used to characterize the multi-level structural features of a network system. The multi-level topology diagram includes a physical topology layer, a logical topology layer, a security topology layer, and a business topology layer. Each topology layer describes the structural relationships of the network system from different dimensions and together constitutes complete network topology information for use in risk propagation path analysis.

[0042] In some examples, the physical topology layer is used to characterize the physical connectivity and link redundancy of network devices, including the physical connectivity between routers, switches, firewalls, load balancers, WAF devices, VPN devices, and SDN control devices, as well as the correspondence between primary and backup links. Based on the physical topology layer, risk propagation path analysis can determine the set of network devices and links affected by configuration changes, and obtain the scope of affected devices and links respectively.

[0043] In some examples, the logical topology layer is used to characterize routing propagation relationships and virtual network isolation relationships at the network protocol level, including OSPF area division, BGP autonomous system neighbor relationships, VRF instance division, and routing leakage and isolation relationships between VRF instances. Based on the logical topology layer, risk propagation path analysis can determine the set of logical routing instances affected by configuration changes and obtain the range of affected routing domains.

[0044] In some examples, the security topology layer is used to characterize the network security domain division and the access control relationship between security domains, including the access control policies between security domains, the trust level of security domains, and the attribution relationship between security domains and network devices. Based on the security topology layer, risk propagation path analysis can determine the set of security domains affected by configuration changes and obtain the scope of affected security domains.

[0045] In some examples, the business topology layer is used to characterize the deployment structure and business access path relationships of business systems, including the deployment mapping relationship of each business system on network devices, the calling dependency relationship between business systems, and the network device path traversed by business access. Based on the business topology layer, risk propagation path analysis can determine the set of business access paths and the set of business systems affected by configuration changes, and obtain the scope of affected business links and the scope of affected business systems, respectively.

[0046] In some examples, risk propagation path analysis can be understood as simulating the diffusion process of network state changes after configuration changes take effect, layer by layer and hop by hop, based on a multi-layer topology graph. This process takes the starting point of the network configuration change operation as the source node and proceeds along device connection relationships and primary / backup link relationships in the physical topology layer, along routing propagation relationships and VRF routing leakage relationships in the logical topology layer, along security domain access control relationships in the security topology layer, and along service access path relationships and service call dependencies in the service topology layer. This continues until the affected device and link range in the physical topology layer, the affected routing domain range in the logical topology layer, the affected security domain range in the security topology layer, and the affected service link and service system range in the service topology layer are determined.

[0047] In some examples, the M risk impact dimensions can be understood as the specific classification of the risk impact scope of configuration changes on each topology layer, as determined by risk propagation path analysis. M is an integer greater than or equal to 6, and the M risk impact dimensions include at least the affected device range, link range, routing domain range, security domain range, business link range, and business system range.

[0048] In some examples, the scope of affected devices can be understood as the set of network devices that are affected by the network configuration to be changed, as determined at the physical topology layer through risk propagation path analysis. Network devices may include routers, switches, firewalls, load balancers, WAF devices, VPN devices, and SDN control devices. The scope of affected devices provides the basis for calculating the propagation impact of network impact factors at the device level.

[0049] In some examples, the affected link range can be understood as the set of physical or logical links that are affected by the network configuration to be changed, as determined at the physical topology layer through risk propagation path analysis. The links include primary links and backup links; the link range provides the basis for calculating the propagation impact of the link dimension for calculating the network impact factor.

[0050] In some examples, the affected routing domain range can be understood as the set of logical routing instances that are affected by the network configuration to be changed, as determined at the logical topology layer through risk propagation path analysis. Logical routing instances include at least one of OSPF areas, BGP autonomous systems, and VRF instances. The routing domain range provides the basis for calculating the propagation impact of the network impact factor at the routing domain dimension.

[0051] In some examples, the scope of the affected security domains can be understood as the set of security domains that are affected by the network configuration to be changed, as determined at the security topology layer through risk propagation path analysis. A security domain is a set of network areas with the same security protection requirements and trust levels. The scope of the security domains provides the basis for calculating the propagation impact of the business continuity impact factor in terms of the security domain dimension.

[0052] In some examples, the scope of affected business links can be understood as the set of business access paths that are affected by the network configuration to be changed, as determined at the business topology layer through risk propagation path analysis. The business access path is the network device path that business traffic takes from the client to the server. The scope of business links provides the basis for the propagation impact of business link dimensions when calculating the business continuity impact factor.

[0053] In some examples, the scope of affected business systems can be understood as the set of business systems affected by the network configuration to be changed, as determined at the business topology layer through risk propagation path analysis. These business systems include at least one of the core transaction system, payment and settlement system, mobile banking system, database system, and external business systems. The scope of business systems provides the basis for calculating the propagation impact of business continuity factors at the business system level.

[0054] In some examples, the historical fault association model can be understood as a pre-built association model used to store historical network configuration change records and their corresponding fault event records. The historical network configuration change records include change operation characteristics, and the fault event records include equipment fault range, link fault range, routing domain fault range, security domain fault range, service link fault range, and business system fault range. The historical fault association model is used to perform similarity matching between the change operation characteristics of the network configuration to be changed and the stored historical network configuration change records during risk prediction, and output the dimensional risk contribution value of each risk impact dimension based on the matching results.

[0055] In some examples, the dimensional risk contribution value of each risk impact dimension can be understood as the value obtained by combining the propagation impact degree of each risk impact dimension obtained from the risk propagation path analysis with the historical failure rate of each risk impact dimension output by the historical failure association model. The dimensional risk contribution value is used to characterize the size of each risk impact dimension's contribution to the overall risk level of the network configuration to be changed.

[0056] In some examples, the risk score can be understood as a quantitative value obtained by comprehensively calculating the risk contribution value of each risk impact dimension. The risk score is used to characterize the comprehensive impact of the network configuration to be changed on the overall security and business stability of the network system.

[0057] The network configuration change risk prediction method according to embodiments of this application acquires a multi-layered topology map including physical topology, logical topology, security topology, and service topology. Based on this multi-layered topology map, it performs risk propagation path analysis on the network configuration to be changed. This comprehensively captures the diffusion impact of configuration changes from four dimensions: physical connection, routing logic, security isolation, and service bearing. This solves the problem in existing technologies that cannot analyze the risk propagation path after configuration changes, elevating risk assessment from single-point configuration checks to full-network impact analysis. By inputting the multi-layered topology map and M risk impact dimensions into a pre-constructed historical fault association model, the dimensional risk contribution value of each risk impact dimension is obtained. This achieves a structured fusion of historical fault experience and current topology propagation analysis, solving the problem in existing technologies that lack historical fault association learning capabilities. This enables risk assessment to perform quantitative reasoning based on historical accident patterns, avoiding the recurrence of similar faults. The M risk impact dimensions include at least the affected equipment scope, link scope, routing domain scope, security domain scope, business link scope, and business system scope. The introduction of the business link scope and business system scope enables the potential impact of configuration changes on the core transaction system, payment and settlement system, mobile banking system, and database system to be explicitly quantified and predicted. This solves the problem that existing technologies cannot assess the impact of configuration changes on the continuity of banking business, provides an objective and quantitative decision-making basis for configuration change approval, and effectively ensures the stable operation of banking business.

[0058] According to some embodiments of this application, the network configuration change risk prediction method may also include a prompting step.

[0059] The prompt step is used to compare the risk score with a pre-set risk threshold. If the risk score is greater than or equal to the risk threshold, an alarm prompt is generated and a rollback policy is configured.

[0060] In some examples, a risk threshold can be understood as a pre-set critical value used to determine whether the comprehensive risk score of the network configuration to be changed reaches the alarm triggering condition. The risk threshold is configured according to the network operating environment and business security policies, including at least one of a single fixed threshold, multi-level thresholds, or dynamic thresholds. Specifically, a single fixed threshold uses a fixed threshold value to determine the risk level; a multi-level threshold uses at least two different threshold values ​​to classify the risk level, for example, dividing the risk into low, medium, and high risk levels; a dynamic threshold is adjusted according to the network operating period, business cycle, or historical risk distribution, for example, using a stricter threshold during peak transaction periods and a more lenient threshold during maintenance windows. When the comprehensive risk score is greater than or equal to the risk threshold, the corresponding alarm prompt and rollback policy generation are triggered.

[0061] In some examples, an alarm notification can be understood as a risk warning message generated to notify operations and maintenance personnel when the overall risk score of the network configuration to be changed is greater than or equal to a risk threshold. An alarm notification may include at least one of the following: alarm level, alarm content, alarm time, and alarm recipient. The alarm level characterizes the severity of the current risk, and may include, for example, a low-level alert, a medium-level warning, and a high-level emergency alarm. The alarm content may include the overall risk score, the specific value exceeding the threshold, the corresponding risk impact dimension information, and suggested actions. The alarm time is the system timestamp that triggered the alarm. The alarm recipient is the operations and maintenance personnel, approvers, or automated operations and maintenance system that needs to receive the alarm.

[0062] In some examples, configuring a rollback policy can be understood as an automatically generated configuration recovery plan to restore the network configuration to its pre-change state when the overall risk score of the network configuration to be changed is greater than or equal to the risk threshold. A configuration rollback policy can include at least one of the following: rollback preconditions, rollback operation steps, rollback device order, estimated rollback duration, service recovery priority, and rollback triggering conditions. Specifically, rollback preconditions are pre-check conditions that must be met before performing a rollback operation, including at least one of the target device's online status and configuration backup integrity; rollback operation steps are a list of rollback commands or rollback scripts arranged in execution order; rollback device order is the order in which each device performs the rollback operation; estimated rollback duration is at least one of the estimated time for each rollback step and the total rollback time; service recovery priority is the recovery order of each service system during the rollback process; and rollback triggering conditions are threshold values ​​for service anomalies that determine the need for rollback, such as at least one of the service error rate threshold or service response time threshold. The rollback strategy is generated based on historical rollback records stored in a pre-built historical fault association model, or by matching the change operation type of the network configuration to be changed with the corresponding predefined reverse operation template.

[0063] This embodiment compares a risk score with a pre-set risk threshold and generates an alarm and configuration rollback policy when the risk score is greater than or equal to the threshold. This automatically identifies high-risk changes and issues timely warnings before configuration changes are implemented, solving the problems of subjectivity and delayed response caused by relying on manual experience to judge risk levels in existing technologies. Simultaneously, the automatic generation of a configuration rollback policy upon triggering an alarm allows operations personnel to obtain a clear fault recovery plan before the change is implemented. This avoids the time delays and operational omissions caused by hastily formulating rollback plans after an anomaly occurs, significantly improving the efficiency of risk response to network configuration changes and system security.

[0064] According to some embodiments of this application, the network configuration change risk prediction method may further include a generation step.

[0065] The generation step is used to generate a risk assessment report, which includes at least one of the following: risk score, M risk impact dimensions, historical failure correlation analysis, and configuration rollback strategy. The historical failure correlation analysis is obtained by comparing the network configuration to be changed with historical network configuration change records.

[0066] In some examples, a risk assessment report can be understood as an output document that presents the risk assessment process and results of a proposed network configuration change to operations personnel or approval systems. A risk assessment report may include at least one of the following: risk score, M risk impact dimensions, historical failure correlation analysis, and configuration rollback strategy. The risk assessment report provides quantitative evidence for approval decisions regarding network configuration changes and is used by network operations systems, automated operations platforms, or business approval systems.

[0067] In some examples, historical fault correlation analysis can be understood as comparing the change operation characteristics of the network configuration to be changed with the historical changed network configuration records stored in the historical fault correlation model, and generating analysis result data to characterize the correlation between the current change and historical faults based on the comparison results. Historical fault correlation analysis includes at least one of the following: at least one historical changed network configuration record with the highest similarity to the network configuration to be changed; fault event records corresponding to each similar historical changed network configuration record; similarity scores for each similar historical changed network configuration record; and historical fault rates for each risk impact dimension obtained based on the similarity comparison results.

[0068] In some examples, comparing the network configuration to be changed with historical network configuration change records to obtain historical fault correlation analysis can be achieved in the following way: First, extract the change operation features of the network configuration to be changed. The change operation features include at least one of the following: change type, change device type, change-related protocol type, and change parameters. Then, calculate the similarity between the change operation features and the feature vectors of each historical network configuration change record stored in the historical fault correlation model to obtain the similarity score between each historical network configuration change record and the network configuration to be changed. Next, select the K historical network configuration change records with the highest similarity based on the similarity scores, where K is an integer greater than or equal to 1. Finally, based on the fault event records corresponding to the selected K historical network configuration change records, count the number of fault matches in each risk impact dimension to generate historical fault correlation analysis.

[0069] This embodiment generates a risk assessment report that includes at least one of the following: risk score, M risk impact dimensions, historical fault correlation analysis, and configuration rollback strategy. This report presents the risk analysis process and results of configuration changes to operations personnel or the approval system in a structured document format. As a result, operations personnel or approvers can fully understand the quantitative risk level, specific impact scope, correlation with historical faults, and recovery plans after anomalies occur before the change is implemented. This solves the problem of inefficient approval decisions caused by fragmented risk assessment results and the lack of a unified presentation format in existing technologies. It shifts configuration change approval from relying on manual experience to data-driven decision-making based on visualized, structured assessment reports, effectively improving the standardization and traceability of network configuration change approval.

[0070] According to some embodiments of this application, the step of inputting a multi-level topology diagram and M risk impact dimensions into a pre-built historical fault association model to obtain the dimension risk contribution value of each risk impact dimension may include a first statistical step, a second statistical step, a first calculation step, a second calculation step, a third statistical step, a third calculation step, and a fourth calculation step.

[0071] The first statistical step is to count the total number of devices, links, routing domains, security domains, service links, and service systems in the multi-layer topology diagram.

[0072] The second statistical step is to count the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, the number of security domains in the security domain range, the number of service links in the service link range, and the number of service systems in the service system range.

[0073] The first calculation step is to calculate the propagation impact of each risk impact dimension based on the total number of devices, links, routing domains, security domains, service links, service systems, devices in the device range, links in the link range, routing domains in the routing domain range, security domains in the security domain range, service links in the service link range, and service systems in the service system range of the multi-layer topology diagram.

[0074] The second calculation step is to calculate the number of similarities among historical network configuration change records stored in the historical fault association model for each of the M risk impact dimensions.

[0075] The third statistical step is to count the total number of devices, links, routing domains, security domains, service links, and service systems in the historical network configuration change records.

[0076] The third calculation step is to calculate the historical failure rate for each risk impact dimension based on the number of similarities for each risk impact dimension, the total number of devices, links, routing domains, security domains, business links, and business systems in the historical network configuration change records.

[0077] Fourth calculation step: Calculate the risk contribution value of each risk dimension based on the propagation impact and historical failure rate of each risk impact dimension.

[0078] In some examples, the total number of devices, links, routing domains, security domains, service links, and service systems in a multi-layer topology diagram can be calculated as follows: traverse all device nodes in the physical topology layer of the multi-layer topology diagram and count the total number of devices; traverse all link edges in the physical topology layer and count the total number of links; traverse all routing instance nodes in the logical topology layer and count the total number of routing domains; traverse all security domain nodes in the security topology layer and count the total number of security domains; traverse all service access path edges in the service topology layer and count the total number of service links; traverse all service system nodes in the service topology layer and count the total number of service systems.

[0079] In some examples, the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, the number of security domains in the security domain range, the number of business links in the business link range, and the number of business systems in the business system range can be achieved as follows: From the M risk impact dimensions obtained from the risk propagation path analysis, extract the number of elements contained in each of the affected device range, link range, routing domain range, security domain range, business link range, and business system range, respectively, to obtain the corresponding number of devices, links, routing domains, security domains, business links, and business systems.

[0080] In some examples, the propagation impact of each risk impact dimension can be calculated based on the total number of devices, total number of links, total number of routing domains, total number of security domains, total number of service links, total number of service systems, number of devices in the device range, number of links in the link range, number of routing domains in the routing domain range, number of security domains in the security domain range, number of service links in the service link range, and number of service systems in the service system range in the service system range. This can be achieved by dividing the number of affected elements in each risk impact dimension by the total number of elements in that dimension to obtain the propagation impact of that dimension. Specifically, the propagation impact of a device-wide scope is equal to the number of devices in that scope divided by the total number of devices in the multi-layer topology diagram; the propagation impact of a link-wide scope is equal to the number of links in that scope divided by the total number of links in the multi-layer topology diagram; the propagation impact of a routing domain-wide scope is equal to the number of routing domains in that scope divided by the total number of routing domains in the multi-layer topology diagram; the propagation impact of a security domain-wide scope is equal to the number of security domains in that scope divided by the total number of security domains in the multi-layer topology diagram; the propagation impact of a service link-wide scope is equal to the number of service links in that scope divided by the total number of service links in the multi-layer topology diagram; and the propagation impact of a service system-wide scope is equal to the number of service systems in that scope divided by the total number of service systems in the multi-layer topology diagram. The propagation impact of each dimension is a normalized value between 0 and 1, used to characterize the degree to which that dimension is affected by configuration changes.

[0081] In some examples, calculating the number of similarities between M risk impact dimensions and historical network configuration change records stored in the historical fault association model across each risk impact dimension can be achieved as follows: Extract the change operation features of the network configuration to be changed; calculate the similarity between the change operation features and each historical network configuration change record stored in the historical fault association model to obtain the similarity score between each historical network configuration change record and the network configuration to be changed; select the K historical network configuration change records with the highest similarity scores; for each selected historical network configuration change record, based on its fault label, count the fault hits in the corresponding dimensions of device scope, link scope, routing domain scope, security domain scope, business link scope, and business system scope; count the total number of fault hits in each dimension for the K historical network configuration change records to obtain the number of similarities for each dimension.

[0082] In some examples, the total number of devices, links, routing domains, security domains, service links, and service systems in historical network configuration change records can be achieved as follows: Traverse all fault event records corresponding to historical network configuration change records stored in the historical fault association model. Perform deduplication on the device fault range, link fault range, routing domain fault range, security domain fault range, service link fault range, and service system fault range in each fault event record to obtain the total number of devices, links, routing domains, security domains, service links, and service systems in the historical network configuration change records. It should be noted that this count is not the total number of historical records, but rather the total number of each of the deduplicated devices, links, routing domains, security domains, service links, and service systems covered by all historical fault events.

[0083] In some examples, the historical failure rate of each risk impact dimension can be calculated based on the number of similar points of each risk impact dimension, the total number of devices, links, routing domains, security domains, business links, and business systems in the historical network configuration change records. This can be achieved by dividing the number of similar points of that dimension by the total number of that dimension in the historical network configuration change records to obtain the historical failure rate of that dimension. Specifically, the historical failure rate for each dimension is calculated as follows: device-level failure rate = number of similarities in the device dimension divided by the total number of devices in the historical network configuration change records; link-level failure rate = number of similarities in the link dimension divided by the total number of links in the historical network configuration change records; routing domain-level failure rate = number of similarities in the routing domain dimension divided by the total number of routing domains in the historical network configuration change records; security domain-level failure rate = number of similarities in the security domain dimension divided by the total number of security domains in the historical network configuration change records; service link-level failure rate = number of similarities in the service link dimension divided by the total number of service links in the historical network configuration change records; and service system-level failure rate = number of similarities in the service system dimension divided by the total number of service systems in the historical network configuration change records. All historical failure rates for each dimension are normalized values ​​between 0 and 1, representing the frequency of failures in that dimension in historical records.

[0084] In some examples, the dimension risk contribution value can be calculated based on the propagation impact and historical failure rate of each risk impact dimension as follows: For each risk impact dimension, multiply the propagation impact of that dimension by its historical failure rate to obtain the dimension risk contribution value. Specifically, the dimension risk contribution value for the device dimension equals the propagation impact across the device scope multiplied by the historical failure rate of the device dimension; the dimension risk contribution value for the link dimension equals the propagation impact across the link scope multiplied by the historical failure rate of the link dimension; the dimension risk contribution value for the routing domain dimension equals the propagation impact across the routing domain scope multiplied by the historical failure rate of the routing domain dimension; the dimension risk contribution value for the security domain dimension equals the propagation impact across the security domain scope multiplied by the historical failure rate of the security domain dimension; the dimension risk contribution value for the business link dimension equals the propagation impact across the business link scope multiplied by the historical failure rate of the business link dimension; and the dimension risk contribution value for the business system dimension equals the propagation impact across the business system scope multiplied by the historical failure rate of the business system dimension. The physical meaning of the dimensional risk contribution value is as follows: the propagation impact degree characterizes the extent to which the current change affects each dimension, and the historical failure rate characterizes the probability of similar changes causing problems in each dimension in the past. The dimensional risk contribution value obtained by multiplying the two represents the actual risk borne by each dimension in the current change. The higher the dimensional risk contribution value, the more prominent the risk of that dimension in the current change.

[0085] This embodiment calculates the propagation impact by statistically analyzing the total number of each dimension in the multi-layer topology diagram and the number of affected dimensions obtained from risk propagation analysis, transforming the structured output of risk propagation path analysis into quantifiable normalized indicators. This provides a quantitative basis for qualitative impact analysis at the network topology level, solving the technical problem of the inability to quantify and assess the scope of risk propagation in existing technologies. By calculating the number of similarities between M risk impact dimensions and historical network configuration change records, and statistically analyzing the total number of each dimension in historical network configuration change records to calculate the historical failure rate of each dimension, the analysis results of a large number of discrete historical records in the historical failure association model are refined into independent and normalized risk probability indicators for each dimension. This allows historical failure experience to participate in risk calculation in a standardized probabilistic form. By multiplying the propagation impact of each dimension by the corresponding historical failure rate to obtain the dimension risk contribution value, a structured fusion of the actual impact breadth of the current change and historical failure experience is achieved. The risk contribution value of each dimension simultaneously reflects two independent risk factors: the extent of the impact and the probability of problems, avoiding the one-sidedness of single-factor assessment and significantly improving the accuracy and interpretability of risk scoring.

[0086] According to some embodiments of this application, the step of calculating the risk score of the network configuration to be changed based on the dimensional risk contribution value of each risk impact dimension may include a fifth calculation step, a sixth calculation step, a seventh calculation step, and an eighth calculation step.

[0087] Fifth calculation step: Calculate the network impact factor based on the risk contribution values ​​of the device range, link range, and routing domain range dimensions.

[0088] The sixth calculation step: Calculate the historical failure correlation factor based on the historical failure rate of each risk impact dimension.

[0089] Seventh calculation step: Calculate the business continuity impact factor based on the risk contribution values ​​of the security domain scope, business link scope, and business system scope.

[0090] Eighth calculation step: Calculate the risk score based on the network impact factor, historical failure correlation factor, and business continuity impact factor.

[0091] In some examples, the network impact factor can be calculated based on the risk contribution values ​​of device scope, link scope, and routing domain scope as follows: The network impact factor is obtained by summing the risk contribution values ​​of device scope, link scope, and routing domain scope. The network impact factor characterizes the comprehensive impact of the network configuration change on the network structure and traffic propagation range. Device scope, link scope, and routing domain scope are all risk impact dimensions at the network layer. Device scope and link scope reflect the breadth of the configuration change's impact at the physical topology layer, while routing domain scope reflects the breadth of the configuration change's impact at the logical topology layer. Together, they constitute a complete characterization of network layer risk.

[0092] In some examples, the historical failure correlation factor can be calculated based on the historical failure rates of each risk impact dimension as follows: a weighted average of the historical failure rates at the device, link, routing, security, business link, and business system dimensions is taken. The weight of each dimension is determined based on its importance in historical failure events or the number of historical network configuration change records corresponding to that dimension. The historical failure correlation factor characterizes the degree of correlation between the network configuration to be changed and historical failure events, reflecting the risk similarity of the configuration change in historical operation records. By incorporating the historical failure rates of all six dimensions, the historical failure correlation factor can comprehensively reflect the potential failure risks at each level.

[0093] In some examples, the business continuity impact factor can be calculated based on the dimensional risk contribution values ​​of the security domain scope, business link scope, and business system scope as follows: The business continuity impact factor is obtained by summing the dimensional risk contribution values ​​of the security domain scope, business link scope, and business system scope. The business continuity impact factor characterizes the degree of impact of the network configuration change on the continuity and stability of the core business system. Specifically, the security domain scope reflects the breadth of the impact of the configuration change at the security topology layer; the business link scope reflects the breadth of the impact of the configuration change on business access paths at the business topology layer; and the business system scope reflects the breadth of the impact of the configuration change on business system nodes at the business topology layer. Together, these three factors constitute a complete characterization of business continuity risk.

[0094] Furthermore, before summing, the dimensional risk contribution values ​​of each business system can be weighted and adjusted according to the importance level of each business system. For example, higher weights can be given to core transaction systems and payment and settlement systems, while lower weights can be given to external business systems, so that the business continuity impact factor is more in line with the actual business scenarios of banks.

[0095] In some examples, the risk score can be calculated based on the network impact factor, historical failure correlation factor, and business continuity impact factor as follows: The network impact factor is multiplied by a first weighting coefficient, the historical failure correlation factor by a second weighting coefficient, and the business continuity impact factor by a third weighting coefficient, and then summed to obtain the risk score. The first, second, and third weighting coefficients are pre-set weight values ​​used to dynamically adjust the risk assessment model according to different network operating environments and business strategies. During peak transaction periods or in scenarios involving changes to core business systems, the third weighting coefficient is adjusted to be higher than the first and second weighting coefficients to highlight the dominant role of business continuity impact in the risk score. In scenarios involving network architecture adjustments or core equipment changes, the first weighting coefficient is adjusted to be higher than both the second and third weighting coefficients to highlight the dominant role of network impact in the risk score. The risk score is used to quantitatively assess the comprehensive impact of the network configuration change on the overall system security and business stability.

[0096] This embodiment calculates the network impact factor by aggregating the risk contribution values ​​of the device scope, link scope, and routing domain scope; it calculates the business continuity impact factor by aggregating the risk contribution values ​​of the security domain scope, business link scope, and business system scope; and it calculates the historical failure correlation factor based on the historical failure rates of all six dimensions. This achieves a hierarchical abstraction and aggregation from the six underlying risk contribution values ​​to the three higher-level risk factors. A risk score is obtained by weighted summation of the network impact factor, historical failure correlation factor, and business continuity impact factor. The system supports dynamic adjustment of the three weight coefficients according to different network operating environments and business strategies. This ensures that the risk score comprehensively reflects the combined risks of configuration changes at the network, historical correlation, and business levels, and flexibly adapts to the differentiated risk assessment needs under different business scenarios such as peak transaction periods and network architecture adjustments, effectively improving the adaptability and accuracy of the risk assessment model.

[0097] According to some embodiments of this application, the step of pre-constructing a historical fault association model may include an acquisition step, an annotation step, and a construction step.

[0098] Acquisition Steps: Acquire N historical network configuration change records. The historical network configuration change records include change operation characteristics and fault event records caused by the changes. The fault event records include the scope of equipment faults, the scope of link faults, the scope of routing domain faults, the scope of security domain faults, the scope of service link faults, and the scope of service system faults. N is an integer greater than or equal to 5.

[0099] Labeling steps: Vectorize the change operation features of each historical network configuration change record to generate a historical change feature vector, and label each historical network configuration change record with a fault label based on the fault event record.

[0100] Construction steps: Associate and store all historical change feature vectors with their corresponding fault labels, configure statistical functions and calculation functions, and thus construct a historical fault association model.

[0101] In some examples, retrieving N historical network configuration change records, which include change operation characteristics and fault event records caused by the changes, and fault event records including device fault range, link fault range, routing domain fault range, security domain fault range, service link fault range, and service system fault range, can be achieved in the following way: Collect the change operation characteristics and historical fault event records included in the historical network configuration change records from the network operation and maintenance system, configuration management database, or network change management platform; associate the change operation characteristics with the historical fault event records using a time window alignment method to generate historical network configuration change records. Change operation characteristics can include at least one of change type, changed device type, change-related protocol type, and change parameters. The device fault range, link fault range, routing domain fault range, security domain fault range, service link fault range, and service system fault range in the fault event records are used to indicate the corresponding range of faults actually caused by the historical change record in the six risk impact dimensions.

[0102] In some examples, the change operation characteristics of each historical network configuration change record are vectorized to generate historical change feature vectors. This can be achieved by: performing one-hot encoding or tag encoding on discrete features such as change type, change device type, and change-related protocol type in the change operation characteristics, converting them into numerical feature vectors; normalizing or standardizing numerical features such as change parameters to make them within the same numerical range as discrete features; and combining the encoded and normalized feature values ​​into a fixed-length feature vector, which serves as the historical change feature vector corresponding to that historical network configuration change record.

[0103] In some examples, labeling each historical network configuration change record with fault tags based on fault event records can be achieved as follows: For each historical network configuration change record, based on the device fault range, link fault range, routing domain fault range, security domain fault range, service link fault range, and service system fault range in its corresponding fault event record, label whether the historical record has experienced a fault in the corresponding dimension across six risk impact dimensions. Specifically, if the fault range corresponding to a certain dimension is not empty or contains at least one element, then the fault tag for that dimension is marked as 1, indicating that a fault actually occurred in that dimension in the historical record; if the fault range corresponding to a certain dimension is empty or does not contain any elements, then the fault tag for that dimension is marked as 0, indicating that a fault did not occur in that dimension in the historical record. After the above labeling, each historical network configuration change record corresponds to a tag vector containing fault tags across the six dimensions.

[0104] In some examples, a historical fault association model is constructed by associating and storing all historical change feature vectors with their corresponding fault labels, and configuring statistical and computational functions. This can be achieved as follows: The historical change feature vectors of each historical network configuration change record are associated and stored with their corresponding fault label vectors as key-value pairs, forming a set of historical change feature vectors. Statistical functions are configured in the historical fault association model to count the total number of entries in all historical network configuration change records, the total number of fault label hits in each dimension, and the total number of deduplicated devices, links, routing domains, security domains, service links, and service systems covered by all historical network configuration change records. Computational functions are configured in the historical fault association model to calculate the similarity between the change operation feature vector of the network configuration to be changed and each historical change feature vector in the historical change feature vector set. The K historical network configuration change records with the highest similarity are selected based on similarity ranking, and the number of fault label hits in each dimension of the selected K records is counted as the number of similarity points. Statistical and computational functions are invoked when the historical fault association model is applied to risk prediction to output the number of similar points, the total number of each dimension in the historical network configuration change records, and the historical fault rate of each dimension.

[0105] This embodiment acquires N historical network configuration change records, including change operation features and fault event records. The change operation features are vectorized to generate historical change feature vectors. Simultaneously, each historical record is labeled with six risk impact dimensions based on the fault event records. Finally, all historical change feature vectors are associated and stored with their corresponding fault labels, and statistical and calculation functions are configured to construct a historical fault association model, providing structured historical data support for subsequent risk prediction. When applied, this historical fault association model can quickly retrieve similar historical records based on the feature vector of the configuration to be changed and statistically analyze the fault hit rate in each dimension, thereby calculating the dimensional risk contribution value for each risk impact dimension. This solves the problems of low utilization rate of historical fault data and lack of systematic storage and retrieval mechanisms in existing technologies. It enables historical fault experience to serve the risk assessment process of each configuration change in a standardized and reusable form, effectively improving the utilization efficiency of historical data and the accuracy of risk prediction.

[0106] Based on the above-described network configuration change risk prediction method, this application also provides a network configuration change risk prediction device. The following will combine... Figure 3 The device is described in detail.

[0107] Figure 3 A schematic block diagram of a network configuration change risk prediction device according to an embodiment of this application is shown.

[0108] like Figure 3As shown, the network configuration change risk prediction device 10 includes an acquisition module 1, an analysis module 2, a first calculation module 3, and a second calculation module 4.

[0109] The acquisition module 1 is used to acquire the network configuration to be changed and the pre-built multi-level topology diagram, which includes a physical topology layer, a logical topology layer, a security topology layer and a service topology layer.

[0110] Analysis module 2 is used to perform risk propagation path analysis on the network configuration to be changed based on a multi-level topology diagram, and obtain M risk impact dimensions. Among them, the M risk impact dimensions include at least the affected device range, link range, routing domain range, security domain range, business link range, and business system range, and M is an integer greater than or equal to 6.

[0111] The first calculation module 3 is used to input the multi-level topology diagram and M risk impact dimensions into the pre-built historical fault association model to obtain the dimension risk contribution value of each risk impact dimension.

[0112] The second calculation module 4 is used to calculate the risk score of the network configuration to be changed based on the dimensional risk contribution value of each risk impact dimension.

[0113] According to some embodiments of this application, the network configuration change risk prediction device may also include a prompting module.

[0114] The alert module compares the risk score with a pre-set risk threshold. If the risk score is greater than or equal to the risk threshold, an alarm alert is generated and a rollback policy is configured.

[0115] According to some embodiments of this application, the network configuration change risk prediction device may further include a generation module.

[0116] The generation module is used to generate a risk assessment report, which includes at least one of the following: risk score, M risk impact dimensions, historical failure correlation analysis, and configuration rollback strategy. The historical failure correlation analysis is obtained by comparing the network configuration to be changed with historical network configuration change records.

[0117] According to some embodiments of this application, the first calculation module may include a first statistical unit, a second statistical unit, a first calculation unit, a second calculation unit, a third statistical unit, a third calculation unit, and a fourth calculation unit.

[0118] The first statistical unit is to count the total number of devices, links, routing domains, security domains, service links, and service systems in the multi-layer topology diagram.

[0119] The second statistical unit counts the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, the number of security domains in the security domain range, the number of business links in the business link range, and the number of business systems in the business system range.

[0120] The first calculation unit calculates the propagation impact of each risk impact dimension based on the total number of devices, links, routing domains, security domains, service links, service systems, the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, the number of security domains in the security domain range, the number of service links in the service link range, and the number of service systems in the service system range in the multi-layer topology diagram.

[0121] The second calculation unit calculates the number of similarities among historical network configuration change records stored in the historical fault association model across the M risk impact dimensions.

[0122] The third statistical unit: Statistically counts the total number of devices, links, routing domains, security domains, service links, and service systems in the historical network configuration change records.

[0123] The third calculation unit calculates the historical failure rate for each risk impact dimension based on the number of similarities in each risk impact dimension, the total number of devices, links, routing domains, security domains, business links, and business systems in the historical network configuration change records.

[0124] The fourth calculation unit calculates the risk contribution value of each risk dimension based on the propagation impact and historical failure rate of each risk impact dimension.

[0125] According to some embodiments of this application, the second computing module may include a fifth computing unit, a sixth computing unit, a seventh computing unit, and an eighth computing unit.

[0126] The fifth calculation unit calculates the network impact factor based on the risk contribution values ​​of the device range, link range, and routing domain range.

[0127] The sixth calculation unit calculates the historical failure correlation factor based on the historical failure rate of each risk impact dimension.

[0128] The seventh calculation unit calculates the business continuity impact factor based on the risk contribution values ​​of the security domain scope, business link scope, and business system scope.

[0129] The eighth calculation unit calculates the risk score based on the network impact factor, historical failure correlation factor, and business continuity impact factor.

[0130] According to some embodiments of this application, the network configuration change risk prediction device may further include a pre-construction module, which is used to pre-construct a historical fault association model. The pre-construction module may include an acquisition unit, a labeling unit, and a construction unit.

[0131] Acquisition Unit: Acquire N historical network configuration change records. The historical network configuration change records include change operation characteristics and fault event records caused by the changes. The fault event records include the scope of equipment faults, the scope of link faults, the scope of routing domain faults, the scope of security domain faults, the scope of service link faults, and the scope of service system faults. N is an integer greater than or equal to 5.

[0132] Labeling Unit: The change operation features of each historical network configuration change record are vectorized to generate historical change feature vectors, and fault labels are labeled for each historical network configuration change record according to the fault event records.

[0133] Building Unit: Associate and store all historical change feature vectors with their corresponding fault labels, configure statistical functions and calculation functions, and thus build a historical fault association model.

[0134] The network configuration change risk prediction device according to the embodiments of this application acquires a multi-layered topology map including physical topology, logical topology, security topology, and service topology, and performs risk propagation path analysis on the network configuration to be changed based on this multi-layered topology map. This allows for a comprehensive capture of the diffusion impact of configuration changes from four dimensions: physical connection, routing logic, security isolation, and service carrying. This solves the problem in existing technologies that cannot analyze the risk propagation path after a configuration change, elevating risk assessment from single-point configuration checks to a full-network impact analysis. By inputting the multi-layered topology map and M risk impact dimensions into a pre-built historical fault association model, the dimensional risk contribution value of each risk impact dimension is obtained. This achieves a structured fusion of historical fault experience and current topology propagation analysis, solving the problem of lacking historical fault association learning capabilities in existing technologies. This enables risk assessment to perform quantitative reasoning based on historical accident patterns, avoiding the recurrence of similar faults. The M risk impact dimensions include at least the affected equipment scope, link scope, routing domain scope, security domain scope, business link scope, and business system scope. The introduction of the business link scope and business system scope enables the potential impact of configuration changes on the core transaction system, payment and settlement system, mobile banking system, and database system to be explicitly quantified and predicted. This solves the problem that existing technologies cannot assess the impact of configuration changes on the continuity of banking business, provides an objective and quantitative decision-making basis for configuration change approval, and effectively ensures the stable operation of banking business.

[0135] According to embodiments of this application, any multiple modules among the acquisition module 1, analysis module 2, first calculation module 3, and second calculation module 4 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some functions of one or more of these modules can be combined with at least some functions of other modules and implemented in one module. According to embodiments of this application, at least one of the acquisition module 1, analysis module 2, first calculation module 3, and second calculation module 4 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array, programmable logic array, system-on-a-chip, system-on-a-substrate, system-on-package, application-specific integrated circuit, or any other reasonable means of integrating or packaging the circuit, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the acquisition module 1, analysis module 2, first calculation module 3, and second calculation module 4 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0136] Figure 4 A block diagram schematically illustrates an electronic device suitable for implementing the above-described method according to an embodiment of this application.

[0137] like Figure 4 As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory 902 or a program loaded from a storage portion 908 into a random access memory 903. The processor 901 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for executing different steps of the method flow according to an embodiment of this application.

[0138] Random access memory 903 stores various programs and data required for the operation of electronic device 900. Processor 901, read-only memory 902, and random access memory 903 are interconnected via bus 904. Processor 901 executes various steps of the method flow according to embodiments of this application by executing programs stored in read-only memory 902 and / or random access memory 903. It should be noted that the programs may also be stored in one or more memories other than read-only memory 902 and random access memory 903. Processor 901 may also execute various steps of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0139] According to embodiments of this application, the electronic device 900 may further include an input / output interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card, such as a local area network card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0140] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0141] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include the read-only memory 902 described above, and / or random access memory 903, and / or one or more memories other than read-only memory 902 and random access memory 903.

[0142] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0143] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0144] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by processor 901, it performs the functions defined in the system of embodiments of this application. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0145] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0146] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0147] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for predicting network configuration change risks, characterized in that, include: Obtain the network configuration to be changed and a pre-built multi-layer topology map, wherein the multi-layer topology map includes a physical topology layer, a logical topology layer, a security topology layer, and a service topology layer; Based on the multi-level topology diagram, risk propagation path analysis is performed on the network configuration to be changed to obtain M risk impact dimensions. The M risk impact dimensions include at least the affected device range, link range, routing domain range, security domain range, service link range, and service system range, where M is an integer greater than or equal to 6. The multi-level topology diagram and the M risk impact dimensions are input into a pre-built historical fault association model to obtain the dimension risk contribution value of each of the risk impact dimensions. Calculate the risk score of the network configuration to be changed based on the dimensional risk contribution value of each of the aforementioned risk impact dimensions.

2. The network configuration change risk prediction method according to claim 1, characterized in that, Also includes: The risk score is compared with a pre-set risk threshold. If the risk score is greater than or equal to the risk threshold, an alarm is generated and a rollback policy is configured.

3. The network configuration change risk prediction method according to claim 2, characterized in that, Also includes: Generate a risk assessment report, wherein the risk assessment report includes at least one of the following: risk score, M risk impact dimensions, historical failure correlation analysis, and configuration rollback strategy. The historical failure correlation analysis is obtained by comparing the network configuration to be changed with historical network configuration change records.

4. The network configuration change risk prediction method according to claim 1, characterized in that, The steps of inputting the multi-level topology diagram and the M risk impact dimensions into a pre-constructed historical fault association model to obtain the dimension risk contribution value of each of the risk impact dimensions include: The total number of devices, links, routing domains, security domains, service links, and service systems in the multi-layer topology diagram are statistically analyzed. The system counts the number of devices in the device range, the number of links in the link range, the number of routing domains in the routing domain range, the number of security domains in the security domain range, the number of service links in the service link range, and the number of service systems in the service system range. Based on the total number of devices, total number of links, total number of routing domains, total number of security domains, total number of service links, total number of service systems, number of devices in the device range, number of links in the link range, number of routing domains in the routing domain range, number of security domains in the security domain range, number of service links in the service link range, and number of service systems in the service system range in the service system range, calculate the propagation impact of each of the risk impact dimensions. Calculate the number of similarities between the M risk impact dimensions and the historical change network configuration records stored in the historical fault association model in each of the risk impact dimensions; The total number of devices, links, routing domains, security domains, service links, and service systems in the historical network configuration change records are statistically analyzed. Based on the number of similarities in each of the risk impact dimensions, the total number of devices, links, routing domains, security domains, business links, and business systems in the historical network configuration change records, calculate the historical failure rate for each of the risk impact dimensions. The risk contribution value of each dimension is calculated based on the propagation impact and the historical failure rate of each risk impact dimension.

5. The network configuration change risk prediction method according to claim 4, characterized in that, The step of calculating the risk score of the network configuration to be changed based on the dimensional risk contribution value of each of the aforementioned risk impact dimensions includes: Calculate the network impact factor based on the dimensional risk contribution values ​​of the device range, the link range, and the routing domain range; Calculate the historical failure correlation factor based on the historical failure rate of each of the aforementioned risk impact dimensions; Calculate the business continuity impact factor based on the risk contribution values ​​of the security domain scope, business link scope, and business system scope. A risk score is calculated based on the network impact factor, the historical failure correlation factor, and the business continuity impact factor.

6. The network configuration change risk prediction method according to claim 1, characterized in that, The steps for pre-building a historical fault correlation model include: Obtain N historical network configuration change records, wherein the historical network configuration change records include change operation characteristics and fault event records caused by the changes, and the fault event records include equipment fault range, link fault range, routing domain fault range, security domain fault range, service link fault range and service system fault range, where N is an integer greater than or equal to 5; The change operation features of each of the historical network configuration change records are vectorized to generate historical change feature vectors, and fault labels are marked for each of the historical network configuration change records according to the fault event records. All the historical change feature vectors are associated with and stored with their corresponding fault labels. Statistical functions and calculation functions are configured to construct the historical fault association model.

7. A network configuration change risk prediction device, characterized in that, include: The acquisition module is used to acquire the network configuration to be changed and a pre-built multi-layer topology map, wherein the multi-layer topology map includes a physical topology layer, a logical topology layer, a security topology layer and a service topology layer; The analysis module is used to perform risk propagation path analysis on the network configuration to be changed based on the multi-level topology diagram, and obtain M risk impact dimensions, wherein the M risk impact dimensions include at least the affected device range, link range, routing domain range, security domain range, service link range and service system range, and M is an integer greater than or equal to 6; The first calculation module is used to input the multi-level topology diagram and the M risk impact dimensions into a pre-constructed historical fault association model to obtain the dimension risk contribution value of each of the risk impact dimensions. The second calculation module is used to calculate the risk score of the network configuration to be changed based on the dimensional risk contribution value of each of the risk impact dimensions.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

Images