CN105335819A - Information system risk early warning model construction method based on big data - Google Patents

Abstract

The invention belongs to the information technology field and discloses an information system risk early warning model construction method based on big data. An information system risk early warning model is established, wherein the information system risk model comprises three sub-models which are an information system basic infrastructure evaluation mathematic model, an information system real-time reliable evaluation mathematic model and an information system historic operation evaluation mathematic model. On the basis of the three sub-models, the invention realizes a risk pre-alarming on the information system, realizes information system risk alarming before the fault, greatly improves the information system maintenance efficiency, promotes the information to develop toward the more delicate, more coordinated, and more efficient direction.

Description

A kind of Risk of Information System Early-warning Model construction method based on large data

Technical field

The invention belongs to areas of information technology, relate to a kind of communication system method for prewarning risk, be specifically related to a kind of Risk of Information System Early-warning Model construction method based on large data.

Background technology

For guarantee information security of system, stable, effectively run, power grid enterprises start informatization, achieve the real-time monitoring of information O&M infrastructure such as comprehensively covering main process equipment, the network equipment, safety equipment, memory device, database and middleware and infosystem, for the information maintenance work of the whole network provides technical support means.

But also there is following deficiency at Risk of Information System warning aspect:

1) alarm to infosystem is only achieved at present, and the Risk-warning of unrealized infosystem, the various phenomenons before failing to the generation of infosystem fault are monitored and identify, do not pinpoint the problems before the failure occurs and problem-solving ability;

2) fail the risk warning model that builds up an information system, lack theoretical method and the implementation tool of Risk of Information System early warning;

3) means that the large data of O&M are managed are lacked, and the statistical study based on form is also mainly rested on to the means of the large data separate of O&M, lack the advanced analysis means that the large data of O&M are excavated and explored, constrain from digitizing to intelligentized development.

Along with the development of company information O&M business, Various types of data generates in a large number, except traditional structural data, also create the semi-structured data such as a large amount of system journals and unstructured data, this has deepened the application demand of company to large data technique further.The Risk-warning of infosystem can be monitored correlated phenomena before the failure occurs, identify and early warning, greatly can promote information O&M efficiency, promotes that corporate business is towards meticulousr, more collaborative, quicker, more efficient future development.

Summary of the invention

Goal of the invention: the object of the invention is the problem in order to solve infosystem devoid of risk early warning mechanism in above prior art, a kind of Risk of Information System Early-warning Model construction method based on large data is provided, thus provides powerful guarantee for the safe operation of infosystem.

Technical scheme: a kind of Risk of Information System Early-warning Model construction method based on large data of the present invention, its objective is and like this to realize,

Based on a Risk of Information System Early-warning Model construction method for large data, comprise the following steps:

S01: the infrastructure building infosystem is classified, comprises main process equipment, the network equipment, safety equipment, memory device, database and middleware; Obtain real-time monitor control index and the history run achievement data of infrastructure;

S02: definition frastructure state index is A ₀, for all indexs except frastructure state index, the algorithm of design basis facility metrics evaluation, set up the mathematical model of infrastructure metrics evaluation:

$\left\{\begin{array}{c}{A}_n=0(T\&GreaterEqual;\max )\\ A_n=\frac{500(\max -T)}{\max }(\frac{4}{5}\max <T<\max )\\ A_n=100(T\&le;\frac{4}{5}\max )\end{array}\right.$

In formula, A _nbe the evaluation of the n-th infrastructure index, T is the desired value of the n-th infrastructure, and max is the metrics-thresholds of the n-th infrastructure;

S03: be in the prerequisite of normal condition in infrastructure under, based on the evaluation algorithms of all indexs except frastructure state index, devise infrastructure evaluation algorithms, the real-time performance of infrastructure evaluated, set up the mathematical model that infrastructure real-time performance is evaluated:

$\left\{\begin{array}{c}f=0(A_0=0)\\ f=50(0<A_0<1)\\ f=50+\frac{\underset{i=1}{\overset{n}{\&Sigma;}}{k}_n{A}_n}{n}(A_0=1)\end{array}\right.$

In formula, infrastructure is evaluated be divided into f, and the weight of the n-th index is k _n, k under normal circumstances _n=1;

S04: by the network topology architecture of Topology Discovery technical limit spacing infosystem, is divided into category-A and category-B by single infrastructure according to its importance, and category-A infrastructure represents that it is if there is problem, and infosystem cannot normally be run; Category-B infrastructure represents that it is if there is problem, directly can not affect the normal operation of infosystem; The node of the infosystem topological structure that definition S class infrastructure is made up of multiple category-B infrastructure; When any one category-A infrastructure or any one S class infrastructure unavailable time, then infosystem architecture is evaluated be divided into zero; When all category-A infrastructure and all S class infrastructure all available time, the architecture that builds up an information system evaluate mathematical model:

$F_1=\frac{{\mathrm{\&alpha;}}_1\underset{i=1}{\overset{n_A}{\&Sigma;}}{f}_{n_A}^i+{\mathrm{\&alpha;}}_2\underset{k=1}{\overset{n_{B2}}{\&Sigma;}}{f}_{n_{B2}}^k+{\mathrm{\&alpha;}}_3\underset{j=1}{\overset{n_s}{\&Sigma;}}\underset{p=1}{\overset{q_j}{\&Sigma;}}\frac{f_{n_{B1}}^{j,p}}{q_j}}{{\mathrm{\&alpha;}}_1{n}_A+{\mathrm{\&alpha;}}_2{n}_{B2}+{\mathrm{\&alpha;}}_3{n}_s}$

In formula, n _afor the quantity of category-A infrastructure, n _sfor the quantity of S class infrastructure, n _b1for being under the jurisdiction of the quantity of the category-B infrastructure of S class infrastructure, n _b2for not belonging to the quantity of the category-B infrastructure of S class infrastructure, f is that in step S03, all kinds of infrastructure evaluates score, q _jfor the quantity of category-B infrastructure inside a jth S class infrastructure, α 1, α 2, α 3 are respectively category-A infrastructure, do not belong to the evaluation weight of the category-B infrastructure of S class infrastructure and S class infrastructure, wherein α 3 > α 1 > α 2, and can be configured by User Defined, F ₁for infosystem architecture evaluates score;

S05: in real time sampling is monitored to infosystem main page, the mathematical model that the reliability in time that builds up an information system is evaluated:

$F_2=\underset{i=1}{\overset{m}{\&Sigma;}}{\mathrm{\&gamma;}}_i\&times;\frac{\underset{k=1}{\overset{m}{\&Sigma;}}\frac{f_k}{{(1+p)}^{k-1}}}{\underset{k=1}{\overset{m}{\&Sigma;}}\frac{1}{{(1+p)}^{k-1}}}$

In formula, f _kfor the secondary instantaneous page reliability score of the kth nearest from current time, i represents i-th page that infosystem is covered by active probe, m is history samples point quantity, p is weight converges value, the weight of the larger then history samples point that p is arranged is lower, the quantity of the active detection system cover part page is m, γ _iit is the weight of i-th page;

S06: based on infosystem history run, the mathematical model that the history run that builds up an information system is evaluated:

$F_3=100-\underset{i=1}{\overset{k}{\&Sigma;}}{n}_i\&times;f_i$

In formula, i represents the quantity of alarm level, n _irepresent the number of times of history alarm at different levels, f _irepresent that alarm at different levels needs to subtract the score value of button, full marks are 100 points, till having detained;

S07: mathematical model, the mathematical model of infosystem reliability in time evaluation and these three submodels of mathematical model of speech breath System History postitallation evaluation of evaluating based on infosystem architecture, build Risk of Information System Early-warning Model

F＝β ₁F ₁+β ₂F ₂+β ₃F ₃

Wherein:

β ₁+β ₂+β ₃＝1

In formula, F is Risk of Information System evaluation, F ₁, F ₂and F ₃be respectively the evaluation of infosystem architecture, Information System Reliability evaluation and the evaluation of infosystem history run, β ₁for F ₁weight, β ₂for F ₂weight, β ₃for F ₃weight, β ₁, β ₂, β ₃arranged by User Defined.

As above based on the Risk of Information System Early-warning Model construction method of large data, in step S05, order:

$A=\underset{k=1}{\overset{m}{\&Sigma;}}\frac{f_k}{{(1+p)}^{k-1}}$

$B=\underset{k=1}{\overset{m}{\&Sigma;}}\frac{1}{{(1+p)}^{k-1}}$

F _kfor the secondary instantaneous page reliability score of the kth nearest from current time, i represents i-th page that infosystem is covered by active probe, m is history samples point quantity, p is weight converges value, the weight of the larger then history samples point that p is arranged is lower, and the quantity of the active detection system cover part page is m;

Then new sampled result once out after, on original basis, new A ' and the value of B ' can be calculated as follows:

$A^{\&prime;}=\frac{A}{1+p}+f_1$

$B^{\&prime;}=\frac{B}{1+p}+1$

Then the mathematical model of infosystem reliability in time evaluation is:

$F_2=\underset{i=1}{\overset{m}{\&Sigma;}}{\mathrm{\&gamma;}}_i\&times;\frac{A^{\&prime;}}{B^{\&prime;}}.$

According to above method, significantly can reduce the complexity of real time information system page reliability evaluation score, calculate result relatively easy.

Beneficial effect: the invention has the beneficial effects as follows:

One, Risk of Information System Early-warning Model is established: Risk of Information System model comprises mathematical model, the mathematical model of infosystem reliability in time evaluation and these three submodels of mathematical model of infosystem history run evaluation that infosystem architecture is evaluated.Based on these three submodels, achieve the Risk-warning to infosystem;

Two, infosystem architecture appraisement system is devised: realize the evaluation to infrastructure from availability and performance two aspect, and be divided into category-A, category-B and S class according to the importance of infrastructure in information systems internetting topological structure, achieve the evaluation of infosystem architecture;

Three, achieve the evaluation of infosystem reliability in time: based on infosystem active probe index, consider infosystem state index and response time, devise infosystem reliability in time evaluation model.Infosystem reliability in time evaluation model achieves the Real-Time Evaluation to the performance of infosystem own, is the basis realizing Risk of Information System early warning.

What the present invention innovated is applied in Risk of Information System early warning by large data technique, establish the Risk of Information System Early-warning Model of mathematical model, the mathematical model of infosystem reliability in time evaluation and the mathematical model of infosystem history run evaluation evaluated based on infosystem architecture, realize Risk of Information System early warning before the failure occurs, greatly can promote infosystem O&M efficiency, promote that infosystem is towards meticulousr, more collaborative, quicker, more efficient future development.

Accompanying drawing explanation

Fig. 1 is a kind of Risk of Information System Early-warning Model construction method Organization Chart based on large data of the present invention.

Embodiment

Below in conjunction with accompanying drawing and specific embodiment, technical solution of the present invention is described in further detail, can better understand the present invention to make those skilled in the art and can be implemented, but illustrated embodiment is not as a limitation of the invention.

Based on a Risk of Information System Early-warning Model construction method for large data, as shown in Figure 1, comprise the steps:

S01: the infrastructure building infosystem is classified, comprises main process equipment, the network equipment, safety equipment, memory device, database and middleware; Obtain real-time monitor control index and the history run achievement data of infrastructure;

S02: build forewarning index unit, judge based on to the early warning of index service data, realize the Risk-warning of index;

Definition frastructure state index is A ₀, for all indexs except frastructure state, devise metrics evaluation algorithm, evaluate the real-time performance of index, the result of metrics evaluation is the basis that infrastructure is evaluated.The mathematical model setting up infrastructure metrics evaluation is as follows:

$\left\{\begin{array}{c}{A}_n=0(T\&GreaterEqual;max)\\ A_n=\frac{500(max-T)}{max}(\frac{4}{5}max<T<max)\\ A_n=100(T\&le;\frac{4}{5}max)\end{array}\right.$

In formula, A _nbe the evaluation of the n-th infrastructure index, T is the desired value of the n-th infrastructure, and max is the metrics-thresholds of the n-th infrastructure;

S03: based on the analysis result of each forewarning index unit belonging to infrastructure, devise infrastructure Early-warning Model, realize the Risk-warning of single infrastructure;

Under the prerequisite fully weighing early warning performance and early warning efficiency, for this six classes infrastructure of main process equipment, the network equipment, safety equipment, memory device, database and middleware, respectively choose some typical index to complete the design of infrastructure Early-warning Model.The principle of index for selection is: index quantity is as far as possible few; Index can by automatic Real-time Collection and be easy to calculate; Index system can effectively reflect infrastructure current state.Through screening further, the infrastructure index chosen is as follows:

Main process equipment index: comprise Host Status, CPU average service rate, virtual memory utilization rate, memory usage and disk partition utilization rate;

Network equipment index: comprise equipment state, memory usage, CPU usage, operation duration, temperature, bandwidth availability ratio (bandwidth traffic) and packet loss;

Safety equipment index: comprise equipment state, memory usage, CPU usage, current sessions number, newly-built session number per second, port status, the total wrong bag amount of port and the total packet loss amount of port;

Memory device index: comprise equipment state, storage device status, disk space utilization rate and I/O speed;

Database index: comprise database positioning, user's linking number, average transaction response time, table space utilization factor, SGA utilization rate, PGA utilization rate, Process index, Session index, archive log space utilization rate and lock information;

Middleware index: comprise middleware state, JVM index, JDBC connects sum, thread uses number and movable reply quantity.

Set up corresponding risk warning model for six class infrastructure, comprise main process equipment risk evaluation model, network equipment evaluation model, safety equipment evaluation model, memory device evaluation model, database evaluation model and middleware evaluation model.

Infrastructure Early-warning Model is based upon on the basis evaluated infrastructure availability and infrastructure performance these two aspects.

First from availability aspect, infrastructure is evaluated: when infrastructure is in abnomal condition, early warning or alarm are carried out to it; When infrastructure is in normal condition, continue to carry out performance evaluation to it.

From aspect of performance, infrastructure is evaluated: be in the prerequisite of normal condition in infrastructure, based on the evaluation of its all indexs except frastructure state, devise infrastructure evaluation algorithms, evaluate the real-time performance of infrastructure, its evaluation result is the basis of information systems evaluation.The mathematical model setting up the evaluation of infrastructure real-time performance is as follows:

$\left\{\begin{array}{c}f=0(A_0=0)\\ f=50(0<A_0<1)\\ f=50+\frac{\underset{i=1}{\overset{n}{\&Sigma;}}{k}_n{A}_n}{n}(A_0=1)\end{array}\right.$

In formula, infrastructure is evaluated be divided into f, and the weight of the n-th index is k _n, k under normal circumstances _n=1;

Infrastructure Early-warning Model is based on infrastructure evaluation result, and when infrastructure is in abnomal condition, it evaluates be divided into zero, needs to carry out early warning or alarm to it; When infrastructure is in normal condition, design suitable threshold value for its evaluation result, this threshold value can be configured by User Defined, and evaluation result carries out early warning lower than needing during threshold value to infrastructure.

S04: by the network topology architecture of Topology Discovery technical limit spacing infosystem, based on the network topology architecture of infrastructure Early-warning Model and infosystem, devises infosystem architecture evaluation model;

Infrastructure is the basis that infosystem is normally run, so infrastructure Early-warning Model is also the basis of Risk-warning of building up an information system.Based on the topological structure of infrastructure Early-warning Model and infrastructure, devise following infosystem architecture evaluation model:

Infrastructure is divided into category-A, category-B and S class.Single infrastructure is divided into category-A and category-B according to its importance: category-A infrastructure represents that it is extremely important for infosystem, if it goes wrong, infosystem cannot normally be run; Even and if category-B infrastructure represents that it goes wrong also directly can not affect the normal operation of infosystem, an equipment in such as multimachine assembly.The infosystem topological structure key node that S class infrastructure is made up of multiple category-B infrastructure, the every platform main frame in such as dual computer group is all a B infrastructure, but the cluster of two main frame compositions can virtually be then a S class infrastructure.

When any one category-A infrastructure and S class infrastructure unavailable, then infosystem architecture is evaluated be divided into zero; When all category-A infrastructure and S class infrastructure all available, infosystem architecture evaluate mathematical model as follows:

$F_1=\frac{{\mathrm{\&alpha;}}_1\underset{i=1}{\overset{n_A}{\&Sigma;}}{f}_{n_A}^i+{\mathrm{\&alpha;}}_2\underset{k=1}{\overset{n_{B2}}{\&Sigma;}}{f}_{n_{B2}}^k+{\mathrm{\&alpha;}}_3\underset{j=1}{\overset{n_s}{\&Sigma;}}\underset{p=1}{\overset{q_j}{\&Sigma;}}\frac{f_{n_{B1}}^{j,p}}{q_j}}{{\mathrm{\&alpha;}}_1{n}_A+{\mathrm{\&alpha;}}_2{n}_{B2}+{\mathrm{\&alpha;}}_3{n}_s}$

In formula, n _afor the quantity of category-A infrastructure, n _sfor the quantity of S class infrastructure, n _b1for being under the jurisdiction of the quantity of the category-B infrastructure of S class infrastructure, n _b2for not belonging to the quantity of the category-B infrastructure of S class infrastructure, f is the score of all kinds of infrastructure in step S03, q _jfor the quantity of category-B infrastructure inside a jth S class infrastructure, α 1, α 2, α 3 are respectively category-A infrastructure, do not belong to the evaluation weight of the category-B infrastructure of S class infrastructure and S class infrastructure, wherein α 3 > α 1 > α 2, and can be configured by User Defined, F ₁for infosystem architecture evaluates score;

S05: based on the real-time monitor control index to infosystem main page, whether have response and response time, devise infosystem reliability in time evaluation model if comprising the page;

Information System Reliability evaluates the result of detection based on active detection system, active detection system detects infosystem and each main page thereof according to the frequency of 5 minutes/time, and feedback result is the page response time whether target pages has response and goal systems.For the response time of target pages, be provided with a baseline time, be within baseline time scope when the response time, then instantaneous page reliability evaluation is 100 points; When the page is without response, then instantaneous page reliability evaluation must be divided into 0 point; Be greater than baseline time when the response time, then instantaneous page reliability evaluation must be divided into:

$F_s=\frac{t_0}{t}\&times;100$

Wherein, t is the response time of target pages, t ₀for baseline time, F _sfor the instantaneous reliability evaluation score of the page when the target pages response time is greater than baseline time.

The instantaneous reliability evaluation of the page based on each sampled point, infosystem page reliability is evaluated: if n detection recently, the page is all without response, then think that target pages is evaluated be divided into 0 point, if n detection recently, target pages has at least once has response, then infosystem page reliability evaluation algorithm is as follows:

$F_2^i=\frac{\underset{k=1}{\overset{m}{\&Sigma;}}\frac{f_k}{{(1+p)}^{k-1}}}{\underset{k=1}{\overset{m}{\&Sigma;}}\frac{1}{{(1+p)}^{k-1}}}$

Wherein, f _kfor the secondary instantaneous page reliability score of the kth nearest from current time, i represents i-th page that infosystem is covered by active probe, and m is history samples point quantity, and p is weight converges value, and the weight of the larger then history samples point that p is arranged is lower.Wherein n, m and P can be configured by User Defined.

In actual computation, Ke Yiling:

$A=\underset{k=1}{\overset{m}{\&Sigma;}}\frac{f_k}{{(1+p)}^{k-1}}$

$B=\underset{k=1}{\overset{m}{\&Sigma;}}\frac{1}{{(1+p)}^{k-1}}$

F _kfor the secondary instantaneous page reliability score of the kth nearest from current time, i represents i-th page that infosystem is covered by active probe, m is history samples point quantity, p is weight converges value, the weight of the larger then history samples point that p is arranged is lower, and the quantity of the active detection system cover part page is m;

Each new sampled result once out after, on original basis, new A ' and the value of B ' can be calculated as follows:

$A^{\&prime;}=\frac{A}{1+p}+f_1$

$B^{\&prime;}=\frac{B}{1+p}+1$

Then the reliability evaluation of infosystem i-th page must be divided into:

$F_2^i=\frac{A^{\&prime;}}{B^{\&prime;}}.$

According to above method, significantly can reduce the complexity of real time information system page reliability evaluation score, calculate result relatively easy.

An infosystem comprises multiple page, wherein the active detection system cover part page, if its quantity is m, makes γ _ibe the weight of i-th page, F ₂ ⁱbe the reliability evaluation score of i-th page, the mathematical model of infosystem reliability in time evaluation is:

$F_2=\underset{i=1}{\overset{m}{\&Sigma;}}{\mathrm{\&gamma;}}_i\&times;F_2^i$

That is, $F_2=\underset{i=1}{\overset{m}{\&Sigma;}}{\mathrm{\&gamma;}}_i\&times;\frac{A^{\&prime;}}{B^{\&prime;}}$

Information System Reliability evaluation result is the basis of Information System Reliability model, and when goal systems is without response, it evaluates be divided into zero, needs to carry out alarm to it; When infosystem has response, design suitable threshold value for its evaluation result, this threshold value can be configured by User Defined, and evaluation result carries out early warning lower than needing during threshold value to infosystem.

S06: based on infosystem history run, mainly history alarm quantity and history alarm rank, devise infosystem history evaluation model;

Infosystem operational indicator comprise online user number, day login user number, service system running state, operation system Interface status, operation system health runs duration etc.The infosystem history run of current design evaluates score based on history alarm situation, mainly considers the one-level rush repair number of times within the scope of history run and secondary rush repair number of times.The mathematical model that infosystem history run is evaluated is as follows:

$F_3=100-\underset{i=1}{\overset{k}{\&Sigma;}}{n}_i\&times;f_i$

Wherein, i represents the quantity of alarm level, n _irepresent alarm number of times at different levels, f _irepresent that alarm at different levels needs to subtract the score value of button, full marks are 100 points, till having detained.

S07: based on these three submodels of infosystem architecture evaluation model, infosystem reliability in time evaluation model and infosystem history evaluation model, construct Risk of Information System Early-warning Model.

Risk of Information System pre-warning indexes system comprises base values, operating index and history index three major types, wherein base values is approve-useful index and the performance index of six class infrastructure, operating index is the whether corresponding and page corresponding duration index of the infosystem page, and history index refers to history alarm index.

Based on above three class indexs and information systems internetting topological structure, achieve the evaluation of infosystem architecture, Information System Reliability evaluation and infosystem history evaluation respectively, and on this basis, devise Risk of Information System Alarm Assessment model:

$F=\underset{i=1}{\overset{3}{\&Sigma;}}{\mathrm{\&beta;}}_i{F}_i$

That is, F=β ₁f ₁+ β ₂f ₂+ β ₃f ₃

Wherein:

β ₁+β ₂+β ₃＝1

In formula, F is Risk of Information System evaluation, F ₁, F ₂and F ₃be respectively the evaluation of infosystem architecture, Information System Reliability evaluation and the evaluation of infosystem history run, β ₁for F ₁weight, β ₂for F ₂weight, β ₃for F ₃weight, β ₁, β ₂, β ₃arranged by User Defined.

The foregoing is only preferred embodiment of the present invention and oneself, not in order to limit the present invention, within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.

Claims (2)

1., based on a Risk of Information System Early-warning Model construction method for large data, it is characterized in that, comprise the following steps:

S01: the infrastructure building infosystem is classified, comprises main process equipment, the network equipment, safety equipment, memory device, database and middleware; Obtain real-time monitor control index and the history run achievement data of infrastructure;

S02: definition frastructure state index is A ₀, for all indexs except frastructure state index, the algorithm of design basis facility metrics evaluation, set up the mathematical model of infrastructure metrics evaluation:

$\left\{\begin{array}{c}{A}_n=0(T\&GreaterEqual;max)\\ A_n=\frac{500(max-T)}{max}(\frac{4}{5}max<T<max)\\ A_n=100(T\&le;\frac{4}{5}max)\end{array}\right.$

In formula, A _nbe the evaluation of the n-th infrastructure index, T is the desired value of the n-th infrastructure, and max is the metrics-thresholds of the n-th infrastructure;

S03: be in the prerequisite of normal condition in infrastructure under, based on the evaluation algorithms of all indexs except frastructure state index, design basis facility evaluation algorithms, evaluates the real-time performance of infrastructure, sets up the mathematical model that infrastructure real-time performance is evaluated:

$\left\{\begin{array}{c}f=0(A_0=0)\\ f=50(0<A_0<1)\\ f=50+\frac{\underset{i=1}{\overset{n}{\&Sigma;}}{k}_n{A}_n}{n}(A_0=1)\end{array}\right.$

In formula, infrastructure is evaluated be divided into f, and the weight of the n-th index is k _n, k under normal circumstances _n=1;

S04: by the network topology architecture of Topology Discovery technical limit spacing infosystem, is divided into category-A and category-B by single infrastructure according to its importance, and category-A infrastructure represents that it is if there is problem, and infosystem cannot normally be run; Category-B infrastructure represents that it is if there is problem, directly can not affect the normal operation of infosystem; The node of the infosystem topological structure that definition S class infrastructure is made up of multiple category-B infrastructure; When any one category-A infrastructure or any one S class infrastructure unavailable time, then infosystem architecture is evaluated be divided into zero; When all category-A infrastructure and all S class infrastructure all available time, the architecture that builds up an information system evaluate mathematical model:

$F_1=\frac{{\mathrm{\&alpha;}}_1\underset{i=1}{\overset{n_A}{\&Sigma;}}{f}_{n_A}^i+{\mathrm{\&alpha;}}_2\underset{k=1}{\overset{n_{B2}}{\&Sigma;}}{f}_{n_{B2}}^k+{\mathrm{\&alpha;}}_3\underset{j=1}{\overset{n_s}{\&Sigma;}}\underset{p=1}{\overset{q_j}{\&Sigma;}}\frac{f_{n_{B1}}^{j,p}}{q_j}}{{\mathrm{\&alpha;}}_1{n}_A+{\mathrm{\&alpha;}}_2{n}_{B2}+{\mathrm{\&alpha;}}_3{n}_s}$

In formula, n _afor the quantity of category-A infrastructure, n _sfor the quantity of S class infrastructure, n _b1for being under the jurisdiction of the quantity of the category-B infrastructure of S class infrastructure, n _mfor not belonging to the quantity of the category-B infrastructure of S class infrastructure, f is the score of all kinds of infrastructure in step S03, q _jfor the quantity of category-B infrastructure inside a jth S class infrastructure, α 1, α 2, α 3 are respectively category-A infrastructure, do not belong to the evaluation weight of the category-B infrastructure of S class infrastructure and S class infrastructure, wherein α 3 > α 1 > α 2, and can be configured by User Defined, F ₁for infosystem architecture evaluates score;

S05: in real time sampling is monitored to infosystem main page, the mathematical model that the reliability in time that builds up an information system is evaluated:

$F_2=\underset{i=1}{\overset{m}{\&Sigma;}}{\mathrm{\&gamma;}}_i\&times;\frac{\underset{k=1}{\overset{m}{\&Sigma;}}\frac{f_k}{{(1+p)}^{k-1}}}{\underset{k=1}{\overset{m}{\&Sigma;}}\frac{1}{{(1+p)}^{k-1}}}$

In formula, f _kfor the secondary instantaneous page reliability score of the kth nearest from current time, i represents i-th page that infosystem is covered by active probe, m is history samples point quantity, p is weight converges value, the weight of the larger then history samples point that p is arranged is lower, the quantity of the active detection system cover part page is m, γ _iit is the weight of i-th page;

S06: based on infosystem history run, the mathematical model that the history run that builds up an information system is evaluated:

$F_3=100-\underset{i=1}{\overset{k}{\&Sigma;}}{n}_i\&times;f_i$

In formula, i represents the quantity of alarm level, n _irepresent the number of times of history alarm at different levels, f _irepresent that alarm at different levels needs to subtract the score value of button, full marks are 100 points, till having detained;

S07: mathematical model, the mathematical model of infosystem reliability in time evaluation and these three submodels of mathematical model of infosystem history run evaluation of evaluating based on infosystem architecture, build Risk of Information System Early-warning Model:

F＝β ₁F ₁+β ₂F ₂+β ₃F ₃

Wherein:

β ₁+β ₂+β ₃＝1

In formula, F is Risk of Information System evaluation, F ₁, F ₂and F ₃be respectively the evaluation of infosystem architecture, Information System Reliability evaluation and the evaluation of infosystem history run, β ₁for F ₁weight, β ₂for F ₂weight, β ₃for F ₃weight, β ₁, β ₂, β ₃arranged by User Defined.

2. the Risk of Information System Early-warning Model construction method based on large data according to claim 1, is characterized in that, in step S05, and order:

$A=\underset{k=1}{\overset{m}{\&Sigma;}}\frac{f_k}{{(1+p)}^{k-1}}$

$B=\underset{k=1}{\overset{m}{\&Sigma;}}\frac{1}{{(1+p)}^{k-1}}$

F _kfor the secondary instantaneous page reliability score of the kth nearest from current time, i represents i-th page that infosystem is covered by active probe, m is history samples point quantity, p is weight converges value, the weight of the larger then history samples point that p is arranged is lower, and the quantity of the active detection system cover part page is m;

Then new sampled result once out after, new A ' and the value of B ' can be calculated as follows:

$A^{\&prime;}=\frac{A}{1+p}+f_1$

$B^{\&prime;}=\frac{B}{1+p}+1$

Then the mathematical model of infosystem reliability in time evaluation is:

$F_2=\underset{i=1}{\overset{m}{\&Sigma;}}{\mathrm{\&gamma;}}_i\&times;\frac{A^{\&prime;}}{B^{\&prime;}}.$