WO2023207689A1

WO2023207689A1 - Change risk assessment method and apparatus, and storage medium

Info

Publication number: WO2023207689A1
Application number: PCT/CN2023/089099
Authority: WO
Inventors: 吕彪; 戚依宁; 王绍哲; 党浩; 方崇荣; 祝顺民; 蒋江伟; 程鹏; 陈积明
Original assignee: 浙江大学
Priority date: 2022-04-27
Filing date: 2023-04-19
Publication date: 2023-11-02
Also published as: CN115102834A; CN115102834B

Abstract

Provided in the embodiments of the present application are a change risk assessment method and apparatus, and a storage medium. The change influence range of a target change event can be rationally expanded, such that it can be ensured that the observation range of change risk assessment work is sufficiently large, which is conducive to improving the accuracy of risk assessment; alarm information can also be introduced to serve as a basis for change risk assessment, the alarm influence range of each piece of alarm information is rationally expanded, such that potential alarms which have not yet appeared in a cloud network can be discovered in a timely manner, and these potential alarms are fully involved in a change risk assessment process; and target alarm information which matches the target change event can also be discovered by means of determining whether there is an overlapping part between the alarm influence range and the change influence range, such that the expanded change influence range can be corrected to a more accurate range, and required alarm information can be accurately and comprehensively hit to calculate a change risk value. Therefore, the risk of a change can be efficiently and accurately assessed.

Description

A change risk assessment method, equipment and storage medium

This application requires the priority of a Chinese patent application submitted to the China Patent Office on April 27, 2022, with the application number 202210459479. This reference is incorporated into this application.

Technical field

This application relates to the field of cloud technology, and in particular to a change risk assessment method, equipment and storage medium.

Background technique

With the development of cloud technology, the scale of cloud is getting larger and larger, and the frequency of feature updates is also getting higher and higher. Code modifications, configuration of new functions, bug fixes and other operations performed on functional components that occur in the cloud network can be called changes.

At present, operation and maintenance personnel will conduct strict analysis and testing of changes before submitting them. Among them, changes that successfully pass the test will be considered risk-free. However, since the real environment of the cloud may be different from the test environment in terms of scale, software and hardware versions, workload conditions, component interactions, etc., this results in insufficient accuracy of test results for changes. There may be defective changes among those changes that have passed the test, and these defective changes may cause catastrophic failures to the cloud after they are put online.

Contents of the invention

Various aspects of this application provide a change risk assessment method, equipment and storage medium to assess the risk of change more reasonably and accurately.

The embodiment of this application provides a change risk assessment method, including:

In response to the risk assessment instruction, determine the change impact scope corresponding to the target change event based on the preset topology information in the cloud network. The topology information includes affiliation relationships between objects at different levels in the cloud network and associations between objects at the same level. Relationship, the change impact scope includes at least one layer of superior objects corresponding to the change object of the target change event and associated objects of the same level;

Collect multiple alarm information generated in the cloud network within a preset time range after the target change event occurs;

Determine the alarm influence scope corresponding to each of the multiple alarm information according to the topology information, and the alarm influence scope includes at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects of the same level;

Select at least one piece of target alarm information adapted to the target change event from the plurality of alarm information, and there is an overlap between the alarm impact scope corresponding to the target alarm information and the change impact scope;

Based on the at least one target alarm information, a risk assessment is performed on the target change event.

An embodiment of the present application also provides a computing device, including a memory and a processor;

The memory is used to store one or more computer instructions;

The processor is coupled to the memory for executing the one or more computer instructions for:

Embodiments of the present application also provide a computer-readable storage medium that stores computer instructions. When the computer instructions are executed by one or more processors, the one or more processors are caused to execute the aforementioned change risk assessment method.

In the embodiment of this application, the change impact scope of the target change event can be reasonably expanded based on the topology information preset in the cloud network. This can ensure that the observation range of the change risk assessment work is large enough and help improve the accuracy of the risk assessment; Alarm information can also be introduced as the basis for change risk assessment. By collecting alarm information generated in the cloud network and reasonably expanding the alarm impact scope of each alarm information based on topology information, potential alarms that have not yet appeared in the cloud network can be discovered in a timely manner. And fully participate in these potential alarms in the change risk assessment process; on this basis, you can also find target alarm information that matches the target change event by judging whether there is overlap between the alarm impact scope and the change impact scope, so that , not only can the expanded change impact scope be corrected to a more accurate scope, but also the required alarm information can be accurately and comprehensively hit to calculate the change risk value. As a result, the risk of change can be assessed more comprehensively, efficiently, and accurately.

Description of the drawings

The drawings described here are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation of the present application. In the attached picture:

Figure 1a is a schematic flow chart of a change risk assessment method provided by an exemplary embodiment of the present application;

Figure 1b is a logical schematic diagram of a change risk assessment solution provided by an exemplary embodiment of the present application;

Figure 2a is a logical schematic diagram of network scope expansion of a change object provided by an exemplary embodiment of the present application;

Figure 2b is a logical schematic diagram of extending the network range of an alarm occurrence object provided by an exemplary embodiment of the present application;

Figure 3 is a logical schematic diagram of a solution for selecting target alarm information for target change events provided by an exemplary embodiment of the present application;

Figure 4 is a schematic diagram of the effect of a modified impact scope after matching provided by an exemplary embodiment of the present application;

Figure 5 is a logical schematic diagram of a risk threshold determination scheme provided by an exemplary embodiment of the present application;

FIG. 6 is a schematic structural diagram of a computing device provided by another exemplary embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be clearly and completely described below in conjunction with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

Currently, testing is used to conduct risk assessment on changes, but the assessment results of this method are not accurate enough and may cause catastrophic failures to the cloud. To this end, in some embodiments of this application: the change impact scope of the target change event can be reasonably expanded based on the topology information preset in the cloud network. This can ensure that the observation scope of the change risk assessment work is large enough and help improve the risk assessment. Accuracy; alarm information can also be introduced as the basis for change risk assessment. By collecting alarm information generated in the cloud network and reasonably expanding the alarm impact scope of each alarm information based on topology information, this can promptly discover problems that have not yet appeared in the cloud network. potential alarms, and fully participate in these potential alarms in the change risk assessment process; on this basis, you can also find targets that match the target change events by judging whether there is overlap between the alarm impact scope and the change impact scope. Alarm information, in this way, not only can the expanded change impact scope be corrected to a more accurate range, but also the required alarm information can be accurately and comprehensively hit to calculate the change risk value. As a result, the risk of change can be assessed more comprehensively, efficiently, and accurately.

The technical solutions provided by each embodiment of the present application will be described in detail below with reference to the accompanying drawings.

Figure 1a is a schematic flowchart of a change risk assessment method provided by an exemplary embodiment of the present application. The method can be executed by a change risk assessment device. The change risk assessment device can be implemented as a combination of software and/or hardware. The change risk assessment method can be implemented as a combination of software and/or hardware. The evaluation device can be integrated in the computing device. Referring to Figure 1a, the method may include:

Step 100: In response to the risk assessment instruction, determine the change impact scope corresponding to the target change event based on the topology information preset in the cloud network. The topology information includes the affiliation relationships between objects at different levels in the cloud network and the relationships between objects at the same level. Association relationship, the scope of change influence includes at least one layer of superior objects corresponding to the change object of the target change event and the associated objects of the same level;

Step 101: Collect multiple alarm information generated in the cloud network within a preset time range after the target change event occurs;

Step 102: Determine the alarm impact scope corresponding to the multiple alarm information according to the topology information. The alarm impact scope includes at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects of the same level;

Step 103: Select at least one target alarm information that is adapted to the target change event from multiple alarm information, and there is overlap between the alarm impact scope corresponding to the target alarm information and the change impact scope;

Step 104: Perform a risk assessment on the target change event based on at least one target alarm information.

The change risk assessment method provided in this embodiment can be applied to operation and maintenance scenarios of changes in cloud networks. The cloud network may refer to a software-defined computing network in a cloud computing infrastructure. Of course, the definition here is only in a narrow sense. The cloud network in this embodiment may generally refer to a network architecture built based on cloud technology. In this embodiment, operations such as code modification, configuring new functions, and bug fixes performed on functional components that occur in the cloud network can be called changes. The change risk assessment method provided in this embodiment can be applied to the testing phase before the change is launched to replace the existing testing method. It can also be used to continue tracking and evaluating the change after the change is launched to timely discover undetected defects in the testing phase. Change risks, thereby effectively avoiding cloud failures caused by changes.

As the scale of the cloud continues to expand, the number of changes that occur in the cloud network is huge. The number of changes caused by version releases and daily operations and maintenance in a single day may exceed 10,000 times. The target change event in this embodiment can be used to refer to any change that occurs in the cloud network. A change object is usually specified in a change. For example, in a change to fix a bug, a certain gateway component in the cloud network can be specified. as the object of change. In this embodiment, there can be one or more change objects specified in a change event. When there are multiple change objects, there is at least one level of shared level objects between the multiple change objects, for example, the above-mentioned repair Gateway component A and switch component B can be specified in the buge class change, and gateway component A and switch component B are located in the same availability zone (level object). Of course, this is only preferred, and this embodiment is not limited to this. Multiple change objects in the same change event may not have the above restrictions. In this regard, in this embodiment, it is only necessary to perform the above steps within the change event. It is required to group the change objects, analyze the change risks by groups, and then synthesize the analysis results to achieve risk assessment of the change events. In order to facilitate the explanation of the solution, the above-mentioned priority implementation method will be used by default to define the target change event in the following article.

In this embodiment, the risk assessment instruction can be triggered periodically or according to other trigger conditions. It should be understood that in this embodiment, the change risk assessment logic shown in Figure 1a will be continuously executed during the duration of the change event, so that Track and evaluate change events, for example, every 10 seconds. The end time of the tracking assessment can be set according to timing needs. For example, it can be set to stop the assessment after a preset time period after the change event begins, or when the risk assessment result corresponding to the change event is lower than the preset standard and has continued. Stop the evaluation after a preset time period, etc. This embodiment does not limit this.

Based on this, referring to Figure 1a, in step 100, the change impact scope corresponding to the target change event can be reasonably expanded in response to the risk assessment instruction. Among them, the expansion of the impact scope of the change refers to extending the impact scope of the target change event from the change object to a larger scope. For example, when the change object is a physical gateway, the original change impact scope of the target change event is a device in the cloud network. It can be gradually extended to the cluster to which the device belongs, to the availability zone to which the device belongs, and to the region to which the device belongs. region etc. In this way, the scope of change influence of the target change event can be expanded, and a large enough observation range is provided for the target change event. Observing the target change event within a large enough observation range can effectively improve the accuracy of risk assessment.

In this embodiment, multi-level objects can be divided into the cloud network, and the topology information in the cloud network can be predefined based on the multi-level objects. Among them, multiple-level objects can include but are not limited to instances, network elements, applications, devices, clusters, availability zones, regions, etc. In a cloud network, topology information can include affiliation relationships between objects at different levels and associations between objects at the same level. An exemplary affiliation relationship can be that the device belongs to the cluster, the cluster belongs to the availability zone, and the availability zone belongs to the region; an exemplary association relationship between objects of the same level can be that there may be resource association relationships between different instances or There may be resource associations between instances and applications. This embodiment does not limit the specific relationship logic contained in the topology information. In this embodiment, the specifications of objects at different levels are different. For example, the specifications of a region are larger than the availability zone. The specifications of objects of the same level can be the same or similar. For example, instances and applications belong to objects of the same level. Of course, this is just For example, this embodiment does not limit this. Based on the topology information in the cloud network, a change object or an alarm occurrence object can be expanded to a larger scope of influence, including expansion within the same level and expansion to a higher level.

On this basis, in this embodiment, in the process of determining the change impact scope corresponding to the target change event, the level objects to which the change object belongs can be searched level by level according to the topology information preset in the cloud network, so as to obtain and change At least one layer of superior objects corresponding to the object; it can also search for objects of the same level that are associated with the change object; thus, the determined change impact scope can include at least one layer of superior objects corresponding to the change object of the target change event and the associated same-level objects. level object. In this embodiment, in the process of searching for at least one layer of superior objects corresponding to the change object, the object of the specified level can be used as the end condition. In this way, the level objects to which the change object belongs can be searched level by level until the specified level is found. End the search after the object to obtain at least one layer of superior objects corresponding to the change object of the target change event. For example, the object at the specified level may be a region. Of course, this is only exemplary and is not limited in this embodiment.

In this way, the obtained change impact scope can be expanded to record multiple levels of objects that may be affected by the target change event.

Figure 1b is a logical schematic diagram of a change risk assessment solution provided by an exemplary embodiment of the present application. Referring to Figure 1b, the change event can be obtained from the change system in the cloud network, and the change object will be specified in the change event.

Referring to Figure 1b, this embodiment also innovatively proposes to introduce alarm information as the basis for change risk assessment. Mature monitoring systems are usually deployed in cloud networks. The monitoring system is used to monitor the operating status of various points in the cloud network, such as monitoring traffic status, packet loss status, delay status, etc. A large number of data will be generated in the monitoring system. Alarm information. In this embodiment, alarm information generated by the monitoring system in the cloud network can be collected, and these alarm information can be used as the basis for change risk assessment. As mentioned above, the change risk assessment work can be triggered periodically or in the form of other trigger conditions. When a risk assessment instruction is triggered, in this embodiment, new data added in the cloud network after the last risk assessment can be collected The alarm information will be used as the basis for this change risk assessment.

At present, in order to ensure the accuracy of monitoring, monitoring systems in cloud networks usually adopt a single-point monitoring method. The monitoring objects are usually at the instance, device, network element, application, etc. levels. Correspondingly, the alarm occurrence objects in the alarm information are usually A la carte. To this end, in this embodiment, referring to Figure 1a, in step 101, multiple alarm information generated in the cloud network within a preset time range after the target change event occurs may be collected.

On this basis, in step 102, the alarm impact scope corresponding to the multiple alarm information can be determined according to the topology information. The alarm impact scope includes at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and the associated same-level objects. object. Among them, the alarm information may include information such as the alarm occurrence object, alarm level, and alarm description content. Among them, the alarm occurrence object refers to the object in the cloud network where abnormal conditions occur, and the abnormal conditions on the objects trigger the monitoring system to send out alarm information. The level objects of alarm occurrence objects in different alarm information may be different. The level objects of alarm occurrence objects may include but are not limited to the aforementioned instance, device, network element, application and other levels. In this embodiment, the original scope of influence corresponding to the alarm information can be expanded so that the alarm information can cover a larger scope of influence, which can assign the alarm information to the expanded scope of influence. Many times, when a change is defective, the impact scope of the change may be across components. In a short period of time, the abnormalities caused by the change may only appear at a few points, while the abnormalities caused by it at other points may not yet be seen. To this end, in this embodiment, the alarm discovered at a single point is reasonably expanded to a larger scope by extending the scope of influence of the alarm information, so as to fully discover the potential potential that has not yet appeared in the expanded alarm scope. Alarms, and these potential alarms that have not yet appeared can be fully involved in the change risk assessment process, providing a more comprehensive basis for the change risk assessment work.

In practical applications, the influence scope expansion operations in step 100 and step 102 may be performed synchronously, and the order is not limited in this embodiment. Moreover, the logic of expanding the alarm impact scope is basically similar to the logic of expanding the change impact scope. The details of the expansion operation of the alarm impact scope will not be repeated here.

On this basis, referring to Figure 1a and Figure 1b, in step 103, at least one piece of target alarm information adapted to the target change event can be selected from a plurality of alarm information. Here, the change impact scope and the alarm impact scope can be overlapped and analyzed, and the alarm information corresponding to the alarm impact scope that overlaps with the change impact scope can be used as the target alarm information. That is to say, the alarm impact scope of the target alarm information needs to overlap with the change impact scope of the target change event, and the overlapping part contains at least one level object. As mentioned above, in this embodiment, the observation range of the target change event is expanded, and the coverage of the alarm information is expanded. By overlapping the change impact range and the alarm impact range obtained by the expansion, we can quickly This method can accurately determine the level objects in the change impact scope that may cause alarms, which can correct the expanded change impact scope to a more accurate range. Since the revised scope is determined by fully considering the alarms that have already appeared in the cloud network and the potential alarms that have not yet appeared in step 102, it can not only ensure the comprehensiveness and accuracy of the change risk assessment, but also ensure the comprehensiveness and accuracy of the change risk assessment. The observation scope of changes can be further streamlined and the amount of calculations reduced.

It is worth noting that this embodiment describes the matching process in step 102 from the perspective of target change events, but it should be understood that this embodiment does not limit the primary and secondary roles of alarm information and change events in the matching process. , you can search for target alarm information from multiple alarm information from the perspective of each change event, or you can search for matching change events from multiple change events from the perspective of each alarm information, and the alarm information naturally becomes The target alarm information corresponding to the matched change event. Moreover, the matching operation may be synchronous or, of course, asynchronous, which is not limited in this embodiment.

After at least one piece of target alarm information adapted to the target change event is determined, in step 104, a risk assessment can be performed on the target change event based on the at least one piece of target alarm information. In this embodiment, whether there is a risk in the target change event can be assessed by analyzing at least one target alarm information. In this embodiment, multiple implementation methods can be used to perform change risk assessment on target change events based on target alarm information. The specific implementation methods will be described in detail in subsequent embodiments.

Accordingly, in this embodiment, the change impact scope of the target change event can be reasonably expanded based on the topology information preset in the cloud network. This can ensure that the observation scope of the change risk assessment work is large enough and help improve the accuracy of the risk assessment. Alarm information can also be introduced as the basis for change risk assessment. By collecting alarm information generated in the cloud network and reasonably expanding the alarm impact scope of each alarm information based on topology information, potential alarms that have not yet appeared in the cloud network can be discovered in a timely manner. , and fully participate in these potential alarms in the change risk assessment process; on this basis, you can also find target alarm information that matches the target change event by judging whether there is overlap between the alarm impact scope and the change impact scope. In this way, not only can the expanded change impact scope be corrected to a more accurate scope, but also the required alarm information can be accurately and comprehensively hit to calculate the change risk value. As a result, the risk of change can be assessed more comprehensively, efficiently, and accurately. In addition, since the alarm information can cover the entire network, through the alarm information matching scheme proposed in this embodiment, the cross-component alarm information with the changed object can be introduced into the risk assessment work of the target changed object. This It can effectively solve the current dilemma of being unable to evaluate changes across components (usually different components are responsible for different departments. Currently, change testing is usually only carried out by the department responsible for the change object, and the departments responsible for other related components are not even aware of the change. ).

In the above or following embodiments, the topology information in the cloud network may adopt a tree structure, that is, the topology information in the cloud network may be represented in the form of a topology tree. The topology tree can follow a hierarchical structure, and objects of different levels are reasonably distributed in each layer of the topology tree. For example, the upper layer of the device class object can be a cluster class object, the upper layer can be an availability zone class object, and the upper layer can be a region class object.

Based on this, a solution for determining the scope of change influence may be: according to the tree structure corresponding to the topology information, at least one layer of superior objects corresponding to the change object of the target change event and the associated objects of the same level are organized with the change object as the root. A change topology tree of nodes to represent the impact scope of the change. Figure 2a is a logical schematic diagram for determining the impact scope of a change provided by an exemplary embodiment of the present application. Referring to Figure 2a, the change object in the target change event is the AVS device. According to the topology information in the cloud network, the AVS device can be extended level by level to the AVS cluster, availability zone and region to which it belongs, thereby obtaining the scope of change and also That is the changed topology tree on the far right in Figure 2a. Of course, Figure 2a only shows the topology tree structure when the change object is a device. When the initial level object to which the change object belongs is other objects, it can be adaptively expanded according to the topology information preset in the cloud network.

Similarly, a solution for determining the scope of alarm impact may be: according to the tree structure corresponding to the topology information, at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects of the same level are organized with the alarm occurrence object as the root. The alarm topology tree of the node to represent the alarm impact scope. Figure 2b is a logical schematic diagram for determining the impact scope of an alarm provided by an exemplary embodiment of the present application. Referring to Figure 2b, the first alarm information is an EIP instance alarm. In this case, the alarm in the first alarm information can be found first. The object, that is, the EIP instance, and based on the topology information preset in the cloud network, find the ECS instance that has a resource association with the EIP instance; then, you can find the XGW cluster that hosts the EIP instance and the AVS device that hosts the ECS instance. Then, in a similar manner to Figure 2a, continue to extend the XGW cluster level by level to the availability zone and region to which it belongs, and extend the AVS device to the AVS cluster, availability zone and region to which it belongs level by level, so as to obtain the alarm impact. The scope is the alarm topology tree on the far right side in Figure 2b.

It should be understood that in this embodiment, multi-level objects are divided into the cloud network, and multiple actual objects may exist under each level object. For example, instance 1 and instance 2 may exist under the instance class level object. , instance 3 and other instances, and there can be several availability zones such as availability zone A, availability zone B and so on under the availability zone class level object. In this embodiment, in the process of constructing the change topology tree for the target change event, it is only necessary to place the change object in the topology information in the cloud network according to the level object to which it belongs. Based on the topology information, the change object can be determined and changed. Actual objects under objects at other levels that have topological relationships.

When both the change impact scope and the alarm impact scope are represented by a topology tree, in the process of selecting at least one target alarm information adapted to the target change event from multiple alarm information, if the alarm topology tree and the change alarm If there are overlapping tree nodes between trees, it can be determined that the corresponding alarm impact scope and the change impact scope overlap.

FIG. 3 is a logical schematic diagram of a solution for selecting target alarm information for a target change event provided by an exemplary embodiment of the present application. Referring to Figure 3, the left side is the change topology tree corresponding to the target change event, and the right side is the alarm topology tree corresponding to the two alarm information. It can be seen that both alarm topology trees have overlapping tree nodes with the change topology tree. Therefore, Both alarm information in Figure 3 can be determined as target alarm information corresponding to the target change event. In this way, through the topology tree, the adapted target alarm information for the target change event can be determined conveniently, quickly and accurately.

Accordingly, in this embodiment, a topology tree can be used to represent the change impact scope and alarm impact scope, which can not only clearly and comprehensively present at least one level of objects expanded by the impact scope expansion operation, but also present the extended Topological information such as affiliation and resource association between the exported object and the changed object. Of course, in this embodiment, other methods can be used to characterize the change impact range and alarm impact range. For example, the data structure of [first-level objects, second-level objects...; topological information between level objects] can be used to represent The representation may also be represented by a collection+tag method, etc. This embodiment is not limited to this.

FIG. 4 is a schematic diagram of the effect of a modified impact scope after matching provided by an exemplary embodiment of the present application. Referring to Figure 4, after the above matching process, at least one target alarm information will be associated with the change impact scope corresponding to the target change event. Specifically, at least one target alarm information will be associated with the minimum overlap in the change impact scope. level object. For example, in Figure 4, there is a P3 level target alarm information and the smallest level object that overlaps with the changed topology tree is AVS device 1. Then the target alarm information can be associated with the AVS device 1 node in the changed topology tree. , in the same situation, the AVS device 2 node and AVS device 3 node in the changed topology tree are also associated with alarm information; there is also a P1 level target alarm information and the smallest level object that overlaps with the changed topology tree is AVS Cluster 1, then the target alarm information can be associated with the AVS cluster 1 node in the changed topology tree.

In the above or following embodiments, various implementation methods may be used to perform risk assessment on target change events based on at least one piece of target alarm information.

In an optional implementation method, the alarm level recorded in at least one target alarm information can be obtained; based on the respective alarm levels corresponding to the at least one target alarm information, the risk assessment value corresponding to the target change event is calculated; if the risk assessment If the value meets the preset conditions, it is determined that there is a risk in the target change event. Among them, the alarm level is the existing information in the alarm information, which is used to represent the severity, impact, etc. of the corresponding abnormal event.

In this implementation, the alarm level can be extracted from at least one target alarm information, and the extracted alarm level can be used as the basis for change risk assessment. This makes the calculation logic of risk assessment values more concise and clever.

Among them, the risk assessment value can be used to characterize the risk level of the target change event. Generally, the higher the risk assessment value, the higher the risk level of the target change event, and the higher the possibility and severity of the failure it may cause to the cloud. The degree may also be higher.

In this implementation, in the process of calculating the risk assessment value corresponding to the target change event based on the corresponding alarm level of at least one piece of target alarm information: the degree of correlation between each of the at least one piece of target alarm information and the target change event can be determined. ; Assign a weight to at least one target alarm information according to the degree of correlation; Calculate the risk assessment value corresponding to the target change event based on the corresponding alarm level and weight of at least one target alarm information.

Among them, the degree of correlation is used to represent the degree of fit between the alarm impact scope and the change impact scope. The more overlaps between the change impact scope and the alarm impact scope, the higher the fit between the change impact scope and the alarm impact scope, which can be the corresponding The target alarm information is assigned a higher degree of correlation. To this end, the smallest level object in the overlap between the change influence scope and the alarm influence scope corresponding to at least one target alarm information can be searched; according to the smallest level object corresponding to at least one target alarm information, to the change object The level distance between them is used to assign a correlation degree to at least one target alarm information. Among them, the level distance is essentially the number of levels in the affiliation relationship between the smallest level object and the change object. Optionally, if the change impact scope and the alarm impact scope are represented by a topology tree, the lowest tree node in the overlapping portion between the change impact scope and the alarm impact scope corresponding to at least one target alarm information can be searched, where a single tree The node corresponds to a level object; based on the topological distance between the lowest tree node corresponding to at least one target alarm information and the change object in the change topology tree that represents the scope of the change, determine the level distance corresponding to at least one target alarm information. . Among them, the corresponding lowest tree node has the same level distance between the target alarm information with the same position in the topology tree that represents the scope of the change. Referring to Figure 3, the lowest tree node overlapping between the alarm topology tree on the upper right and the change topology tree on the left is AVS device 2; while the lowest tree node overlapping between the alarm topology tree on the lower right and the change topology tree on the left is available. In area a, obviously, the target alarm information corresponding to the alarm topology tree on the upper right will obtain a higher degree of correlation than the target alarm information corresponding to the alarm topology tree on the lower right. In practical applications, level distance can be used to express the degree of correlation. Refer to Figure 3. The level distance between the alarm topology tree on the upper right and the changed topology tree is 1, so its corresponding target alarm can be assigned a correlation degree of 1; If the level distance between the alarm topology tree and the changed topology tree is 2, then its corresponding target alarm can be assigned a correlation level of 2.

On this basis, a weight can be assigned to at least one target alarm information according to the degree of correlation. Generally, target alarm information with a higher degree of correlation can be assigned a higher weight to reflect its higher reference role for target change events. In addition, target alarm information with the same degree of correlation can be assigned the same weight.

Optionally, the weight can be calculated according to the following formula:

Among them, p is the above-mentioned correlation degree (which can be represented by topological distance), α and β are empirical parameters, and q is the alarm proportion in the level object corresponding to the current level distance. The alarm ratio is used to represent the proportion of the number of objects matching alarm information within the same level within the scope of change to the total number of objects within that level. For example, referring to Figure 4, in the smallest level of the changed topology tree, all ECS instances under AVS device 1, AVS device 2 and AVS device 3 all match alarm information, then the alarm ratio of this layer can be 1 (also That is 100%); for the same reason, the three AVS devices under AVS cluster 1 in the previous level also all match the alarm information, so the alarm ratio can also be 1; and the availability zone a in the previous level If only AVS cluster 1 matches the alarm information, then the alarm ratio of availability zone a can be 1/21 (that is, among the 21 clusters in the availability zone, only 1 matches the alarm information), and then go up to the next level. The alarm ratio in inner areas can be 1/5. On this basis, when you want to calculate the degree of correlation corresponding to the alarm information with a level distance of 1 (corresponding to the highest level object AVS device 1-3 in the figure) in the change impact scope, you can assign q in the above formula to 1, Thus f(1) is obtained; similarly, when it is necessary to calculate the correlation degree corresponding to the alarm information with a level distance of 3, q in the above formula can be assigned a value of 1/21, thereby obtaining f(3).

Among them, in the process of calculating the risk assessment value corresponding to the target change event based on the corresponding alarm level and weight of the at least one target alarm information, the initial risk value assigned to the corresponding alarm level of the at least one target alarm information can be obtained ; Based on the corresponding weight of at least one piece of target alarm information, perform a weighted sum of the initial risk values corresponding to at least one piece of target alarm information; and determine the risk assessment value corresponding to the target change event based on the result of the weighted sum.

Optionally, an exemplary solution for assigning initial risk values to different alarm levels may be: determining the basic risk values corresponding to different alarm levels; counting the historical frequency of occurrence of different alarm levels in the cloud network; based on different alarm levels. The corresponding historical frequencies of each alarm level are assigned adjustment coefficients for different alarm levels; under different alarm levels, the corresponding basic risk values are weighted according to the corresponding adjustment coefficients to obtain the initial risk values corresponding to different alarm levels. Among them, for alarm levels with higher historical frequency, a higher adjustment coefficient can be assigned to them, so that their initial risk values are higher and their impact on the final risk assessment value will be greater. In this exemplary solution, the basic risk value is fine-tuned by taking into account the historical frequency of occurrence of different alarm levels in the cloud network. In this way, as the alarm situation changes in the cloud network, the initial corresponding alarm levels of different alarm levels change. The value at risk will also be dynamic. Of course, in this implementation, other exemplary solutions can also be used to assign initial risk values to different alarm levels, but are not limited thereto.

On this basis, the initial risk value of the corresponding alarm level of at least one target alarm information can be obtained.

In this implementation, the calculation logic of the risk assessment value can be characterized as the following formula:
v _p =x*(1+f(p))
v＝v ₁ +v ₂ +…+v _p

Among them, v represents the risk assessment value of the target change event, v _p represents the sum of risk assessment values caused by all target alarm information with a topological distance of p, p represents the aforementioned topological distance, and f(p) represents the target with a correlation degree of p. The weight assigned to the alarm information, x represents the initial risk value corresponding to each target alarm information with a correlation degree of p. It can be seen that the risk assessment value of the target change event is equal to the weighted sum of the initial risk values of all target alarm information plus the initial risk value of all target alarm information.

By calculating the risk assessment value in this way, the target alarm information that matches the target change event that occurs in the cloud network can be used as the basis for risk assessment, and each direction can also be classified according to the degree of correlation between the target alarm information and the target change event. The degree of participation of target alarm information in the process of calculating risk assessment values. In this way, the risk basis provided by all target alarm information can be comprehensively considered to avoid one-sided judgments about the risk of target change events due to a small amount of target alarm information. For example, alarm information in the cloud network may be caused by user behavior, but these alarm information are difficult to accurately eliminate. In this implementation, even if the alarm information caused by these user behaviors participates in the calculation of risk assessment values During the process, the alarm information caused by user behavior is usually local and temporary. Therefore, its participation in the risk assessment value calculation process is not too strong, which invisibly affects the final risk assessment. The influence of value has been weakened, which can effectively avoid the problem of misjudgment of risk assessment caused by user behavior.

The above implementation method can associate target alarm information to target change events, and comprehensively consider the degree of influence that each target alarm information should play in the risk assessment value through various dimensions such as alarm proportion, weight, adjustment coefficient, and initial risk value. , so as to reasonably analyze the target alarm information to obtain the risk assessment value.

It should be understood that in this embodiment, other implementation methods can also be used to calculate the risk assessment value based on the target alarm information, for example, using machine learning to learn the mapping relationship between the alarm information and the risk evaluation value, etc., This embodiment will not be described in detail here.

Furthermore, in this embodiment, a risk threshold can also be set, and the aforementioned preset condition is set to exceed the risk threshold. In this way, when the risk assessment value calculated for the target change event exceeds the risk threshold, it can be determined Target change events are risky. When it is determined that there is a risk in the target change event, a reminder notification can be issued; the reminder notification can be output to the operation and maintenance personnel for the operation and maintenance personnel to confirm the handling plan for the target change event, for example, it can be to suspend the change or modify the change online, etc. , this embodiment is not limited here.

An exemplary solution for determining the risk threshold may be: continuously collect risk assessment values calculated for historical change events that occur in the cloud network as assessment value samples; and compare the collected values according to the number of times different risk assessment values have been recorded. Distribution fitting is performed on the evaluation value samples to obtain the fitting function; based on the fitting function, the risk threshold is selected.

Figure 5 is a logical schematic diagram of a risk threshold determination scheme provided by an exemplary embodiment of the present application. Referring to Figure 5, the risk assessment value in the assessment value sample can be used as the X-axis, and each risk assessment value involved in the assessment value sample The number of times recorded is the Y-axis, the distribution data of the risk assessment value is obtained, and the corresponding distribution fitting function is generated.

In the process of selecting the risk threshold: if the number of evaluation value samples is higher than the specified number, the evaluation value samples are distributed and sorted based on the fitting function; the evaluation value samples after distribution sorting are selected to match the preset false alarm rate target evaluation value sample; use the risk evaluation value corresponding to the target evaluation value sample as the risk threshold; if the number of evaluation value samples is lower than the specified number, the evaluation value samples will be distributed and sorted based on the fitting function; sorted from the distribution Select the target evaluation value sample that is adapted to the cumulative probability of the preset distribution among the evaluation value samples; use the risk evaluation value corresponding to the target evaluation value sample as the risk threshold. For example, the evaluation value samples in Figure 5 are less than 500 (corresponding to the specified number mentioned above). If the evaluation value samples are 100, and the cumulative probability of the preset distribution is 99%, the risk threshold is calculated to be 9.4. In this way, If the risk assessment value of a target change event is higher than 9.4, it will be deemed to be a risk.

Accordingly, in this embodiment, the risk assessment value corresponding to the target change event can be calculated simply, efficiently, and accurately based on the target alarm information, and whether there is a risk in the target change event by judging whether the risk assessment value exceeds the risk threshold. In this way, the risk of change events can be discovered in a timely manner during the change testing phase or the operation phase after the change is launched, thereby effectively avoiding the failures that the change may bring to the cloud.

It should be noted that the execution subject of each step of the method provided in the above embodiments may be the same device, or the method may also be executed by different devices. Some of the processes described in the above embodiments and drawings include multiple operations that appear in a specific order, but it should be clearly understood that these operations may not be performed in the order in which they appear in this article or may be performed in parallel. The operations The serial numbers such as 101, 102, etc. are only used to distinguish different operations. The serial numbers themselves do not represent any execution order. Additionally, these processes may include more or fewer operations, and the operations may be performed sequentially or in parallel.

FIG. 6 is a schematic structural diagram of a computing device provided by another exemplary embodiment of the present application. As shown in FIG. 6 , the computing device includes: a memory 60 and a processor 61 .

The processor 61 is coupled to the memory 60 and is used to execute the computer program in the memory 60 for:

In response to the risk assessment instructions, determine the change impact scope corresponding to the target change event based on the preset topology information in the cloud network. The topology information includes the affiliation relationships between objects at different levels in the cloud network and the association relationships between objects at the same level. The change impact scope includes at least one layer of superior objects corresponding to the change object of the target change event and associated objects of the same level;

Determine the alarm impact scope corresponding to multiple alarm information according to the topology information. The alarm impact scope includes at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects of the same level;

Select at least one target alarm information that is adapted to the target change event from multiple alarm information, and there is overlap between the alarm impact scope corresponding to the target alarm information and the change impact scope;

Based on at least one target alarm information, conduct a risk assessment on target change events.

In an optional embodiment, in the process of determining at least one layer of superior objects corresponding to the change objects of the target change event included in the change impact scope, the processor 61 is configured to:

According to the topology information, search the level objects to which the change object belongs level by level until the object of the specified level is found and end the search to obtain at least one layer of superior objects corresponding to the change object of the target change event;

In the process of determining at least one level of superior objects corresponding to the alarm occurrence objects of alarm information included in the alarm impact scope, it is used to:

According to the topology information, the level objects to which the alarm occurrence object belongs are searched level by level until the object of the specified level is found and the search is terminated to obtain at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information.

In an optional embodiment, the topology information adopts a tree structure, and the processor 61 can also be used to:

According to the tree structure corresponding to the topology information, at least one layer of superior objects corresponding to the change object of the target change event and the associated objects of the same level are organized into a change topology tree with the change object as the root node to represent the scope of change influence;

According to the tree structure corresponding to the topology information, at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects at the same level are organized into an alarm topology tree with the alarm occurrence object as the root node to represent the scope of alarm influence.

In an optional embodiment, in the process of risk assessment of a target change event based on at least one piece of target alarm information, the processor 61 is configured to:

Obtain the alarm level recorded in at least one target alarm information;

Calculate the risk assessment value corresponding to the target change event based on the corresponding alarm level of at least one target alarm information;

If the risk assessment value is higher than the risk threshold, it is determined that the target change event is risky.

In an optional embodiment, in the process of calculating the risk assessment value corresponding to the target change event based on the corresponding alarm level of at least one item of target alarm information, the processor 61 is used to:

Respectively determine the degree of correlation between at least one piece of target alarm information and the target change event;

Assign a weight to at least one target alarm information according to the degree of correlation;

Calculate the risk assessment value corresponding to the target change event based on the corresponding alarm level and weight of at least one target alarm information.

In an optional embodiment, in the process of determining the degree of correlation between at least one piece of target alarm information and the target change event, the processor 61 is configured to:

Find the smallest level object in the overlap between the change impact scope and the alarm impact scope corresponding to at least one target alarm information;

A correlation degree is assigned to at least one piece of target alarm information based on the level distance between the minimum level object corresponding to each of the at least one piece of target alarm information and the change object.

In an optional embodiment, in the process of searching for the smallest level object in the overlap between the change impact scope and the alarm impact scope corresponding to at least one piece of target alarm information, the processor 61 is used to:

If the change impact scope and the alarm impact scope are represented by a topology tree, search for the lowest tree node in the overlap between the change impact scope and the alarm impact scope corresponding to at least one target alarm information, where a single tree node corresponds to a level object. ;

The process of determining level distance is used for:

Based on the topological distance between the lowest tree node corresponding to the at least one target alarm information and the change object in the change topology tree that represents the scope of the change, determine the level distance corresponding to the at least one target alarm information.

In an optional embodiment, in the process of calculating the risk assessment value corresponding to the target change event based on the corresponding alarm level and weight of at least one piece of target alarm information, the processor 61 is used to:

Obtain the initial risk value assigned to the corresponding alarm level of at least one target alarm information;

Based on the corresponding weights of at least one piece of target alarm information, perform a weighted summation of the respective initial risk values corresponding to at least one piece of target alarm information;

Based on the results of the weighted sum, determine the risk assessment value corresponding to the target change event.

In an optional embodiment, in the process of assigning initial risk values to different alarm levels, the processor 61 is used to:

Determine the basic risk values corresponding to different alarm levels;

Statistics of the historical frequency of occurrence of different alarm levels in the cloud network;

Based on the corresponding historical frequencies of different alarm levels, allocate adjustment coefficients to different alarm levels;

Under different alarm levels, the corresponding basic risk values are weighted according to the corresponding adjustment coefficients to obtain the initial risk values corresponding to different alarm levels.

In an optional embodiment, the processor 61 can also be used to:

Continuously collect risk assessment values calculated for historical change events that occur in the cloud network as assessment value samples;

According to the number of times different risk assessment values are recorded, distribution fitting is performed on the collected assessment value samples to obtain a fitting function;

Based on the fitting function, the risk threshold is selected.

Further, as shown in Figure 6, the computing device also includes: a communication component 62, a power supply component 63 and other components. Only some components are schematically shown in FIG. 6 , which does not mean that the computing device only includes the components shown in FIG. 6 .

It is worth noting that for the above technical details in each embodiment of the computing device, reference can be made to the relevant descriptions in the foregoing method embodiments. To save space, they will not be repeated here, but this should not cause a loss in the scope of protection of the present application. .

Correspondingly, embodiments of the present application also provide a computer-readable storage medium storing a computer program. When the computer program is executed, it can implement each step that can be executed by a computing device in the above method embodiment.

The memory in Figure 6 above is used to store computer programs, and can be configured to store various other data to support operations on the computing platform. Examples of such data include instructions for any application or method operating on the computing platform, contact data, phonebook data, messages, pictures, videos, etc. Memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable memory Read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.

The communication component in Figure 6 mentioned above is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G/LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component further includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

The power supply component in Figure 6 above provides power to various components of the device where the power supply component is located. A power component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power component resides.

Those skilled in the art will understand that embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.

Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information. Information may be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory. (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include transient computer-readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "comprises," or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements not only includes those elements, but also includes Other elements are not expressly listed or are inherent to the process, method, article or equipment. Without further limitation, an element defined by the statement "comprises a..." does not exclude the presence of additional identical elements in a process, method, article, or device that includes the stated element.

The above descriptions are only examples of the present application and are not intended to limit the present application. To those skilled in the art, various modifications and variations may be made to this application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application shall be included in the protection scope of this application.

Claims

A change risk assessment approach that includes:

In response to the risk assessment instruction, determine the change impact scope corresponding to the target change event based on the preset topology information in the cloud network. The topology information includes affiliation relationships between objects at different levels in the cloud network and associations between objects at the same level. Relationship, the change impact scope includes at least one layer of superior objects corresponding to the change object of the target change event and associated objects of the same level;

Collect multiple alarm information generated in the cloud network within a preset time range after the target change event occurs;

Determine the alarm influence scope corresponding to each of the multiple alarm information according to the topology information, and the alarm influence scope includes at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects of the same level;

Select at least one piece of target alarm information adapted to the target change event from the plurality of alarm information, and there is an overlap between the alarm impact scope corresponding to the target alarm information and the change impact scope;

Based on the at least one target alarm information, a risk assessment is performed on the target change event.
According to the method of claim 1, the process of determining at least one layer of superior objects corresponding to the change objects of the target change event included in the change impact scope includes:

According to the topology information, find the level objects to which the change object belongs level by level until the object of the specified level is found and end the search to obtain at least one layer of superior objects corresponding to the change object of the target change event;

The process of determining at least one layer of superior objects corresponding to the alarm occurrence objects of the alarm information included in the alarm impact scope includes:

According to the topology information, the level object to which the alarm occurrence object belongs is searched level by level until an object of a specified level is found and the search is terminated to obtain at least one layer of upper-level objects corresponding to the alarm occurrence object of the alarm information.
According to the method of claim 2, the topology information adopts a tree structure, and the method further includes:

According to the tree structure corresponding to the topology information, at least one layer of superior objects corresponding to the change object of the target change event and associated objects of the same level are organized into a change topology tree with the change object as the root node to represent The scope of impact of the change;

According to the tree structure corresponding to the topology information, at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects of the same level are organized into an alarm topology tree with the alarm occurrence object as the root node, so as to Characterize the impact scope of the alarm.
The method according to claim 1, performing a risk assessment on the target change event based on the at least one target alarm information includes:

Obtain the alarm level recorded in the at least one target alarm information;

Calculate the target change event pair according to the corresponding alarm level of the at least one target alarm information. appropriate risk assessment value;

If the risk assessment value is higher than the risk threshold, it is determined that the target change event is risky.
The method according to claim 4, wherein calculating the risk assessment value corresponding to the target change event based on the corresponding alarm level of each of the at least one target alarm information includes:

Determine respectively the degree of correlation between each of the at least one target alarm information and the target change event;

Assign a weight to the at least one target alarm information according to the degree of correlation;

Calculate the risk assessment value corresponding to the target change event according to the corresponding alarm level and weight of the at least one target alarm information.
The method according to claim 5, wherein determining the degree of correlation between each of the at least one target alarm information and the target change event includes:

Find the smallest level object in the overlap between the change impact scope and the alarm impact scope corresponding to the at least one target alarm information;

The degree of association is assigned to the at least one item of target alarm information based on the level distance between the minimum level object corresponding to each of the at least one item of target alarm information and the change object.
The method according to claim 6, wherein the search for the smallest level object in the overlap between the change impact scope and the alarm impact scope corresponding to the at least one item of target alarm information includes:

If the change impact scope and the alarm impact scope are represented by a topology tree, search for the lowest tree node in the overlap between the change impact scope and the alarm impact scope corresponding to the at least one target alarm information, where , a single tree node corresponds to a level object;

The process of determining level distance includes:

According to the topological distance between the lowest tree node corresponding to each of the at least one target alarm information and the change object in the change topology tree that represents the scope of the change, determine the corresponding minimum tree node of each of the at least one target alarm information. The level distance.
The method according to claim 5, calculating the risk assessment value corresponding to the target change event based on the respective alarm levels and weights of the at least one target alarm information, including:

Obtain the initial risk value assigned to the corresponding alarm level of each of the at least one target alarm information;

Based on the respective weights corresponding to the at least one item of target alarm information, perform a weighted summation of the initial risk values corresponding to each of the at least one item of target alarm information;

According to the result of the weighted sum, the risk assessment value corresponding to the target change event is determined.
According to the method of claim 8, the process of assigning initial risk values to different alarm levels includes:

Determine the basic risk values corresponding to different alarm levels;

Statistics of the historical frequency of occurrence of different alarm levels in the cloud network;

Based on the corresponding historical frequencies of different alarm levels, allocate adjustment coefficients to different alarm levels;

Under different alarm levels, the corresponding basic risk values are weighted according to the corresponding adjustment coefficients to obtain the initial risk values corresponding to different alarm levels.
The method of claim 4, further comprising:

Continuously collect risk assessment values calculated for historical change events that occur in the cloud network as assessment value samples;

According to the number of times different risk assessment values are recorded, distribution fitting is performed on the collected assessment value samples to obtain a fitting function;

Based on the fitting function, the risk threshold is selected.
A computing device including a memory and a processor;

The memory is used to store one or more computer instructions;

The processor is coupled to the memory for executing the one or more computer instructions for:

In response to the risk assessment instruction, determine the change impact scope corresponding to the target change event based on the preset topology information in the cloud network. The topology information includes affiliation relationships between objects at different levels in the cloud network and associations between objects at the same level. Relationship, the change impact scope includes at least one layer of superior objects corresponding to the change object of the target change event and associated objects of the same level;

Collect multiple alarm information generated in the cloud network within a preset time range after the target change event occurs;

Determine the alarm influence scope corresponding to each of the multiple alarm information according to the topology information, and the alarm influence scope includes at least one layer of superior objects corresponding to the alarm occurrence object of the alarm information and associated objects of the same level;

Select at least one piece of target alarm information adapted to the target change event from the plurality of alarm information, and there is an overlap between the alarm impact scope corresponding to the target alarm information and the change impact scope;

Based on the at least one target alarm information, a risk assessment is performed on the target change event.
A computer-readable storage medium storing computer instructions that, when executed by one or more processors, cause the one or more processors to execute the change risk described in any one of claims 1-10 assessment method.