A method and system for determining the sequence of vulnerability rectification based on attack chain

Abstract

The invention discloses a vulnerability restructuring sequence determining method and system based on attack links. The method comprises the steps of determining an indirect loss coefficient corresponding to each host according to attack link information of an access connection structure; through utilization of the indirect loss coefficient of each host and the direct loss coefficient of each host, determining a total loss coefficient of each host; and determining a final score and a vulnerability restructuring sequence corresponding to each vulnerability according to the total loss coefficient of each host corresponding to each vulnerability and a weight coefficient of each vulnerability. Visibly, different vulnerabilities are scored through combination of the attack link information of an information network; the harmfulness scores of the vulnerabilities and the hosts can be calculated according to the harmfulness of the vulnerabilities themselves and a topological structure, so under the condition that the manpower is limited, the vulnerabilities and hosts badly in need of restoration are distinguished, the operation and maintenance personnel are prevented from excessively paying close attention to the internal network high-risk vulnerabilities hardly possible to be used, while the external network high-risk vulnerabilities with higher risk are ignored.

Description

technical field [0001] The present invention relates to the technical field of information network vulnerability rectification, and more specifically, relates to a method and system for determining the order of vulnerability rectification based on attack chains. Background technique [0002] At present, the traditional static vulnerability scoring system is isolated and based on a single host, and does not rely on other information such as network structure and asset value for evaluation. Usually, only emergency, high-risk, medium-risk, and low-risk levels are evaluated, and the traditional static vulnerability scoring system is limited to the static evaluation of a single host, and cannot calculate the harmfulness of vulnerabilities based on the network topology. However, in the organization's internal information network, the data in the deep intranet is often of high value. Once it is leaked, the loss will be huge. On the other hand, after repeated firewall filtering, the...

AI Technical Summary

Problems solved by technology

Usually, only emergency, high-risk, medium-risk, low-risk and other levels are evaluated, and the traditional static vulnerability scoring system is limited to the static evaluation of a single host, and cannot calculate the harmfulness of vulnerabilities based on the network topology

However, in the organization's internal information network, the data in the deep intranet is often of high value. Once it is leaked, the loss will be huge. On the other hand, after repeated firewall filtering, the probability of hackers penetrating into the intranet will decrease, thereby reducing the loss expectation.

Images