A security vulnerability threat quantification method based on multi-level impact factors

Abstract

The invention discloses a multilayer impact factor-based security vulnerability threat quantification method. The method comprises the following steps of: 1, determining a website to be crawled, crawling website data and processing the website data to obtain content related to heat assessment; 2, processing the crawled website data, carrying out heat assessment and correcting the score of a CVSS basic factor through a formula 1: ScoreBase=min [(ScoreBasc+ScoreConcerned), 8] (Formula 1), ScoreSconcerned=5*Publish*Click*Transmit (Formula2), wherein ScoreConcerned is a heat score, ScoreBasc is a basic score, Publish is a publish frequency, Click is a click frequency and Transmit is a transmit frequency; 3, carrying out asset assessment; and 4, fusing an asset assessment result obtained in the step 3 with a CVSS basic score by referring to a CVSS algorithm so as to obtain a final hole score, and substituting the final hole score into a CVSS assessment algorithm to obtain a final hole score.

Description

technical field [0001] The invention belongs to the technical field of network security, and designs a security loophole threat quantification method based on multi-level impact factors. Background technique [0002] The wide application of information technology and the rapid development of cyberspace have greatly promoted the prosperity and progress of society. However, in the process of informatization development, information security issues have become increasingly prominent. And destruction opens the door to convenience. In order to prevent problems before they happen, quantitative analysis of security vulnerabilities in advance, and taking corresponding protective measures according to the degree of harm of security vulnerabilities can effectively reduce asset losses. [0003] Quantitative analysis of security vulnerabilities is to comprehensively consider the security vulnerabilities themselves, occurrence conditions, scope of occurrence, and the degree of damage to...

AI Technical Summary

Problems solved by technology

[0005] Therefore, only focusing on the vulnerability itself and the environment without considering the degree of concern about the vulnerability will lead to a decrease in the reference value of the vulnerability score

In addition, the environmental factors in the CVSS system include the modification of the basic factors and the requirements for confidentiality, integrity and availability in a specific environment, but the evaluation is highly subjective and cannot well reflect the objective threat of vulnerabilities

Images