Network security risk assessment system

Abstract

The invention discloses a network security risk assessment system, and the system comprises a server side and a client side adopting a C / S architecture, and an agent side installed on an assessment target system. The server side comprises an assessment engine service module, a vulnerability library, a historical assessment record, a fusion assessment module and an identity verification module; the client comprises a login module, a scanning configuration module, a feedback processing module and an evaluation result library, and the agent end of the evaluation target system comprises an information collection module, a machine learning module, a machine learning updating module, an anomaly detection module and an asset scanning module. According to the invention, the evaluation of the network security risk is more comprehensive and objective.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security risk assessment system. Background technique [0002] At present, various known and unknown network attacks have seriously threatened the security of network information systems. In the tough cybersecurity landscape, not being aware of the risk is the biggest risk. You need to assess the network threats you have encountered and what kind of security situation your own network is in. Through network security assessment, it is an important issue in the field of network security to analyze the current security threat situation that the system is facing, so as to provide a basis for further formulating targeted defense. [0003] How to conduct a comprehensive and accurate assessment of the current network security risk. Traditional network security risk assessment technology research mainly uses techniques such as system vulnerability analysis, log analy...

AI Technical Summary

Problems solved by technology

[0005] 1) Traditional network security risk assessment systems rely on prior knowledge such as known vulnerabilities, virus signatures, and attack traffic characteristics to assess the security risks of the target system. In the absence of prior knowledge, it is difficult to assess the potential security risks of the system. 2) The traditional risk assessment process only focuses on the current vulnerability of the target system to be assessed, asset weight, log alarm analysis, virus scanning results and other indicators are scored according to predetermined scoring standards and the final score is fused. Value, ignoring the impact of the security risks of adjacent network nodes on the target system, and the impact of vulnerabilities, alarms, detected viruses, Trojan horses and other threats on the current system state during the historical assessment process of the target system, resulting in one-sided assessment results; 3) The traditional risk assessment model lacks self-learning and self-adaptive capabilities. A unified and fixed detection model is used to conduct risk assessment on all target systems, and it is difficult to dynamically adjust according to the system's own network environment and asset changes. adaptability

Images