Network security analysis method and device, computer equipment and storage medium

Abstract

The invention discloses a network security analysis method and device, computer equipment and a storage medium. The method comprises the following steps: scanning various network main bodies in a target network system to obtain parameters, and performing format processing to obtain a standard format file; according to the standard format file, through network topology self-discovery, generating a network topology structure diagram, and then generating a system structure diagram; generating a penetration graph model according to the standard format files of the various network main bodies, the system structure diagrams and a preset vulnerability knowledge base; traversing all the penetration paths in the penetration graph model and executing the killing chain process, and finally determining the penetration path of the target network main body, so the application can not only perform vulnerability verification on the hosts on the whole line from the attacker to the core asset server, but also perform vulnerability verification on the hosts on the whole line from the attacker to the core asset server; hosts on all potential attack paths from the attacker to the core assets are even mined, one-by-one penetration verification is carried out, and based on this, global restoration is carried out, so that the security of the network system is greatly improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network security analysis method, device, computer equipment and storage medium. Background technique [0002] In real scenarios, often in a large-scale network system, there may be multiple hosts carrying vulnerabilities, and the vulnerability level may be high or low. If the system is faced with an urgent and high-risk 0day vulnerability, it is difficult to repair in a short time, and the core assets are facing huge risks. Threats, it is not necessarily the best solution to repair high-risk vulnerabilities in a head-to-head manner. It is possible that the vulnerability repair time will be too long and cause corporate losses. In order to reduce the risk of asset loss as much as possible, an effective overall defense Strategy is also essential. [0003] The current mainstream vulnerability scanning tools are based on isolated hosts for vulnerability scanning. The scanning actio...

AI Technical Summary

Problems solved by technology

Security analysts manually confirm the scan results and verify the vulnerabilities. However, this network security analysis method cannot guarantee the security level of the overall network system.

Images