Network asset risk assessment method, device and system

Abstract

The embodiment of the invention provides a network asset risk assessment method, device and system, and relates to the technical field of Internet. The network asset risk assessment method comprises the following steps: firstly, obtaining various kinds of probe data in a network, asset data of target network assets and a current assessment time period; calculating an asset value of the target network assets according to the various kinds of probe data and the asset data; calculating a vulnerability risk value of the target network assets according to the various probe data and the asset data; further calculating a threat event risk value of the target network assets according to the current assessment time period, the various probe data and the asset data; and finally, according to the asset value, the vulnerability risk value and the threat event risk value, calculating a network asset risk assessment result of the target network assets in the current assessment time period. Therefore, comprehensive assessment of network asset risks can be realized, artificial participation in assessment is not needed, and an assessment result is accurate, objective and highly professional.

Description

technical field [0001] The present application relates to the field of Internet technology, in particular, to a method, device and system for network asset risk assessment. Background technique [0002] With the continuous discovery of the Internet, network security issues are becoming more and more serious, and the demand for accurate quantitative assessment of network security risks is increasing day by day. The existing network asset risk assessment method usually sets the corresponding weight value according to the importance of the network equipment, uses the weight value to weight the equipment risk score of each network equipment, and obtains all the network assets in the network to be tested. The weighted sum of devices to assess the risk of the network under test. However, in practice, it is found that the existing technology usually determines the weight value manually, which leads to the artificial definition in the risk assessment, which is highly subjective, wh...

AI Technical Summary

Problems solved by technology

However, in practice, it is found that the existing technology usually determines the weight value manually, which leads to artificial definition and strong subjectivity in risk assessment, which in turn leads to unprofessional and inaccurate assessment, so that it is impossible to conduct a comprehensive assessment of network threat events

It can be seen that the existing methods require manual participation in the assessment, and the assessment is not professional and accurate, so that it is impossible to conduct a comprehensive assessment of network threat events

Images