Network security assessment method and device, network security equipment and storage medium

Abstract

The embodiment of the invention discloses a network security assessment method and device, network security equipment and a storage medium. The method comprises the following steps: acquiring a network security event set; each network security event is obtained in the data transmission process of each network asset, and each network asset is an entity device with an independent IP; aiming at each network security event, determining attack parameters comprising network assets, attack relationships and attack coefficients; determining attack relations and attack times among the asset groups; determining an attack relationship pair value between every two asset groups with an attack relationship according to the attack relationship and the attack times between the asset groups; and based on each attack relationship pair value and a preset asset group number threshold value, determining a target attack relationship and a target attack frequency between the target asset group set and each two asset groups with the attack relationship. Therefore, the security performance of the network environment is evaluated, the asset group corresponding to the network threat is positioned, and the network threat is further analyzed.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular to a network security assessment method, device, network security equipment and storage medium. Background technique [0002] Network assets are important management objects in the security management platform. They are physical devices with independent IP addresses (Internet Protocol Address, Internet Protocol Address), such as computers, smart terminals, and servers. The threats inside the network where each network asset is located mainly include zombies, worms, scanning and detection, and login with weak passwords. [0003] In related technologies, in the face of security events caused by the above threats, operation and maintenance personnel usually respond and handle them according to their own understanding, such as analyzing log events. However, on the one hand, it consumes manpower and material resources. On the other hand, due to the existence of hu...

AI Technical Summary

Problems solved by technology

However, on the one hand, it consumes manpower and material resources; on the other hand, due to the existence of human subjective factors, the analysis results of security incidents are biased and inaccurate, so that it is impossible to accurately determine the source and type of external threats, etc.

Images