Operating system security assessment method based on attack-fault tree

Abstract

The invention relates to an attack-fault tree-based operating system security evaluation method, which comprises the following steps of: aiming at an attack-fault tree-based operating system, evaluating an attack surface exposure risk result of an exposure element in a simulated attack scene; based on an attack surface exposure risk result, performing adaptive adjustment on a security evaluation algorithm and algorithm parameters of an operation system defense mechanism; based on the self-adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating a defense mechanism of the operating system to obtain a defense mechanism evaluation result; based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; and obtaining real-time operation data of the operating system, correcting the preliminary comprehensive risk value, and generating a comprehensive security assessment result of the operating system. According to the invention, the mutual influence of multiple aspects is comprehensively considered, so that the final comprehensive safety assessment result is more accurate.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an operating system security assessment method based on an attack-fault tree. Background Art

[0002] Currently, operating systems are facing an endless stream of security threats, such as increasingly complex and diverse cyberattacks, and incidents of exploiting system vulnerabilities to steal sensitive data and disrupt normal system operations.

[0003] Traditional operating system security assessment methods focus on static vulnerability scanning, which can only identify known security risks and are unable to respond to dynamically changing attack scenarios. Assessments of attack surface exposure risk lack comprehensiveness and accuracy, and are unable to effectively identify hidden exposure elements and their risk level.

[0004] In the evaluation of defense mechanisms, algorithms and parameters are often fixed and cannot be adaptively adjusted according to real-time risk conditions, resulting in delayed evaluation results and difficulty in reflecting the actual defense effectiveness of the operating system.

[0005] Therefore, the evaluation results of current operating system security evaluation methods have the defect of being inaccurate. Summary of the Invention

[0006] The main purpose of the present invention is to provide an operating system security assessment method based on attack-fault tree, aiming to overcome the defect that the assessment results of current operating system security assessment are not accurate enough.

[0007] To achieve the above object, the present invention provides an operating system security assessment method based on an attack-fault tree, comprising the following steps:

[0008] For operating systems based on attack-fault trees, evaluate the attack surface exposure risk results of exposed elements under simulated attack scenarios;

[0009] Based on the attack surface exposure risk result, adaptively adjust the security assessment algorithm and algorithm parameters of the operating system defense mechanism;

[0010] Based on the adaptively adjusted security assessment algorithm and algorithm parameters, the defense mechanism of the operating system is evaluated to obtain a defense mechanism evaluation result;

[0011] Based on matrix operations, quantify the comprehensive impact of the attack surface exposure risk results and the defense mechanism assessment results on the overall security status of the operating system to obtain a preliminary comprehensive risk value;

[0012] Real-time operating data of the operating system is obtained, and based on the real-time operating data, the preliminary comprehensive risk value is corrected to generate a comprehensive security assessment result of the operating system.

[0013] Furthermore, the exposed elements include system interfaces, services, and accessible resources.

[0014] Furthermore, based on the attack surface exposure risk result, the security assessment algorithm and algorithm parameters of the operating system defense mechanism are adaptively adjusted, including:

[0015] The attack surface exposure risk results are analyzed hierarchically according to hazard level, attack type, and affected object, and key feature parameters are extracted;

[0016] Selecting a security assessment algorithm for performing a security assessment on the operating system defense mechanism based on a pre-established security assessment algorithm selection rule and the key characteristic parameters;

[0017] For the selected security assessment algorithm, based on the attack surface exposure risk results, a fuzzy control algorithm is used to dynamically adjust the algorithm parameters.

[0018] Furthermore, based on matrix operations, the combined impact of the attack surface exposure risk results and the defense mechanism assessment results on the overall security status of the operating system is quantified to obtain a preliminary comprehensive risk value, including:

[0019] Constructing an attack surface risk matrix based on the attack surface exposure risk results;

[0020] constructing a defense mechanism matrix based on the defense mechanism assessment results;

[0021] Obtaining a correlation matrix from a database, wherein the correlation matrix is ​​used to represent the degree of correlation between attack surface exposure risk and defense mechanism;

[0022] Multiplying the attack surface risk matrix, the correlation matrix, and the defense mechanism matrix in sequence to obtain an intermediate matrix; summing the intermediate matrix row by row to obtain a one-dimensional vector;

[0023] The elements in the one-dimensional vector are normalized and weighted summed to obtain the preliminary comprehensive risk value.

[0024] Furthermore, based on the real-time operation data, the preliminary comprehensive risk value is revised, including:

[0025] extracting key safety indicator data from the real-time operation data;

[0026] Determine the correlation value between the key safety indicator data and the safety risk through correlation analysis;

[0027] Based on the preset correction rules, the preliminary comprehensive risk value is adjusted upward or downward using the associated value to obtain a comprehensive safety assessment result.

[0028] Furthermore, after generating the comprehensive security assessment result of the operating system, the following steps are included:

[0029] Obtaining the identification number and security test code of the operating system; adding the identification number and security test code to the matrix one by one in sequence to generate a sequence matrix;

[0030] generating a simulation graphic based on the type of the operating system;

[0031] Changing the sequence matrix based on the simulation graph to obtain a changed matrix;

[0032] Based on the change matrix, a storage key is generated, and the comprehensive security assessment result of the operating system is encrypted and stored.

[0033] Furthermore, generating a storage key based on the change matrix includes:

[0034] Obtain a preset mapping table; the preset mapping table includes a one-to-one mapping relationship between original data and mapped data;

[0035] Based on the simulation graph, performing mutation processing on the mapping data of the preset mapping table to obtain a mutated mapping table;

[0036] Acquiring attribute information of the variation mapping table, and selecting a target matrix element from the change matrix based on the attribute information;

[0037] The target matrix elements are mapped based on the variation mapping table, and the mapping results are sequentially combined to obtain the storage key.

[0038] Furthermore, generating a storage key based on the change matrix includes:

[0039] Superimposing the change matrix and the simulation graph according to a rule, obtaining each matrix element located in the simulation graph in the change matrix, and reconstructing the matrix into a deformation matrix;

[0040] Obtaining properties of the change matrix and properties of the deformation matrix;

[0041] The storage key is generated based on the properties of the change matrix and the properties of the deformation matrix.

[0042] Furthermore, the sequence matrix is ​​changed based on the simulation graph to obtain a changed matrix, including:

[0043] Adding the simulation graphic to the sequence matrix, and constructing a plurality of closed sub-graphics based on the simulation graphic in the sequence matrix;

[0044] In the sequence matrix, the matrix elements located within the closed subgraph are exchanged with the matrix elements located outside the closed subgraph one by one in sequence until all the matrix elements located within the closed subgraph are exchanged, or all the matrix elements located outside the closed subgraph are exchanged, to obtain the changed matrix.

[0045] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0046] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0047] The present invention provides an operating system security assessment method based on an attack-fault tree, comprising: evaluating the attack surface exposure risk results of exposed elements in a simulated attack scenario for an operating system based on an attack-fault tree; adaptively adjusting the security assessment algorithm and algorithm parameters of the operating system's defense mechanism based on the attack surface exposure risk results; evaluating the operating system's defense mechanism based on the adaptively adjusted security assessment algorithm and algorithm parameters to obtain a defense mechanism assessment result; quantifying the combined impact of the attack surface exposure risk results and the defense mechanism assessment results on the overall security status of the operating system based on matrix operations to obtain a preliminary comprehensive risk value; obtaining real-time operating data of the operating system, and revising the preliminary comprehensive risk value based on the real-time operating data to generate a comprehensive security assessment result of the operating system. In the present invention, by evaluating the attack surface exposure risk results of exposed elements in a simulated attack scenario and adaptively adjusting the security assessment algorithm and algorithm parameters of the defense mechanism, the security assessment is made more accurate; at the same time, the preliminary comprehensive risk value is revised based on the real-time operating data, and the mutual influence of multiple aspects is comprehensively considered, so that the final comprehensive security assessment result is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a schematic diagram of the steps of an operating system security assessment method based on an attack-fault tree in one embodiment of the present invention;

[0049] Figure 2 This is a structural block diagram of an operating system security assessment device based on an attack-fault tree in one embodiment of the present invention;

[0050] Figure 3 It is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0051] The implementation, functional features and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with embodiments. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0053] Reference Figure 1 In one embodiment of the present invention, a method for operating system security assessment based on an attack-fault tree is provided, comprising the following steps:

[0054] Step S1: for an operating system based on an attack-fault tree, evaluating the attack surface exposure risk results of exposed elements under a simulated attack scenario;

[0055] Step S2: adaptively adjusting the security assessment algorithm and algorithm parameters of the operating system defense mechanism based on the attack surface exposure risk result;

[0056] Step S3, evaluating the defense mechanism of the operating system based on the adaptively adjusted security assessment algorithm and algorithm parameters to obtain a defense mechanism assessment result;

[0057] Step S4: quantifying the comprehensive impact of the attack surface exposure risk result and the defense mechanism assessment result on the overall security status of the operating system based on matrix operations to obtain a preliminary comprehensive risk value;

[0058] Step S5: acquiring real-time operating data of the operating system, and revising the preliminary comprehensive risk value based on the real-time operating data to generate a comprehensive security assessment result of the operating system.

[0059] In this embodiment, as described in step S1 above, an operating system based on an attack-fault tree model is first constructed. The attacks facing the operating system are decomposed into sub-events and the logical relationships between them are analyzed. By simulating various real-world attack scenarios, including common network attacks and malware intrusions, a risk assessment algorithm is applied to exposed elements in the operating system, such as open ports and executable file vulnerabilities, to calculate the likelihood of these exposed elements being attacked and the severity of the consequences if attacked.

[0060] First, using security testing tools and simulation software, various attack scenarios are replicated in a virtual environment, conducting comprehensive attack tests on the operating system. During the test, the state changes of exposed elements are monitored in real time, and relevant data is recorded. Finally, this monitoring data is input into a pre-defined risk assessment model to determine the attack surface exposure risk.

[0061] As described in step S2 above, based on the attack surface exposure risk results obtained in step S1, the impact of different risk types on the operating system's defense mechanisms is analyzed. If a certain attack risk occurs frequently and poses a significant threat, it indicates that the current defense mechanism is insufficient in addressing that risk, and the corresponding security assessment algorithm and parameters need to be optimized. By establishing a mapping relationship between risk and algorithm adjustment, the algorithm's detection sensitivity, coverage, and parameter threshold settings are automatically adjusted based on the risk severity and frequency of occurrence. For example, the attack surface exposure risk results are categorized and ranked by risk type, severity, and frequency of occurrence. Using machine learning techniques, historical risk data and successful adjustment cases are trained to generate algorithm adjustment rules. Based on these rules, the existing security assessment algorithm code is modified to adjust relevant parameters, such as the detection threshold of the intrusion detection algorithm and the matching priority of firewall rules. This enables the security assessment algorithm and parameters to adapt to dynamically changing security risks, improves the accuracy of the assessment of the operating system's defense mechanism, and ensures that the defense mechanism can effectively respond to actual security threats.

[0062] As described in step S3 above, based on the adaptively adjusted security assessment algorithm and algorithm parameters, a comprehensive test is performed on the operating system's defense mechanisms, such as firewalls, intrusion detection systems, and access control modules. By simulating the response of the defense mechanism under attack scenarios, its defense capabilities against various attacks are evaluated, including indicators such as detection rate, blocking rate, and response time, thereby obtaining the defense mechanism evaluation results. In the simulation environment, various attack scenarios are run again to allow the operating system's defense mechanism to respond to the attacks. Monitoring tools are used to record various response data of the defense mechanism, such as whether the firewall successfully blocks the attack traffic and whether the intrusion detection system issues an alarm in a timely manner. The recorded data is input into the adjusted security assessment algorithm, and according to the pre-set evaluation indicators and calculation methods, the evaluation scores of the defense mechanism in various aspects are obtained, and the defense mechanism evaluation results are comprehensively formed.

[0063] As described in step S4 above, an attack surface risk matrix and a defense mechanism assessment matrix are constructed. The risk type, probability of occurrence, and impact level information from the attack surface exposure risk results, as well as the defense capability indicators from the defense mechanism assessment results, are mapped to matrix elements. The correlation matrix is ​​introduced, and through matrix operations such as matrix multiplication and weighted summation, the correlation between risks and defense mechanisms is comprehensively considered, quantifying their combined impact on the overall security status of the operating system, and deriving a preliminary comprehensive risk value.

[0064] As described in step S5 above, various data are collected in real time during the operation of the operating system, such as CPU usage, memory utilization, network traffic, and user operation behavior. Data analysis algorithms are used to explore the potential relationship between this real-time data and security risks. If the real-time data indicates system anomalies, such as a sudden surge in CPU usage or a large number of abnormal network connections, this indicates a security threat. The preliminary comprehensive risk value needs to be revised based on these anomalies to make the assessment results more consistent with the actual security status of the operating system. Specifically, data collection tools can be deployed to collect operating system data in real time. Data mining techniques and machine learning algorithms are used to analyze the collected data and identify abnormal data patterns. Based on a pre-established correlation model between abnormal data and security risks, the risk type and impact level corresponding to the abnormality are determined. According to the set correction rules, the preliminary comprehensive risk value is adjusted, such as by increasing the values ​​of relevant risk dimensions. Finally, the revised risk values ​​are summarized and organized to generate a comprehensive security assessment result for the operating system.

[0065] This embodiment fully considers the real-time operating status of the operating system and dynamically adjusts the assessment results, improving the timeliness and accuracy of the assessment and providing users with more reliable information on the operating system's security status. By evaluating the attack surface exposure risk of exposed elements in simulated attack scenarios and adaptively adjusting the security assessment algorithm and algorithm parameters of the defense mechanism, the security assessment is made more accurate. Furthermore, based on this real-time operating data, the preliminary comprehensive risk value is revised, comprehensively considering the mutual influence of multiple aspects, and the final comprehensive security assessment result is more accurate.

[0066] In one embodiment, the exposed elements include system interfaces, services, and accessible resources.

[0067] In one embodiment, based on the attack surface exposure risk result, the security assessment algorithm and algorithm parameters of the operating system defense mechanism are adaptively adjusted, including:

[0068] The attack surface exposure risk results are analyzed hierarchically according to hazard level, attack type, and affected object, and key feature parameters are extracted;

[0069] Selecting a security assessment algorithm for performing a security assessment on the operating system defense mechanism based on a pre-established security assessment algorithm selection rule and the key characteristic parameters;

[0070] For the selected security assessment algorithm, based on the attack surface exposure risk results, a fuzzy control algorithm is used to dynamically adjust the algorithm parameters.

[0071] In this embodiment, the security risk characteristics inherent in different hazard levels, attack types, and affected objects vary. Through layered analysis, key information can be extracted from the complex attack surface exposure risk results. For example, high-hazard attacks often have a significant impact on the core functions of the system; different attack types, such as network attacks and malware attacks, have their own unique behavior patterns; and the consequences and risk propagation paths of affected objects, such as the system kernel and user data, vary. Using data mining and feature extraction techniques, key characteristic parameters that accurately reflect the essence of the risk are extracted from this information at different levels, providing a basis for subsequent algorithm selection and adjustment.

[0072] The degree of harm in the attack surface exposure risk results is graded, such as into three levels: high, medium, and low. Based on common attack methods, the attack types are divided into categories such as DDoS attacks, SQL injection attacks, and ransomware attacks. The affected objects are determined, such as system processes, file systems, network interfaces, etc. Then, for each level, key feature parameters are extracted using methods such as text mining and statistical analysis. At the harm level, parameters such as the probability of risk occurrence and the potential amount of loss are extracted; at the attack type level, the time series characteristics of the attack behavior and the data flow characteristics are extracted; at the affected object level, parameters such as the number of affected objects and the degree of criticality are extracted.

[0073] Pre-built selection rules are based on extensive historical security incident data and research and analysis of the performance of various security assessment algorithms. These rules clearly define the relationship between different key feature parameter combinations and applicable security assessment algorithms. For example, when the attack type is a network attack, the affected target is the network interface, and the risk level is high, an algorithm that focuses on network traffic monitoring and anomaly detection may be more suitable. By matching the extracted key feature parameters with the selection rules, the security assessment algorithm that best suits the current attack surface exposure risk can be quickly and accurately selected. Specifically, a security assessment algorithm selection rule base is established. Each rule in the rule base consists of key feature parameter conditions and a corresponding recommended algorithm. The key feature parameters extracted in the first step are then compared one by one with the rules in the rule base. For example, if the key feature parameters indicate an attack type of SQL injection, a database, and a medium risk level, the rule base is searched for rules that meet these conditions to determine the recommended security assessment algorithm, such as one based on vulnerability scanning and data integrity checking.

[0074] Fuzzy control algorithms are capable of handling uncertainty and fuzzy information. Attack surface exposure risk results are somewhat ambiguous, making them difficult to fully describe with precise numerical values. Through fuzzy control algorithms, various information contained in attack surface exposure risk results, such as the fuzzy description of the hazard level (high, low, etc.) and the complex characteristics of the attack type, are converted into control signals for adjusting algorithm parameters. For example, when the hazard level is "high" and the attack type is "new type of network attack," the fuzzy control algorithm will increase the sensitivity parameter for abnormal traffic detection in the intrusion detection algorithm to better address potential risks.

[0075] In this embodiment, first, the input variables (such as hazard level, attack type related features, etc.) and output variables (i.e., algorithm parameters that need to be adjusted) of the fuzzy control algorithm are determined. The input variables are fuzzified, and the precise key feature parameters are converted into fuzzy language variables, such as converting the precise numerical value of the risk occurrence probability into a fuzzy set of "low probability", "medium probability", and "high probability". According to the pre-established fuzzy control rules, fuzzy reasoning operations are performed to obtain the fuzzy output for adjusting the algorithm parameters. Finally, through defuzzification, the fuzzy output is converted into a specific algorithm parameter adjustment value, and the selected security assessment algorithm parameters are dynamically updated. In this embodiment, the parameters of the security assessment algorithm can be dynamically optimized according to the real-time changing attack surface exposure risk situation, further improving the adaptability and accuracy of the assessment algorithm to complex security risks, thereby more accurately evaluating the effectiveness of the operating system defense mechanism.

[0076] In one embodiment, based on matrix operations, the combined impact of the attack surface exposure risk result and the defense mechanism assessment result on the overall security status of the operating system is quantified to obtain a preliminary comprehensive risk value, including:

[0077] Constructing an attack surface risk matrix based on the attack surface exposure risk results;

[0078] constructing a defense mechanism matrix based on the defense mechanism assessment results;

[0079] Obtaining a correlation matrix from a database, wherein the correlation matrix is ​​used to represent the degree of correlation between attack surface exposure risk and defense mechanism;

[0080] Multiplying the attack surface risk matrix, the correlation matrix, and the defense mechanism matrix in sequence to obtain an intermediate matrix; summing the intermediate matrix row by row to obtain a one-dimensional vector;

[0081] The elements in the one-dimensional vector are normalized and weighted summed to obtain the preliminary comprehensive risk value.

[0082] In this embodiment, the attack surface exposure risk results encompass a variety of risk information, such as the likelihood of a risk occurring and the degree of its impact. This information is constructed into a matrix, with risk types as rows and quantitative indicators such as risk probability and impact as columns. This clearly presents complex attack surface risk situations. This matrix format facilitates subsequent operations with other matrices for comprehensive risk assessment. First, the attack surface exposure risk results are organized and categorized to identify different risk types, such as network attack risk, data leakage risk, and privilege escalation risk. For each risk type, historical data is evaluated to determine its likelihood of occurrence in real-world scenarios. The probability of risk occurrence is quantified, typically ranging from 0 to 1. The degree of impact is graded or numerically quantified, for example, on a scale of 1 to 10, based on the degree of damage to operating system functionality, data integrity, user privacy, and other aspects. Next, the risk types are assigned as rows of the matrix, and the corresponding quantitative values ​​for risk probability and impact are entered into the corresponding columns to construct the attack surface risk matrix.

[0083] Defense mechanism evaluation results include information on the effectiveness of various operating system defense mechanisms, such as the firewall's attack interception success rate and the intrusion detection system's attack detection accuracy. This information is constructed into a matrix with defense mechanism types as rows and quantitative defense effectiveness indicators as columns. This clearly displays the overall status of the defense mechanisms. This matrix format allows for correlation with the attack surface risk matrix to assess the defense mechanisms' ability to address attack surface risks. Existing operating system defense mechanisms, such as firewalls, intrusion detection systems, access control modules, and encryption mechanisms, are reviewed. For each defense mechanism, quantitative indicators of its defense effectiveness are obtained through actual testing, simulated attack verification, or analysis of historical operational data. For example, multiple tests in a simulated attack environment can be conducted to calculate the firewall's interception success rate for specific attack types. The accuracy of the intrusion detection system can be determined by the ratio of correctly detected attacks to the total number of attacks. The defense mechanism matrix is ​​constructed by assigning defense mechanism types to the rows of the matrix and filling the corresponding columns with the corresponding quantitative defense effectiveness values.

[0084] The correlation between different attack surface exposure risks and various defense mechanisms varies. An association matrix is ​​used to describe this relationship. Its element values ​​reflect the closeness between specific risks and defense mechanisms. This matrix is ​​derived through analysis of historical security incidents, summarizing security expert experience, and applying data mining techniques. In matrix operations, this matrix can rationally correlate attack surface risks with defense mechanisms, making the quantification of combined impact more consistent with practical security logic. First, establish a database dedicated to storing association matrix data. Collect a large amount of historical security incident data, including information such as the attack type, the corresponding defense mechanism response, and the final security outcome. Apply data mining algorithms, such as association rule mining, to analyze this data and identify potential correlation patterns between attack surface exposure risks and defense mechanisms. For example, analysis revealed a strong correlation between data leakage risk and encryption and access control mechanisms. Based on this analysis and combined with security experts' weighting of various associations, the value of each element in the association matrix is ​​determined. Element values ​​generally range from 0 (no correlation) to 1 (strong correlation). This association matrix data is stored in the database for easy access when needed.

[0085] Matrix multiplication can integrate information from multiple matrices. In this solution, the attack surface risk matrix, the correlation matrix, and the defense mechanism matrix are multiplied sequentially, mathematically integrating the attack surface risk, the correlation between risk and defense mechanism, and the effectiveness of the defense mechanism. The resulting intermediate matrix is ​​summed row by row to summarize the impact of the risk type represented by each row after considering defense mechanisms and correlations, resulting in a one-dimensional vector that reflects the combined impact of different risk types. Following the rules of matrix multiplication, each row element of the attack surface risk matrix is ​​multiplied and added with the corresponding column element of the correlation matrix to produce a new matrix. This new matrix is ​​then multiplied with the defense mechanism matrix in a similar manner to produce an intermediate matrix. After obtaining the intermediate matrix, the elements of each row are summed to produce a one-dimensional vector. Each element in this vector represents the preliminary impact of a risk type after considering defense mechanisms and correlations.

[0086] Through matrix multiplication and row summation operations, the attack surface risks, defense mechanisms, and the correlation information between them are effectively integrated, and the comprehensive impact of different risk types on the overall security status of the operating system is preliminarily quantified, laying the foundation for the final determination of the preliminary comprehensive risk value. This is a key transition step from raw data to comprehensive assessment results.

[0087] Normalization is performed to eliminate the impact of different value ranges on the final result caused by different elements in the one-dimensional vector, allowing all elements to be compared and calculated on the same scale. Weighted summation takes into account the varying importance of different risk types to the overall security status of the operating system. By assigning different weights, the impact of various risks is more rationally integrated, resulting in a single value that represents the preliminary comprehensive risk value of the overall security status of the operating system. Through normalization and weighted summation, the one-dimensional vector reflecting the combined impact of different risk types obtained in the previous steps is converted into a concise single value, intuitively presenting the preliminary comprehensive security risk level of the operating system under the current attack surface exposure risk and defense mechanism status, providing a key quantitative basis for subsequent further evaluation and decision-making.

[0088] In one embodiment, the preliminary comprehensive risk value is modified based on the real-time operation data, including:

[0089] extracting key safety indicator data from the real-time operation data;

[0090] Determine the correlation value between the key safety indicator data and the safety risk through correlation analysis;

[0091] Based on the preset correction rules, the preliminary comprehensive risk value is adjusted upward or downward using the associated value to obtain a comprehensive safety assessment result.

[0092] In this embodiment, the operating system generates massive amounts of data during real-time operation, and not all of this data is directly related to security. Key security indicator data refers to core data that can directly or indirectly reflect the security status of the system. Through specific data screening and feature extraction techniques, these key indicators can be accurately identified from the complex real-time operation data, providing core data support for subsequent analysis of security risks. For example, basic performance data such as CPU usage, memory utilization, and number of network connections may indicate security threats under abnormal circumstances; security-related data such as the number of failed user logins and sensitive file access records in the system log are even more directly and closely linked to potential security risks.

[0093] Data mining algorithms, such as principal component analysis (PCA) or feature selection algorithms, are used to process the collected data. Taking PCA as an example, it can transform numerous related raw data variables into a small number of unrelated composite variables, known as principal components. These principal components retain most of the original data's information and highlight features closely related to security. By setting appropriate thresholds and filtering conditions, key security indicator data can be extracted from the principal components or other algorithmically processed data. For example, a threshold can be set for CPU usage change over a period of time, or records of multiple consecutive failed logins within a short period of time can be filtered out as key security indicator data. Extracting key security indicator data is the foundation of the entire remediation process. Only by obtaining accurate and representative security-related data can subsequent security risk analysis and revision of the preliminary comprehensive risk value be meaningful, ensuring that the remediation process is based on authentic and valid system operating status information.

[0094] Key security indicator data itself is not directly equivalent to security risks, and correlation analysis is needed to clarify the inherent connection and impact between them. Association rule mining algorithms in machine learning, such as the Apriori algorithm, or statistically based correlation analysis methods are used to analyze key security indicator data and known security risk types and levels. For example, analysis found that when the number of network connections increases sharply in a short period of time, accompanied by a large number of connection requests from a specific IP address segment, there is a high correlation with the risk of network attacks; frequent sensitive file access failure records in system logs may be related to the risk of permission abuse or data leakage. By calculating the closeness of this association, a correlation value is obtained, which can quantify the indicative role of key security indicator data on security risks.

[0095] Specifically, a database containing a large amount of historical security event data and corresponding key security indicator data is established. The currently extracted key security indicator data is combined with the historical data in the database and processed using the selected association analysis algorithm. Taking the Apriori algorithm as an example, it scans the data set to find frequently occurring item sets, that is, combination patterns of key security indicator data. These combination patterns correspond to specific security risk types. By calculating indicators such as confidence and support, the strength of the association between different key security indicator data combinations and security risks is determined, and the association value is obtained. For example, it is calculated that when the CPU usage rate exceeds 80% and the memory occupancy rate exceeds 90%, the association value with the risk of system resource exhaustion is 0.7 (the value range is 0-1, and the larger the value, the stronger the association).

[0096] Determining the correlation value provides a key basis for revising the preliminary comprehensive risk value based on real-time operational data. By clarifying the degree of correlation between key safety indicator data and safety risks, we can accurately judge the changes in safety risks faced by the system under real-time operation, providing quantitative support for the reasonable adjustment of the preliminary comprehensive risk value, and making the revised comprehensive safety assessment results more consistent with the actual safety status of the system.

[0097] Pre-set correction rules are based on historical security incident analysis and industry best practices. These rules clarify how the preliminary comprehensive risk value should be adjusted based on different correlation values. For example, if the correlation value indicates a strong correlation between a key security indicator and a high-risk category, the correction rules will require an increase in the preliminary comprehensive risk value to reflect the higher security risk currently facing the system. Conversely, if the correlation value indicates a correlation with low risk or normal operating conditions, the preliminary comprehensive risk value may be adjusted downward. In this way, changes in security risks reflected by real-time operational data are incorporated into the preliminary comprehensive risk value, resulting in a more accurate comprehensive security assessment.

[0098] Specifically, a correction rule library is constructed. Each rule in the library consists of a correlation value range, a corresponding security risk type, and a specific method for adjusting the preliminary comprehensive risk value. For example, a rule stipulates that when the correlation value with cyber attack risk is greater than 0.6, the value of the cyber attack risk dimension in the preliminary comprehensive risk value is adjusted upward by 30%; when the correlation value with normal operation is greater than 0.8, the preliminary comprehensive risk value is adjusted downward by 10%. The correlation value obtained in the previous step is matched with the rules in the correction rule library to find the corresponding adjustment rule. Based on the rule, the preliminary comprehensive risk value is adjusted upward or downward accordingly. Finally, the adjusted values ​​of each risk dimension are aggregated to obtain the comprehensive security assessment result. For example, the preliminary comprehensive risk value is obtained by taking the weighted sum of the values ​​of multiple dimensions such as cyber attack risk, data leakage risk, and privilege abuse risk. After adjusting the values ​​of each dimension according to the rule, the weighted sum is re-calculated to obtain the final comprehensive security assessment result. By combining preset correction rules with associated values, dynamic adjustment of the preliminary comprehensive risk value is achieved, so that the comprehensive security assessment results can reflect the current security status of the operating system in real time, provide users with timely and accurate system security information, and help to take targeted security protection measures.

[0099] In one embodiment, after generating the comprehensive security assessment result of the operating system, the following steps are included:

[0100] Obtaining the identification number and security test code of the operating system; adding the identification number and security test code to the matrix one by one in sequence to generate a sequence matrix;

[0101] generating a simulation graphic based on the type of the operating system;

[0102] Changing the sequence matrix based on the simulation graph to obtain a changed matrix;

[0103] Based on the change matrix, a storage key is generated, and the comprehensive security assessment result of the operating system is encrypted and stored.

[0104] In this embodiment, the operating system's identification number uniquely identifies it within a specific system environment or management system, used to accurately identify and distinguish different operating system instances. The security test code records information such as the type, version, or specific test batch of the security test the operating system has undergone. These two codes are sequentially added to the matrix to construct a sequence matrix, providing the basic data structure for subsequent operations based on operating system characteristics. As an orderly data organization, the matrix facilitates the unified management and calculation of this key information, while also enabling data association with subsequent simulation graphics and modification operations.

[0105] Different operating systems, such as Windows, Linux, and macOS, each have their own unique architecture, functional module distribution, and operational logic. Using graph generation technology, we construct corresponding simulation graphs based on the characteristic information corresponding to the operating system type. These graphs can intuitively reflect the operating system's structural characteristics, the relationships between key components, and the distribution areas of potential security risks. For example, for Windows systems, the graphs highlight key security components such as the registry and user account control, and their interrelationships; while for Linux systems, the graphs may focus on modules such as file system permission management and process scheduling. Through simulation graphs, abstract operating system types are converted into visual, analyzable graphical data, facilitating subsequent interaction with the sequence matrix.

[0106] Specifically, a mapping database of operating system types and graphic templates is established, in which each operating system type corresponds to one or more pre-designed graphic template frameworks. The template defines the correspondence between various graphic elements (such as nodes, lines, areas, etc.) and operating system components or features. After the operating system type is obtained, the corresponding graphic template is retrieved from the database. According to the specific configuration information of the operating system, the list of installed software and other detailed data, the graphic template is instantiated, filled and adjusted. For example, if it is detected that a specific firewall software is installed on the Linux system, the firewall component is highlighted at the corresponding position in the graphic, and the attributes of the graphic elements (such as color, size, etc. to indicate its protection strength) are adjusted according to its configuration parameters, and finally a complete simulation graphic is generated.

[0107] The simulation graph contains the operating system's structure, component relationships, and security-related information. This information is potentially linked to the identification numbers and security test codes in the sequence matrix. Through preset change rules, the operating system characteristics reflected by the simulation graph are converted into change instructions for the sequence matrix. For example, if the simulation graph shows that the operating system has a critical security vulnerability, the corresponding change rule may require specific marking or modification of the relevant part of the security test code in the sequence matrix to record the vulnerability information. In this way, the graphical information is integrated with the matrix data to obtain a change matrix that can more comprehensively reflect the security status of the operating system.

[0108] Specifically, a detailed set of change rules is developed. These rules define operations such as adding, deleting, modifying, or rearranging elements in the sequence matrix based on information such as the status, positional relationships, and security risk identification of different graphical elements in the simulation graph. The generated simulation graph is analyzed to identify key elements and features within the graph, such as the presence or absence of specific security components and the identification of risk areas. Based on the identification results, the corresponding rule is searched within the change rule set and the sequence matrix is ​​manipulated accordingly. For example, if a high-risk area identified in the simulation graph is associated with a specific security test, the rule specifies that a code representing the risk level be inserted at the position corresponding to the security test code in the sequence matrix. After a series of such operations, a change matrix is ​​generated. The change matrix integrates the operating system's identification, test information, and security status information reflected by the simulation graph generated based on its type. This provides a richer and more accurate data foundation for generating storage keys. This allows encrypted storage keys to be closely aligned with the actual security status of the operating system, enhancing the targeted nature and security of the encryption.

[0109] The change matrix contains critical information related to the operating system's identity, testing, and security status. This information is converted into an encryption key using an encryption algorithm. The encryption algorithm generates a unique and complex key by performing specific mathematical operations and transformations on the matrix data. This key is used to encrypt and store the comprehensive security assessment results of the operating system, ensuring the confidentiality and integrity of the results during storage and preventing unauthorized access and tampering.

[0110] This securely stores the comprehensive operating system security assessment results, protecting their confidentiality and integrity. The keys generated based on the change matrix are tightly integrated with the operating system's inherent security features, making the encrypted assessment results even more difficult to decrypt. This provides reliable protection for the long-term storage and use of operating system security assessment data, enhancing the security and practicality of the entire security assessment system.

[0111] In one embodiment, generating a storage key based on the change matrix includes:

[0112] Obtain a preset mapping table; the preset mapping table includes a one-to-one mapping relationship between original data and mapped data;

[0113] Based on the simulation graph, performing mutation processing on the mapping data of the preset mapping table to obtain a mutated mapping table;

[0114] Acquiring attribute information of the variation mapping table, and selecting a target matrix element from the change matrix based on the attribute information;

[0115] The target matrix elements are mapped based on the variation mapping table, and the mapping results are sequentially combined to obtain the storage key.

[0116] In this embodiment, the preset mapping table is a pre-built data structure whose core function is to establish a deterministic association between original data and mapped data. This association provides the foundational rules for subsequent data transformation and key generation. Original data can be various data units with specific meanings or characteristics, such as numbers, characters, or specific codes, while mapped data is the transformed data corresponding to the specific design purpose. Through this mapping relationship, the original, relatively conventional data form can be converted into a more secure and complex data representation.

[0117] By using simulation graphics to mutate the mapping data of a preset mapping table, the generated key can be closely integrated with the actual security status of the operating system. The mutation process can modify, replace, rearrange, and perform other operations on the mapping data based on the graphic rules, attributes, shapes, etc. in the simulation graphics. In this way, the generated mutated mapping table no longer relies solely on preset fixed rules, but incorporates the real-time security features of the operating system, making the ultimately generated storage key more targeted and secure. For example, all the mapping data in the preset mapping table can be sequentially superimposed on the edge of the simulation graphic, and through the key positions of the simulation graphic, the mapping data at the key positions can be arranged to the front row of the mapping data in the preset mapping table, thereby sequentially realizing the formation of the mutated mapping table. There are many ways to mutate, which will not be described in detail here.

[0118] The mutation mapping table is a key step in integrating the security features of the operating system into the key generation process. By mutating the preset mapping table, the generated storage key is no longer a simple transformation based on fixed rules, but is closely integrated with the real-time security status of the operating system. This greatly enhances the security and relevance of the key, making the encrypted operating system's comprehensive security assessment results even more difficult to crack, and improving the protection capabilities of the entire security assessment system.

[0119] The mutation mapping table has specific attribute information, which may include the type, length, distribution pattern, etc. of the mapping data. The change matrix contains key information related to the identity, testing, and security status of the operating system. By analyzing the attribute information of the mutation mapping table, it is possible to determine the change matrix elements that match or are associated with these attributes, that is, the target matrix elements. For example, if some mapping data in the mutation mapping table is related to a specific security testing link of the operating system, then the matrix elements corresponding to the security test code can be filtered out from the change matrix based on this attribute. This element selection method based on attribute matching ensures that the data extracted from the change matrix has an intrinsic connection with the mutation mapping table, providing a suitable data foundation for subsequent mapping operations based on the mutation mapping table.

[0120] Establish an attribute-matrix element association rule base that defines the correspondence between different attribute information and change matrix elements. For example, it is stipulated that when the type of a certain mapping data in the mutation mapping table is related to the network security of the operating system, the matrix element corresponding to the network security risk dimension is selected from the change matrix. The extracted attribute information of the mutation mapping table is matched with the rules in the association rule base, and the target matrix element is selected from the change matrix based on the matching results. For example, if the attribute analysis shows that a group of mapping data in the mutation mapping table is related to a specific security test version, the matrix element corresponding to the security test code is filtered out from the change matrix according to the rules.

[0121] Selecting target matrix elements is a crucial step in effectively associating the mutation mapping table with the change matrix. This attribute-based selection ensures the rationality and effectiveness of subsequent matrix element mapping operations based on the mutation mapping table. This allows the generated storage key to fully utilize information in the change matrix that is closely related to operating system security, further enhancing the key's compatibility with the operating system's security posture and improving encryption reliability.

[0122] The mutation mapping table provides specific mapping rules for transforming the target matrix elements. Transforming the target matrix elements according to the mapping relationships in the mutation mapping table converts the operating system's security-related information into confidential and complex key data. By sequentially combining the mapping results, multiple transformed elements are concatenated into a complete key sequence. This combination ensures that the key not only contains the critical information from the mutation matrix but also increases its unpredictability and security through the mapping rules of the mutation mapping table. This step is the final step in converting the operating system's security-related information into a storage key. Through the combination of the mapping and results based on the mutation mapping table, a highly confidential and targeted storage key is generated. This key effectively encrypts and stores the comprehensive security assessment results of the operating system, protecting the confidentiality and integrity of the assessment results.

[0123] In one embodiment, generating a storage key based on the change matrix includes:

[0124] Superimposing the change matrix and the simulation graph according to a rule, obtaining each matrix element located in the simulation graph in the change matrix, and reconstructing the matrix into a deformation matrix;

[0125] Obtaining properties of the change matrix and properties of the deformation matrix;

[0126] The storage key is generated based on the properties of the change matrix and the properties of the deformation matrix.

[0127] In this embodiment, a set of superposition rules for the change matrix and the simulation graph is pre-established. For example, it is stipulated that each node in the simulation graph corresponds to an element at the intersection of specific rows and columns in the change matrix, or that a certain area of ​​the simulation graph corresponds to a certain continuous sub-matrix in the change matrix. The change matrix is ​​presented in the form of a two-dimensional table, and the simulation graph is displayed in a graphical interface. According to the superposition rules, the matrix elements within the range covered by the simulation graph are identified in the change matrix. Assume that there is a circular area in the simulation graph representing the network security component of the operating system. According to the rules, the circular area corresponds to the elements within a specific row and column range in the change matrix, and these elements are extracted. Using the extracted elements, they are rearranged in a certain order to construct a deformation matrix, such as maintaining the relative row and column order of the elements in the original change matrix, and forming them into a new matrix structure.

[0128] For the change matrix, the matrix structure is scanned and the number of rows and columns is counted to determine its size. The data format of the matrix elements is analyzed to determine the element data type. Statistical methods are used to calculate the distribution range, mean, and variance of the element values ​​to determine the element distribution pattern. Based on the correspondence between the matrix construction process and the operating system security risk dimensions, its relationship with various security risks is clarified. For the deformation matrix, the ratio of the number of deformation matrix elements to the number of change matrix elements is calculated to determine the element selection ratio. Graph theory or association analysis algorithms are used to analyze the connection relationship between the deformation matrix elements to determine the degree of association. The security characteristics represented by the deformation matrix elements are classified and counted to determine the concentration of their security characteristics. The extracted attribute information of the change matrix and deformation matrix is ​​organized and stored for subsequent use.

[0129] The extracted change matrix attributes and deformation matrix attributes are preprocessed according to the algorithm's requirements, such as converting the attribute data into a specific data format and encoding method. This preprocessed attribute data is then fed into the key generation module, and the algorithm is run to generate a storage key. For example, a custom hash algorithm is used to hash attribute values ​​such as the variance of the change matrix's element distribution, its correlation with cybersecurity risk, and the closeness of correlation between the elements of the deformation matrix. This generates a fixed-length hash value that serves as the storage key. The generated storage key is then verified and tested to ensure that it meets encryption requirements and security standards. This step transforms the operating system's security-related matrix attributes into a storage key. The generated storage key effectively encrypts and stores the comprehensive operating system security assessment results. Because key generation is based on comprehensive and critical security information attributes of the operating system, it greatly enhances the security and reliability of encryption, provides a core guarantee for the long-term secure storage of operating system security assessment data, and improves the security protection design of the entire security assessment system.

[0130] In one embodiment, the sequence matrix is ​​changed based on the simulation graph to obtain a changed matrix, including:

[0131] Adding the simulation graphic to the sequence matrix, and constructing a plurality of closed sub-graphics based on the simulation graphic in the sequence matrix;

[0132] In the sequence matrix, the matrix elements located within the closed subgraph are exchanged with the matrix elements located outside the closed subgraph one by one in sequence until all the matrix elements located within the closed subgraph are exchanged, or all the matrix elements located outside the closed subgraph are exchanged, to obtain the changed matrix.

[0133] In this embodiment, the simulation graphic is associated with the sequence matrix in a graphic format (such as a bitmap, vector graphic, etc.). This can be achieved by adding a pointer to the storage location of the simulation graphic in the data structure of the sequence matrix, or by directly embedding the key feature data of the simulation graphic into a specific metadata portion of the sequence matrix. Using a graphic recognition and segmentation algorithm, based on the shape, lines, and other features of the simulation graphic, the area corresponding to the simulation graphic is identified in the sequence matrix, and a closed sub-graphic is constructed based on the area. For example, a boundary detection algorithm is used to determine the boundary range of the simulation graphic in the sequence matrix, and then a polygonal closed sub-graphic surrounding the range is constructed. Based on the complexity of the simulation graphic and the division requirements of the security characteristics, multiple closed sub-graphics of different shapes and ranges can be constructed, each sub-graphic corresponding to a specific security-related part of the operating system.

[0134] In the sequence matrix, the matrix elements located within the closed subgraph are exchanged with the matrix elements located outside the closed subgraph one by one in sequence until all the matrix elements located within the closed subgraph are exchanged, or all the matrix elements located outside the closed subgraph are exchanged, to obtain the change matrix; the change matrix generated in this way not only contains the identification and test information of the operating system, but also incorporates changes in the element arrangement based on security characteristics, providing a richer and more security-related data foundation for the subsequent generation of storage keys.

[0135] Specifically, determine the matrix elements inside and outside the closed subgraph. Elements inside and outside the closed subgraph boundary can be identified using matrix indices or coordinate systems. For example, for a two-dimensional sequence matrix, if the closed subgraph is defined by a set of coordinate ranges, traverse the matrix elements and determine whether they are inside the closed subgraph based on the element's coordinates. Set a swapping order, such as starting with the upper-left corner element of the closed subgraph and swapping them with elements outside the subgraph in sequence. A random swapping order can also be used, but the repeatability of the swapping process must be ensured for subsequent verification and analysis. Start the swapping operation by swapping an element inside the closed subgraph with an element outside the subgraph, and record the matrix state after the swap. Continue the swapping operation until a stopping condition is met, meaning all elements inside the closed subgraph have been swapped, or all elements outside the closed subgraph have been swapped. The resulting matrix is ​​the modified matrix, which is stored and processed later. The element swapping process transforms the sequence matrix into a modified matrix, and the resulting modified matrix incorporates information related to the security features of the operating system. This matrix change method based on security features provides a unique data structure for the subsequent generation of storage keys, enabling key generation to be closely integrated with the security status of the operating system, enhancing the pertinence and security of encryption, and improving the technical process of encrypted storage of the entire operating system security assessment results.

[0136] In one embodiment, the sequence matrix is ​​changed based on the simulation graph to obtain a changed matrix, including:

[0137] Adding each matrix element in the sequence matrix to each node in a preset directed graph template to generate an element directed graph; wherein each node is connected by a directed edge;

[0138] superimposing the simulation graph on the element directed graph, and obtaining a directed edge located in the simulation graph in the element directed graph as a target edge;

[0139] The direction of each target edge is converted to obtain a converted directed graph; the elements on each node are sorted according to the direction order of the directed edges in the converted directed graph to obtain an element sort;

[0140] The elements in the element sorting are sequentially replaced into the sequence matrix to obtain the change matrix.

[0141] In this embodiment, first, a preset directed graph template is obtained. The template should have a sufficient number of nodes and directed edges to accommodate all elements in the sequence matrix. The structure and connection method of the nodes and directed edges in the template can be designed according to specific needs and algorithms. For example, the directed graph can be a simple chain structure, a tree structure, or a more complex network structure. Then, each element in the sequence matrix is ​​traversed and each element is added to a node of the directed graph in sequence (such as the row-first or column-first order of the matrix). During the process of adding elements, the directed edge connection relationship between the nodes in the directed graph remains unchanged. Ultimately, an element directed graph containing the sequence matrix elements is generated, in which each node corresponds to an element in the matrix, and the directed edges between the nodes represent certain relationships between the elements. Generating an element directed graph is an important step in the graphical conversion of sequence matrix data. It provides a new structural foundation for subsequent operations on matrix elements based on simulation graphs. Through the form of a directed graph, the relationship between matrix elements can be more intuitively observed and processed, making matrix modification operations more flexible and diverse. It also lays the foundation for subsequent integration with simulation graphs and generation of modification matrices.

[0142] The simulation graph is superimposed on the element graph, aligning them spatially. Next, all directed edges in the element graph are traversed, determining whether both endpoints of each directed edge lie within the simulation graph. If both endpoints of a directed edge lie within the simulation graph, the edge is marked as a target edge. Graph processing algorithms and coordinate calculations can be used to accurately determine the positional relationship between the directed edges and the simulation graph. Ultimately, a set of target edges within the simulation graph is obtained, which serve as the focus of subsequent operations.

[0143] Transforming the direction of the target edge changes the relationship and order between elements, thereby creating a new possible element arrangement. The order of directed edges determines the access order between nodes. By sorting the elements on the nodes according to the transformed directed edge order, a new element arrangement based on the security characteristics of the operating system can be obtained. This new arrangement reflects the matrix element order after considering the changes in the relationship between security-related components or characteristics of the operating system, providing a new element order basis for the subsequent generation of the change matrix.

[0144] For each target edge, its direction is reversed, that is, the directed edge originally pointing from node A to node B is changed to point from node B to node A. After completing the direction conversion of all target edges, a conversion directed graph is obtained. Then, starting from a starting node of the conversion directed graph (the starting node can be selected according to specific needs, such as selecting the node corresponding to the key security component of the operating system), each node is visited in turn according to the pointing order of the directed edges, and the elements on the nodes are recorded to form an element sequence. During the access process, ensure that the directed edges are followed in order to avoid missing or repeating the access to the nodes. Finally, an element sorting is obtained according to the pointing order in the conversion directed graph.

[0145] Substituting sorted elements into the original sequence matrix sequentially is the process of applying a new arrangement of elements derived based on the security characteristics of the operating system. This substitution operation changes the order of elements in the original sequence matrix, forming a new matrix, the modified matrix. The element order in the modified matrix not only incorporates the operating system's identification and testing information but also incorporates changes in element arrangement related to the operating system's security characteristics, derived through simulation graph and directed graph operations. This allows the modified matrix to more comprehensively reflect the operating system's security status. During the substitution process, the matrix structure remains unchanged; only the element content is modified. After all elements have been replaced, the modified matrix is ​​obtained. The modified matrix is ​​stored and subsequently processed for operations such as generating storage keys.

[0146] The generated change matrix is ​​the final result of the entire simulation graph-based sequence matrix modification operation. The change matrix contains the processed matrix element order, which is closely related to the simulation graph. It provides the critical data foundation for the subsequent generation of storage keys, making the generated storage keys more unique and secure, thereby improving the security and reliability of encryption.

[0147] Reference Figure 2 In another embodiment of the present invention, an operating system security assessment device based on an attack-fault tree is provided, comprising the following steps:

[0148] A first evaluation unit is configured to evaluate, for an operating system based on an attack-fault tree, an attack surface exposure risk result of an exposed element under a simulated attack scenario;

[0149] an adjustment unit, configured to adaptively adjust the security assessment algorithm and algorithm parameters of the operating system defense mechanism based on the attack surface exposure risk result;

[0150] a second evaluation unit, configured to evaluate the defense mechanism of the operating system based on the adaptively adjusted security evaluation algorithm and algorithm parameters, and obtain a defense mechanism evaluation result;

[0151] a quantification unit, configured to quantify, based on matrix operations, the comprehensive impact of the attack surface exposure risk result and the defense mechanism assessment result on the overall security status of the operating system, and obtain a preliminary comprehensive risk value;

[0152] The comprehensive evaluation unit is used to obtain real-time operation data of the operating system, and based on the real-time operation data, to correct the preliminary comprehensive risk value to generate a comprehensive security evaluation result of the operating system.

[0153] In this embodiment, for the specific implementation of each unit in the above device embodiment, please refer to the above method embodiment, which will not be repeated here.

[0154] Reference Figure 3 In an embodiment of the present invention, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 3 As shown. The computer device includes a processor, memory, display screen, input device, network interface and database connected via a system bus. The processor of the computer design is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store the corresponding data in this embodiment. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above method is implemented.

[0155] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0156] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which implements the above-described method when executed by a processor. It is understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0157] In summary, an attack-fault tree-based operating system security assessment method provided in an embodiment of the present invention includes: evaluating the attack surface exposure risk results of exposed elements in a simulated attack scenario for an operating system based on an attack-fault tree; adaptively adjusting the security assessment algorithm and algorithm parameters of the operating system defense mechanism based on the attack surface exposure risk results; evaluating the operating system defense mechanism based on the adaptively adjusted security assessment algorithm and algorithm parameters to obtain a defense mechanism assessment result; quantifying the comprehensive impact of the attack surface exposure risk results and the defense mechanism assessment results on the overall security status of the operating system based on matrix operations to obtain a preliminary comprehensive risk value; obtaining real-time operating data of the operating system, and based on the real-time operating data, correcting the preliminary comprehensive risk value to generate a comprehensive security assessment result of the operating system. In the present invention, by evaluating the attack surface exposure risk results of exposed elements in a simulated attack scenario and adaptively adjusting the security assessment algorithm and algorithm parameters of the defense mechanism, the security assessment is made more accurate; at the same time, the preliminary comprehensive risk value is corrected based on the real-time operating data, and the mutual influence of multiple aspects is comprehensively considered, so that the final comprehensive security assessment result is more accurate.

[0158] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-described method embodiments. Among them, any reference to memory, storage, database, or other media provided by the present invention and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAM bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM.

[0159] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, apparatus, article, or method comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, apparatus, article, or method. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, apparatus, article, or method comprising the element.

[0160] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An operating system security assessment method based on attack-fault tree, characterized in that: The following steps are involved: For operating systems based on attack-fault trees, evaluate the attack surface exposure risk results of exposed elements under simulated attack scenarios; Based on the attack surface exposure risk result, adaptively adjust the security assessment algorithm and algorithm parameters of the operating system defense mechanism; Based on the adaptively adjusted security assessment algorithm and algorithm parameters, the defense mechanism of the operating system is evaluated to obtain a defense mechanism evaluation result; Based on matrix operations, quantify the comprehensive impact of the attack surface exposure risk results and the defense mechanism assessment results on the overall security status of the operating system to obtain a preliminary comprehensive risk value; Real-time operating data of the operating system is obtained, and based on the real-time operating data, the preliminary comprehensive risk value is corrected to generate a comprehensive security assessment result of the operating system.

2. The operating system security assessment method based on attack-fault tree according to claim 1 is characterized in that: The exposed elements include system interfaces, services, and accessible resources.

3. The operating system security assessment method based on attack-fault tree according to claim 1, characterized in that: Based on the attack surface exposure risk result, adaptively adjust the security assessment algorithm and algorithm parameters of the operating system defense mechanism, including: The attack surface exposure risk results are analyzed hierarchically according to hazard level, attack type, and affected object, and key feature parameters are extracted; Selecting a security assessment algorithm for performing a security assessment on the operating system defense mechanism based on a pre-established security assessment algorithm selection rule and the key characteristic parameters; For the selected security assessment algorithm, based on the attack surface exposure risk results, a fuzzy control algorithm is used to dynamically adjust the algorithm parameters.

4. The operating system security assessment method based on attack-fault tree according to claim 1, characterized in that: Based on matrix operations, the combined impact of the attack surface exposure risk results and the defense mechanism assessment results on the overall security status of the operating system is quantified to obtain a preliminary comprehensive risk value, including: Constructing an attack surface risk matrix based on the attack surface exposure risk results; constructing a defense mechanism matrix based on the defense mechanism assessment results; Obtaining a correlation matrix from a database, wherein the correlation matrix is ​​used to represent the degree of correlation between attack surface exposure risk and defense mechanism; Multiplying the attack surface risk matrix, the correlation matrix, and the defense mechanism matrix in sequence to obtain an intermediate matrix; summing the intermediate matrix row by row to obtain a one-dimensional vector; The elements in the one-dimensional vector are normalized and weighted summed to obtain the preliminary comprehensive risk value.

5. The operating system security assessment method based on attack-fault tree according to claim 1, characterized in that: After generating the comprehensive security assessment results of the operating system, including: Obtaining the identification number and security test code of the operating system; adding the identification number and security test code to the matrix one by one in sequence to generate a sequence matrix; generating a simulation graphic based on the type of the operating system; Changing the sequence matrix based on the simulation graph to obtain a changed matrix; Based on the change matrix, a storage key is generated, and the comprehensive security assessment result of the operating system is encrypted and stored.

6. The operating system security assessment method based on attack-fault tree according to claim 5, characterized in that: The step of generating a storage key based on the change matrix includes: Obtain a preset mapping table; the preset mapping table includes a one-to-one mapping relationship between original data and mapped data; Based on the simulation graph, performing mutation processing on the mapping data of the preset mapping table to obtain a mutated mapping table; Acquiring attribute information of the variation mapping table, and selecting a target matrix element from the change matrix based on the attribute information; The target matrix elements are mapped based on the variation mapping table, and the mapping results are sequentially combined to obtain the storage key.

7. The operating system security assessment method based on attack-fault tree according to claim 5, characterized in that: Changing the sequence matrix based on the simulation graph to obtain a changed matrix includes: Adding the simulation graphic to the sequence matrix, and constructing a plurality of closed sub-graphics based on the simulation graphic in the sequence matrix; In the sequence matrix, the matrix elements located within the closed subgraph are exchanged with the matrix elements located outside the closed subgraph one by one in sequence until all the matrix elements located within the closed subgraph are exchanged, or all the matrix elements located outside the closed subgraph are exchanged, to obtain the changed matrix.

Images