An operating system security evaluation method based on attack-fault tree

Abstract

The application relates to an attack-fault tree-based operating system security evaluation method, which comprises the following steps: for an attack-fault tree-based operating system, evaluating an attack surface exposure risk result of an exposed element under a simulated attack scene; based on the attack surface exposure risk result, adaptively adjusting a security evaluation algorithm and algorithm parameters of an operating system defense mechanism; based on the adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating the defense mechanism of the operating system to obtain a defense mechanism evaluation result; based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; acquiring real-time running data of the operating system, correcting the preliminary comprehensive risk value, and generating a comprehensive security evaluation result of the operating system. In the application, the mutual influences of multiple aspects are comprehensively considered, so that the final comprehensive security evaluation result is more accurate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to an operating system security evaluation method based on attack-fault tree. BACKGROUND

[0002] At present, operating systems are facing an endless stream of security threats, such as increasingly complex and diverse network attack methods, and events of stealing sensitive data and destroying normal operation of the system by exploiting system vulnerabilities are common.

[0003] Traditional operating system security evaluation methods focus on static vulnerability scanning and can only find known security risks, making it difficult to cope with dynamic attack scenarios. For attack surface exposure risk evaluation, there is a lack of comprehensiveness and accuracy, and it is difficult to effectively identify deeply hidden exposure elements and their risk levels.

[0004] In terms of defense mechanism evaluation, algorithms and parameters are often fixed and cannot be adaptively adjusted according to real-time risk conditions, resulting in lagging evaluation results and difficulty in reflecting the actual defense effectiveness of the operating system.

[0005] Therefore, the evaluation results of the current operating system security evaluation method have the defect of being not accurate enough. SUMMARY

[0006] The main purpose of the present application is to provide an operating system security evaluation method based on attack-fault tree, which aims to overcome the defect that the evaluation results of the current operating system security evaluation are not accurate enough.

[0007] To achieve the above-mentioned purpose, the present application provides an operating system security evaluation method based on attack-fault tree, comprising the following steps:

[0008] For an operating system based on attack-fault tree, evaluate the attack surface exposure risk results of the exposure elements under simulated attack scenarios;

[0009] Based on the attack surface exposure risk results, adaptively adjust the security evaluation algorithm and algorithm parameters of the operating system defense mechanism;

[0010] Based on the adaptively adjusted security evaluation algorithm and algorithm parameters, evaluate the defense mechanism of the operating system to obtain a defense mechanism evaluation result;

[0011] Based on matrix operation, quantize the comprehensive influence of the attack surface exposure risk results and the defense mechanism evaluation results on the overall security state of the operating system to obtain a preliminary comprehensive risk value;

[0012] Obtaining real-time running data of the operating system, and correcting the preliminary comprehensive risk value based on the real-time running data to generate a comprehensive security evaluation result of the operating system.

[0013] Further, the exposed elements include system interfaces, services, and accessible resources.

[0014] Further, based on the attack surface exposure risk result, the security evaluation algorithm and algorithm parameters of the operating system defense mechanism are adaptively adjusted, including:

[0015] The attack surface exposure risk result is hierarchically analyzed according to the damage level, attack type, and influence object, and key feature parameters are extracted;

[0016] Based on the selection rules of the pre-constructed security evaluation algorithm and the key feature parameters, a security evaluation algorithm for security evaluation of the operating system defense mechanism is selected;

[0017] For the selected security evaluation algorithm, based on the attack surface exposure risk result, a fuzzy control algorithm is used to dynamically adjust the algorithm parameters.

[0018] Further, based on matrix operation, the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system is quantified to obtain a preliminary comprehensive risk value, including:

[0019] Based on the attack surface exposure risk result, an attack surface risk matrix is constructed;

[0020] Based on the defense mechanism evaluation result, a defense mechanism matrix is constructed;

[0021] An association matrix in the database is obtained, which is used to represent the association closeness between attack surface exposure risk and defense mechanism;

[0022] The attack surface risk matrix, the association matrix, and the defense mechanism matrix are multiplied in turn to obtain an intermediate matrix; the intermediate matrix is summed by row to obtain a one-dimensional vector;

[0023] The elements in the one-dimensional vector are normalized and weighted summed to obtain the preliminary comprehensive risk value.

[0024] Further, based on the real-time running data, the preliminary comprehensive risk value is corrected, including:

[0025] Key security indicator data is extracted from the real-time running data;

[0026] Through correlation analysis, the correlation value of the key security indicator data and the security risk is determined;

[0027] Based on the preset correction rule, the preliminary comprehensive risk value is adjusted up or down by using the correlation value, and a comprehensive safety evaluation result is obtained.

[0028] Further, after generating the comprehensive safety evaluation result of the operating system, the method further comprises:

[0029] An identification number and a safety test code of the operating system are obtained, and the identification number and the safety test code are sequentially added to the matrix one by one to generate a sequence matrix.

[0030] An analog graph is generated based on the type of the operating system.

[0031] The sequence matrix is changed based on the analog graph to obtain a changed matrix.

[0032] Based on the changed matrix, a storage key is generated to encrypt and store the comprehensive safety evaluation result of the operating system.

[0033] Further, the generating of the storage key based on the changed matrix comprises:

[0034] A preset mapping table is obtained, and the preset mapping table comprises a one-to-one mapping relationship between original data and mapping data.

[0035] The mapping data of the preset mapping table is processed based on the analog graph to obtain a variation mapping table.

[0036] Attribute information of the variation mapping table is obtained, and a target matrix element is selected from the changed matrix based on the attribute information.

[0037] The target matrix element is mapped based on the variation mapping table, and the mapping result is combined in sequence to obtain the storage key.

[0038] Further, the generating of the storage key based on the changed matrix comprises:

[0039] The changed matrix and the analog graph are superimposed according to a rule, each matrix element in the analog graph is obtained in the changed matrix, and a deformed matrix is reconstructed.

[0040] The attribute of the changed matrix and the attribute of the deformed matrix are obtained.

[0041] The storage key is generated based on the attribute of the changed matrix and the attribute of the deformed matrix.

[0042] Further, the changing of the sequence matrix based on the analog graph to obtain the changed matrix comprises:

[0043] adding the simulation graph into the sequence matrix, and constructing a plurality of closed sub-graphs based on the simulation graph in the sequence matrix;

[0044] In the sequence matrix, the matrix elements located in the closed sub-graphs and the matrix elements located outside the closed sub-graphs are exchanged one by one in sequence until all the matrix elements located in the closed sub-graphs are exchanged or all the matrix elements located outside the closed sub-graphs are exchanged, and the changed matrix is obtained.

[0045] The application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method according to any one of the preceding embodiments when executing the computer program.

[0046] The application further provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the method according to any one of the preceding embodiments when executed by a processor.

[0047] The application provides an operating system security evaluation method based on attack-fault tree, comprising: for an operating system based on attack-fault tree, evaluating an attack surface exposure risk result of an exposed element under a simulated attack scenario; based on the attack surface exposure risk result, adaptively adjusting a security evaluation algorithm and algorithm parameters of a defense mechanism of the operating system; based on the adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating the defense mechanism of the operating system to obtain a defense mechanism evaluation result; based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; obtaining real-time running data of the operating system, and based on the real-time running data, correcting the preliminary comprehensive risk value to generate a comprehensive security evaluation result of the operating system. In the application, the attack surface exposure risk result of the exposed element under the simulated attack scenario is evaluated, and the security evaluation algorithm and algorithm parameters of the defense mechanism are adaptively adjusted, so that the security evaluation is more accurate; at the same time, based on the real-time running data, the preliminary comprehensive risk value is corrected, and the mutual influence of multiple aspects is comprehensively considered, so that the final comprehensive security evaluation result is more accurate. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 is a step schematic diagram of the operating system security evaluation method based on attack-fault tree in an embodiment of the application;

[0049] Figure 2 is a structure block diagram of the operating system security evaluation device based on attack-fault tree in an embodiment of the application;

[0050] Figure 3 is a structural schematic block diagram of a computer device according to an embodiment of the present application.

[0051] The implementation, functional features and advantages of the present application will be further described with reference to the accompanying drawings in conjunction with embodiments. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0053] With reference to Figure 1 , an attack-fault tree based operating system security evaluation method is provided in an embodiment of the present application, including the following steps:

[0054] Step S1, for an operating system based on an attack-fault tree, evaluating the attack surface exposure risk result of exposed elements under simulated attack scenarios;

[0055] Step S2, based on the attack surface exposure risk result, adaptively adjusting the security evaluation algorithm and algorithm parameters of the defense mechanism of the operating system;

[0056] Step S3, based on the adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating the defense mechanism of the operating system to obtain a defense mechanism evaluation result;

[0057] Step S4, based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value;

[0058] Step S5, obtaining real-time running data of the operating system, and based on the real-time running data, correcting the preliminary comprehensive risk value to generate a comprehensive security evaluation result of the operating system.

[0059] In the present embodiment, as described above in step S1, first, an operating system based on an attack-fault tree model is constructed, attacks faced by the operating system are decomposed into various sub-events, and logical relationships between them are analyzed. By simulating various attack scenarios in a real environment, including common network attacks, malicious software intrusion, etc., for exposed elements in the operating system, such as open ports, executable file vulnerability points, etc., a risk evaluation algorithm is used to calculate the possibility of these exposed elements being attacked and the severity of the consequences once attacked.

[0060] First, use security testing tools and simulation software to reproduce various attack scenarios in a virtual environment, and conduct comprehensive attack testing on the operating system. During the testing process, the state changes of the exposed elements are monitored in real time, and relevant data are recorded. Finally, the monitoring data are input into the pre-set risk assessment model, and the attack surface exposure risk results are obtained.

[0061] As described in step S2 above, according to the attack surface exposure risk results obtained in step S1, the influence of different types of risks on the defense mechanism of the operating system is analyzed. If a certain attack risk frequently occurs and is of great harm, it indicates that the current defense mechanism has deficiencies in dealing with this risk, and the corresponding security assessment algorithm and parameters need to be optimized. By establishing a mapping relationship between risks and algorithm adjustment, the detection sensitivity, coverage range, and threshold setting of the algorithm parameters are automatically adjusted according to the risk severity and frequency. For example, the attack surface exposure risk results are classified and sorted according to risk type, severity, and frequency. Using machine learning techniques, historical risk data and successful adjustment cases are trained to generate algorithm adjustment rules. According to the rules, the existing security assessment algorithm code is modified, and related parameters such as the detection threshold of the intrusion detection algorithm and the matching priority of the firewall rules are adjusted. This allows the security assessment algorithm and parameters to adapt to dynamically changing security risks, improves the accuracy of the evaluation of the operating system defense mechanism, and ensures that the defense mechanism can effectively respond to actual security threats.

[0062] As described in step S3 above, based on the self-adaptive adjustment of the security assessment algorithm and algorithm parameters, the defense mechanism of the operating system, such as the firewall, intrusion detection system, and access control module, is comprehensively detected. By simulating the response of the defense mechanism under attack scenarios, the defense capability of the defense mechanism against various attacks is evaluated, including detection rate, blocking rate, response time, etc., thereby obtaining the defense mechanism evaluation results. In the simulation environment, the various attack scenarios are run again, and the defense mechanism of the operating system responds to the attacks. Using monitoring tools, various response data of the defense mechanism are recorded, such as whether the firewall successfully blocks attack traffic, whether the intrusion detection system timely issues an alarm, etc. The recorded data are input into the adjusted security assessment algorithm, and the evaluation scores of the defense mechanism in various aspects are obtained according to the pre-set evaluation indicators and calculation methods, and the defense mechanism evaluation results are formed.

[0063] As described in step S4 above, the attack surface risk matrix and the defense mechanism evaluation matrix are constructed, and the risk type, occurrence probability, impact degree, etc. in the attack surface exposure risk results and the defense capability indicators in the defense mechanism evaluation results are mapped into the matrix elements, respectively. The correlation matrix is introduced, and the correlation between risks and defense mechanisms is considered comprehensively through matrix operations such as matrix multiplication and weighted summation, the comprehensive influence of both on the overall security state of the operating system is quantified, and the preliminary comprehensive risk value is obtained.

[0064] As described in step S5 above, various types of data during the operation of the operating system are collected in real time, such as CPU usage, memory occupancy, network traffic, user operation behavior, etc. Through data analysis algorithms, the potential relationship between these real-time data and security risks is mined. If the real-time data shows that the system is abnormal, such as a sudden surge in CPU usage, a large number of abnormal network connections, etc., it means that there is a security threat, and the preliminary comprehensive risk value needs to be corrected according to these abnormal conditions, so that the evaluation result is more in line with the actual security status of the operating system. Specifically, data collection tools can be deployed to collect operating system running data in real time. Data mining techniques and machine learning algorithms are used to analyze the collected data and identify abnormal data patterns. According to the pre-established association model between abnormal data and security risks, the risk type and impact degree corresponding to the abnormal situation are determined. According to the set correction rules, the preliminary comprehensive risk value is adjusted, such as increasing the value of the relevant risk dimension. Finally, the corrected risk value is summarized and arranged to generate the comprehensive security evaluation result of the operating system.

[0065] In this embodiment, the real-time running state of the operating system is fully considered, and the evaluation result is dynamically adjusted to improve the timeliness and accuracy of the evaluation, and to provide more reliable operating system security status information for the user. The attack surface exposure risk result of the exposed elements under the simulated attack scenario is evaluated, and the security evaluation algorithm and algorithm parameters of the defense mechanism are adaptively adjusted, so that the security evaluation is more accurate; at the same time, based on the real-time running data, the preliminary comprehensive risk value is corrected, and the mutual influence of multiple aspects is considered comprehensively, so that the final comprehensive security evaluation result is more accurate.

[0066] In an embodiment, the exposed elements include system interfaces, services, and accessible resources.

[0067] In an embodiment, based on the attack surface exposure risk result, the security evaluation algorithm and algorithm parameters of the operating system defense mechanism are adaptively adjusted, including:

[0068] The attack surface exposure risk result is hierarchically analyzed according to the damage level, attack type, and impact object, and key feature parameters are extracted;

[0069] Based on the selection rules of the pre-constructed security evaluation algorithm and the key feature parameters, a security evaluation algorithm for security evaluation of the operating system defense mechanism is selected;

[0070] For the selected security evaluation algorithm, based on the attack surface exposure risk result, a fuzzy control algorithm is used to dynamically adjust the algorithm parameters.

[0071] In this embodiment, the security risk characteristics contained in different hazard levels, attack types and impact objects are different. Through hierarchical analysis, key information can be sorted out from the complex attack surface exposure risk results. For example, high-hazard-level attacks often have a significant impact on the core functions of the system; different attack types, such as network attacks and malware attacks, have their own unique behavior patterns; and the consequences and risk propagation paths of the impact objects, such as the system kernel and user data, after being attacked are different. Using data mining and feature extraction techniques, key feature parameters that accurately reflect the nature of the risk are extracted from these different levels of information, providing a basis for subsequent algorithm selection and adjustment.

[0072] The degree of harm in the attack surface exposure risk results is classified, such as into high, medium and low levels. According to common attack methods, attack types are divided into categories such as DDoS attacks, SQL injection attacks, and ransomware attacks. The impact objects are determined, such as system processes, file systems, and network interfaces. Then, for each level, text mining, statistical analysis and other methods are used to extract key feature parameters. For the hazard level level, risk occurrence probability and potential loss amount parameters are extracted; for the attack type level, time series features and data flow features of attack behavior are extracted; and for the impact object level, the number of affected objects and key degree parameters are extracted.

[0073] The pre-constructed selection rules are based on a large amount of historical security event data and research and analysis of the performance of different security assessment algorithms. The above rules clearly define the correspondence between different combinations of key feature parameters and suitable security assessment algorithms. For example, when the attack type is network attack and the impact object is network interface, and the risk hazard level is high, an algorithm that focuses on network traffic monitoring and anomaly detection may be more suitable. By matching the extracted key feature parameters with the selection rules, the most suitable security assessment algorithm for the current attack surface exposure risk situation can be quickly and accurately selected. Specifically, a security assessment algorithm selection rule library is established, and each rule in the rule library is composed of key feature parameter conditions and corresponding recommended algorithms. The key feature parameters extracted in the first step are compared one by one with the rules in the rule library. For example, if the key feature parameters show that the attack type is SQL injection attack, the impact object is a database, and the hazard level is medium, find the rule that meets these conditions in the rule library to determine the recommended security assessment algorithm, such as an algorithm based on vulnerability scanning and data integrity detection.

[0074] The fuzzy control algorithm can process uncertain and fuzzy information. The attack surface exposure risk result has a certain fuzziness and is difficult to be completely described by precise numerical values. Through the fuzzy control algorithm, various types of information in the attack surface exposure risk result, such as the fuzzy description of the hazard level (higher, lower, etc.), the complex characteristics of the attack type, etc., are converted into control signals for adjusting the algorithm parameters. For example, when the hazard level is “high” and the attack type is “new network attack”, the fuzzy control algorithm will increase the sensitivity parameter of the abnormal traffic detection in the intrusion detection algorithm to better cope with the potential risk.

[0075] In this embodiment, first, the input variables (such as hazard level, attack type related characteristics, etc.) and output variables (i.e. algorithm parameters that need to be adjusted) of the fuzzy control algorithm are determined. The input variables are fuzzified to convert precise key feature parameters into fuzzy language variables, such as converting the precise numerical value of the risk occurrence probability into the fuzzy set of “low probability”, “medium probability”, and “high probability”. According to the pre-established fuzzy control rules, fuzzy reasoning operations are performed to obtain fuzzy outputs for adjusting the algorithm parameters. Finally, through defuzzification processing, the fuzzy outputs are converted into specific algorithm parameter adjustment values, and the selected security evaluation algorithm parameters are dynamically updated. In this embodiment, the parameters of the security evaluation algorithm can be dynamically optimized according to the real-time changing attack surface exposure risk situation, further improving the adaptability and accuracy of the evaluation algorithm to complex security risks, so as to more accurately evaluate the effectiveness of the operating system defense mechanism.

[0076] In an embodiment, based on matrix operations, the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system is quantified to obtain a preliminary comprehensive risk value, including:

[0077] An attack surface risk matrix is constructed based on the attack surface exposure risk result;

[0078] A defense mechanism matrix is constructed based on the defense mechanism evaluation result;

[0079] An association matrix in the database is obtained, which is used to represent the association tightness between the attack surface exposure risk and the defense mechanism;

[0080] The attack surface risk matrix, the association matrix, and the defense mechanism matrix are multiplied in turn to obtain an intermediate matrix; the intermediate matrix is summed by row to obtain a one-dimensional vector;

[0081] The elements in the one-dimensional vector are normalized and weighted summed to obtain the preliminary comprehensive risk value.

[0082] In this embodiment, the attack surface exposure risk result covers various risk information, such as the possibility of risk occurrence and the degree of impact. Building the above information into a matrix, setting the risk type as the row, and setting the risk occurrence probability, impact degree, and other quantitative indicators as the column, can clearly present the complex attack surface risk situation. Such a matrix form facilitates subsequent operations with other matrices to comprehensively evaluate the risk. First, the attack surface exposure risk result is sorted and classified to determine different risk types such as network attack risk, data leakage risk, and privilege escalation risk. For each risk type, combined with historical data evaluation, the possibility of its occurrence in the actual scenario is judged, and the risk occurrence probability is quantified, with a value range generally between 0 and 1. For the impact degree, according to the damage to the operating system function, data integrity, user privacy, etc., the level is divided or the numerical value is quantified, such as from 1 to 10. Then, the risk type is taken as the row of the matrix in turn, and the corresponding risk occurrence probability and impact degree quantification value are filled in the corresponding column to build the attack surface risk matrix.

[0083] The defense mechanism evaluation result contains the effectiveness information of various defense mechanisms of the operating system, such as the success rate of the firewall intercepting attacks and the accuracy rate of the intrusion detection system detecting attacks. Building these information into a matrix, taking the defense mechanism type as the row, and taking the defense effectiveness quantitative indicators as the column, can clearly show the overall situation of the defense mechanism. Through the matrix form, the attack surface risk matrix can be associated and operated to evaluate the response ability of the defense mechanism to the attack surface risk. Sort out the existing firewall, intrusion detection system, access control module, encryption mechanism, and other defense mechanisms of the operating system. For each defense mechanism, through actual testing, simulated attack verification, or analysis of historical operation data, the quantitative indicators of its defense effectiveness are obtained. For example, through multiple tests in a simulated attack environment, the success rate of the firewall intercepting a specific type of attack is calculated; according to the proportion of the number of attacks correctly detected by the intrusion detection system to the total number of attacks, the accuracy rate is determined. The defense mechanism type is taken as the row of the matrix, and the corresponding defense effectiveness quantitative value is filled in the corresponding column to build the defense mechanism matrix.

[0084] The correlation matrix is used to describe the relationship between the different attack surface exposure risks and the defense mechanisms. The element value of the matrix reflects the closeness between a specific risk and a defense mechanism, which is obtained by analyzing historical security events, summarizing the experience of security experts, and using data mining techniques. In matrix operations, the matrix can reasonably associate attack surface risks and defense mechanisms, and the quantification of the comprehensive impact is more in line with the actual security logic. First, a database is established to store the correlation matrix data. A large amount of historical security event data is collected, including the types of attacks, the corresponding defense mechanism response, and the final security results. Data mining algorithms such as association rule mining algorithms are used to analyze these data and find out the potential correlation patterns between attack surface exposure risks and defense mechanisms. For example, through analysis, it is found that data leakage risks are closely related to encryption mechanisms and access control mechanisms. According to the analysis results, combined with the weight judgment of security experts on various correlation relationships, the value of each element in the correlation matrix is determined, and the element value is generally between 0 (no correlation) and 1 (strong correlation). These correlation matrix data are stored in the database for retrieval when needed.

[0085] Matrix multiplication can integrate the information of multiple matrices. In this scheme, the attack surface risk matrix, the correlation matrix, and the defense mechanism matrix are multiplied in turn to integrate the information of attack surface risks, the correlation between risks and defense mechanisms, and the effectiveness of defense mechanisms. The sum of the elements in the intermediate matrix obtained by multiplication is calculated to obtain a one-dimensional vector that reflects the comprehensive influence of different risk types. According to the rules of matrix multiplication, the elements of each row of the attack surface risk matrix are multiplied with the corresponding column elements of the correlation matrix in turn and accumulated to obtain a new matrix. Then, the new matrix is subjected to similar multiplication operation with the defense mechanism matrix to obtain an intermediate matrix. After obtaining the intermediate matrix, the elements of each row are added to obtain a one-dimensional vector, and each element in the vector represents the preliminary influence value of a risk type after considering the defense mechanisms and the correlation.

[0086] Through matrix multiplication and row summation operation, attack surface risks, defense mechanisms, and their correlation information are effectively integrated, and the preliminary quantitative comprehensive influence of different risk types on the overall security state of the operating system is obtained, which lays the foundation for the final preliminary comprehensive risk value and is the key transition step from raw data to comprehensive evaluation results.

[0087] The normalization processing is to eliminate the deviation influence of different elements in the one-dimensional vector on the final result due to different value ranges, so that all elements are compared and calculated in the same scale. The weighted summation is to consider the importance of different risk types to the overall security state of the operating system, to more reasonably integrate the influence of various risks by assigning different weights, and to obtain a single value representing the preliminary comprehensive risk value of the overall security state of the operating system. After normalization and weighted summation, the one-dimensional vector reflecting the comprehensive influence of different risk types obtained in the previous steps is converted into a simple single value, which intuitively presents the preliminary comprehensive security risk level of the operating system under the current attack surface exposure risk and defense mechanism state, and provides a key quantitative basis for subsequent further assessment and decision-making.

[0088] In an embodiment, based on the real-time running data, the preliminary comprehensive risk value is corrected, including:

[0089] Extracting key security indicator data from the real-time running data;

[0090] Determining the correlation value of the key security indicator data and the security risk through correlation analysis;

[0091] Based on the preset correction rule, the correlation value is used to adjust the preliminary comprehensive risk value up or down to obtain the comprehensive security evaluation result.

[0092] In this embodiment, the operating system generates a large amount of data during real-time running, and not all data is directly related to security. The key security indicator data refers to the core data that can directly or indirectly reflect the security state of the system. Through specific data screening and feature extraction technology, these key indicators can be accurately found from the complex real-time running data, providing core data support for subsequent analysis of security risks. For example, the basic performance data such as CPU usage, memory occupancy, and network connection number may imply a security threat in abnormal situations; the security-related data such as the number of user login failures in system logs and access records of sensitive files are directly and closely related to potential security risks.

[0093] The collected data is processed using data mining algorithms, such as Principal Component Analysis (PCA) or feature selection algorithms. Taking Principal Component Analysis as an example, it can transform a large number of related original data variables into a few unrelated comprehensive variables, i.e. principal components, which retain most of the information of the original data and highlight the features closely related to safety. By setting appropriate thresholds and screening conditions, key security indicator data is extracted from principal components or other algorithm-processed data. For example, set the CPU usage rate change rate within a certain period of time exceeding a certain threshold as the key security indicator data for extraction, or filter out the records of the user's continuous multiple login failures within a short period of time as the key security indicator data. Extracting key security indicator data is the basis of the entire correction process. Only accurate and representative security-related data can be obtained, and the subsequent analysis of security risks and the correction of preliminary comprehensive risk values have practical significance, which can ensure that the correction process is based on real and effective system operation state information.

[0094] Key security indicator data itself is not directly equivalent to security risk, and the internal relationship and influence degree between them need to be clarified through correlation analysis. Using association rule mining algorithms in machine learning, such as Apriori algorithm, or correlation analysis methods based on statistics, the key security indicator data and known security risk types and degrees are analyzed. For example, through analysis, it is found that when the number of network connections increases sharply within a short period of time, accompanied by a large number of connection requests from a specific IP address segment, there is a high correlation with network attack risk; frequent sensitive file access failure records in system logs may be related to permission abuse or data leakage risk. By calculating the closeness of this association, an association value is obtained, which can quantify the indicative effect of key security indicator data on security risk.

[0095] Specifically, a database containing a large amount of historical security event data and corresponding key security indicator data is established. The currently extracted key security indicator data is combined with the historical data in the database, and selected correlation analysis algorithms are used for processing. Taking the Apriori algorithm as an example, it scans the data set to find frequently occurring item sets, i.e. combination patterns of key security indicator data, which correspond to specific security risk types. By calculating indicators such as confidence and support, the association strength between different combinations of key security indicator data and security risks is determined, and an association value is obtained. For example, it is calculated that when the CPU usage rate exceeds 80% and the memory occupancy rate exceeds 90%, the association value with the system resource exhaustion risk is 0.7 (value range 0-1, the larger the value, the stronger the association).

[0096] The determination of the correlation value provides a key basis for correcting the preliminary comprehensive risk value based on real-time operation data. By determining the correlation degree of the key safety indicator data and the safety risk, the change of the safety risk faced by the system in the real-time operation state can be accurately judged, and quantitative support for reasonably adjusting the preliminary comprehensive risk value is provided, so that the comprehensive safety evaluation result after correction is more in line with the actual safety status of the system.

[0097] The preset correction rule is formulated based on historical safety event analysis and industry best practices. These rules clearly define the adjustment method for the preliminary comprehensive risk value under different correlation values. For example, if the correlation value indicates that a certain key safety indicator data is strongly correlated with a high-risk type, then according to the correction rule, the preliminary comprehensive risk value should be increased to reflect the higher safety risk currently faced by the system; on the contrary, if the correlation value shows a correlation with a low-risk or normal operation state, the preliminary comprehensive risk value may be decreased. In this way, the safety risk changes reflected by the real-time operation data are integrated into the preliminary comprehensive risk value, and a more accurate comprehensive safety evaluation result is obtained.

[0098] Specifically, a correction rule library is constructed, and each rule in the library consists of a correlation value range, a corresponding safety risk type, and a specific way to adjust the preliminary comprehensive risk value. For example, the rule stipulates that when the correlation value with network attack risk is greater than 0.6, the value of the network attack risk dimension in the preliminary comprehensive risk value will be increased by 30%; when the correlation value with normal operation state is greater than 0.8, the overall preliminary comprehensive risk value will be decreased by 10%. The correlation value obtained in the previous step is matched with the rules in the correction rule library to find the corresponding adjustment rule. According to the rule, the preliminary comprehensive risk value is adjusted accordingly. Finally, the adjusted values of each risk dimension are calculated to obtain the comprehensive safety evaluation result. For example, the preliminary comprehensive risk value is obtained by weighted summation of multiple dimension values such as network attack risk, data leakage risk, and privilege abuse risk. After adjusting each dimension value according to the rule, the weighted summation is performed again to obtain the final comprehensive safety evaluation result. Through the combination and use of the preset correction rule and the correlation value, the dynamic adjustment of the preliminary comprehensive risk value is realized, and the comprehensive safety evaluation result can reflect the current safety status of the operating system in real time, providing timely and accurate system safety information for the user, which helps to take targeted security protection measures.

[0099] In an embodiment, after generating the comprehensive safety evaluation result of the operating system, the method comprises:

[0100] Obtaining an identification number and a security test code of the operating system; sequentially adding the identification number and the security test code to the matrix one by one to generate a sequence matrix;

[0101] Generating a simulation graph based on the type of the operating system;

[0102] Based on the simulation graph, the sequence matrix is changed to obtain a changed matrix;

[0103] Based on the changed matrix, a storage key is generated to encrypt and store the comprehensive security evaluation result of the operating system.

[0104] In this embodiment, the identification number of the operating system is its unique identity in a specific system environment or management system, which is used to accurately identify and distinguish different operating system instances. The security test code records the security test type, version or specific test batch of the operating system and other information. These two are added to the matrix in order, constructing a sequence matrix, providing a basic data structure for subsequent operations based on operating system characteristics. The matrix as an ordered data organization form facilitates the unified management and operation of these key information, and can establish data association with subsequent simulation graphs and change operations.

[0105] Different types of operating systems, such as Windows, Linux, macOS, etc., have their own unique architecture, functional module distribution and running logic. Using graph generation technology, according to the characteristic information corresponding to the operating system type, the corresponding simulation graph is constructed. The above-mentioned graph can directly reflect the structural characteristics, key component relationship and possible security risk distribution area of the operating system. For example, for Windows system, its graph highlights the key security components such as registry, user account control and their mutual relationship; the graph of Linux system may focus on the display of file system permission management, process scheduling and other modules. Through the simulation graph, the abstract operating system type is converted into visual and analyzable graph data, which is convenient for subsequent interactive operation with the sequence matrix.

[0106] Specifically, a mapping database of operating system types and graph templates is established, in which each operating system type corresponds to one or more pre-designed graph template frameworks. The template defines the correspondence between various graph elements (such as nodes, lines, areas, etc.) and operating system components or characteristics. When the operating system type is obtained, the corresponding graph template is retrieved from the database. According to the specific configuration information, installed software list and other detailed data of the operating system, the graph template is instantiated, filled and adjusted. For example, if it is detected that a specific firewall software is installed in the Linux system, the firewall component is highlighted in the corresponding position of the graph, and the attributes of the graph elements (such as color, size, etc. representing the protection strength) are adjusted according to the configuration parameters of the firewall, and finally the complete simulation graph is generated.

[0107] The simulation graph contains the structure, component relationship and security-related information of the operating system, which has a potential connection with the identification sequence number and security test code in the sequence matrix. Through preset change rules, the operating system characteristics reflected by the simulation graph are converted into change instructions for the sequence matrix. For example, if the simulation graph shows that the operating system has a certain key security vulnerability, the corresponding change rule can be to specify that a specific mark or modification is made to the security test code related part in the sequence matrix to record the vulnerability information. In this way, the graph information and matrix data are fused to obtain a change matrix that can more comprehensively reflect the security status of the operating system.

[0108] Specifically, a detailed change rule set is formulated, which defines the addition, deletion, modification or rearrangement of elements of the sequence matrix according to different graphical element states, position relationships and security risk identifications in the simulation graph. The generated simulation graph is analyzed to identify key elements and features in the graph, such as the presence or absence of a specific security component, the identification of a risk area, etc. According to the identification result, the corresponding rule is found in the change rule set, and the sequence matrix is operated according to the rule. For example, if a high-risk area related to a specific security test link is identified in the simulation graph, the rule specifies that a risk level code is inserted at the corresponding position of the security test code in the sequence matrix. After a series of such operations, the change matrix is obtained. The change matrix integrates the identification, test information of the operating system and the security status information reflected by the simulation graph generated based on its type, providing a richer and more accurate data basis for generating the storage key, so that the encrypted storage key can closely combine the actual security status of the operating system, enhancing the pertinence and security of encryption.

[0109] The change matrix contains key information closely related to the identity, test and security status of the operating system. Using an encryption algorithm, these information is converted into a key used for encryption. The encryption algorithm generates a key with uniqueness and complexity by performing specific mathematical operations and transformations on the matrix data. The key is used to encrypt the comprehensive security evaluation results of the operating system, ensuring the confidentiality and integrity of the evaluation results during storage, preventing unauthorized access and tampering.

[0110] The above realizes the secure storage of the comprehensive security evaluation results of the operating system, protecting the confidentiality and integrity of the evaluation results. The key generated based on the change matrix closely combines the security characteristics of the operating system itself, making it more difficult to crack the encrypted evaluation results, providing reliable protection for the long-term storage and use of the operating system security evaluation data, and improving the security and practicality of the entire security evaluation system.

[0111] In an embodiment, the generating a storage key based on the change matrix comprises:

[0112] obtain a preset mapping table; the preset mapping table comprising a one-to-one mapping relationship between original data and mapping data;

[0113] based on the simulation graph, perform mutation processing on the mapping data of the preset mapping table to obtain a mutated mapping table;

[0114] obtain attribute information of the mutated mapping table, and select a target matrix element from the change matrix based on the attribute information;

[0115] map the target matrix element based on the mutated mapping table, and sequentially combine the mapping results to obtain the storage key.

[0116] In this embodiment, the preset mapping table is a pre-constructed data structure, and its core function is to establish a deterministic association between the original data and the mapping data. This association provides a basic rule for subsequent data transformation and key generation. The original data can be various data units with certain meaning or characteristics, such as numbers, characters, specific codes, etc., while the mapping data is the transformed data corresponding to the original data according to specific design purposes. Through this mapping relationship, the original and relatively conventional data form can be converted into a more secure and complex data representation.

[0117] Using the simulation graph to perform mutation processing on the mapping data of the preset mapping table can make the generated key closely combined with the actual security status of the operating system. Mutation processing can modify, replace, rearrange, etc. the mapping data based on the pattern rules, attributes, shapes, etc. in the simulation graph. In this way, the generated mutated mapping table no longer relies solely on the preset fixed rules, but incorporates the real-time security features of the operating system, making the final generated storage key more targeted and secure. For example, all the mapping data in the preset mapping table can be sequentially added to the edge of the simulation graph, and the mapping data at the key position can be arranged in front of the mapping data in the preset mapping table by the key position of the simulation graph, to sequentially realize the formation of the mutated mapping table. There are many mutation methods, which will not be described here.

[0118] The mutated mapping table is a key link that integrates the security features of the operating system into the key generation process. Through mutation processing of the preset mapping table, the generated storage key is no longer a simple transformation based on fixed rules, but closely combines the real-time security status of the operating system. This greatly enhances the security and targeting of the key, making it more difficult to crack the encrypted operating system comprehensive security evaluation result, and improving the protection capability of the entire security evaluation system.

[0119] The variant mapping table has specific attribute information, and the attribute information can include the type, length, distribution rule, and the like of the mapping data. The change matrix contains key information related to the operating system identity, test, and security state. By analyzing the attribute information of the variant mapping table, the change matrix elements that match or are associated with these attributes, i.e., the target matrix elements, can be determined. For example, if some mapping data in the variant mapping table is related to a specific security test link of the operating system, then the matrix elements corresponding to the security test code can be selected from the change matrix according to this attribute. This element selection method based on attribute matching ensures that the data extracted from the change matrix has an inherent connection with the variant mapping table, and provides a suitable data basis for subsequent mapping operations based on the variant mapping table.

[0120] An attribute-matrix element association rule library is established, and the association rule library defines the correspondence between different attribute information and the change matrix elements. For example, it is specified that when the type of a mapping data in the variant mapping table is related to the network security of the operating system, the matrix elements corresponding to the network security risk dimension are selected from the change matrix. The extracted attribute information of the variant mapping table is matched with the rules in the association rule library, and the target matrix elements are selected from the change matrix according to the matching result. For example, if the attribute analysis shows that a group of mapping data in the variant mapping table is related to a specific security test version, the matrix elements at the positions corresponding to the security test code are selected from the change matrix according to the rules.

[0121] Selecting the target matrix elements is an important step for effectively associating the variant mapping table with the change matrix. Through the selection method based on attribute information, the rationality and effectiveness of the subsequent mapping operation of the matrix elements based on the variant mapping table are ensured. This enables the generated storage key to fully utilize the information in the change matrix that is closely related to the security of the operating system, further enhancing the degree of fit between the key and the security status of the operating system and improving the reliability of the encryption.

[0122] The variant mapping table provides specific mapping rules for the transformation of the target matrix elements. The target matrix elements are converted according to the mapping relationship of the variant mapping table, which can convert the security-related information of the operating system into key data with confidentiality and complexity. By sequentially combining the mapping results, multiple elements that have been mapped and transformed are connected into a complete key sequence. This combination method makes the key not only contain key information from the change matrix, but also increase the unpredictability and security of the key through the mapping rules of the variant mapping table. This step is the final implementation link for converting the security-related information of the operating system into a storage key. Through the mapping based on the variant mapping table and the combination of the results, a storage key with high confidentiality and pertinence is generated. The key can effectively encrypt and store the comprehensive security evaluation results of the operating system, protecting the confidentiality and integrity of the evaluation results.

[0123] In an embodiment, the generating the storage key based on the change matrix comprises:

[0124] superimposing the change matrix and the simulation graph according to a rule, obtaining each matrix element in the change matrix located in the simulation graph, and reconstructing the matrix element into a deformation matrix;

[0125] obtaining attributes of the change matrix and attributes of the deformation matrix;

[0126] generating the storage key based on the attributes of the change matrix and the attributes of the deformation matrix.

[0127] In the embodiment, a set of superimposition rules of the change matrix and the simulation graph is prepared in advance. For example, it is specified that each node in the simulation graph corresponds to an element at a specific intersection of rows and columns in the change matrix, or a certain region of the simulation graph corresponds to a certain continuous sub-matrix in the change matrix. The change matrix is presented in the form of a two-dimensional table, and the simulation graph is displayed in a graphical interface. According to the superimposition rules, the matrix elements in the change matrix located in the coverage range of the simulation graph are identified. Assuming that a circular region in the simulation graph represents a network security component of the operating system, according to the rules, the circular region corresponds to the elements in the change matrix within a specific range of rows and columns, and the elements are extracted. Using the extracted elements, a deformation matrix is constructed by rearranging the elements in a certain order, such as maintaining the relative row and column order of the elements in the original change matrix to form a new matrix structure.

[0128] For the change matrix, the size of the matrix is determined by scanning the matrix structure and counting the number of rows and columns; the data format of the matrix elements is determined by analyzing the data format of the elements; the distribution of the element values is determined by using statistical methods to calculate the distribution range, mean, variance, etc. of the element values; and the association with various security risks is determined according to the correspondence between the matrix construction process and the security risk dimensions of the operating system. For the deformation matrix, the selection ratio of the elements is determined by calculating the ratio of the number of elements in the deformation matrix to the number of elements in the change matrix; the connection relationship between the elements in the deformation matrix is determined by using graph theory or correlation analysis algorithm to analyze the connection relationship between the elements; and the concentration degree of the security characteristics represented by the elements in the deformation matrix is determined by classifying and counting the security characteristics represented by the elements. The extracted attribute information of the change matrix and the deformation matrix is sorted and stored for subsequent use.

[0129] The extracted change matrix attributes and deformation matrix attributes are preprocessed according to algorithm requirements, such as converting attribute data into specific data formats, encoding methods, etc. The preprocessed attribute data is input into the key generation module, and the algorithm is run to generate a storage key. For example, using a custom hash algorithm, the element distribution variance of the change matrix, the degree of association with network security risks, and the degree of association of the elements of the deformation matrix are hashed to obtain a fixed-length hash value as the storage key. The generated storage key is verified and tested to ensure that it meets the encryption requirements and security standards. This step realizes the conversion from the operating system security-related matrix attributes to the storage key, and the generated storage key can effectively encrypt and store the operating system comprehensive security evaluation results. Since the key generation is based on comprehensive and key security information attributes of the operating system, the security and reliability of the encryption are greatly enhanced, providing a core guarantee for long-term secure storage of operating system security evaluation data and improving the security protection design of the entire security evaluation system.

[0130] In an embodiment, the sequence matrix is changed based on the simulation graph to obtain a change matrix, including:

[0131] The simulation graph is added to the sequence matrix, and a plurality of closed sub-graphs are constructed based on the simulation graph in the sequence matrix;

[0132] In the sequence matrix, the matrix elements located in the closed sub-graphs and the matrix elements located outside the closed sub-graphs are exchanged one by one in order until all the matrix elements located in the closed sub-graphs are exchanged or all the matrix elements located outside the closed sub-graphs are exchanged, obtaining the change matrix.

[0133] In this embodiment, the simulation graph is associated with the sequence matrix in a graphical format (such as a bitmap, a vector graph, etc.). This can be achieved by adding a pointer to the storage location of the simulation graph in the data structure of the sequence matrix, or by directly embedding the key feature data of the simulation graph in a specific metadata part of the sequence matrix. Using a graph recognition and segmentation algorithm, based on the shape, lines, and other features of the simulation graph, the area corresponding to the simulation graph in the sequence matrix is identified, and a closed sub-graph is constructed based on this area. For example, a boundary detection algorithm is used to determine the boundary range of the simulation graph in the sequence matrix, and then a polygon closed sub-graph is constructed around the range. According to the complexity of the simulation graph and the division requirements of the security features, a plurality of closed sub-graphs of different shapes and ranges can be constructed, each corresponding to a specific security-related part of the operating system.

[0134] In the sequence matrix, the matrix elements located in the closed subgraph are sequentially exchanged with the matrix elements located outside the closed subgraph until all the matrix elements located in the closed subgraph are exchanged or all the matrix elements located outside the closed subgraph are exchanged, to obtain the changed matrix. The changed matrix generated in this way not only contains the identification and test information of the operating system, but also integrates the element arrangement change based on the security characteristics, thereby providing a richer and more closely related data basis for subsequent generation of the storage key.

[0135] Specifically, the matrix elements inside and outside the closed subgraph are determined. The elements located inside and outside the boundary of the closed subgraph can be identified by matrix index or coordinate system. For example, for a two-dimensional sequence matrix, if the closed subgraph is defined by a set of coordinate ranges, the matrix elements are traversed, and it is judged whether the element is inside the closed subgraph according to the coordinates of the element. The exchange order rule is set, such as starting from the top-left element of the closed subgraph and sequentially exchanging with the elements outside the subgraph. A random order can also be used for exchange, but the repeatability of the exchange process needs to be ensured for subsequent verification and analysis. The exchange operation is started, one element inside the closed subgraph is exchanged with one element outside the subgraph, and the matrix state after the exchange is recorded. The exchange operation is continuously performed until the stop condition is met, i.e., all elements inside the closed subgraph have been exchanged or all elements outside the closed subgraph have been exchanged. At this time, the obtained matrix is the changed matrix, which is stored and processed subsequently. The element exchange process realizes the transformation of the sequence matrix to the changed matrix, and the generated changed matrix integrates the information related to the security characteristics of the operating system. This matrix change method based on security characteristics provides a unique data structure for subsequent generation of the storage key, so that the key generation can be closely combined with the security status of the operating system, enhancing the pertinence and security of encryption and perfecting the technical process of encryption storage of the entire operating system security evaluation result.

[0136] In an embodiment, the sequence matrix is changed based on the simulation graph to obtain a changed matrix, including:

[0137] Each matrix element in the sequence matrix is added to each node in a preset directed graph template to generate an element directed graph; wherein each node is connected by a directed edge;

[0138] The simulation graph is superimposed in the element directed graph, and the directed edges located in the simulation graph in the element directed graph are obtained as target edges;

[0139] The direction of each target edge is converted to obtain a converted directed graph; and the elements on each node are sorted according to the pointing order of the directed edges in the converted directed graph to obtain an element order;

[0140] The elements in the element sequence are replaced in sequence into the sequence matrix to obtain the changed matrix.

[0141] In this embodiment, first, a preset directed graph template is obtained, which should have a sufficient number of nodes and directed edges to accommodate all elements in the sequence matrix. The structure and connection mode of the nodes and directed edges in the template can be designed according to specific requirements and algorithms. For example, the directed graph can be a simple chain structure, a tree structure, or a more complex mesh structure. Then, each element in the sequence matrix is added to a node of the directed graph in sequence (such as row priority or column priority of the matrix). In the process of adding elements, the connection relationship between the nodes in the directed graph is kept unchanged. Finally, an element directed graph containing elements of the sequence matrix is generated, in which each node corresponds to an element in the matrix, and the directed edges between the nodes represent a certain relationship between the elements. Generating the element directed graph is an important step of graphically converting the sequence matrix data, which provides a new structural basis for subsequent operations on the matrix elements based on the simulated graph. Through the form of the directed graph, the relationship between the matrix elements can be more intuitively observed and processed, making the change operation of the matrix more flexible and diversified, and also laying a foundation for subsequent combination with the simulated graph and generation of the changed matrix.

[0142] The simulated graph is superimposed on the element directed graph, so that the simulated graph corresponds to the element directed graph in space. Then, all directed edges in the element directed graph are traversed to determine whether both endpoints of each directed edge are located within the range of the simulated graph. If both endpoints of a directed edge are within the simulated graph, the directed edge is marked as a target edge. Graph processing algorithms and coordinate calculations can be used to accurately determine the positional relationship between the directed edge and the simulated graph. Finally, a group of target edges located within the simulated graph is obtained, which will be the focus of subsequent operations.

[0143] Converting the direction of the target edge can change the relationship and order between the elements, thereby generating a new element arrangement possibility. The pointing order of the directed edge determines the access order between the nodes, and by sorting the elements on the nodes according to the pointing order of the converted directed edge, a new element arrangement based on the security features of the operating system can be obtained. This new arrangement can reflect the order of the matrix elements after considering the relationship changes between the security-related parts or features of the operating system, providing a new element order basis for subsequent generation of the changed matrix.

[0144] For each target edge, reverse its direction, i.e. change the original directed edge pointing from node A to node B to a directed edge pointing from node B to node A. After completing the direction conversion of all target edges, the converted directed graph is obtained. Then, starting from a certain starting node of the converted directed graph (the starting node can be selected according to specific requirements, such as selecting a node corresponding to a key security component of the operating system), follow the direction order of the directed edges to visit each node in turn, and record the elements on the nodes to form an element sequence. During the visiting process, ensure that the nodes are visited in the direction order of the directed edges to avoid missing or repeated visiting of nodes. Finally, an element order is obtained according to the direction order in the converted directed graph.

[0145] Replacing the sorted elements into the original sequence matrix in order is the process of applying the new element arrangement based on the security features of the operating system to the matrix. Through this replacement operation, the element order in the original sequence matrix is changed to form a new matrix, i.e. the change matrix. The element order in the change matrix not only contains the identification and test information of the operating system, but also incorporates the element arrangement changes related to the security features of the operating system obtained based on the simulation graph and directed graph operations, so that the change matrix can more comprehensively reflect the security status of the operating system. During the replacement process, the structure of the matrix is maintained, only the content of the elements is changed. After completing the replacement of all elements, the change matrix is obtained. The change matrix is stored and processed subsequently for generating storage keys and other operations.

[0146] Generating the change matrix is the final result of the entire change operation of the sequence matrix based on the simulation graph. The change matrix contains the processed matrix element order, which is closely related to the simulation graph. It provides a key data basis for subsequent generation of storage keys, making the generation of storage keys more specific and secure, thereby improving the security and reliability of encryption.

[0147] Reference Figure 2 In another embodiment of the present application, an operating system security evaluation device based on attack-fault tree is also provided, comprising the following steps:

[0148] The first evaluation unit is used for evaluating the attack surface exposure risk result of the exposed elements under the simulated attack scene for the operating system based on the attack-fault tree.

[0149] The adjustment unit is used for adaptively adjusting the security evaluation algorithm and algorithm parameters of the defense mechanism of the operating system based on the attack surface exposure risk result.

[0150] The second evaluation unit is used for evaluating the defense mechanism of the operating system based on the adaptively adjusted security evaluation algorithm and algorithm parameters, and obtaining the defense mechanism evaluation result.

[0151] a quantization unit, configured to quantize, based on a matrix operation, a comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on an overall security state of the operating system, to obtain a preliminary comprehensive risk value;

[0152] a comprehensive evaluation unit, configured to obtain real-time running data of the operating system, and correct the preliminary comprehensive risk value based on the real-time running data, to generate a comprehensive security evaluation result of the operating system.

[0153] In the embodiment, the specific implementation of each unit in the above device embodiment can refer to the description in the above method embodiment, and will not be repeated here.

[0154] With reference to Figure 3 In the embodiment, a computer device can be a server, and the internal structure thereof can be as shown in Figure 3 The computer device includes a processor, a memory, a display screen, an input device, a network interface and a database connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store corresponding data in the embodiment. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement the above method.

[0155] Those skilled in the art can understand Figure 3 that the structure shown in the embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied.

[0156] The embodiment of the present application also provides a computer readable storage medium having a computer program stored thereon. The computer program is executed by the processor to implement the above method. It can be understood that the computer readable storage medium in the embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0157] In summary, the operating system security evaluation method based on attack-fault tree provided in the embodiments of the present application comprises: for an operating system based on attack-fault tree, evaluating the attack surface exposure risk result of exposed elements under a simulated attack scenario; based on the attack surface exposure risk result, adaptively adjusting the security evaluation algorithm and algorithm parameters of the defense mechanism of the operating system; based on the adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating the defense mechanism of the operating system to obtain a defense mechanism evaluation result; based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; obtaining real-time running data of the operating system, and based on the real-time running data, correcting the preliminary comprehensive risk value to generate a comprehensive security evaluation result of the operating system. In the present application, by evaluating the attack surface exposure risk result of exposed elements under a simulated attack scenario and adaptively adjusting the security evaluation algorithm and algorithm parameters of the defense mechanism, the security evaluation is more accurate; at the same time, based on the real-time running data, the preliminary comprehensive risk value is corrected, and the mutual influence of multiple aspects is comprehensively considered, so that the final comprehensive security evaluation result is more accurate.

[0158] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments of each method. Any reference to memory, storage, database or other medium provided by the present application and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM, etc.

[0159] It is to be understood that the terminology "including", "comprising", or any other variation thereof, is intended to cover a non-exclusive inclusion such that process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0160] The preferred embodiments of the present application have been described above with the specific language and / or illustrative examples, but it should be understood that the patent protection is not intended to be limited to literal embodiments, and that changes and modifications can be substituted for things that are the same while still retaining the essential nature of such subject matter.

Claims

1. An attack-fault tree based operating system security evaluation method, characterized by, The method comprises the following steps: For an attack-fault tree-based operating system, evaluate the attack surface exposure risk result of exposed elements in a simulated attack scenario; Based on the attack surface exposure risk result, adaptively adjust the security evaluation algorithm and algorithm parameters of the operating system defense mechanism; Based on the adaptively adjusted security evaluation algorithm and algorithm parameters, evaluate the defense mechanism of the operating system to obtain a defense mechanism evaluation result; Based on matrix operations, quantify the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; including: constructing an attack surface risk matrix based on the attack surface exposure risk result; constructing a defense mechanism matrix based on the defense mechanism evaluation result; obtaining an association matrix in a database, which is used to represent the association closeness between attack surface exposure risk and defense mechanism; multiplying the attack surface risk matrix, the association matrix, and the defense mechanism matrix in turn to obtain an intermediate matrix; summing the intermediate matrix by row to obtain a one-dimensional vector; normalizing the elements in the one-dimensional vector and performing weighted summation to obtain the preliminary comprehensive risk value; Obtain real-time running data of the operating system, and based on the real-time running data, correct the preliminary comprehensive risk value to generate a comprehensive security evaluation result of the operating system; Obtain the identification number and security test code of the operating system; add the identification number and security test code to the matrix in sequence to generate a sequence matrix; generate a simulation graph based on the type of the operating system; change the sequence matrix based on the simulation graph to obtain a changed matrix; based on the changed matrix, generate a storage key to encrypt and store the comprehensive security evaluation result of the operating system.

2. The attack-fault tree based operating system security evaluation method according to claim 1, characterized in that, The exposed elements include system interfaces, services, and accessible resources.

3. The attack-fault tree based operating system security evaluation method according to claim 1, wherein, Based on the attack surface exposure risk result, adaptively adjust the security evaluation algorithm and algorithm parameters of the operating system defense mechanism, including: Layered analysis of the attack surface exposure risk result according to harm level, attack type, and impact object to extract key feature parameters; Based on the selection rules of the pre-constructed security evaluation algorithm and the key feature parameters, select a security evaluation algorithm for security evaluation of the operating system defense mechanism; For the selected security evaluation algorithm, based on the attack surface exposure risk result, use a fuzzy control algorithm to dynamically adjust the algorithm parameters.

4. The attack-fault tree based operating system security evaluation method according to claim 1, wherein, The generation of the storage key based on the changed matrix comprises: Obtain a preset mapping table; the preset mapping table includes a one-to-one mapping relationship between original data and mapping data; Based on the simulation graph, perform mutation processing on the mapping data of the preset mapping table to obtain a mutated mapping table; Obtain attribute information of the mutated mapping table, and select target matrix elements from the changed matrix based on the attribute information; Based on the mutated mapping table, map the target matrix elements, and combine the mapping results in sequence to obtain the storage key.

5. The attack-fault tree based operating system security evaluation method of claim 1, wherein, Based on the simulation pattern, the sequence matrix is changed to obtain a changed matrix, including: The simulation pattern is added to the sequence matrix, and a plurality of closed sub-patterns are constructed based on the simulation pattern in the sequence matrix; In the sequence matrix, the matrix elements in the closed sub-patterns and the matrix elements outside the closed sub-patterns are exchanged one by one in sequence until all the matrix elements in the closed sub-patterns are exchanged or all the matrix elements outside the closed sub-patterns are exchanged, and the changed matrix is obtained.

Images