Information system security evaluation method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an information system security evaluation method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining an evaluation index model corresponding to a security evaluation request, and obtaining a simulation system corresponding to a target information system; performing vulnerability scanning on the simulation system based on the scanning missing tool and the MDATA knowledge base to obtain a corresponding first scanning result and a corresponding second scanning result, and performing scanning result fusion analysis based on the MDATA knowledge base to obtain a system risk assessment result of the simulation system; obtaining an optimized attack strategy based on the system risk assessment result and the MDATA knowledge base, and obtaining an optimized defense strategy based on the system risk assessment result and the expert knowledge base; the attack and defense test is performed on the simulation system based on the optimized attack strategy and the optimized defense strategy to obtain the attack and defense test result, and the security evaluation result of the target information system is obtained based on the evaluation index model and the attack and defense test result, so that the accuracy of evaluating the information system is improved.

Description

Technical Field

[0001] This application relates to the field of system data security processing technology, and in particular to information system security evaluation methods, devices, electronic equipment and storage media. Background Technology

[0002] In today's digital age, information systems have become the core support for the daily operations of enterprises and governments, carrying massive amounts of sensitive data and critical business processes. Their security is directly related to economic interests, social order, and even national security. However, with the continuous upgrading of cyberattack methods, data breaches, ransomware, APT attacks, and other security incidents occur frequently, highlighting the increasing vulnerability of information systems and bringing huge risks and losses to organizations. Against this backdrop, conducting comprehensive and in-depth security assessments of information systems is not only necessary to meet regulatory requirements but also an important measure to ensure the stable operation of organizations and maintain social and economic order.

[0003] In related technologies, the existing security assessment process usually involves experienced assessors conducting security assessments of information systems in advance. This relies on the assessors' experience and lacks unified evaluation standards, resulting in low accuracy of the assessment results. Summary of the Invention

[0004] This application provides an information system security assessment method, apparatus, electronic device, and storage medium, which can improve the accuracy of information system security assessment.

[0005] To achieve the above objectives, a first aspect of this application proposes an information system security evaluation method, the method comprising:

[0006] In response to a security assessment request from a target information system, the system obtains an evaluation index model corresponding to the security assessment request and a simulation system corresponding to the target information system.

[0007] The simulation system is subjected to a first vulnerability scan based on a vulnerability scanning tool to obtain a first scan result, and the simulation system is subjected to a second vulnerability scan based on the MDATA knowledge base to obtain a second scan result.

[0008] Based on the first scan result, the second scan result, and the MDATA knowledge base, a fusion analysis of the scan results is performed to obtain the system risk assessment result of the simulation system.

[0009] Based on the system risk assessment results and the MDATA knowledge base, an optimized attack strategy is obtained, and based on the system risk assessment results and the expert knowledge base, an optimized defense strategy is obtained.

[0010] The simulation system is subjected to attack and defense tests based on the optimized attack strategy and the optimized defense strategy to obtain the attack and defense test results. Based on the evaluation index model and the attack and defense test results, the security evaluation results of the target information system are obtained.

[0011] In some embodiments, the step of performing a fusion analysis of the scan results based on the first scan result, the second scan result, and the MDATA knowledge base to obtain the system risk assessment result of the simulation system includes:

[0012] The first scan result and the second scan result are deduplicated and merged to obtain the associated deduplicated scan result;

[0013] Based on the MDATA knowledge base, the association deduplication scan results are analyzed to obtain the association scan results;

[0014] Based on the MDATA knowledge base, attack path analysis is performed on the associated scan results to obtain the potential attack paths of the simulation system.

[0015] Based on the potential attack paths and the asset information of the simulation system, the system risk assessment results are obtained.

[0016] In some embodiments, the associated deduplication scan results include multiple vulnerability scan data. The associated scan results are obtained by performing correlation analysis on the associated deduplication scan results based on the MDATA knowledge base, including:

[0017] The vulnerability data information corresponding to each vulnerability scan data is obtained from the MDATA knowledge base, and each vulnerability scan data is verified based on the corresponding vulnerability data information to obtain the vulnerability verification result corresponding to each vulnerability scan data.

[0018] Vulnerability association information of the target information system is obtained from the MDATA knowledge base, and vulnerability scanning association information between the vulnerability scanning data is determined based on the vulnerability association information;

[0019] Obtain the network topology information and asset configuration information of the target information system, and perform correlation analysis based on the network topology information, the asset configuration information and the vulnerability scanning correlation information to obtain the correlation analysis results;

[0020] The correlation scan results are obtained based on the vulnerability verification results and the correlation analysis results.

[0021] In some embodiments, the step of performing attack path analysis on the correlation scan results based on the MDATA knowledge base to obtain the potential attack paths of the simulation system includes:

[0022] Vulnerability exploitation information is obtained from the MDATA knowledge base, and attackable assets in the simulation system are determined based on the correlation scan results, the asset configuration information, and the vulnerability exploitation information.

[0023] Based on the network topology information, the attackable path for each of the attackable assets is determined, and the potential attack path is obtained based on all the attackable paths.

[0024] In some embodiments, the optimized attack strategy includes a target attack path and a target path attack strategy. The step of obtaining the optimized attack strategy based on the system risk assessment results and the MDATA knowledge base includes:

[0025] Based on the system risk assessment results, the comprehensive attack threat level of each potential attack path is determined, and the potential attack paths are selected from the multiple potential attack paths based on the numerical value of the comprehensive attack threat level.

[0026] Based on the vulnerability association information between the candidate attack paths, the candidate attack paths are combined and associated to obtain multiple candidate combined attack paths.

[0027] Based on the MDATA knowledge base, a path recommendation attack strategy is generated for each of the candidate combined attack paths.

[0028] For each of the candidate attack paths, the attack score corresponding to each candidate attack path is obtained by using the corresponding path recommendation attack strategy.

[0029] Based on the attack score, asset importance, attack tactical coverage, and attack impact range corresponding to each candidate attack path combination, the target attack path is selected from multiple candidate attack path combinations, and the path-recommended attack strategy corresponding to the target attack path is used as the target path attack strategy.

[0030] In some embodiments, determining the overall attack threat level of each potential attack path based on the system risk assessment results includes:

[0031] Based on the vulnerability exploitability information in the MDATA knowledge base and the system risk assessment results, the exploitability of each potential attack path is determined;

[0032] Based on the asset damage hazard information in the MDATA knowledge base and the system risk assessment results, the hazard rate of each potential attack path is determined;

[0033] Based on the asset importance information, path coverage asset information, and the system risk assessment results, the important asset coverage rate for each potential attack path is determined;

[0034] The overall attack threat level for each potential attack path is obtained by weighting the availability, the harm rate, and the coverage of critical assets.

[0035] In some embodiments, acquiring the simulation system corresponding to the target information system includes:

[0036] Obtain asset information of the target information system and identify key asset information within that asset information;

[0037] Based on the key asset information and the asset information, a simulation system corresponding to the target information system is constructed, and the simulation system is ensured to meet the simulation degree requirements.

[0038] In some embodiments, the evaluation index parameters in the evaluation index model are adjusted based on the security evaluation results.

[0039] To achieve the above objectives, a second aspect of this application provides an information system security evaluation device, the device comprising:

[0040] The response acquisition module is used to respond to the security assessment request of the target information system, acquire the assessment index model corresponding to the security assessment request, and acquire the simulation system corresponding to the target information system.

[0041] The vulnerability scanning module is used to perform a first vulnerability scan on the simulation system based on a vulnerability scanning tool to obtain a first scan result, and to perform a second vulnerability scan on the simulation system based on the MDATA knowledge base to obtain a second scan result.

[0042] The fusion analysis module is used to perform fusion analysis of the scan results based on the first scan result, the second scan result, and the MDATA knowledge base to obtain the system risk assessment result of the simulation system.

[0043] The attack and defense strategy generation module is used to obtain an optimized attack strategy based on the system risk assessment results and the MDATA knowledge base, and to obtain an optimized defense strategy based on the system risk assessment results and the expert knowledge base.

[0044] The evaluation module is used to conduct attack and defense tests on the simulation system based on the optimized attack strategy and the optimized defense strategy, obtain the attack and defense test results, and obtain the security evaluation results of the target information system based on the evaluation index model and the attack and defense test results.

[0045] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the information system security evaluation method as described in the first aspect.

[0046] To achieve the above objectives, a fourth aspect of the present application provides a storage medium, which is a computer-readable storage medium storing a computer program that, when executed by a processor, implements the information system security evaluation method described in the first aspect.

[0047] The information system security evaluation method, apparatus, electronic device, and storage medium proposed in this application include: First, in response to a security evaluation request from a target information system, obtaining an evaluation index model corresponding to the security evaluation request and obtaining a simulation system corresponding to the target information system; then, performing a first vulnerability scan on the simulation system based on a vulnerability scanning tool to obtain a first scan result, and performing a second vulnerability scan on the simulation system based on an MDATA knowledge base to obtain a second scan result; next, performing a fusion analysis of the scan results based on the first scan result, the second scan result, and the MDATA knowledge base to obtain a system risk assessment result for the simulation system; second, obtaining an optimized attack strategy based on the system risk assessment result and the MDATA knowledge base, and obtaining an optimized defense strategy based on the system risk assessment result and an expert knowledge base; finally, performing attack and defense tests on the simulation system based on the optimized attack strategy and the optimized defense strategy to obtain attack and defense test results, and obtaining a security evaluation result for the target information system based on the evaluation index model and the attack and defense test results. This application first introduces a standardized "evaluation index model" and a secure "simulation system," providing a unified benchmark and controllable testing environment for the real-time security evaluation process of information systems. This overcomes the problem of inconsistent evaluation standards. It employs a dual vulnerability scanning approach, combining vulnerability scanning tools with the MDATA knowledge base. The results of these dual vulnerability scans are then fused and analyzed based on the knowledge base to obtain more accurate system risk assessment results, significantly improving the coverage of vulnerability identification and the accuracy of risk assessment. This approach provides a more comprehensive and in-depth identification of system vulnerabilities than relying solely on human experience. The MDATA knowledge base is then used to generate the most targeted optimized attack strategy based on the system risk assessment results. Combined with an expert knowledge base, targeted optimized defense strategies are obtained based on the system risk assessment results. This makes attack and defense testing more scientific and targeted, reducing subjective assumptions and improving the effectiveness of strategies and the objectivity of evaluation. Finally, actual attack and defense tests are conducted in a network testbed, and quantitative security evaluation results are output based on the evaluation index model. This not only verifies the effectiveness of risks and strategies but also improves the accuracy, repeatability, and standardization of information system evaluation.

[0048] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0049] Figure 1 This is a flowchart of an information system security evaluation method provided in an embodiment of this application.

[0050] Figure 2 yes Figure 1 The flowchart for step 101.

[0051] Figure 3 yes Figure 1 The flowchart for step 103.

[0052] Figure 4 yes Figure 3 The flowchart for step 302.

[0053] Figure 5 yes Figure 3 The flowchart for step 303.

[0054] Figure 6 yes Figure 1 The flowchart for step 104.

[0055] Figure 7 yes Figure 6 The flowchart for step 601.

[0056] Figure 8 yes Figure 1 The flowchart following step 105.

[0057] Figure 9 This is a schematic diagram of the structure of an information system security evaluation device provided in another embodiment of this application.

[0058] Figure 10 This is a schematic diagram of the hardware structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] It should be noted that although functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0062] In today's digital age, information systems have become the core support for the daily operations of enterprises and governments, carrying massive amounts of sensitive data and critical business processes. Their security is directly related to economic interests, social order, and even national security. However, with the continuous upgrading of cyberattack methods, data breaches, ransomware, APT attacks, and other security incidents occur frequently, highlighting the increasing vulnerability of information systems and bringing huge risks and losses to organizations. Against this backdrop, conducting comprehensive and in-depth security assessments of information systems is not only necessary to meet regulatory requirements but also an important measure to ensure the stable operation of organizations and maintain social and economic order.

[0063] In related technologies, the existing security assessment process usually involves experienced assessors conducting security assessments of information systems in advance. This relies on the assessors' experience and lacks unified evaluation standards, resulting in low accuracy of the assessment results.

[0064] To improve the accuracy of security assessments of information systems, this application first introduces a standardized "assessment index model" and a secure "simulation system," providing a unified benchmark and controllable testing environment for real-time information system security assessment processes. This overcomes the problem of inconsistent assessment standards. It employs a dual vulnerability scanning approach, combining vulnerability scanning tools with the MDATA knowledge base. The results of these dual vulnerability scans are then fused and analyzed based on the knowledge base to obtain more accurate system risk assessment results, significantly improving the coverage of vulnerability identification and the accuracy of risk assessment. This approach provides a more comprehensive and in-depth identification of system vulnerabilities than relying solely on human experience. The MDATA knowledge base is then used to generate optimized attack strategies that are most targeted under the system risk assessment results. Combined with an expert knowledge base, optimized defense strategies are obtained based on the system risk assessment results, making attack and defense testing more scientific and targeted, reducing subjective assumptions, and improving the effectiveness of strategies and the objectivity of assessments. Finally, actual attack and defense tests are conducted in a network testbed, and quantitative security assessment results are output based on the assessment index model. This not only verifies the effectiveness of risks and strategies but also improves the accuracy, repeatability, and standardization of information system assessments.

[0065] The information system security evaluation method, apparatus, electronic device, and storage medium provided in the embodiments of this application will be further described below. (Refer to...) Figure 1 This is an optional flowchart of the information system security evaluation method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps 101 to 105. It is also understood that this embodiment... Figure 1 The order of steps 101 to 105 is not specifically limited; the order of steps can be adjusted or certain steps can be added or removed according to actual needs. The information system security evaluation method provided in this embodiment can be applied to any server or intelligent processing terminal, etc.

[0066] Step 101: In response to the security assessment request of the target information system, obtain the assessment index model corresponding to the security assessment request, and obtain the simulation system corresponding to the target information system.

[0067] Step 101 will be described in detail below.

[0068] In some embodiments, upon receiving a security evaluation request for a specific target information system, initialization preparation work will be performed first. This preparation work specifically includes two aspects: First, obtaining the evaluation index model corresponding to the security evaluation request. Here, the evaluation index model can be understood as a predefined set of parameters, scoring standards, or calculation functions used to measure and quantify the security status or specific security attributes of an information system, which provides an objective basis for subsequent evaluation result determination. Second, constructing a simulation system in a network range that is highly similar to the target information system in terms of configuration, function, network topology, and even known vulnerabilities. The network range system is essentially an isolated and controllable simulation environment that allows for in-depth security testing and attack and defense drills without affecting the actual production system.

[0069] When acquiring the evaluation indicator model, the process begins by considering the requirements of the security assessment request, such as the risk level and security protection capabilities of the assessment system. Based on factors such as the system type (e.g., web application, industrial control system, or critical infrastructure system), business scale (user volume, data volume), and system architecture (distributed / centralized), the assessment objectives and scope are determined. Following this, a suitable evaluation indicator model is selected, and the evaluation indicators to be covered in this assessment are determined according to the model. The evaluation model and its indicator system need to effectively cover multiple key dimensions of security assessment to comprehensively and accurately evaluate the security of the information system.

[0070] The following section will further describe how to obtain a simulation system corresponding to the target information system.

[0071] Reference Figure 2The simulation system corresponding to the target information system is constructed, including the following steps 201 to 202.

[0072] Step 201: Obtain the asset information of the target information system and identify the key asset information within it.

[0073] Step 202: Based on key asset information and asset information, construct a simulation system corresponding to the target information system, and ensure that the simulation system meets the simulation degree requirements.

[0074] Steps 201 to 202 are described in detail below.

[0075] In some embodiments, to construct a simulation system that matches the target information system, asset information of the target information system is collected using data acquisition tools deployed on the target information system (e.g., network scanners, configuration management database interfaces, automated scripts, etc.), supplemented by necessary manual input to ensure the completeness of the information. For example, for some offline devices or systems with special configurations, manual verification and entry of relevant information may be required. The collected asset information will comprehensively cover detailed hardware and software configuration information such as system configurations of each host (including servers, workstations, network devices, etc.) (e.g., operating system type and version, installed applications and their specific version numbers), network identifiers (e.g., IP address, MAC address), open ports and the types and versions of services running on them. Simultaneously, this asset information also includes key network configuration information such as the network topology depicting the interconnectivity between systems, data flow, access control policies (e.g., specific rule sets of firewalls, policy configurations of intrusion detection / prevention systems), and data transmission paths (e.g., routing tables and routing policies).

[0076] After acquiring this extensive asset information, the next step is to identify key asset information. Key asset information here specifically refers to components that have a decisive impact on the core business functions of the target information system, the sensitivity or value of the data they carry, and the overall operational continuity. Identifying these key asset information typically involves a comprehensive assessment based on their business value (e.g., servers processing core transactions), the sensitivity of the data (e.g., databases storing customer personal information or trade secrets), and specific security requirements (e.g., systems needing to meet specific compliance requirements). These assets may be assigned an appropriate importance level, for example, marking core business application servers, main databases, and authentication / authorization servers as the highest priority key asset information. All acquired asset information (including identified key asset information and their importance levels) is then typically converted into a standardized data format, such as XML, JSON, or a specific database schema, to facilitate unified access and parsing for subsequent automated processing and security assessment analysis in network range construction.

[0077] Next, this precise and structured information will be used to construct a simulation system corresponding to the target information system, based on key asset information and asset information. This simulation system can be understood as a test environment built on a dedicated network range platform using virtualization and simulation technologies, capable of highly simulating the operational state and behavior of the real target information system. Its core objective is to replicate the overall architecture, component configuration, and operational characteristics of the target information system as accurately as possible, especially those components identified as key asset information and their complex interactions, thereby ensuring the authenticity of subsequent security assessments and the validity of the evaluation results. The construction process will strictly adhere to the acquired, standardized asset information of the target information system (including but not limited to hardware and software configuration lists, network topology diagrams, security policy configuration details, etc.), with particular attention paid to the accurate reproduction of key asset information. Finally, "ensuring the simulation system meets simulation requirements" is a crucial quality control step, meaning that the constructed simulation system must maintain a high degree of consistency with the real system in terms of network structure, system configuration, core functions, and even known security vulnerabilities, and be completely isolated, thus providing an ideal target for subsequent automated attack and defense testing that realistically reflects potential risks without affecting the actual production environment.

[0078] Through steps 201 to 202 above, a comprehensive and detailed acquisition of the target information system's asset information is achieved, and the key asset information and its importance are accurately determined. This provides a detailed and accurate data foundation and priority guidance for subsequent simulation construction. Based on this key asset information and overall asset information, a simulation system highly corresponding to the target information system is carefully constructed in an isolated network range environment. This system strives to maintain consistency with the real system in terms of hardware and software configuration, network topology, and key business processes. This ensures that subsequent security assessment activities can fully reflect the potential risk points and attack surfaces of the real system without causing any interference or damage to actual business operations, thus laying a solid foundation for the effectiveness, reliability, and security of the entire assessment method.

[0079] Step 102: Perform a first vulnerability scan on the simulation system using a vulnerability scanning tool to obtain the first scan result, and perform a second vulnerability scan on the simulation system using the MDATA knowledge base to obtain the second scan result.

[0080] Step 102 is described in detail below.

[0081] In some embodiments, after obtaining the evaluation metric model and building or configuring the simulation system, a comprehensive vulnerability scan is performed on the simulation system. This scanning process employs a dual mechanism to enhance the breadth and depth of discovery: First, a first vulnerability scan is performed on the simulation system using one or more general-purpose vulnerability scanning tools, i.e., software programs capable of automatically detecting common security vulnerabilities, thereby obtaining a first scan result, which typically includes potential vulnerabilities identified based on the tool's built-in rule base; Second, a second vulnerability scan is further performed on the same simulation system based on a core MDATA knowledge base to obtain a second scan result.

[0082] The MDATA model (Multi-dimensional Data Association and Threat Analysis) is a cognitive model applicable to cybersecurity situational awareness. This model enables the correlation analysis of multi-dimensional data and the construction of cybersecurity knowledge with spatiotemporal characteristics, providing analysts with a cognitive model suitable for cybersecurity situational awareness. The MDATA model was created to address the challenges of widely distributed data and the difficulty in representing cybersecurity knowledge due to its spatiotemporal characteristics in cybersecurity situational awareness.

[0083] Step 103: Based on the first scan result, the second scan result, and the MDATA knowledge base, perform a fusion analysis of the scan results to obtain the system risk assessment result of the simulation system.

[0084] Step 103 will be described in detail below.

[0085] In some embodiments, after obtaining the aforementioned first and second scan results, the MDATA knowledge base is used to perform a fusion analysis of the two sets of scan data. This fusion analysis process aims to integrate vulnerability information from different sources, such as through deduplication, verification, and correlation analysis, to eliminate redundancy and false positives, and to supplement and enhance the scan findings using deeper contextual information in the MDATA knowledge base (such as asset associations, dependencies between vulnerabilities, and vulnerability exploitation conditions). Through this comprehensive analysis, a more comprehensive and accurate system risk assessment result for the simulation system can be obtained. This result not only points out the existing vulnerabilities but may also preliminarily reveal the potential impact of these vulnerabilities on the overall security posture of the system.

[0086] The following section will further describe how to perform fusion analysis.

[0087] Reference Figure 3Based on the first scan result, the second scan result, and the MDATA knowledge base, the scan results are fused and analyzed to obtain the system risk assessment result of the simulation system, including the following steps 301 to 303.

[0088] Step 301: Perform deduplication and merging on the first scan result and the second scan result to obtain the associated deduplicated scan result.

[0089] Step 302: Perform association analysis on the association deduplication scan results based on the MDATA knowledge base to obtain the association scan results.

[0090] Steps 301 to 302 are described in detail below.

[0091] In some embodiments, after obtaining the first scan result generated by a general vulnerability scanning tool and the second scan result generated by a deep scan based on the MDATA knowledge base, these two sets of heterogeneous vulnerability data undergo preliminary integration processing. Specifically, this processing involves deduplicating and merging the first and second scan results. The purpose is to eliminate identical or highly similar vulnerability entries that may be identified by different scanning sources or mechanisms, avoid information redundancy, and ensure that each unique vulnerability information (i.e., vulnerability information) is included in subsequent analysis. Through this deduplication and merging operation, a more refined and comprehensive preliminary vulnerability list can be formed, resulting in a correlated deduplicated scan result containing multiple vulnerability scan data.

[0092] Next, the core MDATA knowledge base will be used to perform correlation analysis on the correlation deduplication scan results. This will verify, enrich, and contextualize each vulnerability information in the correlation deduplication scan results, ultimately yielding correlation scan results. Compared to the initial scan list, these results have higher accuracy, richer contextual information, and a preliminary revelation of potential connections between vulnerabilities.

[0093] Reference Figure 4 The association analysis is performed on the association deduplication scan results based on the MDATA knowledge base to obtain the association scan results, including the following steps 401 to 404.

[0094] Step 401: Obtain the vulnerability data information corresponding to each vulnerability scan data from the MDATA knowledge base, and verify each vulnerability scan data based on the corresponding vulnerability data information to obtain the vulnerability verification result corresponding to each vulnerability scan data.

[0095] Step 402: Obtain vulnerability association information of the target information system from the MDATA knowledge base, and determine the vulnerability scanning association information between vulnerability scanning data based on the vulnerability association information.

[0096] Step 403: Obtain the network topology information and asset configuration information of the target information system, and perform correlation analysis based on the network topology information, asset configuration information and vulnerability scanning correlation information to obtain the correlation analysis results.

[0097] Step 404: Obtain the correlation scan results based on the vulnerability verification results and correlation analysis results.

[0098] Steps 401 to 404 are described in detail below.

[0099] In some embodiments, after obtaining the associated deduplication scan results after preliminary deduplication and merging processing, vulnerability data information corresponding to each vulnerability scan record is retrieved from the MDATA knowledge base. This vulnerability data information refers to a detailed and authoritative description of a specific vulnerability stored in the MDATA knowledge base, which may include the vulnerability's standard number (e.g., CVE ID), technical details, scope of impact, known exploitation conditions, remediation solutions, and historical false positives. Next, each vulnerability scan record is verified based on the corresponding vulnerability data information. This involves comparing and verifying the associated deduplication scan results with the authoritative information in the MDATA knowledge base, such as checking whether the vulnerability exists in a specific version of the target system and whether the configuration meets the exploitation conditions. This yields a vulnerability verification result for each vulnerability scan record. This vulnerability verification result clarifies the authenticity and validity of the vulnerability pointed to by each scan record, helping to filter out false positives that may be generated by the scanning tool and improving the accuracy of subsequent analysis.

[0100] After verifying the authenticity of individual vulnerabilities, the potential connections between different vulnerabilities will be further explored, namely, obtaining vulnerability association information of the target information system from the MDATA knowledge base. Here, vulnerability association information refers to knowledge stored in the MDATA knowledge base regarding possible dependencies, synergistic effects, or exploit sequences between different vulnerabilities. For example, the exploitation of one vulnerability may create conditions for the exploitation of another, or multiple low-risk vulnerabilities combined may form a high-risk vulnerability. Then, this embodiment will determine the vulnerability scanning association information between vulnerability scanning data based on the vulnerability association information. That is, the verified vulnerability scanning data (i.e., vulnerabilities actually existing in the simulation system) will be matched and reasoned with the vulnerability association information in the MDATA knowledge base to identify the actual interrelationships between verified vulnerabilities existing in the current system, forming vulnerability scanning association information, providing a basis for subsequent attack chain construction and understanding of systemic risks.

[0101] Next, to gain a more comprehensive understanding of the potential impact and exploitability of vulnerabilities in the target information system, this embodiment will introduce a comprehensive analysis of the system's specific configuration and network structure information. First, the latest network topology and asset configuration information of the target information system, directly obtained during the asset probing process in the initial evaluation phase, will be retrieved. The network topology information depicts the connection relationships, network segments, data flow, and access control policies of various nodes (such as servers and network devices) in the target information system; while the asset configuration information details the specific hardware and software configurations, running services, and security settings of each asset. Next, this embodiment will perform a correlation analysis based on the network topology information, asset configuration information, and vulnerability scanning correlation information obtained in the previous step. This correlation analysis is a multi-dimensional information fusion process that examines the location of verified and interconnected vulnerabilities in the actual network topology, the configuration of the assets they reside in, and the reachability between assets. For example, it determines whether a vulnerability can be directly exploited from an external network, or whether an internal vulnerability can be indirectly exploited through a series of network jumps, thereby obtaining the correlation analysis results. The correlation analysis results profoundly reveal the actual exposure surface and potential cascading effects of vulnerabilities in a real system environment.

[0102] After a series of detailed verifications and multi-dimensional correlation analyses, this embodiment will summarize all the collected processing results to form the final deep scan conclusion, namely the correlation scan result.

[0103] Through steps 401 to 404 above, authoritative vulnerability information is obtained from the MDATA knowledge base, and the scan data is verified, effectively eliminating false positives and ensuring the accuracy of vulnerability information. This forms the foundation for all subsequent analysis. Secondly, vulnerability correlation information from the MDATA knowledge base is used to identify potential connections between vulnerabilities, allowing the assessment to move beyond isolated vulnerability points and understand the collaborative risks between vulnerabilities from a more macroscopic perspective. Furthermore, incorporating actual system environment factors such as network topology and asset configuration into the correlation analysis makes the vulnerability assessment more realistic and enables a more accurate judgment of the true exposure and exploitability of vulnerabilities. Finally, the resulting correlation scan results integrate authenticity, correlation, and contextual information, providing high-quality input for subsequent attack path analysis and system risk assessment, significantly improving the depth and accuracy of security evaluation of the target information system.

[0104] Step 303: Analyze the attack paths of the correlation scan results based on the MDATA knowledge base to obtain the potential attack paths of the simulation system.

[0105] Step 303 will be described in detail below.

[0106] In some embodiments, after obtaining the correlation scan results after deep correlation analysis, this embodiment continues to rely on the MDATA knowledge base to analyze the attack paths of the correlation scan results. The MDATA knowledge base provides key information on vulnerability exploitation techniques, attack sequences, privilege escalation methods, and reachability between different network areas during this process. By combining the valid vulnerabilities identified in the correlation scan results with the attack techniques and tactics in the MDATA knowledge base, and taking into account the network topology and configuration information of the simulation system, this method can deduce how to chain multiple vulnerabilities to form a complete attack chain starting from one or more entry points, thereby obtaining a set of potential attack paths for the simulation system. These potential attack paths represent multi-step attack sequences that the system may suffer and that have a certain degree of feasibility.

[0107] Understandably, attack path analysis is a key security assessment technique that aims to simulate how attackers exploit one or more interrelated vulnerabilities in a system to gradually penetrate the system, escalate privileges, and ultimately achieve their attack goals (such as stealing data or damaging the system) through a series of steps (i.e., the attack path).

[0108] The following section will further describe how to perform attack path analysis.

[0109] Reference Figure 5 Based on the MDATA knowledge base, attack path analysis is performed on the correlation scan results to obtain the potential attack paths of the simulation system, including the following steps 501 to 502.

[0110] Step 501: Obtain vulnerability exploitation information from the MDATA knowledge base, and determine the attackable assets in the simulation system based on the correlation scan results, asset configuration information, and vulnerability exploitation information;

[0111] Step 502: Determine the attackable path for each attackable asset based on network topology information, and obtain potential attack paths based on all attackable paths.

[0112] Steps 501 to 502 are described in detail below.

[0113] In some embodiments, after obtaining the correlation scan results through deep correlation analysis, the process begins to identify specific assets in the simulation system that may actually be attacked. This process first retrieves vulnerability exploitation information from the MDATA knowledge base. This vulnerability exploitation information refers to knowledge stored in the MDATA knowledge base regarding the technical details of how to actually exploit known vulnerabilities, the required tools, specific environmental conditions, and the privileges or impacts that may be gained or caused after successful exploitation.

[0114] Next, based on the correlation scan results, asset configuration information, and vulnerability exploitation information, vulnerable assets in the simulation system will be identified. This involves matching the verified and interconnected vulnerabilities listed in the correlation scan results with detailed asset configuration information for each asset (e.g., operating system version, installed software, open ports and services) and corresponding vulnerability exploitation information obtained from the MDATA knowledge base. This allows us to determine which assets have vulnerabilities that are indeed exploitable under the current configuration, and these assets are identified as "vulnerable assets." These vulnerable assets are targets where attackers may successfully launch attacks within the simulation system, gain an initial foothold, or further lateral movement.

[0115] After identifying the vulnerable assets in the simulation system, the next step is to analyze how attackers could actually access and exploit vulnerabilities in these assets. This will begin by determining the attack paths for each vulnerable asset based on the network topology information of the identified target information system.

[0116] The network topology information details the network connections, network segments, firewall rules, and routing policies among the various nodes (including attackable assets) in the system. By analyzing this network topology information, and combining it with the location of attackable assets and the exploitation conditions of their vulnerabilities (e.g., some vulnerabilities may require specific network access permissions), it is possible to infer the network paths from a certain attack origin (which could be an external network or a compromised internal system) to each attackable asset, enabling the successful exploitation of its vulnerabilities. These paths are the attackable paths targeting individual attackable assets.

[0117] Subsequently, all identified attackable paths are integrated. Considering that the number of paths can be extremely large in a large-scale network environment, to ensure the efficiency and focus of the analysis, the system does not directly use all paths. Instead, it sorts and filters them through grouping, preliminary threat assessment, or correlation analysis, and finally determines a set of top-ranked and high-threat paths, which constitute the core set of 'potential attack paths' for subsequent risk assessment and attack strategy generation.

[0118] Through steps 501 to 502 above, by combining vulnerability exploitation information and asset configuration information, attackable assets are identified. This ensures that the focus of the analysis is concentrated on system components that are truly at risk of being exploited, avoiding ineffective analysis of theoretically existing but practically difficult-to-exploit vulnerabilities. This improves the accuracy and efficiency of attack path analysis. Based on network topology information, the attackable paths of each attackable asset are determined. These paths are integrated to obtain potential attack paths with higher risk, higher exploitability, or higher threat. This allows the assessment to truly reflect the penetration routes and lateral movement methods that attackers may take at the network level, revealing the end-to-end attack chains that exist in the system and may be exploited by attackers. This helps managers to more clearly understand the real threat scenarios they face and provides direct and specific guidance for subsequent development of targeted defense strategies, patching of high-risk vulnerabilities, and optimization of network security architecture, thereby more effectively improving the overall security protection capabilities of information systems.

[0119] Step 304: Based on potential attack paths and asset information of the simulation system, obtain the system risk assessment results.

[0120] Step 304 will be described in detail below.

[0121] In some embodiments, once potential attack paths are identified in the simulation system, the information on these attack paths, along with previously acquired asset information of the simulation system, is combined to make a final risk assessment, resulting in a system risk evaluation. The risk assessment process involves comprehensively considering the harmfulness of each potential attack path and the value of the assets that path can reach or affect. For example, a potential attack path that could lead to the leakage of critical business database data will obviously have a higher risk level than an attack path that can only affect non-core, low-value assets, even if the technical difficulty of the two paths is similar.

[0122] By conducting such quantitative or qualitative assessments of all potential attack paths, and comprehensively considering the probability of an attack's success (as determined by the exploitability of vulnerabilities in the path) and the potential impact on assets after a successful attack, a comprehensive system risk assessment result for the entire simulation system is ultimately formed. This result can clearly identify the main threats faced by the system, high-risk areas, and the priority of different risks.

[0123] Through steps 301 to 304 above, the deduplication and merging of multi-source scan results ensures the refinement and comprehensiveness of the input data, avoids redundant analysis, and integrates the advantages of different scanning tools. Deep correlation analysis based on the MDATA knowledge base not only verifies the authenticity of vulnerabilities but also reveals the inherent connections between vulnerabilities and their actual exposure in specific system environments, surpassing the limitations of traditional isolated vulnerability assessments. Attack path analysis based on these highly contextualized correlation scan results can simulate the perspective of a real attacker, identifying potential, exploitable multi-step attack chains in the system. This makes risk assessment more forward-looking and practical. Combined with asset information, a comprehensive evaluation of these potential attack paths results in a system risk assessment that accurately reflects the actual impact and priority of each risk point on business operations. In summary, this series of steps, through a systematic and knowledge-driven analysis process, greatly improves the accuracy, depth, and comprehensiveness of risk identification, providing managers with a clearer and more instructive understanding of the security situation, thereby enabling them to more effectively formulate and implement targeted security protection measures.

[0124] Step 104: Based on the system risk assessment results and the MDATA knowledge base, obtain the optimized attack strategy, and based on the system risk assessment results and the expert knowledge base, obtain the optimized defense strategy.

[0125] Step 104 is described in detail below.

[0126] In some embodiments, based on the obtained system risk assessment results, the system will further proceed to the generation stage of attack and defense strategies. Specifically, on the one hand, based on the system risk assessment results and information such as attack vectors, attack tools, attack paths, and vulnerability exploitation techniques stored in the MDATA knowledge base, optimized attack strategies, including target attack paths and target path attack strategies, can be intelligently generated. These strategies aim to simulate the most effective attack paths and strategies adopted by real attackers against identified risk points. On the other hand, also based on the system risk assessment results, and combined with an expert knowledge base (which typically contains mature defense experience, configuration suggestions, and incident response measures for various security threats and vulnerabilities summarized and refined by security experts), corresponding optimized defense strategies are generated to guide how to harden the system to resist potential attacks.

[0127] Reference Figure 6 Based on the system risk assessment results and the MDATA knowledge base, an optimized attack strategy is obtained, including the following steps 601 to 605.

[0128] Step 601: Based on the system risk assessment results, determine the comprehensive attack threat level of each potential attack path, and sort them according to the numerical value of the comprehensive attack threat level. Select the potential attack paths with the number of candidate paths from multiple potential attack paths as candidate attack paths.

[0129] Step 601 will be described in detail below.

[0130] In some embodiments, based on the results of a previously completed system risk assessment, the comprehensive attack threat level is calculated and determined for each potential attack path in the core set of 'potential attack paths' identified and organized during the assessment process.

[0131] Understandably, the overall attack threat level is a quantitative indicator that comprehensively considers various factors such as the probability of success of an attack, the difficulty of exploitation, the resources required, and the probability of being detected in each link of a potential attack path, in order to assess the overall likelihood or frequency of an attacker successfully exploiting a specific potential attack path.

[0132] After determining the overall attack threat level of all potential attack paths, they will be ranked according to the magnitude of this overall attack threat level. Finally, based on a preset number of candidate paths (a configurable parameter used to control the scope and depth of the analysis), the top-ranked paths will be selected from the ranked set of potential attack paths as candidate attack paths, which will serve as the basis for the next stage of analysis.

[0133] The following section will first describe how to calculate the overall attack threat level for each potential attack path.

[0134] Reference Figure 7 Based on the system risk assessment results, the comprehensive attack threat level of each potential attack path is determined, including the following steps 701 to 704.

[0135] Step 701: Based on the vulnerability exploitability information in the MDATA knowledge base and the system risk assessment results, determine the exploitability of each potential attack path.

[0136] Step 702: Based on the asset damage hazard information and system risk assessment results from the MDATA knowledge base, determine the hazard rate of each potential attack path.

[0137] Step 703: Based on the asset importance information, path coverage asset information, and system risk assessment results, determine the important asset coverage rate for each potential attack path.

[0138] Step 704: Based on the weighted processing of availability, harm rate, and coverage of important assets, obtain the comprehensive attack threat level of each potential attack path.

[0139] Steps 701 to 704 are described in detail below.

[0140] In some embodiments, the exploitability information from the MDATA knowledge base and the system risk assessment results are used to quantitatively analyze and obtain the exploitability rate of each potential attack path. It is understood that this exploitability rate is a quantitative metric used to assess the likelihood or difficulty of an attacker successfully exploiting a specific potential attack path. The vulnerability exploitability information in the MDATA knowledge base includes standardized data related to the ease of exploitation of known vulnerabilities, such as technical details, public availability of exploit code, exploit complexity, required permissions, and whether user interaction is required. The system risk assessment results from the MDATA knowledge base provide the specific context of the target information system, such as the actual vulnerability configurations in the system, deployed defenses, and network environment. These factors all affect the actual probability of a theoretical vulnerability being exploited in a real-world environment. By combining these two aspects, the system can more accurately assess the likelihood of each potential attack path being successfully implemented.

[0141] Next, the hazard rate is calculated for each potential attack path. This hazard rate aims to quantify the severity of the negative impact that a successful exploitation of a potential attack path could have on a system or organization. This calculation relies on asset damage hazard information from the MDATA knowledge base and existing system risk assessments to evaluate the actual damage that a successful exploitation of a particular potential attack path would cause to related assets and the overall business, thus deriving the key indicator of "hazard rate." The asset damage hazard information in the MDATA knowledge base includes standardized descriptions and assessments of the specific damage consequences that different types of assets (such as data, services, and equipment) may suffer when subjected to different types of attacks (such as data breaches, service interruptions, and loss of system control), which may include multiple dimensions such as economic losses, reputational damage, and legal liability.

[0142] Next, the critical asset coverage of each potential attack path is further evaluated. This critical asset coverage represents the number or proportion of critical assets touched or affected by each potential attack path in its attack sequence. This calculation is based on the collected asset importance information, path-covered asset information, and the obtained system risk assessment results to determine the extent to which each potential attack path exposes the organization's critical resources to risk. The collected asset importance information includes the criteria and classification system for judging asset importance, such as classifying them according to the coreness of the asset in the business process, the sensitivity level of the stored data, or its criticality in meeting compliance requirements. Path-covered asset information refers to the list of system assets that will be directly or indirectly interacted with, accessed, controlled, or damaged during the execution of each potential attack path by analyzing its specific composition.

[0143] Finally, the three independent risk dimensions of availability, damage rate, and critical asset coverage for each potential attack path calculated earlier are integrated and weighted to calculate the overall attack threat level for each potential attack path.

[0144] Through steps 701 to 704 above, the determination of the overall attack threat level is no longer based on a single dimension or vague judgment, but is based on a systematic analysis and quantification of path exploitability, potential harm rate, and coverage of important assets. By introducing professional data on vulnerability exploitability, asset damage and harm information, and asset importance information from the MDATA knowledge base, and combining it with specific system risk assessment results and path coverage asset information, this method can more objectively and accurately assess the true threat level of each potential attack path. The introduction of a weighted processing mechanism allows for flexible adjustment of the relative importance of different risk factors according to actual security strategies and business priorities, thereby producing an overall attack threat ranking that better meets the specific needs of the organization. This lays a solid data foundation for more accurate screening of candidate attack paths and the formulation of targeted defense strategies.

[0145] Step 602: Based on the vulnerability association information between candidate attack paths, combine and associate the candidate attack paths to obtain multiple candidate combined attack paths.

[0146] Step 603: Based on the MDATA knowledge base, generate a path recommendation attack strategy corresponding to each candidate combined attack path.

[0147] Step 604: For each candidate attack path combination, use the corresponding path recommendation attack strategy to obtain the attack score corresponding to each candidate attack path combination.

[0148] Step 605: Based on the attack score, asset importance, attack tactics coverage and attack impact range corresponding to each candidate attack path combination, select the target attack path from multiple candidate attack path combinations, and use the path recommended attack strategy corresponding to the target attack path as the target path attack strategy.

[0149] Steps 602 to 605 are described in detail below.

[0150] In some embodiments, the system performs in-depth analysis on the obtained set of candidate attack paths to identify and utilize vulnerability association information between these paths. Vulnerability association information refers to the interdependence, mutual reinforcement, or chain-exploitability relationships between different vulnerabilities. For example, the successful exploitation of one vulnerability may create preconditions for the exploitation of another vulnerability, or multiple vulnerabilities may be cleverly combined by attackers to form a longer, more covert, or more destructive attack chain.

[0151] Based on this detailed vulnerability association information, further combination association operations are performed to identify paths that can be connected through shared vulnerabilities, sequential exploitation, or logical linkage, and these paths are integrated into new, more complex attack sequences. Through such combination association, multiple candidate combined attack paths are generated, each representing a potential advanced attack scenario consisting of multiple single attack steps or exploiting multiple related vulnerabilities.

[0152] Next, for each candidate attack path combination, a matching attack strategy will be generated, which relies on the MDATA knowledge base. The MDATA knowledge base stores a large number of patterned descriptions of known attackers' tactics, techniques, and processes (TTPs), exploit details, malware behavior characteristics, and historical attack events.

[0153] By intelligently matching and reasoning the characteristics of the current candidate attack path combination (such as the types of vulnerabilities involved, target asset attributes, network topology, etc.) with entries in the MDATA knowledge base, one or more specific and operable attack execution schemes are derived for the candidate attack path combination as a path recommendation attack strategy. This strategy details the specific technical means and operational steps that the attacker may take to successfully traverse the attack path combination.

[0154] Then, each candidate attack path combination and its corresponding recommended attack strategy are quantitatively evaluated to determine the attack score of the threat level of the candidate attack path combination to the target information system under the recommended attack strategy.

[0155] When calculating the attack score, the system considers various factors, such as the success probability of each step in the recommended attack strategy, the required technical complexity, execution cost, potential business impact (such as the severity of data breaches and service interruptions), and the difficulty for the strategy to be detected and blocked by existing defense systems. By weighting and summarizing these factors or using a specific risk assessment model, the system assigns a specific numerical value, i.e., an attack score, to each candidate attack path combination. A higher score generally indicates a greater threat posed by the path and its corresponding strategy.

[0156] After obtaining the attack score corresponding to the recommended attack strategy for each candidate attack path combination, the most substantial threat to the target information system is precisely identified from among numerous feasible candidate attack paths, and this is established as the final target attack path. This process comprehensively considers four key factors: first, the attack score, which quantifies the technical advantages and success probability of the attack strategy itself; second, asset importance, ensuring priority is given to paths that can access core business or sensitive data; third, attack technique and tactic coverage, favoring paths that can simulate a wider range of more complex attack methods to achieve more comprehensive testing results; and finally, the scope of attack impact, assessing the extent of system assets affected if the path succeeds.

[0157] Asset importance refers to the core value of system assets (such as servers, databases, applications, and data) that an attack path can reach or affect to an organization's business. Attack technique and tactic coverage measures the diversity and representativeness of the attack techniques and tactics simulated by a candidate attack path combination. Attack impact scope refers to the number or breadth of assets in the system whose negative impact will be affected once an attack path is successfully executed; it measures the lateral spread capability of the attack and the scale of the chain reaction.

[0158] By weighting or comprehensively scoring these four dimensions, and weighing multiple aspects such as technical feasibility, business impact, testing value, and destructive potential, the path with the optimal overall evaluation result is ultimately selected as the target attack path. Simultaneously, the corresponding attack strategy is recommended as the target path attack strategy. This target path attack strategy reveals to the defender the specific tactics and techniques most likely to be employed by attackers on the most critical threat paths.

[0159] Through steps 601 to 605 above, by quantitatively assessing system risks, screening and combining potential attack paths, generating specific attack strategies using a professional knowledge base, and scoring and ranking these strategies, a comprehensive assessment is conducted from multiple perspectives, including technical feasibility, business impact, testing value, and destructive potential. Ultimately, this allows for the accurate identification of the most substantial "target attack path" and the most likely "target path attack strategy" from a complex array of potential threats. This enables security teams to focus limited defense resources and efforts on the most critical risk points, rather than spreading them across all theoretically possible threats. By introducing technical features such as comprehensive attack threat level, vulnerability association information, the MDATA knowledge base, and attack scores, a multi-dimensional and in-depth analysis of attack possibilities is achieved, improving the accuracy and foresight of threat warnings. This not only helps enterprises gain a deeper understanding of the vulnerabilities of their systems and the possible behavioral patterns of attackers, but also provides direct and specific technical support for developing more targeted and efficient defense hardening measures, emergency response plans, and security drill scenarios, thereby significantly improving overall network security protection capabilities and risk resistance levels.

[0160] Step 105: Conduct attack and defense tests on the simulation system based on the optimized attack and defense strategies, obtain the attack and defense test results, and obtain the security evaluation results of the target information system based on the evaluation index model and the attack and defense test results.

[0161] Step 105 is described in detail below.

[0162] In some embodiments, after generating optimized attack and defense strategies, these strategies are actually executed in the simulation system, i.e., attack and defense testing is conducted. This attack and defense testing phase includes simulating an attacker launching an attack on the simulation system according to the optimized attack strategy, while observing the effectiveness of preset or deployed protective measures based on the optimized defense strategy, thereby obtaining an attack and defense test result. This result reflects the actual performance of the system in a specific attack and defense scenario, such as whether vulnerabilities can be exploited, whether the attack is successful, and whether the defense measures are effective. Finally, the overall security status of the target information system is quantitatively assessed by combining the initially obtained evaluation index model and the results of this attack and defense test, and the final security evaluation result is output. This result can provide users with a clear report on the system's security level, major risk points, and improvement suggestions.

[0163] Reference Figure 8 The security evaluation method for information systems also includes step 801: adjusting the evaluation index parameters in the evaluation index model based on the security evaluation results.

[0164] In some embodiments, the evaluation index parameters in the evaluation index model used for measuring and determining security status are dynamically adjusted based on the previously performed and obtained security evaluation results. It is understood that the evaluation index parameters in the evaluation index model are specific configurable elements constituting the model, such as the weight values ​​of each index, the threshold for risk level classification, the selection criteria and definitions of specific metrics, and the frequency or range of data collection.

[0165] This adjustment process is initiated when security assessment results reveal deficiencies or biases in the current evaluation indicator model's ability to reflect real risks, guide security decisions, or adapt to a constantly changing security environment—for example, the model may not be sensitive enough to certain emerging threat types, or the weighting of certain indicators may not accurately reflect their actual impact on overall business. By analyzing the differences between the security assessment results and the model's expected output, or based on new risk points revealed by the assessment results, the evaluation indicator parameters are modified and improved in a targeted manner to optimize the evaluation indicator model, thereby enhancing the accuracy, relevance, and effectiveness of subsequent security assessments.

[0166] The information system security evaluation method, apparatus, electronic device, and storage medium proposed in this application include: First, in response to a security evaluation request from a target information system, obtaining an evaluation index model corresponding to the security evaluation request, and obtaining asset information of the target information system, and determining key asset information within the asset information; based on the key asset information and the asset information, constructing a simulation system corresponding to the target information system; then, performing a first vulnerability scan on the simulation system using a vulnerability scanning tool to obtain a first scan result, and performing a second vulnerability scan on the simulation system based on the MDATA knowledge base to obtain a second scan result; next, performing deduplication and merging processing on the first scan result and the second scan result to obtain a correlated deduplicated scan result, obtaining vulnerability data information corresponding to each vulnerability scan data from the MDATA knowledge base, and performing processing on each vulnerability scan data based on the corresponding vulnerability data information. The system performs verification to obtain vulnerability verification results for each vulnerability scan. It retrieves vulnerability association information of the target information system from the MDATA knowledge base and determines vulnerability scanning association information between vulnerability scan data based on the vulnerability association information. It obtains network topology information and asset configuration information of the target information system and performs association analysis based on the network topology information, asset configuration information, and vulnerability scanning association information to obtain association analysis results. It obtains association scan results based on vulnerability verification results and association analysis results. It retrieves vulnerability exploitation information from the MDATA knowledge base and determines attackable assets in the simulation system based on association scan results, asset configuration information, and vulnerability exploitation information. It determines the attackable paths for each attackable asset based on network topology information and obtains potential attack paths based on all attackable paths. It obtains system risk assessment results based on potential attack paths and asset information of the simulation system.Secondly, based on the vulnerability exploitability information and system risk assessment results from the MDATA knowledge base, the exploitability of each potential attack path is determined. Based on the asset damage hazard information and system risk assessment results from the MDATA knowledge base, the hazard rate of each potential attack path is determined. Based on asset importance information, path-covered asset information, and system risk assessment results, the important asset coverage rate of each potential attack path is determined. A weighted average of the exploitability, hazard rate, and important asset coverage rate is used to obtain the comprehensive attack threat level of each potential attack path. Based on the numerical value of the comprehensive attack threat level, potential attack paths with a certain number of candidate paths are selected as candidate attack paths. Based on the vulnerability correlation information between candidate attack paths, the candidate attack paths are combined and associated to obtain multiple candidate combined attack paths. Each candidate combined attack path includes candidate... Based on the MDATA knowledge base, and considering at least two potential attack paths in the attack path, a path recommendation attack strategy is generated for each candidate attack path combination. For each candidate attack path combination, an attack score is obtained using the corresponding path recommendation attack strategy. Based on the attack score, asset importance, attack tactical coverage, and attack impact range of each candidate attack path combination, a target attack path is selected from multiple candidate attack path combinations. The path recommendation attack strategy corresponding to the target attack path is then used as the target path attack strategy. Based on the system risk assessment results and the expert knowledge base, an optimized defense strategy is obtained. Finally, the simulation system is subjected to attack and defense tests based on the optimized attack and defense strategies to obtain the attack and defense test results. Based on the evaluation index model and the attack and defense test results, the security evaluation results of the target information system are obtained.

[0167] This application's embodiments first introduce a standardized "evaluation index model" and a secure "simulation system," providing a unified benchmark and controllable testing environment for the real-time information system security evaluation process. This overcomes the problem of inconsistent evaluation standards. Furthermore, it employs a dual vulnerability scanning approach, combining vulnerability scanning tools with the MDATA knowledge base. Based on the knowledge base, it fuses and analyzes the results of these dual vulnerability scans to obtain more accurate system risk assessment results. This significantly improves the coverage of vulnerability identification and the accuracy of risk assessment, providing a more comprehensive and in-depth identification of system vulnerabilities than relying solely on human experience. Finally, it utilizes the MDATA knowledge base to generate the most targeted optimizations based on the system risk assessment results. Attack strategies were developed and, combined with an expert knowledge base, targeted and optimized defense strategies were derived based on system risk assessment results. This made attack and defense testing more scientific and targeted, reduced subjective assumptions, and improved the effectiveness of strategies and the objectivity of evaluations. Subsequently, actual attack and defense tests were conducted in a network range, and quantitative security evaluation results were output based on the evaluation index model. This not only verified the effectiveness of the risks and strategies but also improved the accuracy and repeatability of information system evaluations, making the evaluation process more standardized. Furthermore, by comprehensively and meticulously acquiring the asset information of the target information system and accurately identifying key asset information and its importance, detailed data was provided for subsequent simulation construction. With accurate data foundation and priority guidance, and based on this critical asset information and overall asset information, a simulation system highly corresponding to the target information system was meticulously constructed in an isolated network range environment. This system strives to maintain consistency with the real system in terms of hardware and software configuration, network topology, and key business processes. This ensures that subsequent security assessments can fully reflect the potential risks and attack surfaces of the real system without causing any interference or damage to actual business operations, laying a solid foundation for the effectiveness, reliability, and security of the entire assessment methodology. Furthermore, by deduplicating and merging multi-source scan results, the refinement and comprehensiveness of the input data are ensured, avoiding redundant analysis and consolidation. By combining the advantages of different scanning tools and relying on the MDATA knowledge base for in-depth correlation analysis, it not only verifies the authenticity of vulnerabilities but also reveals the inherent connections between vulnerabilities and their actual exposure in specific system environments. This surpasses the limitations of traditional isolated vulnerability assessments. Attack path analysis based on these highly contextualized correlation scan results can simulate the perspective of a real attacker, identify potential and exploitable multi-step attack chains in the system, and make risk assessment more forward-looking and practical. By combining asset information to comprehensively evaluate these potential attack paths, the resulting system risk assessment results can accurately reflect the actual impact and priority of each risk point on the business.In summary, this series of steps, through a systematic and knowledge-driven analysis process, significantly improves the accuracy, depth, and comprehensiveness of risk identification, providing managers with a clearer and more instructive understanding of the security posture. This enables them to more effectively formulate and implement targeted security protection measures. Furthermore, by quantitatively assessing system risks, screening and combining potential attack paths, generating specific attack strategies using a professional knowledge base, and scoring and ranking these strategies, the system can ultimately accurately identify the most substantial "target attack paths" posing a threat to the system and the "target path attack strategies" most likely to be employed by attackers from a complex array of potential threats. This allows security teams to... It allows limited defense resources and efforts to be focused on the most critical risk points, rather than spreading them across all theoretically possible threats. By introducing technical features such as comprehensive attack threat level, vulnerability correlation information, MDATA knowledge base, and attack scores, it achieves multi-dimensional and in-depth analysis of attack possibilities, improving the accuracy and foresight of threat warnings. This not only helps enterprises to better understand the vulnerabilities of their own systems and the possible behavioral patterns of attackers, but also provides direct and specific technical support for developing more targeted and efficient defense hardening measures, emergency response plans, and security drill scenarios, thereby significantly improving overall network security protection capabilities and risk resistance levels.

[0168] This application also provides an information system security evaluation device that can implement the above-described information system security evaluation method, referring to... Figure 9 The device 900 includes:

[0169] The response acquisition module 910 is used to respond to the security assessment request of the target information system, acquire the assessment index model corresponding to the security assessment request, and acquire the simulation system corresponding to the target information system.

[0170] The vulnerability scanning module 920 is used to perform a first vulnerability scan on the simulation system based on a vulnerability scanning tool to obtain a first scan result, and to perform a second vulnerability scan on the simulation system based on the MDATA knowledge base to obtain a second scan result.

[0171] The fusion analysis module 930 is used to perform fusion analysis of the scan results based on the first scan result, the second scan result, and the MDATA knowledge base to obtain the system risk assessment result of the simulation system.

[0172] The attack and defense strategy generation module 940 is used to obtain optimized attack strategies based on system risk assessment results and MDATA knowledge base, and to obtain optimized defense strategies based on system risk assessment results and expert knowledge base.

[0173] The evaluation module 950 is used to conduct attack and defense tests on the simulation system based on optimized attack and defense strategies, obtain attack and defense test results, and obtain the security evaluation results of the target information system based on the evaluation index model and the attack and defense test results.

[0174] In some embodiments, the fusion analysis module 930 is further configured to:

[0175] The first and second scan results are deduplicated and merged to obtain the associated deduplicated scan result.

[0176] Based on the MDATA knowledge base, correlation analysis is performed on the correlation deduplication scan results to obtain the correlation scan results;

[0177] Based on the MDATA knowledge base, attack path analysis is performed on the correlation scan results to obtain the potential attack paths of the simulation system.

[0178] Based on potential attack paths and asset information of the simulation system, the system risk assessment results are obtained.

[0179] In some embodiments, the fusion analysis module 930 is further configured to:

[0180] The vulnerability data information corresponding to each vulnerability scan data is obtained from the MDATA knowledge base, and each vulnerability scan data is verified based on the corresponding vulnerability data information to obtain the vulnerability verification result corresponding to each vulnerability scan data.

[0181] Obtain vulnerability association information of the target information system from the MDATA knowledge base, and determine vulnerability scanning association information between vulnerability scanning data based on the vulnerability association information;

[0182] Obtain network topology and asset configuration information of the target information system, and perform correlation analysis based on network topology information, asset configuration information and vulnerability scanning correlation information to obtain correlation analysis results;

[0183] The correlation scan results are obtained based on the vulnerability verification results and correlation analysis results.

[0184] In some embodiments, the fusion analysis module 930 is further configured to:

[0185] Vulnerability exploitation information is obtained from the MDATA knowledge base, and attackable assets in the simulation system are identified based on correlation scan results, asset configuration information, and vulnerability exploitation information.

[0186] Based on network topology information, the attackable paths for each attackable asset are determined, and potential attack paths are obtained based on all attackable paths.

[0187] In some embodiments, the attack and defense strategy generation module 940 is further configured to:

[0188] Based on the system risk assessment results, the comprehensive attack threat level of each potential attack path is determined, and the potential attack paths selected from multiple potential attack paths are ranked according to the numerical value of the comprehensive attack threat level.

[0189] Based on the vulnerability association information between candidate attack paths, the candidate attack paths are combined and associated to obtain multiple candidate combined attack paths.

[0190] Based on the MDATA knowledge base, a path recommendation attack strategy is generated for each candidate combined attack path.

[0191] For each candidate attack path combination, the attack score corresponding to each candidate attack path combination is obtained by using the corresponding path recommendation attack strategy.

[0192] Based on the attack score, asset importance, attack tactics coverage, and attack impact range corresponding to each candidate attack path combination, a target attack path is selected from multiple candidate attack path combinations, and the path-recommended attack strategy corresponding to the target attack path is taken as the target path attack strategy.

[0193] In some embodiments, the attack and defense strategy generation module 940 is further configured to:

[0194] Based on the vulnerability exploitability information and system risk assessment results from the MDATA knowledge base, the exploitability of each potential attack path is determined.

[0195] Based on asset damage hazard information and system risk assessment results from the MDATA knowledge base, the hazard rate of each potential attack path is determined.

[0196] Based on asset importance information, path coverage asset information, and system risk assessment results, the important asset coverage rate for each potential attack path is determined;

[0197] The overall attack threat level for each potential attack path is obtained by weighting the availability, damage rate, and coverage of critical assets.

[0198] In some embodiments, the response acquisition module 910 is further configured to:

[0199] Obtain asset information from the target information system and identify key asset information within that information;

[0200] Based on key asset information and asset information, a simulation system corresponding to the target information system is constructed.

[0201] In some embodiments, the evaluation module 950 is further configured to:

[0202] The parameters of the evaluation indicators in the evaluation indicator model are adjusted based on the safety assessment results.

[0203] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, the specific implementation of the information system security evaluation device is basically the same as the specific implementation of the information system security evaluation method described above, and will not be repeated here.

[0204] This application also provides an electronic device, including:

[0205] At least one memory;

[0206] At least one processor;

[0207] At least one program;

[0208] The program is stored in a memory, and the processor executes the at least one program to implement the information system security evaluation method described above in this application. The electronic device can be any smart terminal, including mobile phones, tablets, personal digital assistants (PDAs), in-vehicle computers, etc.

[0209] Please see Figure 10 , Figure 10 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0210] The processor 1001 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0211] The memory 1002 can be implemented in the form of ROM (Read-Only Memory), static storage device, dynamic storage device, or RAM (Random Access Memory). The memory 1002 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1002 and is called and executed by the processor 1001 using the information system security evaluation method of the embodiments of this application.

[0212] Input / output interface 1003 is used to implement information input and output;

[0213] The communication interface 1004 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0214] Bus 1005 transmits information between various components of the device (e.g., processor 1001, memory 1002, input / output interface 1003, and communication interface 1004);

[0215] The processor 1001, memory 1002, input / output interface 1003 and communication interface 1004 are connected to each other within the device via bus 1005.

[0216] This application also provides a storage medium, which is a computer-readable storage medium, storing a computer program that, when executed by a processor, implements the above-described information system security evaluation method.

[0217] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0218] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0219] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0220] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0221] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0222] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0223] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0224] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The coupling or direct coupling or communication connection between the shown or discussed units may be through some interfaces, or indirect coupling or communication connection between the apparatus or units, and may be electrical, mechanical, or other forms.

[0225] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0226] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0227] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0228] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for evaluating the security of an information system, characterized in that, The method includes: In response to a security assessment request from a target information system, the system obtains an evaluation index model corresponding to the security assessment request and a simulation system corresponding to the target information system. The simulation system is subjected to a first vulnerability scan based on a vulnerability scanning tool to obtain a first scan result, and the simulation system is subjected to a second vulnerability scan based on the MDATA knowledge base to obtain a second scan result. Based on the first scan result, the second scan result, and the MDATA knowledge base, a fusion analysis of the scan results is performed to obtain the system risk assessment result of the simulation system. Based on the system risk assessment results and the MDATA knowledge base, an optimized attack strategy is obtained, and based on the system risk assessment results and the expert knowledge base, an optimized defense strategy is obtained. The simulation system is subjected to attack and defense tests based on the optimized attack strategy and the optimized defense strategy to obtain the attack and defense test results. Based on the evaluation index model and the attack and defense test results, the security evaluation results of the target information system are obtained.

2. The information system security evaluation method according to claim 1, characterized in that, The process of fusing and analyzing the scan results based on the first scan result, the second scan result, and the MDATA knowledge base to obtain the system risk assessment result of the simulation system includes: The first scan result and the second scan result are deduplicated and merged to obtain the associated deduplicated scan result; Based on the MDATA knowledge base, the association deduplication scan results are analyzed to obtain the association scan results; Based on the MDATA knowledge base, attack path analysis is performed on the associated scan results to obtain the potential attack paths of the simulation system. Based on the potential attack paths and the asset information of the simulation system, the system risk assessment results are obtained.

3. The information system security evaluation method according to claim 2, characterized in that, The associated deduplication scan results include multiple vulnerability scan data. The associated deduplication scan results are then analyzed based on the MDATA knowledge base to obtain associated scan results, including: The vulnerability data information corresponding to each vulnerability scan data is obtained from the MDATA knowledge base, and each vulnerability scan data is verified based on the corresponding vulnerability data information to obtain the vulnerability verification result corresponding to each vulnerability scan data. Vulnerability association information of the target information system is obtained from the MDATA knowledge base, and vulnerability scanning association information between the vulnerability scanning data is determined based on the vulnerability association information; Obtain the network topology information and asset configuration information of the target information system, and perform correlation analysis based on the network topology information, the asset configuration information and the vulnerability scanning correlation information to obtain the correlation analysis results; The correlation scan results are obtained based on the vulnerability verification results and the correlation analysis results.

4. The information system security evaluation method according to claim 3, characterized in that, The attack path analysis based on the MDATA knowledge base of the associated scan results yields the potential attack paths of the simulation system, including: Vulnerability exploitation information is obtained from the MDATA knowledge base, and attackable assets in the simulation system are determined based on the correlation scan results, the asset configuration information, and the vulnerability exploitation information. Based on the network topology information, the attackable path for each of the attackable assets is determined, and the potential attack path is obtained based on all the attackable paths.

5. The information system security evaluation method according to claim 4, characterized in that, The optimized attack strategy includes a target attack path and a target path attack strategy. Based on the system risk assessment results and the MDATA knowledge base, the optimized attack strategy is obtained, including: Based on the system risk assessment results, the comprehensive attack threat level of each potential attack path is determined, and the potential attack paths are selected from the multiple potential attack paths based on the numerical value of the comprehensive attack threat level. Based on the vulnerability association information between the candidate attack paths, the candidate attack paths are combined and associated to obtain multiple candidate combined attack paths. Based on the MDATA knowledge base, a path recommendation attack strategy is generated for each of the candidate combined attack paths. For each of the candidate attack paths, the attack score corresponding to each candidate attack path is obtained by using the corresponding path recommendation attack strategy. Based on the attack score, asset importance, attack tactical coverage, and attack impact range corresponding to each candidate attack path combination, the target attack path is selected from multiple candidate attack path combinations, and the path-recommended attack strategy corresponding to the target attack path is used as the target path attack strategy.

6. The information system security evaluation method according to claim 5, characterized in that, The determination of the overall attack threat level for each potential attack path based on the system risk assessment results includes: Based on the vulnerability exploitability information in the MDATA knowledge base and the system risk assessment results, the exploitability of each potential attack path is determined; Based on the asset damage hazard information in the MDATA knowledge base and the system risk assessment results, the hazard rate of each potential attack path is determined; Based on the asset importance information, path coverage asset information, and the system risk assessment results, the important asset coverage rate for each potential attack path is determined; The overall attack threat level for each potential attack path is obtained by weighting the availability, the harm rate, and the coverage of critical assets.

7. The information system security evaluation method according to claim 1, characterized in that, The simulation system corresponding to the target information system includes: Obtain asset information of the target information system and identify key asset information within that asset information; Based on the key asset information and the asset information, a simulation system corresponding to the target information system is constructed, and the simulation system is ensured to meet the simulation degree requirements.

8. The information system security evaluation method according to claim 1, characterized in that, The method further includes: The evaluation index parameters in the evaluation index model are adjusted based on the security evaluation results.

9. An information system security evaluation device, characterized in that, The device includes: The response acquisition module is used to respond to the security assessment request of the target information system, acquire the assessment index model corresponding to the security assessment request, and acquire the simulation system corresponding to the target information system. The vulnerability scanning module is used to perform a first vulnerability scan on the simulation system based on a vulnerability scanning tool to obtain a first scan result, and to perform a second vulnerability scan on the simulation system based on the MDATA knowledge base to obtain a second scan result. The fusion analysis module is used to perform fusion analysis of the scan results based on the first scan result, the second scan result, and the MDATA knowledge base to obtain the system risk assessment result of the simulation system. The attack and defense strategy generation module is used to obtain an optimized attack strategy based on the system risk assessment results and the MDATA knowledge base, and to obtain an optimized defense strategy based on the system risk assessment results and the expert knowledge base. The evaluation module is used to conduct attack and defense tests on the simulation system based on the optimized attack strategy and the optimized defense strategy, obtain the attack and defense test results, and obtain the security evaluation results of the target information system based on the evaluation index model and the attack and defense test results.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the information system security evaluation method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the information system security evaluation method as described in any one of claims 1 to 8.

Images