A network security risk assessment method, device, equipment and medium

Abstract

The present disclosure provides a network security risk assessment method, device, equipment and medium, including: obtaining security log data of the target network environment; obtaining various target indicator data related to the network risk from the security log data; statistically quantifying each of the target indicator data to obtain each quantitative data; determining the indicator weight corresponding to each of the target indicator data based on the sigmoid function characteristics and the preset indicator upper limit value of each of the target indicator data; wherein the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value; using the preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data to determine the comprehensive risk of the target network environment, and obtain the risk assessment result of the target network environment. It can improve the determination efficiency of the indicator weight and effectively control the numerical range of the comprehensive risk of the network environment, thereby improving the user experience.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a network security risk assessment method, device, equipment and medium. Background Art

[0002] With the rapid development of informatization, information security has received more and more attention. Information security risk assessment is an important way to determine information security.

[0003] Currently, there are two commonly used information security risk assessment methods: the matrix method and the multiplication method. However, the indicator weights of the matrix method and the multiplication method are usually determined by defining the weights and levels based on the frequency of events provided in historical or relevant security reports. These reference reports are difficult to obtain and have no relevant standards. In addition, the final risk value has no clear upper limit. In actual business, it is difficult to guide users to make corresponding processing decisions based on the calculated values, resulting in a poor user experience. Summary of the invention

[0004] In view of this, the purpose of the present disclosure is to provide a network security risk assessment method, device, equipment and medium, which can improve the efficiency of determining indicator weights and effectively control the numerical range of the comprehensive risk of the network environment, thereby improving user experience. The specific scheme is as follows:

[0005] In a first aspect, the present disclosure provides a network security risk assessment method, comprising:

[0006] Obtain security log data of the target network environment;

[0007] Obtaining various target indicator data related to network risks from the security log data;

[0008] Performing statistical quantification on each of the target indicator data to obtain each quantitative data;

[0009] Determine the indicator weight corresponding to each target indicator data based on the sigmoid function characteristic and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value;

[0010] The preset sigmoid function is used to determine the comprehensive risk of the target network environment based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, so as to obtain a risk assessment result of the target network environment.

[0011] Optionally, determining the indicator weight corresponding to each target indicator data based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data includes:

[0012] Obtaining a preset indicator upper limit value for each of the target indicator data; wherein the preset indicator upper limit value is an indicator upper limit value determined according to the risk impact degree of the risk indicator factor corresponding to the target indicator data on the target network environment;

[0013] The indicator weight corresponding to each target indicator data is determined based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data.

[0014] Optionally, the preset sigmoid function is a sigmoid function obtained by performing a translation transformation on the original sigmoid function, and the function value is 0 when the independent variable is 0.

[0015] Optionally, the obtaining of various target indicator data related to network risks from the security log data includes:

[0016] Based on preset identification rules and / or machine learning models and / or baseline models, various target indicator data related to network risks are obtained from the security log data.

[0017] Optionally, obtaining security log data of the target network environment includes:

[0018] Regularly obtain security log data of the target network environment during a preset period of time.

[0019] Optionally, the using a preset sigmoid function and determining the comprehensive risk of the target network environment based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data to obtain a risk assessment result of the target network environment includes:

[0020] Based on the hierarchical structure corresponding to the target network environment and the recursive and divide-and-conquer strategy, a preset sigmoid function is used and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, the comprehensive risk of the target network environment is determined to obtain a risk assessment result of the target network environment;

[0021] Among them, the bottom layer of the hierarchical structure includes the risk indicator factors corresponding to each of the target indicator data, the top layer is the comprehensive risk of the target network environment, and the risk indicator factors in each intermediate layer are the parent risk indicator factors corresponding to the corresponding risk indicator factors in the next layer of this layer; the intermediate layer is the layer between the bottom layer and the top layer.

[0022] Optionally, the determining the comprehensive risk of the target network environment based on the hierarchical structure corresponding to the target network environment and the recursive and divide-and-conquer strategy, using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, includes:

[0023] Determine the indicator risk of each of the parent risk indicator factors in the upper layer of the bottom layer by using each of the quantitative data and the indicator weight corresponding to each of the quantitative data;

[0024] Adopting a hierarchical additive weighted method to recursively calculate upward layer by layer based on the indicator risk of each of the parent risk indicator factors and the indicator weight of each of the parent risk indicator factors until the comprehensive risk of the target network environment is obtained;

[0025] The formula used to calculate the indicator risk of each parent risk indicator factor in the upper layer of the bottom layer is:

[0026]

[0027] Among them, the nth layer is the lowest layer, RiskScore (n-1)i is the indicator risk of the i-th risk indicator factor at the n-1th layer; w (1) 、w (2) …w (j) is the indicator weight of the sub-level risk indicator factor corresponding to the i-th risk indicator factor in the n-th layer; N (1) 、N (2) …N (j) The quantitative data corresponding to the sub-level risk indicator factors.

[0028] In a second aspect, the present disclosure provides a network security risk assessment device, comprising:

[0029] A log data acquisition module is used to acquire security log data of the target network environment;

[0030] An indicator data acquisition module, used to obtain various target indicator data related to network risks from the security log data;

[0031] A quantitative data acquisition module is used to statistically quantify each target indicator data to obtain each quantitative data;

[0032] An indicator weight determination module, used to determine the indicator weight corresponding to each target indicator data based on the sigmoid function characteristic and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that when the independent variable reaches a certain value, the corresponding function value tends to 1;

[0033] The comprehensive risk determination module is used to determine the comprehensive risk of the target network environment by using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, so as to obtain a risk assessment result of the target network environment.

[0034] In a third aspect, the present disclosure provides an electronic device, including:

[0035] Memory, used to store computer programs;

[0036] The processor is used to execute the computer program to implement the aforementioned network security risk assessment method.

[0037] In a fourth aspect, the present disclosure provides a computer-readable storage medium for storing a computer program, which implements the aforementioned network security risk assessment method when executed by a processor.

[0038] It can be seen that the present disclosure first obtains the security log data of the target network environment, then obtains each target indicator data related to the network risk from the security log data, and then performs statistical quantification on each target indicator data to obtain each quantitative data, and determines the indicator weight corresponding to each target indicator data based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value, and finally uses the preset sigmoid function and determines the comprehensive risk of the target network environment based on each quantitative data and the indicator weight corresponding to each quantitative data, and obtains the risk assessment result of the target network environment. That is, in the present disclosure, the indicator weight corresponding to each target indicator data is determined based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data, which can improve the determination efficiency of the indicator weight, and finally, the preset sigmoid function is used in the determination process of the comprehensive risk. Since the function value of the sigmoid function is infinitely close to 1, the numerical range of the comprehensive risk of the network environment can be effectively controlled, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A flowchart of a network security risk assessment method provided by the present disclosure;

[0041] Figure 2 A specific quantitative data acquisition flow chart provided in the present disclosure;

[0042] Figure 3 A schematic diagram of the original sigmoid function image provided by the present disclosure;

[0043] Figure 4 A schematic diagram of a preset sigmoid function image provided by the present disclosure;

[0044] Figure 5 A flowchart of a specific network security risk assessment method provided by the present disclosure;

[0045] Figure 6 A flowchart of a specific network security risk assessment method provided by the present disclosure;

[0046] Figure 7 A schematic diagram of the structure of a classification model training device provided by the present disclosure;

[0047] Figure 8 A structural diagram of an electronic device provided by the present disclosure. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0049] Currently, there are two commonly used information security risk assessment methods: matrix method and multiplication method. However, the indicator weight determination method of matrix method and multiplication method usually defines the weight and level based on the frequency of events provided in history or relevant security reports, and these reference reports are difficult to obtain and have no relevant standards. In addition, the final risk value has no clear upper limit. In actual business, it is difficult to guide users to make corresponding processing decisions based on the calculated value, and the user experience is poor. To this end, the present disclosure provides a network security risk assessment scheme that can improve the efficiency of determining indicator weights and effectively control the numerical range of the comprehensive risk of the network environment, thereby improving the user experience.

[0050] See also Figure 1 As shown, the embodiment of the present disclosure provides a network security risk assessment method, including:

[0051] Step S101: Obtain security log data of the target network environment.

[0052] In a specific implementation, the disclosed embodiment can obtain the security log data of the target network environment from a database, a disk or a file system. It can be understood that the security log data is log data related to the risk of the target network environment.

[0053] Step S102: Acquire various target indicator data related to network risks from the security log data.

[0054] In a specific implementation, various target indicator data related to network risks can be obtained from the security log data based on preset identification rules and / or machine learning models and / or baseline models.

[0055] Step S103: Statistically quantify each target indicator data to obtain each quantified data.

[0056] In a specific implementation, each target indicator data may be quantified into a quantity or a percentage, etc., and the specific quantification into a quantity or a percentage may be determined according to the indicator data type. For example, vulnerability data may be quantified into the amount of vulnerabilities, the percentage of non-compliant items in compliance checks, etc.

[0057] For example, see Figure 2 As shown, Figure 2 A specific quantitative data acquisition flow chart provided for the embodiment of the present disclosure. First, query and obtain security log data from the database, disk, file system, etc., then use recognition rules, machine learning, baseline analysis and other methods to analyze the security log data and identify and detect target indicator data related to risks, and judge whether the target indicator data related to risks has been detected. If not, continue to detect, otherwise output the target indicator data, and then perform statistical quantification on the indicator data according to the risk calculation needs, and output the quantitative data.

[0058] Step S104: Determine the indicator weight corresponding to each target indicator data based on the sigmoid function characteristic and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value.

[0059] In a specific implementation, a preset indicator upper limit value of each target indicator data is obtained; wherein the preset indicator upper limit value is an indicator upper limit value determined according to the risk impact degree of the risk indicator factor corresponding to the target indicator data on the target network environment; and the indicator weight corresponding to each target indicator data is determined based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data. The indicator weight corresponding to the target indicator data is the indicator weight corresponding to the corresponding risk indicator factor.

[0060] The preset indicator upper limit value may be a value set by a security expert or a value set by a user according to his or her own network environment. The indicator upper limit value refers to the value at which the quantitative data of the risk indicator factor makes the corresponding risk reach the upper limit value. For example, if the risk indicator factor is a high-risk vulnerability, the risk impact on the network is relatively high, so a smaller upper limit value may be set. For example, the preset upper limit value may be 2. In this embodiment, when the number of high-risk vulnerabilities is 2, the corresponding risk reaches the upper limit value.

[0061] In a specific implementation, the indicator weight calculation formula is as follows:

[0062]

[0063] Among them, w(i) represents the indicator weight corresponding to the i-th risk indicator factor, and Max(i) represents the preset upper limit value corresponding to the i-th risk indicator factor.

[0064] In a specific implementation, the preset upper limit value may be a number or a percentage, and accordingly, the indicator weight calculation formulas are:

[0065]

[0066] Wherein, MaxNum(i) represents the preset upper limit of quantity, and MaxPro(i) represents the preset upper limit of percentage.

[0067] It should be pointed out that the sigmoid function has the function characteristic that when the independent variable reaches a certain value, the corresponding function value tends to 1.

[0068] Step S105: using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, determining the comprehensive risk of the target network environment to obtain a risk assessment result of the target network environment.

[0069] In a specific implementation, the preset sigmoid function is a sigmoid function whose function value is 0 when the independent variable is 0, obtained by performing a translation transformation on the original sigmoid function.

[0070] It should be pointed out that the original sigmoid function expression is:

[0071] See also Figure 3 As shown, Figure 3 The original sigmoid function image diagram provided in the embodiment of the present disclosure, the sigmoid function, has the following characteristics:

[0072] (1) The function curve has a monotonically increasing characteristic, which satisfies the requirement that the more factors that affect the risk and the higher the frequency of occurrence, the greater the corresponding risk, that is, the risk value increases with the increase of influencing factors.

[0073] (2) The vertical axis value range belongs to [0, 1), and the risk value calculated by the corresponding risk indicator factor meets the requirement of taking the risk value in the interval of [0, 100].

[0074] (3) The horizontal axis value belongs to (-∞, +∞) (only one section is taken in the figure), which can meet the mapping of the quantitative value of the risk indicator factor. Since the quantitative value of each indicator in the indicator system is greater than or equal to zero, the horizontal axis takes the interval [0, +∞), which also meets the actual business needs.

[0075] (4) When the horizontal axis takes the value of 0, the corresponding vertical axis value is equal to 0.5. This characteristic is mapped to the risk indicator factor, which means that the quantitative value of the indicator affecting the risk is 0, while the risk value is still 0.5*100%=50, so it does not meet the security business application.

[0076] The embodiment of the present disclosure is based on the above-mentioned point (4) of the original sigmoid function characteristic. In order to make it conform to security business applications, the original sigmoid function is subjected to coordinate translation transformation. The transformed function form is as follows:

[0077]

[0078] That is, this function is the preset sigmoid function in the present disclosure. Figure 4 As shown, Figure 4 A schematic diagram of a preset sigmoid function image provided by an embodiment of the present disclosure. In addition to retaining the characteristics of the original sigmoid function (1) to (3), the transformed sigmoid function also has the same value of 0 when the horizontal coordinate is 0. This characteristic is mapped to the security risk index system, which means that the quantitative value of the index affecting the risk is 0, and the risk value is also 0, thus meeting the needs of security risk business analysis. The transformed function independent variable takes values ​​in [0, +∞). When the independent variable z in the function takes 3, the S(z) value in the function is approximately equal to 0.9; when the independent variable z in the function takes values ​​between 5.5 and 6, the S(z) value is infinitely close to 1. This embodiment finally multiplies the function value by 100, that is, in the risk index factor, if the quantitative data of the risk index factor reaches 5.5 after weighted calculation, its corresponding risk value has approached 100. Therefore, the present disclosure uses this characteristic to define the index weights of various risk index factors affecting the risk, and the final risk value falls within the interval [0, 100]. It can effectively solve the problem of determining the risk calculation weight in a network security environment and the problem of mapping the risk value to the interval [0,100].

[0079] It can be seen that the embodiment of the present disclosure first obtains the security log data of the target network environment, then obtains each target indicator data related to the network risk from the security log data, and then performs statistical quantification on each target indicator data to obtain each quantitative data, and determines the indicator weight corresponding to each target indicator data based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value, and finally uses the preset sigmoid function and determines the comprehensive risk of the target network environment based on each quantitative data and the indicator weight corresponding to each quantitative data, and obtains the risk assessment result of the target network environment. That is, in the present disclosure, the indicator weight corresponding to each target indicator data is determined based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data, which can improve the determination efficiency of the indicator weight, and finally, the preset sigmoid function is used in the determination process of the comprehensive risk. Since the function value of the sigmoid function is infinitely close to 1, the numerical range of the comprehensive risk of the network environment can be effectively controlled, thereby improving the user experience.

[0080] See also Figure 5 As shown, the embodiment of the present disclosure provides a specific network security risk assessment method, including:

[0081] Step S201: Obtain security log data of the target network environment.

[0082] Step S202: Acquire various target indicator data related to network risks from the security log data.

[0083] Step S203: Statistically quantify each target indicator data to obtain each quantified data.

[0084] Step S204: Determine the indicator weight corresponding to each target indicator data based on the sigmoid function characteristic and the preset indicator upper limit value of each target indicator data; wherein, the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value.

[0085] Step S205: Based on the hierarchical structure corresponding to the target network environment and the recursive and divide-and-conquer strategy, a preset sigmoid function is used and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, a comprehensive risk of the target network environment is determined to obtain a risk assessment result of the target network environment;

[0086] Among them, the bottom layer of the hierarchical structure includes the risk indicator factors corresponding to each of the target indicator data, the top layer is the comprehensive risk of the target network environment, and the risk indicator factors in each intermediate layer are the parent risk indicator factors corresponding to the corresponding risk indicator factors in the next layer of this layer; the intermediate layer is the layer between the bottom layer and the top layer.

[0087] In a specific implementation manner, the indicator risk of each of the parent risk indicator factors in the upper layer of the bottom layer is determined by using each of the quantitative data and the indicator weight corresponding to each of the quantitative data;

[0088] Adopting a hierarchical additive weighted method to recursively calculate upward layer by layer based on the indicator risk of each of the parent risk indicator factors and the indicator weight of each of the parent risk indicator factors until the comprehensive risk of the target network environment is obtained;

[0089] The formula used to calculate the indicator risk of each parent risk indicator factor in the upper layer of the bottom layer is:

[0090]

[0091] Among them, the nth layer is the lowest layer, RiskScore (n-1)i is the indicator risk of the i-th risk indicator factor at the n-1th layer; w (1) 、w (2) …w (j) is the indicator weight of the sub-level risk indicator factor corresponding to the i-th risk indicator factor in the n-th layer; N (1) 、N (2) …N (j) The quantitative data corresponding to the sub-level risk indicator factors.

[0092] It can be understood that the indicator weights corresponding to the risk indicator factors of other layers are pre-set weights, and the sum of the weights is 1, and there is no need to use the indicator weight calculation method of the risk indicator factors of the lowest level.

[0093] That is, the disclosed embodiment first uses the preset sigmoid function, the indicator weight of the bottom layer, and the quantitative data corresponding to the risk indicator factor of the bottom layer to calculate the indicator risk of the parent risk indicator factor of the risk indicator factor of the bottom layer, and obtains the indicator risk corresponding to each risk indicator factor of the upper layer of the bottom layer, and then uses the indicator risk and indicator weight corresponding to each risk indicator factor of this layer to calculate the indicator risk corresponding to each risk indicator factor of the upper layer of this layer using the weighted accumulation method. In this way, the comprehensive risk of the top layer is calculated from bottom to top. Due to the use of the preset sigmoid function, the indicator risks of the risk indicator factors in the upper layer of the bottom layer are all in [0, 100), and the weighted accumulation method is used for all the middle layers, and the final comprehensive risk is also in [0, 100), which meets the top elimination requirements.

[0094] It should be pointed out that there are many complex heterogeneous network environments, with many devices in the network and many risk indicator factors that affect the risk of the network environment. It is necessary to calculate the risk at different levels to obtain the final comprehensive risk. Figure 6 As shown, Figure 6 A specific flow chart of a network security risk assessment method provided by the embodiment of the present disclosure. The number of child risk indicator factors corresponding to each parent risk indicator factor is determined based on the network environment. The embodiment of the present disclosure performs weighted cumulative calculation based on the hierarchical additive weighted method, and adopts a bottom-up recursive and divide-and-conquer strategy. First, the indicator weights and quantitative data of each risk indicator factor of the nth layer are obtained, and the indicator risk corresponding to each risk indicator factor of the n-1th layer is calculated using the calculation formula according to the above risk indicator. Then, the indicator weights of various risk indicator factors of the n-1th layer are weighted and multiplied with the corresponding indicator risk of the n-1th layer, and then the various indicator risks of the n-2th layer are calculated and output. In this way, recursion is performed layer by layer from bottom to top until all layers are calculated, and the final comprehensive risk is output, that is, the risk calculation is completed. That is, the indicator risk of the parent indicator factor at the bottom layer is calculated using the improved Sigmoid function formula, and the indicator risk of other layers is calculated using the weighted cumulative method. In this way, based on the recursive divide-and-conquer strategy, the indicator risk calculation is completed layer by layer using the hierarchical weighted cumulative method until the indicator risk calculation of all layers is completed.

[0095] In addition, the disclosed embodiment can periodically obtain the security log data of the preset time period of the target network environment to periodically perform risk assessment on the target network environment. The preset time period can be the past 24 hours, the past week, etc., and can be set according to actual needs. Specifically, the time period window parameter can be set, and the security log of the preset time period can be obtained by using the time period window parameter, that is, the parameter is configured to obtain data for a period of time in the past. That is, the disclosed embodiment can repeat the aforementioned risk assessment process periodically or in real time, and update the risk in real time or periodically to achieve the timeliness of risk assessment.

[0096] It should be pointed out that the matrix method is a situation where one factor is determined by two factors, so it is necessary to construct a two-dimensional matrix for every two factors, and define the corresponding weights for the intersection of the two factors in the matrix. Because in the current complex and heterogeneous security index factors, many indicators have no causal relationship and the types and number of indicators are huge, it is difficult to construct a two-dimensional matrix. Therefore, this method does not have good scalability and ease of use for complex and heterogeneous security index factors. In addition, in the face of complex network environment structures, the number of indicator factors that affect risks is huge and the levels are complex and diverse. The multiplication method cannot meet the risk calculation requirements for such complex network environments. The embodiment of the present disclosure can solve the risk assessment problem of complex heterogeneous networks through recursion and divide-and-conquer strategies.

[0097] See also Figure 7 As shown, the embodiment of the present disclosure provides a network security risk assessment device 300, including:

[0098] The log data acquisition module 301 is used to acquire the security log data of the target network environment;

[0099] The indicator data acquisition module 302 is used to obtain various target indicator data related to network risks from the security log data;

[0100] The quantitative data acquisition module 303 is used to statistically quantify each target indicator data to obtain each quantitative data;

[0101] The indicator weight determination module 304 is used to determine the indicator weight corresponding to each target indicator data based on the sigmoid function characteristic and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that when the independent variable reaches a certain value, the corresponding function value tends to 1;

[0102] The comprehensive risk determination module 305 is used to determine the comprehensive risk of the target network environment by using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, so as to obtain a risk assessment result of the target network environment.

[0103] It can be seen that the embodiment of the present disclosure first obtains the security log data of the target network environment, then obtains each target indicator data related to the network risk from the security log data, and then performs statistical quantification on each target indicator data to obtain each quantitative data, and determines the indicator weight corresponding to each target indicator data based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value, and finally uses the preset sigmoid function and determines the comprehensive risk of the target network environment based on each quantitative data and the indicator weight corresponding to each quantitative data, and obtains the risk assessment result of the target network environment. That is, in the present disclosure, the indicator weight corresponding to each target indicator data is determined based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data, which can improve the determination efficiency of the indicator weight, and finally, the preset sigmoid function is used in the determination process of the comprehensive risk. Since the function value of the sigmoid function is infinitely close to 1, the numerical range of the comprehensive risk of the network environment can be effectively controlled, thereby improving the user experience.

[0104] The indicator weight determination module 304 is specifically used to obtain the preset indicator upper limit value of each of the target indicator data; wherein the preset indicator upper limit value is the indicator upper limit value determined according to the risk impact degree of the risk indicator factor corresponding to the target indicator data on the target network environment; based on the sigmoid function characteristics and the preset indicator upper limit value of each of the target indicator data, the indicator weight corresponding to each of the target indicator data is determined.

[0105] The preset sigmoid function is a sigmoid function whose function value is 0 when the independent variable is 0, obtained by performing a translation transformation on the original sigmoid function.

[0106] The indicator data acquisition module 302 is specifically used to obtain various target indicator data related to network risks from the security log data based on preset identification rules and / or machine learning models and / or baseline models.

[0107] In a specific implementation, the log data acquisition module 301 is specifically used to periodically acquire security log data of a preset period of time in the target network environment.

[0108] Among them, the comprehensive risk determination module 305 is specifically used to determine the comprehensive risk of the target network environment based on the hierarchical structure corresponding to the target network environment and the recursive and divide-and-conquer strategy, using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, to obtain a risk assessment result of the target network environment;

[0109] Among them, the bottom layer of the hierarchical structure includes the risk indicator factors corresponding to each of the target indicator data, the top layer is the comprehensive risk of the target network environment, and the risk indicator factors in each intermediate layer are the parent risk indicator factors corresponding to the corresponding risk indicator factors in the next layer of this layer; the intermediate layer is the layer between the bottom layer and the top layer.

[0110] In a specific implementation, the comprehensive risk determination module 305 is specifically used to:

[0111] Determine the indicator risk of each parent risk indicator factor in the upper layer of the bottom layer by using a preset sigmoid function, each of the quantitative data, and the indicator weight corresponding to each of the quantitative data;

[0112] Adopting a hierarchical additive weighted method to recursively calculate upward layer by layer based on the indicator risk of each of the parent risk indicator factors and the indicator weight of each of the parent risk indicator factors until the comprehensive risk of the target network environment is obtained;

[0113] The formula used to calculate the indicator risk of each parent risk indicator factor in the upper layer of the bottom layer is:

[0114]

[0115] Among them, the nth layer is the lowest layer, RiskScore (n-1)i is the indicator risk of the i-th risk indicator factor at the n-1th layer; w (1) 、w (2) …w (3) is the indicator weight of the sub-level risk indicator factor corresponding to the i-th risk indicator factor in the n-th layer; N (1) 、N (2) …N (3) The quantitative data corresponding to the sub-level risk indicator factors.

[0116] Figure 8 FIG. 4 is a block diagram of an electronic device 400 according to an exemplary embodiment. Figure 8 As shown, the electronic device 400 may include: a processor 401 and a memory 402. The electronic device 400 may also include one or more of a multimedia component 403, an input / output (I / O) interface 404, and a communication component 405.

[0117] Among them, the processor 401 is used to control the overall operation of the electronic device 400 to complete all or part of the steps in the above-mentioned network security risk assessment method. The memory 402 is used to store various types of data to support the operation of the electronic device 400, and these data may include, for example, instructions for any application or method for operating on the electronic device 400, and application-related data. The memory 402 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk. The multimedia component 403 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signal may be further stored in the memory 402 or sent through the communication component 405. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 404 provides an interface between the processor 401 and other interface modules, and the above-mentioned other interface modules may be a keyboard, a mouse, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 405 is used for wired or wireless communication between the electronic device 400 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 405 may include: Wi-Fi module, Bluetooth module, NFC module.

[0118] In an exemplary embodiment, the electronic device 400 can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned network security risk assessment method.

[0119] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned network security risk assessment method are implemented. For example, the computer-readable storage medium can be the above-mentioned memory 402 including program instructions, and the above-mentioned program instructions can be executed by the processor 401 of the electronic device 400 to complete the above-mentioned network security risk assessment method.

[0120] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings. However, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, the technical solution of the present disclosure can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the present disclosure. It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0121] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

[0122] In summary, the contents of this specification should not be understood as limiting the present disclosure.

Claims

1. A network security risk assessment method, characterized in that: include: Obtain security log data of the target network environment; Obtaining various target indicator data related to network risks from the security log data; Performing statistical quantification on each of the target indicator data to obtain each quantitative data; Determine the indicator weight corresponding to each target indicator data based on the sigmoid function characteristic and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that the corresponding function value tends to 1 when the independent variable reaches a certain value; Determine the comprehensive risk of the target network environment by using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, to obtain a risk assessment result of the target network environment; Wherein, the using of a preset sigmoid function and determining the comprehensive risk of the target network environment based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data to obtain a risk assessment result of the target network environment includes: Based on the hierarchical structure corresponding to the target network environment and the recursive and divide-and-conquer strategy, a preset sigmoid function is used and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, the comprehensive risk of the target network environment is determined to obtain a risk assessment result of the target network environment; Among them, the bottom layer of the hierarchical structure includes the risk indicator factors corresponding to each of the target indicator data, the top layer is the comprehensive risk of the target network environment, and the risk indicator factors in each intermediate layer are the parent risk indicator factors corresponding to the corresponding risk indicator factors in the next layer of this layer; the intermediate layer is the layer between the bottom layer and the top layer.

2. The network security risk assessment method according to claim 1, characterized in that: The determining the indicator weight corresponding to each target indicator data based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data includes: Obtaining a preset indicator upper limit value for each of the target indicator data; wherein the preset indicator upper limit value is an indicator upper limit value determined according to the risk impact degree of the risk indicator factor corresponding to the target indicator data on the target network environment; The indicator weight corresponding to each target indicator data is determined based on the sigmoid function characteristics and the preset indicator upper limit value of each target indicator data.

3. The network security risk assessment method according to claim 1, characterized in that: The preset sigmoid function is a sigmoid function whose function value is 0 when the independent variable is 0, obtained by performing a translation transformation on the original sigmoid function.

4. The network security risk assessment method according to claim 1, characterized in that: The obtaining of various target indicator data related to network risks from the security log data includes: Based on preset identification rules and / or machine learning models and / or baseline models, various target indicator data related to network risks are obtained from the security log data.

5. The network security risk assessment method according to claim 1, characterized in that: The obtaining of security log data of the target network environment includes: Regularly obtain security log data of the target network environment during a preset period of time.

6. The network security risk assessment method according to claim 1, characterized in that: The method of determining the comprehensive risk of the target network environment based on the hierarchical structure corresponding to the target network environment and the recursive and divide-and-conquer strategy, using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, includes: Determine the indicator risk of each parent risk indicator factor in the upper layer of the bottom layer by using a preset sigmoid function, each of the quantitative data, and the indicator weight corresponding to each of the quantitative data; Adopting a hierarchical additive weighted method to recursively calculate upward layer by layer based on the indicator risk of each of the parent risk indicator factors and the indicator weight of each of the parent risk indicator factors until the comprehensive risk of the target network environment is obtained; The formula used to calculate the indicator risk of each parent risk indicator factor in the upper layer of the bottom layer is: Among them, the nth layer is the lowest layer, RiskScore (n-1)i is the indicator risk of the i-th risk indicator factor at the n-1th layer; w (1) 、w (2) …w (j) is the indicator weight of the sub-level risk indicator factor corresponding to the i-th risk indicator factor in the n-th layer; N (1) 、N (2) …N (j) The quantitative data corresponding to the sub-level risk indicator factors.

7. A network security risk assessment device, characterized in that: include: A log data acquisition module is used to acquire security log data of the target network environment; An indicator data acquisition module, used to obtain various target indicator data related to network risks from the security log data; A quantitative data acquisition module is used to statistically quantify each target indicator data to obtain each quantitative data; An indicator weight determination module, used to determine the indicator weight corresponding to each target indicator data based on the sigmoid function characteristic and the preset indicator upper limit value of each target indicator data; wherein the sigmoid function characteristic is a function characteristic that when the independent variable reaches a certain value, the corresponding function value tends to 1; A comprehensive risk determination module, used to determine the comprehensive risk of the target network environment by using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, to obtain a risk assessment result of the target network environment; The comprehensive risk determination module is specifically used to: determine the comprehensive risk of the target network environment based on the hierarchical structure corresponding to the target network environment and the recursive and divide-and-conquer strategy, using a preset sigmoid function and based on each of the quantitative data and the indicator weight corresponding to each of the quantitative data, to obtain a risk assessment result of the target network environment; Among them, the bottom layer of the hierarchical structure includes the risk indicator factors corresponding to each of the target indicator data, the top layer is the comprehensive risk of the target network environment, and the risk indicator factors in each intermediate layer are the parent risk indicator factors corresponding to the corresponding risk indicator factors in the next layer of this layer; the intermediate layer is the layer between the bottom layer and the top layer.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the network security risk assessment method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the network security risk assessment method as described in any one of claims 1 to 6.

Images