Security risk assessment method, device and storage medium

Abstract

The present disclosure relates to a security risk assessment method, device and storage medium. The security risk assessment method includes: collecting security alarm logs and asset information of an object system including multiple security domains, and preprocessing the collected security alarm logs and asset information; converting the text information of the preprocessed security alarm logs and asset information into a Euclidean space vector, filtering based on the cosine correlation of the security alarm log vector and the asset information vector; assigning a security level weight to each security domain based on security tag information representing the security level of the security domain; generating a typical feature vector of each security domain based on the security alarm log of each security domain in a predetermined time period; calculating the angle cosine correlation value for each security domain based on the typical feature vector and a predetermined plurality of reference vectors; and weighted summing the security level weights and angle cosine correlation values ​​of all security domains to obtain a security risk assessment result.

Description

Technical Field

[0001] The present disclosure generally relates to the field of network and information security, and more specifically to a security risk assessment method, device and storage medium for security alarm logs. Background Art

[0002] Currently, the industry mainly adopts the quantitative calculation method of risk in the ISO 27000 series of standards, which can be calculated using the following formula:

[0003] Risk = asset value × threat × vulnerability

[0004] This assessment method is suitable for small and micro enterprise networks (with a small number of assets, simple types, and relatively concentrated security threat events), but it is difficult to adapt to the security risk assessment requirements of medium and large enterprise networks. This assessment method has the following specific disadvantages:

[0005] 1) A large number of security alerts and vulnerability information are not related to the asset version. A large number of "false" alerts can easily lead to misjudgment of risks. The "location" of security alerts is very important for risk assessment results.

[0006] 2) The security risk assessment results are not easily interpretable, and it is difficult to quickly prompt the relevant emergency response requirements. For example, in large enterprises, due to the serial use of qualitative / quantitative assessment methods, the assessment results are "far away / blurred" from the original data source characteristics, and security operation and maintenance personnel still need to spend a lot of energy to investigate the cause of the alarm. Summary of the invention

[0007] The present invention uses a correlation calculation method to filter out irrelevant low-risk alerts, fully utilizes the limited feedback from security administrators, constructs a risk assessment method consistent with their risk acceptance tendency, and realizes a scientific and reasonable assessment of network security risks.

[0008] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to identify the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts of the disclosure in a simplified form as a prelude to a more detailed description given later.

[0009] According to one aspect of the present disclosure, a security risk assessment method is provided, including: collecting security alarm logs and asset information of an object system including multiple security domains, and preprocessing the collected security alarm logs and asset information to remove useless information; converting the text information of the preprocessed security alarm logs and asset information into Euclidean space vectors for modeling in vector space, and filtering the security alarm logs and asset information based on the cosine correlation between the security alarm log vectors and the asset information vectors; allocating a security level weight to each security domain based on security tag information representing the security level of the security domain; generating a typical feature vector of each security domain based on the security alarm log of each security domain at a predetermined time period; for each security domain, calculating an angle cosine correlation value based on the typical feature vector and a predetermined plurality of reference vectors; and weighted summing the security level weights and the angle cosine correlation values ​​of all security domains to obtain a security risk assessment result.

[0010] According to another aspect of the present disclosure, a security risk assessment device is provided, comprising: a memory on which instructions are stored; and a processor configured to execute the instructions stored on the memory to execute the method according to the above aspect of the present disclosure.

[0011] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which includes computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors execute the method according to the above aspects of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0013] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0014] Figure 1 is a flowchart showing the process of a security risk assessment method according to an embodiment of the present disclosure.

[0015] Figure 2 is a diagram showing an example for generating a typical feature vector.

[0016] Figure 3 is an example showing multiple reference vectors for an illustrative network security domain.

[0017] Figure 4 It is a block diagram showing an implementation of a specific application example according to the present disclosure.

[0018] Figure 5is a flow chart showing a specific application example according to the present disclosure.

[0019] Figure 6 is an exemplary configuration showing a computing device that can implement an embodiment according to the present disclosure. DETAILED DESCRIPTION

[0020] The following detailed description is made with reference to the accompanying drawings, and the following detailed description is provided to assist in a comprehensive understanding of the various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0021] In the past, in the security risk assessment of medium and large enterprise networks, there are often a large number of security alerts and vulnerability information that are unrelated to the asset version. A large number of "false" alerts can easily lead to risk misjudgment. In addition, the security risk assessment results of medium and large enterprise networks in the past are not easily explainable, and it is difficult to quickly prompt the relevant emergency response requirements. For example, in large enterprises, due to the serial use of qualitative / quantitative assessment methods, the assessment results are "far away / blurred" from the original data source characteristics, and security operation and maintenance personnel still need to spend a lot of energy to investigate the cause of the alarm.

[0022] Figure 1 is a flowchart showing the process of a security risk assessment method according to an embodiment of the present disclosure.

[0023] like Figure 1 As shown, first, in step S01, security alarm logs and asset information of an object system including multiple security domains are collected, and the collected security alarm logs and asset information are pre-processed to remove useless information. In some embodiments, the security domain here can be a network domain divided by hardware, or a logical domain divided according to function, purpose, security level, etc. For example, according to the security level, an object system can include a customer information domain with a high security level, a logistics information domain with a medium security level, and an employee attendance information domain with a low security level; for another example, according to the function, an object system can include an operating information domain, a financial information domain, a personnel information domain, etc. In one embodiment, the pre-processing can include filtering the security alarm log according to the asset version information and / or filtering irrelevant keywords from the security alarm log and asset data according to the stop word list, thereby preliminarily removing redundant information in the collected information.

[0024] Next, in step S03, the preprocessed text information of the security alarm log and asset information is converted into a Euclidean space vector for modeling in the vector space, and the security alarm log and asset information are filtered based on the cosine correlation between the security alarm log vector and the asset information vector. The method of converting the security alarm log and asset information as text information into a Euclidean space vector is any method that can convert text into a vector, and there is no particular limitation. In some embodiments, for example, the word2vec algorithm can be used to perform vector conversion. In some embodiments, filtering the security alarm log and asset information based on the cosine correlation between the security alarm log vector and the asset information vector includes determining that the security alarm log has a low correlation and removing it when the cosine correlation is less than a specified threshold. As an example, the specified threshold can be set to 0.

[0025] Next, in step S05, based on the security tag information indicating the security level of the security domain, a security level weight Tag is assigned to each security domain i. i In some embodiments, the security tag information may be pre-set by a network administrator based on the function, purpose, security level, and other factors of the security domain. In some embodiments, the security level may include three levels: critical, important, and ordinary. The weight values ​​of critical, important, and ordinary meet the following conditions:

[0026] Key-Important=Important-Common=alpha (1)

[0027] alpha∈[0.2,0.3] (2)

[0028] Among them, Key represents the key weight value, Important represents the important weight value, Common represents the ordinary weight value, and Alpha represents the difference between each level.

[0029] In some embodiments, according to The values ​​of Key, Important, and Common are obtained to obtain the weight values ​​of each security domain, where N is the total number of security domains. Thus, the weight coefficient of each security domain is obtained.

[0030] Next, in step S07, a typical feature vector of each security domain is generated based on the security alarm log of each security domain at a predetermined time period. Figure 2As shown, when generating typical feature vectors, the typical feature vectors of security domain i are composed of the presence or absence of low-risk events in pre-scan, the presence or absence of medium-risk events in pre-scan, the presence or absence of high-risk events in pre-scan, the presence or absence of low-risk events detected during the process, the presence or absence of medium-risk events detected during the process, the presence or absence of high-risk events detected during the process, the presence or absence of low-risk events in post-audit, the presence or absence of medium-risk events in post-audit, and the presence or absence of high-risk events in post-audit, wherein 1 is used to represent the presence or absence and 0 is used to represent the absence or presence, i is the number of the security domain, i is a natural number, i≤N, and N is the total number of security domains.

[0031] Next, in step S09, for each security domain, the angle cosine correlation value is calculated based on the typical feature vector and the predetermined multiple reference vectors. The predetermined multiple reference vectors are pre-set for each security domain. Figure 3 An example of multiple reference vectors for an exemplary network security domain is shown in FIG. Figure 3 As shown in FIG. 1 , three reference vectors are set for each security domain, namely, a high-risk vector, a medium-risk vector, and a low-risk vector. The reference vectors of different security domains may be different according to their respective functions, purposes, and security levels. Figure 3 In the figure, network security domain 1 includes three typical feature vectors, namely, a high-risk vector [0, ..., 0, 1, 1], a medium-risk vector [0, ..., 1, 1, 0, 1, 0, 0] and a low-risk vector [1, 1, 0, ..., 0], where ... represents continuous "0". It should be understood that the number of typical feature vectors is not limited to 3 and can be set to any number greater than 2 as needed. In some embodiments, with respect to security domain i, the angle cosine correlation value is calculated based on the typical feature vector and a plurality of predetermined reference vectors. The cosine correlation calculation of the typical feature vector and a plurality of reference vectors can be performed respectively to obtain a plurality of cosine correlation values, and the largest cosine correlation value cosine is selected. i In other embodiments, regarding security domain i, the angle cosine correlation value is calculated based on the typical feature vector and multiple predetermined reference vectors. Cosine correlation calculations can also be performed on the typical feature vector and multiple reference vectors to obtain multiple cosine correlation values, and the largest cosine correlation value cosine is taken as i Multiply it by its corresponding weight Level i The obtained value is used as the angle cosine correlation value. For example, when the maximum cosine correlation value ∈ [1 / 2, 1] is determined to be a high-risk situation, and the weight Level is set i =Level 高 = 0.7, when the maximum cosine correlation value ∈ [-1 / 2, 1 / 2] is reached, it is judged as a medium-risk situation and is set as the weight Level i =Level中 = 0.5, when the maximum cosine correlation value ∈ [-1, -1 / 2] is reached, it is judged as a low-risk situation and is set as the weight Level i =Level 低 =0.3, the cosine correlation value of the angle of security zone i can be expressed as cosine i ×Level i It should be understood that the weight Level i The level is not limited to high, medium, and low, and can also be set to any level greater than 2. In addition, in some embodiments, 3 to 5 cluster points of each security domain are obtained by K-Means clustering calculation; the security administrator labels these cluster points as "high / medium / low". If the "high / medium / low" labels do not all appear, the security administrator needs to construct a reference vector.

[0032] Next, in step S11, the security level weights and angle cosine correlation values ​​of all security domains are weighted and summed to obtain the security risk assessment result. In some embodiments, the security risk assessment result Score can be expressed as:

[0033]

[0034] Among them, Tags i is the security level weight of security domain i, Cosine i The largest cosine correlation value among multiple cosine correlation values ​​is obtained by performing cosine correlation calculations on the typical feature vector of security domain i and multiple reference vectors. In some embodiments, the security risk assessment result Score can also be expressed as:

[0035]

[0036] Among them, Tags i is the security level weight of security domain i, Cosine i The maximum cosine correlation value among multiple cosine correlation values ​​is obtained by performing cosine correlation calculations on the typical feature vector of security domain i and multiple reference vectors. i is the cosine correlation value i The corresponding weight, as an example, when the maximum cosine correlation value ∈ [1 / 2, 1] is judged as a high-risk situation, is set as the weight Level i =Level 高 = 0.7, when the maximum cosine correlation value ∈ [-1 / 2, 1 / 2] is reached, it is judged as a medium-risk situation and is set as the weight Level i =Level 中= 0.5, when the maximum cosine correlation value ∈ [-1, -1 / 2] is reached, it is judged as a low-risk situation and is set as the weight Level i =Level 低 =0.3.

[0037] According to the present disclosure, through the correlation calculation of space vectors, massive security warning information that is unrelated to asset version information can be effectively filtered, which can improve the accuracy of security risk assessment.

[0038] In addition, according to the present disclosure, by distinguishing security devices / components with different network topologies and detection capabilities in the manner of "network security domain division + pre-scanning / in-process detection / post-audit", and classifying specific security event types as "high risk / medium risk / low risk", it is possible to achieve unified vector space modeling of security alarm logs in the same time window.

[0039] Moreover, according to the present disclosure, with customer tags and the weight allocation method of the present disclosure, the weight calculation of each network security domain can be realized, and through the "unsupervised clustering + vector labeling" method, the characteristic vectors represented by "high risk / medium risk / low risk" in each network security domain are constructed to obtain risk model baselines of multiple categories, thereby achieving the interpretability of risk assessment results.

[0040] Figure 4 It is a block diagram showing an implementation of a specific application example according to the present disclosure.

[0041] Figure 5 is a flow chart showing a specific application example according to the present disclosure.

[0042] Step 1: Collect and preprocess logs. This mainly includes sorting out the stop word lists of various security alarm logs and asset data, and filtering irrelevant keywords from security alarm logs and asset data.

[0043] Step 2: Log filtering. This includes two sub-steps:

[0044] 1) Vector space modeling: Convert text into Euclidean space vectors.

[0045] 2) Log filtering based on angle cosine correlation calculation. Filter irrelevant security alarm logs according to the user-defined threshold, and the threshold can be set to 0.

[0046] Step 3: Label samples for each security domain, which includes two sub-steps:

[0047] 1) Calculate and assign security level weights to each security domain based on the security administrator's tags for the security domain. i . Specifically,

[0048] ① The security administrator marks the business impact analysis (BIA) of each network security domain as “Key / Important / Common”, such as Figure 2 As shown, each network security domain has a corresponding tag;

[0049] ②Satisfy the relationship Key-Important=Important-Common=alpha, where alpha∈[0.2,0.3];

[0050] ③According to The values ​​of Key, Important, and Common can be obtained, corresponding to the marks in step ①, and the weight values ​​of each security domain can be obtained.

[0051] 2) Segment the historical alarm logs of each security domain at a fixed time period, such as 1 hour, and Figure 2 Generate a typical feature vector Vector i In addition, for the historical alarm logs of each security domain, 3 to 5 cluster points of each security domain are obtained based on K-Means clustering calculation; the security administrator marks these cluster points as "high / medium / low"; if the "high / medium / low" labels do not all appear, the security administrator needs to confirm or modify the baseline vector.

[0052] Step 4: Risk calculation. This includes two sub-steps:

[0053] 1) Correlation of the cosine of the angle between the typical eigenvector and the reference vector in each security domain i , get the category label Level i , where each security domain contains at least 3 reference vectors, such as {high: [0, …, 0, 1, 1], medium: [0, …, 1, 1, 0, 1, 0, 0], low: [1, 1, 0, …, 0]}

[0054] 2) According to the weights of each security domain obtained in step 3, the evaluation results of each security domain are weighted and summed, that is,

[0055]

[0056] Among them, Tags i is the security level weight of security domain i, Cosine i The maximum cosine correlation value among multiple cosine correlation values ​​is obtained by performing cosine correlation calculations on the typical feature vector of security domain i and multiple reference vectors. i is the cosine correlation value iThe corresponding weight, as an example, when the maximum cosine correlation value ∈ [1 / 2, 1] is judged as a high-risk situation, is set as the weight Level i =Level 高 = 0.7, when the maximum cosine correlation value ∈ [-1 / 2, 1 / 2] is reached, it is judged as a medium-risk situation and is set as the weight Level i =Level 中 = 0.5, when the maximum cosine correlation value ∈ [-1, -1 / 2] is reached, it is judged as a low-risk situation and is set as the weight Level i =Level 低 =0.3.

[0057] Therefore, according to the present disclosure, the correlation calculation method is used to filter out irrelevant low-risk alerts, make full use of the limited feedback of security administrators, build a risk assessment method consistent with their risk acceptance tendency, and achieve a scientific and reasonable assessment of network security risks.

[0058] Figure 6 An exemplary configuration of a computing device 1200 capable of implementing embodiments according to the present disclosure is shown.

[0059] The computing device 1200 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 1200 can be any machine configured to perform processing and / or computing. The computing device 1200 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0060] like Figure 6As shown, computing device 1200 may include one or more elements that can be connected or communicated with bus 1202 via one or more interfaces. Bus 2102 may include, but is not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus, etc. Computing device 1200 may include, for example, one or more processors 1204, one or more input devices 1206, and one or more output devices 1208. One or more processors 1204 may be any kind of processor, and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). Input device 1206 may be any type of input device capable of inputting information to a computing device, and may include, but is not limited to, a mouse, a keyboard, a touch screen, a microphone, and / or a remote controller. Output device 1208 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer.

[0061] The computing device 1200 may also include or be connected to a non-transitory storage device 1214, which may be any non-transitory storage device that can implement data storage, and may include, but is not limited to, a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape, or any other magnetic medium, a compressed disk or any other optical medium, a cache memory, and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions, and / or code. The computing device 1200 may also include a random access memory (RAM) 1210 and a read-only memory (ROM) 1212. The ROM 1212 may store programs, utilities, or processes to be executed in a non-volatile manner. The RAM 1210 may provide volatile data storage and store instructions related to the operation of the computing device 1200. The computing device 1200 may also include a network / bus interface 1216 coupled to a data link 1218. The network / bus interface 1216 may be any type of device or system capable of enabling communication with an external device and / or a network, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth TM equipment, 802.11 equipment, WiFi equipment, WiMax equipment, cellular communication facilities, etc.).

[0062] The present disclosure may be implemented as any combination of an apparatus, a system, an integrated circuit, and a computer program on a non-transitory computer-readable medium. One or more processors may be implemented as an integrated circuit (IC), an application specific integrated circuit (ASIC), or a large scale integrated circuit (LSI), a system LSI, a super LSI, or a super LSI component that performs some or all of the functions described in the present disclosure.

[0063] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0064] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0065] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0066] The subject matter of the present disclosure is provided as an example of devices, systems, methods, and programs for performing the features described in the present disclosure. However, in addition to the above-mentioned features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be accomplished with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0067] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0068] In addition, in the description of the present disclosure, the terms “first”, “second”, “third”, etc. are used for descriptive purposes only and cannot be understood as indicating or implying relative importance and order.

[0069] Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed to achieve desired results. In certain circumstances, multitasking and parallel processing can be advantageous.

Claims

1. A security risk assessment method, comprising: Collecting security alarm logs and asset information of object systems including multiple security domains, and preprocessing the collected security alarm logs and asset information to remove useless information, wherein the preprocessing includes filtering the security alarm logs according to asset version information and filtering irrelevant keywords from the security alarm logs and asset data according to a stop word list; Modeling the preprocessed text information of the security alarm log and the asset information in the vector space, filtering the security alarm log and the asset information based on the cosine correlation between the security alarm log vector and the asset information vector, including determining that the security alarm log has low correlation and removing it when the cosine correlation is less than a specified threshold; Based on the security tag information indicating the security level of the security domain, a security level weight is assigned to each security domain; Generate a typical feature vector of each security domain based on the security alarm log of each security domain at a predetermined time period; For each security domain, a correlation value is calculated based on a typical feature vector and a plurality of predetermined reference vectors; as well as The security level weights and related values ​​of all security domains are weighted and summed to obtain the security risk assessment result.

2. The method according to claim 1, wherein: The security level includes three levels: critical, important, and ordinary. The weight values ​​of critical, important, and ordinary meet the following conditions: Key-Important=Important–Common=alpha, alpha∈[0.2,0.3], Among them, Key represents the key weight value, Important represents the important weight value, Common represents the ordinary weight value, and Alpha represents the difference between each level.

3. The method according to claim 2, wherein: according to Obtain the values ​​of Key, Important, and Common, and thus obtain the weight values ​​of each security domain. i is the security level weight of security domain i, and N is the total number of security domains.

4. The method according to claim 1, wherein: When generating typical feature vectors, the typical feature vector of security domain i is composed of the presence or absence of low-risk events in pre-scan, the presence or absence of medium-risk events in pre-scan, the presence or absence of high-risk events in pre-scan, the presence or absence of low-risk events detected during the process, the presence or absence of medium-risk events detected during the process, the presence or absence of high-risk events detected during the process, the presence or absence of low-risk events in post-audit, the presence or absence of medium-risk events in post-audit, and the presence or absence of high-risk events in post-audit, where 1 is used to represent the presence or absence and 0 is used to represent the absence, i is the number of the security domain, i is a natural number, i≤N, and N is the total number of security domains.

5. The method according to claim 1, wherein: Calculating the correlation value based on the typical eigenvector and a plurality of predetermined reference vectors can perform cosine correlation calculations on the typical eigenvector and a plurality of reference vectors to obtain a plurality of cosine correlation values, and select the largest cosine correlation value as the correlation value.

6. The method according to claim 1, wherein: Correlation values ​​can be calculated based on typical eigenvectors and multiple predetermined reference vectors. Cosine correlation calculations can also be performed on typical eigenvectors and multiple reference vectors to obtain multiple cosine correlation values, and the value obtained by multiplying the largest cosine correlation value by its corresponding weight is used as the correlation value.

7. The method according to any one of claims 1 to 6, wherein: The correlation value is an angle cosine correlation value.

8. The method according to any one of claims 1 to 6, wherein: The preprocessed text information of security alarm logs and asset information is converted into Euclidean space vectors for modeling in vector space.

9. A safety risk assessment device, comprising: a memory having instructions stored therein; as well as A processor configured to execute instructions stored on the memory to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 8.

Images