Security equipment defense capability assessment method, system, computer and storage medium

Abstract

The present application relates to a method, system, computer and storage medium for evaluating the defense capability of security equipment, wherein the method includes: obtaining the performance parameters of the security equipment within a preset time period, the performance parameters including at least one of the following: basic defense value, security effectiveness against attacks and security position level; using the AHP hierarchical analysis method to calculate the weight of the performance parameters; using a preset function to evaluate the evaluation value of the defense capability level of the security equipment within a preset time period according to the performance parameters and the weights corresponding to the performance parameters; outputting the defense capability level of the security equipment within the preset time period according to the evaluation value, and sending prompt information that matches the defense capability level. Through this application, technical problems such as the inability of the current general security equipment defense capability evaluation scheme based on a complex security equipment network structure to dynamically determine the change trend of the defense capability of the security equipment and the inability to provide corresponding technical means such as upgrading and reinforcement according to the current defense capability are solved.

Description

Technical Field

[0001] The present application relates to the technical field of network information security, and in particular to a method, system, computer and storage medium for evaluating the defense capability of a security device. Background Art

[0002] With the development of new technologies and applications in the era of big data, the Internet has become an indispensable communication platform for people. Network security issues are becoming more and more numerous, and network attacks are becoming more and more frequent, causing user privacy data leakage, Internet service paralysis, and huge losses to social interests. The network security situation is becoming increasingly complex, and extortion viruses are prevalent. Various types of security equipment are generally used to build a security defense network to enhance the network's active security monitoring capabilities.

[0003] For simple security equipment network structures, their defense capabilities are mainly evaluated based on the security functions of the equipment itself. Users only have a vague concept and no reliable algorithm model as technical support, or the parameters of the security evaluation indicators used are single, and only the basic technical parameters of the security equipment, including models, combat technical indicators, physical characteristics, power supply indicators, self-security, general quality characteristics, and localization support, are analyzed. It is also impossible to judge the real-time defense effectiveness of the security equipment in the current networking environment. In addition, for complex security equipment network structures, such as in the case of private networks, intranets, office networks, network security domains, and affiliated business systems, the current general security equipment defense capability evaluation scheme is mainly to obtain the security function, management function, performance indicator and other security evaluation indicator parameters of the security equipment to be tested, establish a progressive hierarchical structure, calculate the weight vector of the security defense capability of each security evaluation indicator, and multiply the weight vector by the value of each security level to obtain the defense capability level of the security equipment. However, this general evaluation scheme cannot dynamically judge the change trend of the defense capability of the security equipment to assist users in analyzing and deciding whether the current defense capability of the security equipment has reached a bottleneck, and cannot provide corresponding technical means such as upgrading and reinforcement according to the current defense capability to improve its own defense capability.

[0004] There is a technical problem in the current related technologies that the general security equipment defense capability assessment scheme based on complex security equipment network structure cannot provide corresponding upgrade and reinforcement and other technical measures to improve its own defense capability according to the current defense capability, and no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a security device defense capability assessment method, system, computer and storage medium to at least solve the technical problems in the current related technology that the general security device defense capability assessment scheme based on a complex security device network structure cannot provide corresponding upgrade and reinforcement technical measures based on the current defense capability.

[0006] In a first aspect, an embodiment of the present application provides a method for evaluating the defense capability of a security device, comprising:

[0007] Acquire performance parameters of the security device within a preset time period, wherein the performance parameters include at least one of the following: basic defense value, anti-attack security effectiveness, and security location level;

[0008] The weights of the performance parameters are calculated using the AHP analytic hierarchy process;

[0009] According to the performance parameters and the weights corresponding to the performance parameters, a preset function is used to evaluate the evaluation value of the defense capability level of the security device within the preset time period;

[0010] The defense capability level of the security device within the preset time period is obtained according to the evaluation value, and prompt information matching the defense capability level is given.

[0011] In some embodiments, the step of obtaining performance parameters of the security device within a preset time period, wherein the performance parameters include at least one of the following: basic defense value, anti-attack security effectiveness, and security location level, further includes:

[0012] According to the category set of equipment model, combat technical indicators, physical characteristics, and power supply indicators of the security equipment within the preset time, a naive Bayes classification algorithm is used to obtain the basic defense value of the security equipment within the preset time;

[0013] According to the attack detection rate and attack interception rate of the network on the security device within the preset time period, a weighted average algorithm is used to obtain the security effectiveness of the security device against attacks within the preset time period;

[0014] According to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection business system within the preset time period, a cubic root algorithm is used to obtain the security position level of the security device within the preset time period.

[0015] In some embodiments, the step of obtaining the basic defense value of the security device within the preset time period using a naive Bayes classification algorithm according to the device model, combat technical indicators, physical characteristics, and power supply indicator category set of the security device within the preset time period further includes:

[0016] Dividing each characteristic attribute to set items to be classified, forming training samples of the category set;

[0017] Calculate the occurrence probability of each of the category sets in the training sample, and the conditional probability of each of the feature attributes corresponding to each of the category sets, and record the results;

[0018] The basic defense value level of the characteristic attribute corresponding to the maximum value in the conditional probability is output to obtain the basic defense value of the security device within the preset time period.

[0019] In some embodiments, the step of using a weighted average algorithm to obtain the security effectiveness of the security device against attacks within the preset time period based on the attack detection rate and attack interception rate of the network on the security device within the preset time period further includes:

[0020] Obtaining the total amount of attacks on the security device by the network within the preset time period, the number of detected attacks, the number of intercepted attacks, and the number of unintercepted attacks;

[0021] Calculate attack detection rate and attack interception rate;

[0022] The attack detection rate and the attack interception rate are weighted averaged to determine the anti-security performance of the security device within the preset time period.

[0023] In some embodiments, the step of obtaining the security location level of the security device within the preset time period by using a cubic algorithm according to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection service system within the preset time period specifically includes:

[0024] According to the predefined level values ​​of the basic security factors of the security equipment within the preset time period, the level values ​​corresponding to the network, the security domain, and the protection business system are respectively obtained;

[0025] The product of the level value of the network, the level value of the security domain and the level value of the protection service system is cubed to calculate the security position level of the security device within the preset time period.

[0026] In some embodiments, the step of calculating the weight of the performance parameter using the AHP analytic hierarchy process further includes:

[0027] Constructing a hierarchical model including the basic defense value, the anti-attack security effectiveness and the security position level;

[0028] Constructing a judgment matrix layer by layer according to the hierarchical structure model;

[0029] By means of hierarchical single sorting and hierarchical total sorting, the maximum eigenvalue and its corresponding eigenvector in the judgment matrix are calculated to obtain the weights of the basic defense value, the anti-attack security effectiveness and the security position level;

[0030] A check quantity similar to that of the hierarchical single ordering is calculated to perform a consistency check analysis of the calculation results of the hierarchical total ordering.

[0031] In some embodiments, the prompt information includes at least one of the following information: the security device has extremely low defense capability and the user is warned of risk; the security device has low defense capability and the user needs to make corrections; the security device has medium defense capability and the user needs to improve; the security device has high defense capability and the user needs to consolidate; or the security device has extremely high defense capability and the user can maintain the status quo.

[0032] In a second aspect, an embodiment of the present application provides a security device defense capability evaluation system, including:

[0033] An acquisition module, used to acquire performance parameters of the security device within a preset time period, wherein the performance parameters include at least one of the following: basic defense value, anti-attack security effectiveness, and security position level;

[0034] An analysis module, used to calculate the weight of the performance parameter using AHP (Analysis Hierarchy Process);

[0035] An evaluation module, configured to evaluate the defense capability level of the security device within the preset time period using a preset function according to the performance parameters and the weights corresponding to the performance parameters;

[0036] The processing module is used to obtain the defense capability level of the security device within the preset time period according to the evaluation value, and to provide prompt information that is compatible with the defense capability level.

[0037] In some embodiments, the acquisition module includes:

[0038] The first acquisition module is used to obtain the basic defense value of the security device within the preset time period using a naive Bayes classification algorithm according to the device model, combat technical indicators, physical characteristics, and power supply indicator category set of the security device within the preset time period;

[0039] A second acquisition module is used to obtain the security effectiveness of the security device against attacks within the preset time period by using a weighted average algorithm according to the attack detection rate and attack interception rate of the network on the security device within the preset time period;

[0040] The third acquisition module is used to obtain the security position level of the security device within the preset time period by using a cubic algorithm according to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection business system within the preset time period.

[0041] In some embodiments, the first acquisition module includes:

[0042] A first acquisition unit is used to divide each characteristic attribute to set items to be classified, so as to form training samples of the category set;

[0043] A first calculation unit, used to calculate the occurrence probability of each of the category sets in the training sample, and the conditional probability of each of the feature attributes corresponding to each of the category sets, and record the results;

[0044] The first algorithm unit is used to output the basic defense value level of the characteristic attribute corresponding to the maximum value in the conditional probability, so as to obtain the basic defense value of the security device within the preset time period.

[0045] In some embodiments, the second acquisition module includes:

[0046] A second acquisition unit is used to obtain the total amount of attacks on the security device by the network within the preset time period, the number of detected attacks, the number of intercepted attacks, and the number of unintercepted attacks;

[0047] A second calculation unit, used to calculate an attack detection rate and an attack interception rate;

[0048] The second algorithm unit is used to perform a weighted average on the attack detection rate and the attack interception rate to determine the anti-security effectiveness of the security device within the preset time period.

[0049] In some embodiments, the third acquisition module includes:

[0050] The third acquisition module is used to obtain the level values ​​corresponding to the network, the security domain, and the protection business system according to the predefined level values ​​of the basic security factors of the security equipment within the preset time period; the third algorithm module is used to cube the product of the level value of the network, the level value of the security domain, and the level value of the protection business system to calculate the security position level of the security equipment within the preset time period.

[0051] In some embodiments, the analysis module includes:

[0052] A construction unit, used for constructing a judgment matrix layer by layer according to the hierarchical structure model;

[0053] A calculation unit, used to calculate the maximum eigenvalue and its corresponding eigenvector in the judgment matrix through hierarchical single sorting and hierarchical total sorting, so as to obtain the weights of the basic defense value, the anti-attack security effectiveness and the security position level;

[0054] A verification unit is used to calculate a verification quantity similar to the hierarchical single sorting to perform consistency verification analysis on the calculation results of the hierarchical total sorting.

[0055] In a third aspect, an embodiment of the present application provides a computer, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for evaluating the defense capability of a security device as described in the first aspect above is implemented.

[0056] In a fourth aspect, an embodiment of the present application provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the method for evaluating the defense capability of a security device as described in the first aspect above is implemented.

[0057] Compared with the related art, the embodiment of the present application provides a method, system, computer and storage medium for evaluating the defense capability of security equipment; wherein, an index system is established for comprehensive security equipment in terms of basic technical parameters, real-time anti-attack security situation, location information importance level and other multi-dimensional protection capability aspects, and according to the attack detection rate, attack interception rate and the situation changes of the network level, security domain and protected business system of the security equipment in the network anti-attack within a period of time, the anti-attack security effectiveness evaluation algorithm model and the security position level algorithm model are triggered, so that the anti-attack security effectiveness evaluation value and weight value, the security position level evaluation value and weight value of the security equipment change accordingly, and the defense capability value of the security equipment also changes periodically, and whether to use technical means such as upgrade and reinforcement to improve its own defense capability. This application effectively solves the technical problems in the current related art that the general security equipment defense capability evaluation scheme based on the complex security equipment network structure cannot provide corresponding suggestions for technical means such as upgrade and reinforcement according to the current defense capability.

[0058] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0060] Figure 1 is a flow chart of a security device defense capability assessment method provided in Embodiment 1 of the present invention;

[0061] Figure 2 It is a logic block diagram of the security device defense capability assessment method provided by the present invention;

[0062] Figure 3 is a specific flow chart of step S101 provided in the first embodiment of the present invention;

[0063] Figure 4is a logic method principle diagram of step S101 provided in the first embodiment of the present invention;

[0064] Figure 5 is a specific flow chart of step S1011 provided in the first embodiment of the present invention;

[0065] Figure 6 is a specific flow chart of step S1012 provided in the first embodiment of the present invention;

[0066] Figure 7 is a specific flow chart of step S1013 provided in the first embodiment of the present invention;

[0067] Figure 8 is a specific flow chart of step S102 provided in the first embodiment of the present invention;

[0068] Fig. 9 It is a hierarchical structure model diagram of the AHP hierarchical analysis method provided in the first embodiment of the present invention;

[0069] Fig.10 is a structural block diagram of a security device defense capability assessment system corresponding to the method of embodiment 1 and provided in embodiment 2 of the present invention;

[0070] Fig.11 It is a schematic diagram of the hardware structure of the computer provided in the third embodiment of the present invention.

[0071] Description of reference numerals:

[0072] 10-acquisition module, 11-first acquisition module, 111-first acquisition unit, 112-first calculation unit, 113-first algorithm unit, 12-second acquisition module, 121-second acquisition unit, 122-second calculation unit, 123-second algorithm unit, 13-third acquisition module, 131-third acquisition unit, 132-third algorithm unit;

[0073] 20-analysis module, 21-construction unit, 22-calculation unit, 23-verification unit;

[0074] 30-Evaluation module;

[0075] 40-processing module;

[0076] 50-bus, 51-processor, 52-memory, 53-communication interface. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0078] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0079] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0080] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0081] The various technologies described in this application can be used in various wireless communication systems, such as 2G, 3G, 4G, 5G communication systems and next-generation communication systems, and also for example, Global System for Mobile communications (GSM), Code Division Multiple Access (CDMA) system, Time Division Multiple Access (TDMA) system, Wideband Code Division Multiple Access Wireless (WCDMA), Frequency Division Multiple Addressing (FDMA) system, Orthogonal Frequency-Division Multiple Access (OFDMA) system, Single Carrier FDMA (SC-FDMA) system, General Packet Radio Service (GPRS) system, Long Term Evolution (LTE) system, 5G New Radio (NR) system and other such communication systems.

[0082] The sliding window-based security device defense capability assessment system provided in this embodiment can be integrated in a base station, a radio remote unit (Radio Remote Unit, referred to as RRU) or any other network element device that requires radio frequency transmission and reception. The base station in this article can be a device in the access network that communicates with the wireless terminal through one or more sectors on the air interface. The base station can be used to convert received air frames to Internet Protocol (Internet Protocol, referred to as IP) packets, as a router between the wireless terminal and the rest of the access network, where the rest of the access network may include an IP network. The base station can also coordinate the attribute management of the air interface. For example, the base station can be a base station (Base Transceiver Station, referred to as BTS) in GSM or CDMA, or a base station (Node B) in WCDMA, or an evolutionary base station (evolutional Node B, referred to as eNB or e-Node B) in LTE, or a generation Node B (referred to as gNB) in 5G NR, which is not limited in this application.

[0083] Embodiment 1

[0084] This embodiment provides a method for evaluating the defense capability of a security device. Figure 1 is a flowchart of a method for evaluating the defense capability of a security device according to an embodiment of the present application, and is combined with Figure 2 The technical solution of this method is explained more clearly and completely. Figure 1 As shown, the process includes steps S101 to S104:

[0085] Step S101, obtaining performance parameters of the security device within a preset time period, wherein the performance parameters include at least one of the following: basic defense value, anti-attack security effectiveness, and security location level.

[0086] Specifically, the basic technical parameters of the basic defense value of the security equipment mainly include model, combat technical indicators, physical characteristics, power supply indicators, self-security, general quality characteristics, localization support, etc. The basic defense value reflects the security defense capabilities of the basic technical parameters of the security equipment; the security effectiveness of the security equipment against attacks reflects the ability of the security equipment to exert its defense effectiveness against attacks; the security location level of the security equipment reflects the degree of loss caused by the destruction of security attributes. This step comprehensively establishes an indicator system for the multi-dimensional protection capabilities of the security equipment in basic technical parameters, real-time security situation against attacks, and location information importance level within a preset time period. In this embodiment, the basic technical parameters correspond to the basic defense value, and the implementation of the security situation against attacks corresponds to the security effectiveness against attacks. This embodiment can collect data on the basic defense value, security effectiveness against attacks, and security location level of the security equipment within a 24-hour period.

[0087] Among them, Figure 3 As shown, the specific process of step S101 is as follows:

[0088] S1011, according to the category set of equipment model, combat technical indicators, physical characteristics, and power supply indicators of the security equipment within the preset time period, a naive Bayes classification algorithm is used to obtain the basic defense value of the security equipment within the preset time period.

[0089] Specifically, Figure 4 As shown, the logic method principle of step S101 is that the basic defense value of the security equipment is mainly based on the dimensions of equipment model, combat technical indicators, physical characteristics, power supply indicators, etc., and the naive Bayes classification algorithm is used to build a model, and the corresponding level of the basic defense value is defined as the item to be classified, and the probability of each characteristic attribute of the item to be classified appearing under the condition of each category appearing is calculated. Which characteristic attribute of the item to be classified has the largest conditional probability, then this characteristic attribute of the item to be classified is the current basic defense value level of the security equipment. In this embodiment, the definition and assignment of the corresponding level of the basic defense value are shown in Table 1-1.

[0090] Table 1-1

[0091] Basic Defense Value grade describe 5 Very high Evaluate the basic technical parameters of security equipment and have very high security defense capabilities 4 high Evaluate the basic technical parameters of security equipment and have high security defense capabilities 3 middle Evaluate the basic technical parameters of security equipment and have medium security defense capabilities 2 Low Evaluate the basic technical parameters of security equipment and have low security defense capabilities 1 Very low Evaluate the basic technical parameters of security equipment and have very low security defense capabilities

[0092] Among them, Figure 5 As shown, the specific process of step S1011 is as follows:

[0093] S10111, dividing each characteristic attribute to set items to be classified, and forming training samples of the category set.

[0094] Specifically, assume that X={x1, x2, x3, x4, .....xm} is an item to be classified, each element is an independent feature attribute, and the category set A={y1, y2, y3, y4, ....yn}, where each element is a class item. In this embodiment, extremely high, high, medium, low, and extremely low are independent feature attributes in an item to be classified, that is, X={extremely high, high, medium, low, and extremely low}; the equipment model, combat technical indicators, physical characteristics, and power supply indicators are respectively used as class items of the category set A, that is, the category set A={equipment model, combat technical indicators, physical characteristics, and power supply indicators}. The equipment model includes enhanced and basic types, the combat technical indicators include various security functions and various management functions, the physical characteristics include 1U, 2U, and 4U, and the power supply indicators include whether there is redundant dual power supply and whether there is a grounding column. Some training samples of the category set are shown in Table 1-2.

[0095] Table 1-2

[0096]

[0097] S10112, calculating the occurrence probability of each of the category sets in the training samples, and the conditional probability of each of the feature attributes corresponding to each of the category sets, and recording the results.

[0098] Specifically, in combination with the training samples,

[0099] First calculate P(y1|X), P(y2|X), P(y3|X), P(y4|X)...P(yn|X); combined with step S10111, X={extremely high, high, medium, low, extremely low}, A={equipment model, combat technical indicators, physical characteristics, power supply indicators}, that is, y1 is the equipment model, y2 is the combat technical indicators, y3 is the physical characteristics, and y4 is the power supply indicator; in this embodiment, P(y1|X) is P(equipment model|extremely high, high, medium, low, extremely low), P(y2|X) is P(combat technical indicators|extremely high, high, medium, low, extremely low), P(y3|X) is P(physical characteristics|extremely high, high, medium, low, extremely low), and P(y4|X) is P(power supply indicators|extremely high, high, medium, low, extremely low).

[0100] If y(yi|X)=max{P(y1|X),P(y2|X),P(y3|X),P(y4|X),P(yn|X)}, then X belongs to class i;

[0101] According to Bayes' theorem, the conditional probability calculation formula for each feature attribute in each category is derived as follows: Complete the calculation of the probability P(yi) of each category appearing in the training sample and the conditional probability P(X|yi)*P(yi) of each feature attribute division for each category.

[0102] S10113, output the basic defense value level of the characteristic attribute corresponding to the maximum value in the conditional probability to obtain the basic defense value of the security device within the preset time period.

[0103] S1012, according to the attack detection rate and attack interception rate of the network on the security device within the preset time period, a weighted average algorithm is used to obtain the security effectiveness of the security device against attacks within the preset time period.

[0104] Specifically, the security effectiveness evaluation of security equipment against attacks is mainly calculated based on dimensions such as the total number of attacks occurring in the network, the number of attacks detected, the number of attacks intercepted, and the number of attacks not intercepted. It has a built-in scoring algorithm for attack detection rate and attack interception rate, and then calculates the security effectiveness value against attacks through a weighted average formula.

[0105] Among them, Figure 6 As shown, the specific process of step S1012 is as follows:

[0106] S10121, obtaining the total amount of attacks from the network to the security device within the preset time period, the number of detected attacks, the number of intercepted attacks, and the number of unintercepted attacks.

[0107] Specifically, the above data is the number of security devices collected by the network within 24 hours. Of course, the collection time can be set according to the specific situation.

[0108] S10122, calculate the attack detection rate and attack interception rate.

[0109] Specifically, the attack detection rate and attack interception rate are calculated as follows:

[0110]

[0111] For example, if the total number of attacks that occurred is 10, the number of attacks that were detected is 8, and the number of attacks that were blocked is 6, then the attack detection rate is 80% and the attack blocking rate is 75%.

[0112] S10123, taking a weighted average of the attack detection rate and the attack interception rate to determine the countermeasure security effectiveness of the security device within the preset time period.

[0113] Specifically, the weighted average algorithm is:

[0114]

[0115] Where a is the base number of the assignment. In this embodiment, a=5 is set, the attack detection rate is 80%, and the attack interception rate is 80%, then the value of the security effectiveness against attacks is calculated to be 4; or in other embodiments, when the attack detection rate is 50%, the attack interception rate is 50%, and the value of the security effectiveness against attacks is calculated to be 2.5. In this embodiment, the assignment interval of the security effectiveness against attacks is between 0 and 5, so the assignment of the security effectiveness against attacks is shown in Table 2-1.

[0116] Table 2-1

[0117] Safety performance Assignment describe Level 1 4～5 Security equipment has strong defense capabilities against attacks and maintains a level Level 2 2.5～4 Security equipment is generally ineffective in defending against attacks and needs to be reinforced Level 3 0～2.5 Security equipment has a weak defense capability against attacks and needs to be rectified

[0118] S1013, according to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection service system within the preset time period, a cubic root algorithm is used to obtain the security position level of the security device within the preset time period.

[0119] Specifically, the security location level is scored based on three basic security factors: the network level to which the security device belongs, the confidentiality level of the security domain to which it belongs, and the importance of protecting the business system. It is mainly determined by the current impact of the security device on these three security factors.

[0120] Among them, Figure 7 As shown, the specific process of step S1013 is as follows:

[0121] S10131, according to the predefined level values ​​of the basic security factors of the security device within the preset time period, respectively obtain the level values ​​corresponding to the network, the security domain, and the protection business system.

[0122] Specifically, first, the level value of the network is scored according to the level protection capability of the network to which the security device currently belongs, and is divided into five different levels, corresponding to the basic security protection capabilities that the network to which the security device belongs should have; the network level assignment is shown in Table 3-1.

[0123] Table 3-1

[0124] Network level value describe Level 1 1 Establish basic security protection measures and be able to resist general attacks Level 2 2 Based on the first level requirements, it has certain ability to prevent internal and external attacks Level 3 3 Based on the second level requirements, it has a certain ability to resist organized attacks Level 4 4 Based on the third level requirements, it has a certain ability to resist large-scale attacks Level 5 5 Based on the fourth level requirements, it has the ability to resist large-scale attacks

[0125] Secondly, regarding the confidentiality level of the security domain, it is divided into three different levels according to the confidentiality level of the security domain to which the security device belongs: confidential, secret, and unconfidential. The higher the confidentiality level of the security domain, the stronger the security protection capability required; the security domain confidentiality level assignment is shown in Table 3-2.

[0126] Table 3-2

[0127] Security Domain Level value describe confidential 5 Such as the core switching domain, responsible for the connection and data exchange of the entire network secret 3 Such as access domain, management domain, internal user domain Non-Confidential 2 For example, external user domain

[0128] Thirdly, for the protection of business systems, the security level protection of the business systems protected by security equipment is generally divided into five different levels, with level one being the lowest protection level and level five being the highest. The higher the importance of protecting the business system, the higher the defense capability requirements for the security equipment. The values ​​assigned to protecting the business system are shown in Table 3-3.

[0129] Table 3-3

[0130]

[0131] S10132, taking the cube root of the product of the level value of the network, the level value of the security domain and the level value of the protection service system, to calculate the security position level of the security device within the preset time period.

[0132] Specifically, the cubic root algorithm is:

[0133]

[0134] In this embodiment, the level value of the network is 3, the level value of the security domain is 3, and the level value of the protection service system is 3, then the security position weight level is assigned a value of 3. Through the above algorithm, the security position level assignment can be obtained as shown in Table 3-4.

[0135] Table 3-4

[0136] Security location importance level Assignment describe Very important 5 The destruction of its security attributes will cause very serious losses important 4 The destruction of its security attributes will cause serious losses More important 3 The destruction of its security attributes will cause moderate losses General Important 2 Its safety properties will cause less loss after being destroyed unimportant 1 The damage to its security properties will cause very little loss, even negligible.

[0137] Step S102, using AHP (Analysis Hierarchy Process) to calculate the weight of the performance parameter.

[0138] Specifically, after using the above algorithm to evaluate the basic defense value, anti-attack security effectiveness and security position level of the security equipment respectively, the AHP hierarchical analysis method is used to calculate the respective weights of the basic defense value, anti-attack security effectiveness and security position level evaluation.

[0139] Among them, Figure 8 As shown, the specific process of step S102 is as follows:

[0140] S1021, constructing a hierarchical model including the basic defense value, the anti-attack security effectiveness and the security position level.

[0141] In this embodiment, combined with Fig. 9 As shown, the hierarchical model consists of a solution layer, a measurement layer, and a target layer.

[0142] S1022: constructing a judgment matrix layer by layer according to the hierarchical structure model.

[0143] In this embodiment, the judgment matrix is ​​shown in Table 4-1.

[0144] Table 4-1

[0145]

[0146] S1023, calculating the maximum eigenvalue and its corresponding eigenvector in the judgment matrix through hierarchical single sorting and hierarchical total sorting, so as to obtain the respective weights of the basic defense value, the anti-attack security effectiveness and the security position level.

[0147] In this embodiment, the AHP hierarchical analysis results are shown in Table 4-2.

[0148] Table 4-2

[0149]

[0150] S1024, calculating a test quantity similar to the hierarchical single sorting to perform consistency test analysis on the calculation results of the hierarchical total sorting.

[0151] Step S103: According to the performance parameters and the weights corresponding to the performance parameters, a preset function is used to evaluate the evaluation value of the defense capability level of the security device within the preset time period.

[0152] Specifically, the preset function is: the evaluation value of the defense capability level = basic defense value assignment * weight + anti-attack security effectiveness assignment * weight + security position level assignment * weight. In this embodiment, the evaluation value of the defense capability level = 5×26.8%+4×61.4%+3*11.8%=1.34+2.456+0.354=4.15. It should be noted that because the assignment intervals of the basic defense value, anti-attack security effectiveness, and security position level are all 1 to 5, the interval of the defense capability level evaluation value is also 1 to 5. According to the rounding method, the defense capability level of the security equipment is divided into five levels according to the evaluation value, as shown in Table 5-1.

[0153] Table 5-2

[0154] Defensive Ability Level Evaluation value definition Level 1 1 Security equipment has very low defense capabilities, user risk warning Level 2 2 The defense capability of security equipment is low, and users need to rectify it Level 3 3 The security equipment has medium defense capability, and users need to improve it Level 4 4 Security equipment has high defense capabilities, and users need to consolidate Level 5 5 Security equipment has extremely high defense capabilities, and users can just keep the status quo

[0155] Step S104, obtaining the defense capability level of the security device within the preset time period according to the evaluation value, and providing prompt information adapted to the defense capability level.

[0156] Specifically, as shown in Table 5-1, the prompt information includes at least one of the following information: the security device has extremely low defense capability, user risk warning, low defense capability of the security device, user needs to rectify, medium defense capability of the security device, user needs to improve, high defense capability of the security device, user needs to consolidate, or extremely high defense capability of the security device, user can keep the status quo. Among them, the prompt information corresponding to the first level of the security device's defense capability level is "the security device has extremely low defense capability, user risk warning", the prompt information corresponding to the second level of the security device's defense capability level is "the security device has low defense capability, user needs to rectify", the prompt information corresponding to the third level of the security device's defense capability level is "the security device has medium defense capability, user needs to improve", the prompt information corresponding to the fourth level of the security device's defense capability level is "the security device has high defense capability, user needs to consolidate", and the prompt information corresponding to the fifth level of the security device's defense capability level is "the security device has extremely high defense capability, user keeps the status quo". In this embodiment, the evaluation value of the defense capability level is 4.15. According to the rounding method, the defense capability level of the security device in this embodiment is level 4, and its corresponding prompt information is "the security device has high defense capability, user needs to consolidate".

[0157] Through the above steps, an indicator system is established for the comprehensive security equipment in terms of basic technical parameters, real-time anti-attack security situation, location information importance level and other multi-dimensional protection capabilities. According to the attack detection rate, attack interception rate of the security equipment in network anti-attack within a period of time, as well as the changes in the network level, security domain and protected business system to which it belongs, the anti-attack security effectiveness evaluation algorithm model and the security location level algorithm model are triggered, so that the anti-attack security effectiveness evaluation value and weight value, security location level evaluation value and weight value of the security equipment change accordingly, and the defense capability value of the security equipment also changes periodically. The changing trend of the defense capability of each security equipment is dynamically analyzed to assist users in analyzing and deciding whether the current defense capability of the security equipment has reached a bottleneck and whether to improve its own defense capability through technical means such as upgrades and reinforcements.

[0158] Embodiment 2

[0159] This embodiment provides a structural block diagram of a system corresponding to the method described in Embodiment 1. Fig.10 is a structural block diagram of a security device defense capability evaluation system according to an embodiment of the present application, such as Fig.10 As shown, the system includes:

[0160] An acquisition module 10 is used to acquire performance parameters of the security device within a preset time period, wherein the performance parameters include at least one of the following: a basic defense value, a security effectiveness against attacks, and a security position level;

[0161] The analysis module 20 is used to calculate the weight of the performance parameter by using the AHP hierarchy analysis method;

[0162] An evaluation module 30, configured to evaluate the defense capability level of the security device within the preset time period using a preset function according to the performance parameters and the weights corresponding to the performance parameters;

[0163] The processing module 40 is used to obtain the defense capability level of the security device within the preset time period according to the evaluation value, and provide prompt information adapted to the defense capability level.

[0164] Furthermore, the acquisition module 10 includes:

[0165] The first acquisition module 11 is used to obtain the basic defense value of the security device within the preset time period using a naive Bayes classification algorithm according to the device model, combat technical indicators, physical characteristics, and power supply indicator category set of the security device within the preset time period;

[0166] The second acquisition module 12 is used to obtain the security effectiveness of the security device against attacks within the preset time period by using a weighted average algorithm according to the attack detection rate and attack interception rate of the network on the security device within the preset time period;

[0167] The third acquisition module 13 is used to obtain the security position level of the security device within the preset time period by using a cubic algorithm according to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection service system within the preset time period.

[0168] Furthermore, the first acquisition module 11 includes:

[0169] A first acquisition unit 111 is used to divide each characteristic attribute to set items to be classified, so as to form training samples of the category set;

[0170] A first calculation unit 112 is used to calculate the occurrence probability of each of the category sets in the training sample, and the conditional probability of each of the feature attributes corresponding to each of the category sets, and record the results;

[0171] The first algorithm unit 113 is used to output the basic defense value level of the characteristic attribute corresponding to the maximum value in the conditional probability, so as to obtain the basic defense value of the security device within the preset time period.

[0172] Furthermore, the second acquisition module 12 includes:

[0173] The second acquisition unit 121 is used to obtain the total amount of attacks on the security device by the network within the preset time period, the number of detected attacks, the number of intercepted attacks, and the number of unintercepted attacks;

[0174] A second calculation unit 122, used to calculate an attack detection rate and an attack interception rate;

[0175] The second algorithm unit 123 is used to perform a weighted average on the attack detection rate and the attack interception rate to determine the anti-security effectiveness of the security device within the preset time period, wherein the weighted average algorithm is:

[0176]

[0177] In the formula, a is the base number of the assignment.

[0178] Furthermore, the third acquisition module 13 includes:

[0179] The third acquisition unit 131 is used to obtain the level values ​​corresponding to the network, the security domain, and the protection business system respectively according to the predefined level values ​​of the basic security factors of the security device within the preset time period;

[0180] The third algorithm unit 132 performs a cubic root on the product of the level value of the network, the level value of the security domain, and the level value of the protection service system to calculate the security position level of the security device within the preset time period, wherein the cubic root algorithm is:

[0181]

[0182] Furthermore, the analysis module 20 includes:

[0183] A construction unit 21, configured to construct a judgment matrix layer by layer according to the hierarchical structure model;

[0184] A calculation unit 22 is used to calculate the maximum eigenvalue and its corresponding eigenvector in the judgment matrix through hierarchical single sorting and hierarchical total sorting to obtain the weights of the basic defense value, the anti-attack security effectiveness and the security position level;

[0185] The verification unit 23 is used to calculate a verification quantity similar to the hierarchical single sorting to perform consistency verification analysis on the calculation results of the hierarchical total sorting.

[0186] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0187] Embodiment 3

[0188] Combination Figure 1 The security device defense capability assessment method described in the embodiment of the present application can be implemented by a computer device. Fig.11 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0189] The computer device may include a processor 51 and a memory 52 storing computer program instructions.

[0190] Specifically, the processor 51 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0191] Among them, the memory 52 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 52 may include a hard disk drive (HDD), a floppy disk drive, a solid state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 52 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 52 may be inside or outside the data processing device. In a specific embodiment, the memory 52 is a non-volatile memory. In a specific embodiment, the memory 52 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (Programmable Read-Only Memory, PROM for short), an erasable PROM (Erasable ProgrammableRead-Only Memory, EPROM for short), an electrically erasable PROM (Electrically Erasable ProgrammableRead-Only Memory, EEPROM for short), an electrically alterable ROM (Electrically Alterable Read-Only Memory, EAROM for short) or a flash memory (FLASH) or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0192] The memory 52 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 51 .

[0193] The processor 51 implements any one of the security device defense capability assessment methods in the above embodiments by reading and executing computer program instructions stored in the memory 52 .

[0194] In some of the embodiments, the computer device may further include a communication interface 53 and a bus 50. Fig.11 As shown, the processor 51, the memory 52, and the communication interface 53 are connected via a bus 50 and communicate with each other.

[0195] The communication interface 53 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication interface 53 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0196] The bus 50 includes hardware, software or both, and couples the components of the computer device to each other. The bus 50 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 50 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 50 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0197] The computer device can execute the security device defense capability evaluation method in the embodiment of the present application based on the acquired security device defense capability evaluation system, thereby realizing the combination of Figure 1 Describes a method for evaluating the defense capabilities of security devices.

[0198] In addition, in combination with the security device defense capability evaluation method in the above embodiment, the present application embodiment can provide a storage medium for implementation. The storage medium stores computer program instructions; when the computer program instructions are executed by the processor, a security device defense capability evaluation method in the above embodiment 1 is implemented.

[0199] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0200] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for evaluating the defense capability of a security device, characterized in that: include: Step S101, obtaining performance parameters of the security device within a preset time period, wherein the performance parameters include at least one of the following: basic defense value, anti-attack security effectiveness, and security position level; Step S102, using AHP analytic hierarchy process to calculate the weight of the performance parameter; Step S103, evaluating the defense capability level of the security device within the preset time period using a preset function according to the performance parameter and the weight corresponding to the performance parameter; Step S104, obtaining the defense capability level of the security device within the preset time period according to the evaluation value, and providing prompt information adapted to the defense capability level; The step S101 further comprises: According to the category set of equipment model, combat technical indicators, physical characteristics, and power supply indicators of the security equipment within the preset time, a naive Bayes classification algorithm is used to obtain the basic defense value of the security equipment within the preset time; Divide each characteristic attribute to set items to be classified, and form a training sample of the category set; calculate the occurrence probability of each category set in the training sample, and the conditional probability of each characteristic attribute corresponding to each category set, and record the results; output the basic defense value level of the characteristic attribute corresponding to the maximum value in the conditional probability, so as to obtain the basic defense value of the security device within the preset time period; According to the attack detection rate and attack interception rate of the network on the security device within the preset time period, a weighted average algorithm is used to obtain the security effectiveness of the security device against attacks within the preset time period; According to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection business system within the preset time period, a cubic root algorithm is used to obtain the security position level of the security device within the preset time period.

2. The method for evaluating the defense capability of a security device according to claim 1, characterized in that: The step of using a weighted average algorithm to obtain the security effectiveness of the security device against attacks within the preset time period according to the attack detection rate and attack interception rate of the network on the security device within the preset time period further includes: Obtaining the total amount of attacks on the security device by the network within the preset time period, the number of detected attacks, the number of intercepted attacks, and the number of unintercepted attacks; Calculate attack detection rate and attack interception rate; The attack detection rate and the attack interception rate are weighted averaged to determine the anti-security performance of the security device within the preset time period.

3. The method for evaluating the defense capability of security equipment according to claim 1, characterized in that: The step of using a cubic algorithm to obtain the security location level of the security device within the preset time period according to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection service system within the preset time period specifically includes: According to the predefined level values ​​of the basic security factors of the security equipment within the preset time period, the level values ​​corresponding to the network, the security domain, and the protection business system are respectively obtained; The product of the level value of the network, the level value of the security domain and the level value of the protection service system is cubed to calculate the security position level of the security device within the preset time period.

4. The method for evaluating the defense capability of security equipment according to claim 1, characterized in that: The step of calculating the weight of the performance parameter using the AHP hierarchy analysis method further includes: Constructing a hierarchical model including the basic defense value, the anti-attack security effectiveness and the security position level; Constructing a judgment matrix layer by layer according to the hierarchical structure model; By means of hierarchical single sorting and hierarchical total sorting, the maximum eigenvalue and its corresponding eigenvector in the judgment matrix are calculated to obtain the weights of the basic defense value, the anti-attack security effectiveness and the security position level; Perform a consistency check analysis on the calculation results of the hierarchical total ordering.

5. The method for evaluating the defense capability of security equipment according to claim 1, characterized in that: When the defense capability level is level one, the prompt information includes a user risk warning; when the defense capability level is level two, the prompt information includes that the user needs to make corrections; when the defense capability level is level three, the prompt information includes that the user needs to improve; when the defense capability level is level four, the prompt information includes that the user needs to consolidate; when the defense capability level is level five, the prompt information includes that the user can maintain the status quo.

6. A security equipment defense capability evaluation system, characterized in that: include: The acquisition module is used to acquire the performance parameters of the security device within a preset time period, wherein the performance parameters include at least one of the following: basic defense value, anti-attack security effectiveness and security position level, and further includes: According to the category set of equipment model, combat technical indicators, physical characteristics, and power supply indicators of the security equipment within the preset time, a naive Bayes classification algorithm is used to obtain the basic defense value of the security equipment within the preset time; Divide each characteristic attribute to set items to be classified, and form a training sample of the category set; calculate the occurrence probability of each category set in the training sample, and the conditional probability of each characteristic attribute corresponding to each category set, and record the results; output the basic defense value level of the characteristic attribute corresponding to the maximum value in the conditional probability, so as to obtain the basic defense value of the security device within the preset time period; According to the attack detection rate and attack interception rate of the network on the security device within the preset time period, a weighted average algorithm is used to obtain the security effectiveness of the security device against attacks within the preset time period; According to the basic security factors of the network to which the security device belongs, the security domain to which it belongs, and the protection service system within the preset time period, a cubic root algorithm is used to obtain the security position level of the security device within the preset time period; An analysis module, used to calculate the weight of the performance parameter using AHP (Analysis Hierarchy Process); An evaluation module, configured to evaluate the defense capability level of the security device within the preset time period using a preset function according to the performance parameters and the weights corresponding to the performance parameters; The processing module is used to obtain the defense capability level of the security device within the preset time period according to the evaluation value, and to provide prompt information that is compatible with the defense capability level.

7. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for evaluating the defense capability of a security device according to any one of claims 1 to 5 is implemented.

8. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for evaluating the defense capability of a security device as described in any one of claims 1 to 5 is implemented.

Images