Enterprise Network Security Assessment Method, System, Storage Medium and Electronic Device

Abstract

The present invention relates to the field of network security technology, and particularly to an enterprise network security assessment method, system, storage medium and electronic device. The method includes: generating a final matrix based on the network security situation data of each preset node of the enterprise network to be evaluated, calculating the similarity between the final matrix and a preset standard matrix, and determining the comprehensive security assessment result of the enterprise network to be evaluated according to the similarity, which can not only ensure the assessment accuracy of the enterprise network to be evaluated, but also achieve the purpose of greatly reducing the calculation amount without establishing and training a neural network model.

Description

Background Art

[0002] A network refers to the automated operation of network management configuration implemented in a strategic and programmed manner. It often has built-in security functions that can detect threats and respond automatically to help enterprises stay away from threats. Currently, the security assessment results of a network are often determined by collecting various factors affecting network security in the network and inputting them into a trained neural network model. Since a neural network model needs to be established and trained, the computational load is large and the processing process is relatively complex. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide an enterprise network security assessment method, system, storage medium and electronic device in view of the deficiencies of the prior art.

[0004] The technical solution of an enterprise network security assessment method of the present invention is as follows:

[0005] Generate a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated;

[0006] Calculate the similarity between the final matrix and a preset standard matrix, and obtain the comprehensive security assessment result of the enterprise network to be evaluated according to the similarity and the preset comprehensive weight value corresponding to the preset standard matrix.

[0007] The beneficial effects of an enterprise network security assessment method of the present invention are as follows:

[0008] Generate a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated, calculate the similarity between the final matrix and a preset standard matrix, and the comprehensive security assessment result of the enterprise network to be evaluated can be determined according to the similarity. It can not only ensure the accuracy of the evaluation of the enterprise network to be evaluated, but also does not need to establish and train a neural network model, achieving the purpose of greatly reducing the computational load.

[0009] On the basis of the above solution, an enterprise network security assessment method of the present invention can be further improved as follows.

[0010] Further, it further includes:

[0011] Obtain multiple initial network communication data sent from a first preset node to a second preset node, and obtain multiple final network communication data received by the second preset node, and determine the data packet loss rate between the first preset node and the second preset node according to the initial network communication data and the final network communication data, until the packet loss rates corresponding to each two directly data-interacting preset nodes are obtained, and correct the comprehensive security assessment result according to all the packet loss rates, where the first preset node and the second preset node represent: any two directly data-interacting preset nodes among all the preset nodes.

[0012] The beneficial effect of adopting the above further solution is that by using the packet loss rate to correct the comprehensive security assessment result, the accuracy of the assessment of the enterprise network to be evaluated is further improved.

[0013] Furthermore, it also includes:

[0014] Embed the network security situation data of each preset node into the corresponding digital watermark respectively and save it.

[0015] The beneficial effect of adopting the above further solution is that by embedding digital watermarks, tampering can be prevented, and the accuracy of data traceability can be guaranteed.

[0016] Furthermore, the process of generating the final matrix includes:

[0017] Generate an initial matrix corresponding to each preset node according to the network security situation data of each preset node of the enterprise network to be evaluated, and generate the final matrix according to all the initial matrices.

[0018] Furthermore, the network security situation data includes: abnormal event situation data, security vulnerability situation data, data inflow volume per unit time, and anti-attack ability level.

[0019] The technical solution of an enterprise network security assessment system of the present invention is as follows:

[0020] It includes a generation module and an evaluation module;

[0021] The generation module is used for: generating a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated;

[0022] The evaluation module is used for: calculating the similarity between the final matrix and a preset standard matrix, and obtaining the comprehensive security assessment result of the enterprise network to be evaluated according to the similarity and the preset comprehensive weight value corresponding to the preset standard matrix.

[0023] The beneficial effect of an enterprise network security assessment system of the present invention is as follows:

[0024] Generate a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated, calculate the similarity between the final matrix and a preset standard matrix, and the comprehensive security assessment result of the enterprise network to be evaluated can be determined according to the similarity. It can not only ensure the accuracy of the assessment of the enterprise network to be evaluated, but also does not need to establish and train a neural network model, achieving the purpose of greatly reducing the calculation amount.

[0025] On the basis of the above solution, an enterprise network security assessment system of the present invention can also be improved as follows.

[0026] Further, it further includes a correction module, and the correction module is used for:

[0027] Obtain multiple pieces of initial network communication data sent from a first preset node to a second preset node, obtain multiple pieces of final network communication data received by the second preset node, and determine the data packet loss rate between the first preset node and the second preset node based on the initial network communication data and the final network communication data, until obtaining the packet loss rate corresponding to each two preset nodes that directly perform data interaction, and correct the comprehensive security assessment result according to all the packet loss rates, where the first preset node and the second preset node represent: any two preset nodes among all the preset nodes that directly perform data interaction.

[0028] The beneficial effect of adopting the above further solution is: By correcting the comprehensive security assessment result through the packet loss rate, the assessment accuracy of the enterprise network to be evaluated is further improved.

[0029] Further, it further includes a watermark module, and the watermark module is used for:

[0030] Embed the network security situation data of each preset node into the corresponding digital watermark respectively and save it.

[0031] The beneficial effect of adopting the above further solution is: By embedding digital watermarks, tampering is prevented, and the accuracy of data traceability can be guaranteed.

[0032] Further, the generation module is specifically used for:

[0033] Generate an initial matrix corresponding to each preset node according to the network security situation data of each preset node of the enterprise network to be evaluated, and generate the final matrix according to all the initial matrices.

[0034] Further, the network security situation data includes: abnormal event situation data, security vulnerability situation data, data inflow volume per unit time, and anti-attack ability level.

[0035] A storage medium of the present invention, in which instructions are stored, and when a computer reads the instructions, the computer executes an enterprise network security assessment method as described in any one of the above.

[0036] An electronic device of the present invention includes a processor and the above storage medium, and the processor executes the instructions in the storage medium. Description of the Drawings

[0037] Figure 1 It is a schematic flowchart of an enterprise network security assessment method according to an embodiment of the present invention;

[0038] Figure 2 The structural schematic diagram of an enterprise network security assessment system according to an embodiment of the present invention. Specific embodiments

[0039] As Figure 1 shown, an enterprise network security assessment method according to an embodiment of the present invention includes the following steps:

[0040] S1. Generate a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated;

[0041] Among them, the enterprise network refers to the network applied to the enterprise, and the node refers to the physical component or virtual component in the enterprise network. The physical component can specifically be: server, computer, switch, gateway, memory, router, etc., and the virtual component can specifically be: database, cloud platform, cloud memory, etc.

[0042] Among them, the network security situation data includes: abnormal event situation data, security vulnerability situation data, data inflow volume per unit time, and anti-attack ability level. The preset node refers to the selected node.

[0043] Among them, the process of generating the final matrix is as follows:

[0044] Generate an initial matrix corresponding to each preset node according to the network security situation data of each preset node of the enterprise network to be evaluated, and generate the final matrix according to all the initial matrices. Specifically:

[0045] 1) The specific form of the initial matrix can be set according to the actual situation. For example, the initial matrix is a matrix with one row and multiple columns. Since the network security situation data includes: abnormal event situation data, security vulnerability situation data, data inflow volume per unit time, and anti-attack ability level, at this time, the initial matrix is specifically a matrix with one row and four columns, or the initial matrix can also be set as a matrix with two rows and two columns, etc.;

[0046] 2) The abnormal event situation data includes the abnormal event type and the abnormal event occurrence frequency; the security vulnerability situation data includes: vulnerability type, vulnerability level, vulnerability impact range, and vulnerability occurrence frequency; the evaluation criterion for the data inflow volume per unit time is: as the data inflow volume per unit time increases, the security assessment level decreases. The anti-attack ability level can be determined by a multi-agent system network anti-attack ability assessment method based on representation learning, a network behavior attack method based on FPGA, or a scale-free network attack method based on random neighbor nodes, or the anti-attack ability level of each preset node can also be determined by other existing technologies;

[0047] The standards can be set manually to quantify the data of each abnormal event situation, the data of security vulnerabilities, the data inflow volume per unit time, and the anti-attack ability level, obtaining an initial matrix. Then, all the initial matrices are arranged in a preset order, such as the order of preset nodes, to generate the final matrix.

[0048] S2. Calculate the similarity between the final matrix and a preset standard matrix, and obtain the comprehensive security evaluation result of the enterprise network to be evaluated according to the similarity and the preset comprehensive weight value corresponding to the preset standard matrix.

[0049] Among them, the network security situation data of each preset node, namely the data of abnormal event situations, the data of security vulnerabilities, the data inflow volume per unit time, and the anti-attack ability level, are set manually in advance as the standard network security situation data for reference, and are respectively denoted as the standard abnormal event situation data, the standard security vulnerability situation data, the standard data inflow volume per unit time, and the standard anti-attack ability level. According to the same manual setting standards above, the standard abnormal event situation data, the standard security vulnerability situation data, the standard data inflow volume per unit time, and the standard anti-attack ability level are quantified, and matrices corresponding to each preset node are generated in the specific form of the above initial matrix. Then, the matrices corresponding to each preset node are arranged in the above preset order to generate a standard matrix. By changing the specific values of the standard abnormal event situation data, the standard security vulnerability situation data, the standard data inflow volume per unit time, and the standard anti-attack ability level, multiple standard matrices are generated, and the comprehensive weight values corresponding to each standard matrix and the comprehensive security evaluation results corresponding to each comprehensive weight value are demonstrated by multiple experts, so as to improve the accurate correspondence relationship among the network security situation data, the preset comprehensive weight values, and the comprehensive security evaluation results corresponding to each preset comprehensive weight value, and finally achieve the purpose of improving the accuracy of the comprehensive security evaluation result of the enterprise network to be evaluated.

[0050] Theoretically, any standard matrix can be used as the preset standard matrix to calculate the similarity between the final matrix and the preset standard matrix. The similarity is specifically the Euclidean distance, the Mahalanobis distance, or the cosine similarity. And according to the similarity and the preset comprehensive weight value corresponding to the preset standard matrix, the comprehensive security evaluation result of the enterprise network to be evaluated is obtained. Specifically:

[0051] The comprehensive security assessment results can be multiple security levels such as the first-level security level, the second-level security level, the third-level security level, etc. Among them, the first-level security level is the highest security level, and the other security levels follow in sequence. For example, the comprehensive security assessment result corresponding to the comprehensive weight value of 10 is the first-level security level, the comprehensive security assessment result corresponding to the comprehensive weight value from 9 to 10 is the second-level security level, the comprehensive security assessment result corresponding to the comprehensive weight value from 8 to 9 is the second-level security level, etc. For the convenience of calculation, the standard matrix corresponding to the comprehensive weight value of the highest security level, that is, the first-level security level, is often used as the preset standard matrix. Specifically:

[0052] 1) Using the standard matrix corresponding to the comprehensive weight value of 10 as the preset standard matrix, if the similarity between the final matrix and the preset standard matrix is 100%, the preset comprehensive weight value corresponding to the preset standard matrix is the comprehensive weight value of the enterprise network to be evaluated. From the comprehensive security assessment results corresponding to each pre-set comprehensive weight value, obtain the comprehensive security assessment result corresponding to the preset comprehensive weight value, that is, the first-level security level, as the comprehensive security assessment result of the enterprise network to be evaluated.

[0053] 2) Using the standard matrix corresponding to the comprehensive weight value of 10 as the preset standard matrix, if the similarity between the final matrix and the preset standard matrix is 50%, 50% of the preset comprehensive weight value corresponding to the preset standard matrix is the comprehensive weight value of the enterprise network to be evaluated, that is, the comprehensive weight value of the enterprise network to be evaluated is 5. From the comprehensive security assessment results corresponding to each pre-set comprehensive weight value, obtain the comprehensive security assessment result corresponding to the preset comprehensive weight value, that is, the fifth-level security level, as the comprehensive security assessment result of the enterprise network to be evaluated.

[0054] 3) Using the standard matrix corresponding to the comprehensive weight value of 10 as the preset standard matrix, if the similarity between the final matrix and the preset standard matrix is 60%, 60% of the preset comprehensive weight value corresponding to the preset standard matrix is the comprehensive weight value of the enterprise network to be evaluated, that is, the comprehensive weight value of the enterprise network to be evaluated is 6. From the comprehensive security assessment results corresponding to each pre-set comprehensive weight value, obtain the comprehensive security assessment result corresponding to the preset comprehensive weight value, that is, the fourth-level security level, as the comprehensive security assessment result of the enterprise network to be evaluated. Then, perform an upgrade operation on the network security of the enterprise network to be evaluated according to the comprehensive security assessment result, etc.

[0055] 4) Use the standard matrix corresponding to the comprehensive weight value of 10 as the preset standard matrix. If the similarity between the final matrix and the preset standard matrix is 65%, and the comprehensive weight value of the enterprise network to be evaluated is 6.5, then the comprehensive security assessment result corresponding to the preset comprehensive weight value can be determined as the fourth-level security level and used as the comprehensive security assessment result of the enterprise network to be evaluated. Then, perform an upgrade operation on the network security of the enterprise network to be evaluated according to the comprehensive security assessment result, etc.

[0056] Generate a final matrix based on the network security situation data of each preset node of the enterprise network to be evaluated, calculate the similarity between the final matrix and the preset standard matrix, and the comprehensive security assessment result of the enterprise network to be evaluated can be determined according to the similarity. This can not only ensure the accuracy of the evaluation of the enterprise network to be evaluated but also eliminate the need to establish and train a neural network model, achieving the purpose of greatly reducing the computational complexity.

[0057] Optionally, in the above technical solution, it further includes:

[0058] S3. Obtain multiple pieces of initial network communication data sent by the first preset node to the second preset node, obtain multiple pieces of final network communication data received by the second preset node, and determine the data packet loss rate between the first preset node and the second preset node based on the initial network communication data and the final network communication data until the packet loss rates corresponding to each pair of directly data-interacting preset nodes are obtained. Then, correct the comprehensive security assessment result according to all the packet loss rates, where the first preset node and the second preset node represent any two directly data-interacting preset nodes among all the preset nodes. Correcting the comprehensive security assessment result through the packet loss rate can further improve the accuracy of the evaluation of the enterprise network to be evaluated. Specifically:

[0059] For example, within a unit time, such as 1 hour, the first preset node sends 100 pieces of initial network communication data to the second preset node, which are sent in a total of 10,000 packets. When the second preset node receives the 100 pieces of initial network communication data sent by the first preset node, it receives 100 pieces of network communication data, that is, 100 pieces of final network communication data, but a total of 9,900 data packets are received. Therefore, the packet loss rate is 1%. Until the packet loss rates corresponding to each pair of directly data-interacting preset nodes are obtained. Suppose a total of 100 packet loss rates are obtained. If the number of packet loss rates with values greater than 1% among the 100 packet loss rates exceeds 80%, then the comprehensive security assessment result is downgraded by one level. For example, if the comprehensive security assessment result of the enterprise network to be evaluated obtained based on the final matrix is the first-level security level, then the comprehensive security assessment result is downgraded by one level, that is, the comprehensive security assessment result of the enterprise network to be evaluated is the second-level security level.

[0060] Optionally, in the above technical solution, it further includes:

[0061] S4. Embed the network security situation data of each preset node into the corresponding digital watermark respectively and save it. Specifically, a watermark algorithm can be adopted to embed the corresponding digital watermark into the network security situation data of each preset node. The verification process of the digital watermark is generally executed by a qualified watermark verification agency. By embedding the digital watermark, tampering can be prevented, and the accuracy of data traceability can be ensured.

[0062] In the above embodiments, although the steps are numbered S1, S2, etc., these are only specific embodiments given in this application. Those skilled in the art can adjust the execution order of S1, S2, etc. according to the actual situation, and this is also within the protection scope of the present invention. It can be understood that in some embodiments, it may include some or all of the above embodiments.

[0063] As Figure 2 shown, an enterprise network security evaluation system 200 according to an embodiment of the present invention includes a generation module 210 and an evaluation module 220;

[0064] The generation module 210 is configured to: generate a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated;

[0065] The evaluation module 220 is configured to: calculate the similarity between the final matrix and a preset standard matrix, and obtain a comprehensive security evaluation result of the enterprise network to be evaluated according to the similarity and the preset comprehensive weight value corresponding to the preset standard matrix.

[0066] Generate a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated, calculate the similarity between the final matrix and a preset standard matrix, and the comprehensive security evaluation result of the enterprise network to be evaluated can be determined according to the similarity. This can not only ensure the evaluation accuracy of the enterprise network to be evaluated, but also does not need to establish and train a neural network model, achieving the purpose of greatly reducing the calculation amount.

[0067] Optionally, in the above technical solution, it further includes a correction module, and the correction module is configured to:

[0068] Obtain multiple pieces of initial network communication data sent from a first preset node to a second preset node, obtain multiple pieces of final network communication data received by the second preset node, and determine the data packet loss rate between the first preset node and the second preset node based on the initial network communication data and the final network communication data, until obtaining the packet loss rates corresponding to each pair of preset nodes that directly perform data interaction. Correct the comprehensive security assessment result according to all the packet loss rates, where the first preset node and the second preset node represent any two preset nodes among all the preset nodes that directly perform data interaction.

[0069] Correct the comprehensive security assessment result through the packet loss rate, further improving the accuracy of the assessment of the enterprise network to be evaluated.

[0070] Optionally, in the above technical solution, it further includes a watermark module, and the watermark module is used for:

[0071] Embed the network security situation data of each preset node into the corresponding digital watermark respectively and save it. By embedding the digital watermark, tampering is prevented, and the accuracy of data traceability can be ensured.

[0072] Optionally, in the above technical solution, the generating module 210 is specifically used for:

[0073] Generate an initial matrix corresponding to each preset node according to the network security situation data of each preset node of the enterprise network to be evaluated, and generate the final matrix according to all the initial matrices.

[0074] Optionally, in the above technical solution, the network security situation data includes: abnormal event situation data, security vulnerability situation data, data inflow volume per unit time, and anti-attack ability level.

[0075] For the parameters and the steps of each unit module in the above-mentioned enterprise network security assessment system 200 of the present invention to implement the corresponding functions, reference can be made to the parameters and steps in the embodiment of the enterprise network security assessment method in the above text, which will not be elaborated here.

[0076] A storage medium according to an embodiment of the present invention, wherein instructions are stored in the storage medium, and when a computer reads the instructions, the computer is made to execute the enterprise network security assessment method described in any one of the above.

[0077] An electronic device according to an embodiment of the present invention includes a processor and the above storage medium, and the processor executes the instructions in the storage medium. Among them, the electronic device can be a computer, a mobile phone, etc.

[0078] Those skilled in the art of the technical field know that the present invention can be implemented as a system, a method, or a computer program product.

[0079] Thus, the present disclosure may be embodied in the following forms, namely: it may be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, which is generally referred to herein as a "circuit", "module" or "system". In addition, in some embodiments, the present invention may also be implemented in the form of a computer program product in one or more computer-readable media, which contain computer-readable program code.

[0080] Any combination of one or more computer-readable media may be employed. The computer-readable media may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this document, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0081] Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. An enterprise network security assessment method, characterized in that, it includes: generating a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated; calculating the similarity between the final matrix and a preset standard matrix, and obtaining the comprehensive security assessment result of the enterprise network to be evaluated according to the similarity and the preset comprehensive weight value corresponding to the preset standard matrix; it further includes: obtaining multiple pieces of initial network communication data sent by a first preset node to a second preset node, and obtaining multiple pieces of final network communication data received by the second preset node, and determining the data packet loss rate between the first preset node and the second preset node according to the initial network communication data and the final network communication data, until obtaining the packet loss rate corresponding to each two directly data-interacting preset nodes, and correcting the comprehensive security assessment result according to all the packet loss rates, where the first preset node and the second preset node represent any two directly data-interacting preset nodes among all the preset nodes.

2. The enterprise network security assessment method according to claim 1, characterized in that, it further includes: embedding the network security situation data of each preset node into corresponding digital watermarks respectively and saving them.

3. The enterprise network security assessment method according to any one of claims 1 to 2, characterized in that, the process of generating the final matrix includes: generating an initial matrix corresponding to each preset node according to the network security situation data of each preset node of the enterprise network to be evaluated, and generating the final matrix according to all the initial matrices.

4. The enterprise network security assessment method according to any one of claims 1 to 2, characterized in that, the network security situation data includes: abnormal event situation data, security vulnerability situation data, data inflow volume per unit time, and anti-attack ability level.

5. An enterprise network security assessment system, characterized in that, it includes a generation module and an evaluation module; the generation module is used for: generating a final matrix according to the network security situation data of each preset node of the enterprise network to be evaluated; the evaluation module is used for: calculating the similarity between the final matrix and a preset standard matrix, and obtaining the comprehensive security assessment result of the enterprise network to be evaluated according to the similarity and the preset comprehensive weight value corresponding to the preset standard matrix; it further includes a correction module, and the correction module is used for: obtaining multiple pieces of initial network communication data sent by a first preset node to a second preset node, and obtaining multiple pieces of final network communication data received by the second preset node, and determining the data packet loss rate between the first preset node and the second preset node according to the initial network communication data and the final network communication data, until obtaining the packet loss rate corresponding to each two directly data-interacting preset nodes, and correcting the comprehensive security assessment result according to all the packet loss rates, where the first preset node and the second preset node represent any two directly data-interacting preset nodes among all the preset nodes.

6. The enterprise network security assessment system according to claim 5, It is characterized in that further comprises a watermark module, and the watermark module is configured to: embed the network security situation data of each preset node into corresponding digital watermarks respectively and save them.

7. A storage medium, it is characterized in that instructions are stored in the storage medium, and when a computer reads the instructions, the computer is caused to execute an enterprise network security assessment method according to any one of claims 1 to 4.

8. An electronic device, it is characterized in that comprises a processor and the storage medium according to claim 7, and the processor executes the instructions in the storage medium.

Images