A method and device for determining database detection evaluation results

Abstract

The present application provides a method and device for determining a database detection evaluation result, the method comprising: obtaining at least one data source required for calculating the database detection evaluation result; using each data source to determine the collection point data corresponding to each set collection point layer; for each set evaluation index layer, determining at least one collection point layer corresponding to the evaluation index layer, and using the collection point data corresponding to each collection point layer to determine the index tuple corresponding to the evaluation index layer; for each set atomic function layer, determining at least one evaluation index layer corresponding to the atomic function layer, and using the index tuple corresponding to each evaluation index layer to determine the evaluation tuple corresponding to the atomic function layer; using the evaluation tuple corresponding to each atomic function layer, determining the database detection evaluation result. According to the determination method and device, the database detection evaluation result can be determined quickly and accurately.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular, to a method and device for determining a database detection and evaluation result. Background Art

[0002] With the development of information technology and the Internet, more and more data are being produced. These data are related to all aspects of society, and their existence has become a necessary condition for the normal operation of the real world. These data are often stored in various databases, so the protection of databases has become very important. In order to better protect the database and the data in it, it is necessary to evaluate the effect of database information detection when conducting attack and defense drills on the database.

[0003] At present, the effect of database information detection is often evaluated manually, which is not only inaccurate, but also slow and time-consuming. Therefore, how to quickly and accurately evaluate the effect of database information detection has always been an urgent problem to be solved. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a method and device for determining the evaluation results of database detection, using a constructed multi-dimensional evaluation index system and combining it with a variety of designed evaluation algorithms to realize an effect evaluation method based on database information detection.

[0005] In a first aspect, an embodiment of the present application provides a method for determining a database detection evaluation result, the determination method comprising:

[0006] Obtain at least one data source required for calculating the database detection evaluation result; wherein the data source includes the target host database type, the database type of the target host detected submitted by the trainee, the target host database version, the database version of the target host detected submitted by the trainee, the target host database related user list, the target host detected related user list submitted by the trainee, the target host database vulnerability list, the target host detected database vulnerability list submitted by the trainee, the database vulnerability detection start time and the database vulnerability detection end time;

[0007] Using various data sources to determine the collection point data corresponding to each set collection point layer;

[0008] For each set evaluation index layer, determine at least one collection point layer corresponding to the evaluation index layer, and use the collection point data corresponding to each collection point layer to determine the index binary group corresponding to the evaluation index layer; wherein the index binary group includes the index value and index weight corresponding to the evaluation index layer, and the index weight is pre-set;

[0009] For each set atomic functional layer, at least one evaluation index layer corresponding to the atomic functional layer is determined, and the evaluation tuple corresponding to the atomic functional layer is determined using the index tuple corresponding to each evaluation index layer; wherein the evaluation tuple includes an evaluation value and an evaluation weight corresponding to the atomic functional layer, and the evaluation weight is pre-set;

[0010] The database detection evaluation result is determined by using the evaluation binary group corresponding to each atomic functional layer.

[0011] Furthermore, the collection point data corresponding to each collection point layer is determined in the following manner:

[0012] When the collection point layer is an actually existing database-related user list, the collection point data corresponding to the collection point layer is the target host database-related user list;

[0013] When the collection point layer is the number of actually existing database-related users, the collection point data corresponding to the collection point layer is the number of related users existing in the target host database-related user list;

[0014] When the collection point layer is a detected correct database-related user list, the collection point data corresponding to the collection point layer is the intersection between the target host database-related user list and the target host-related user list submitted by the student;

[0015] When the collection point layer is the number of correct database-related users detected, the collection point data corresponding to the collection point layer is the number of related users existing in the intersection between the target host database-related user list and the target host-related user list submitted by the trainee;

[0016] When the collection point layer is a detected database-related user list, the collection point data corresponding to the collection point layer is a user list of the detected target host submitted by the trainee;

[0017] When the collection point layer is the number of detected database related users, the collection point data corresponding to the collection point layer is the number of related users existing in the related user list of the detected target host submitted by the trainee;

[0018] When the collection point layer is an actually existing database vulnerability list, the collection point data corresponding to the collection point layer is the target host database vulnerability list;

[0019] When the collection point layer is the number of actual database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the target host database vulnerability list;

[0020] When the collection point layer is a correct database vulnerability list detected, the collection point data corresponding to the collection point layer is the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student;

[0021] When the collection point layer is the number of correct database vulnerabilities detected, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student;

[0022] When the collection point layer is a detected database vulnerability list, the collection point data corresponding to the collection point layer is a vulnerability list of the detected target host submitted by the student;

[0023] When the collection point layer is the number of detected database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the vulnerability list of the detected target host submitted by the student;

[0024] When the collection point layer is the time required for database vulnerability detection, the collection point data corresponding to the collection point layer is the difference between the database vulnerability detection end time and the database vulnerability detection start time.

[0025] Furthermore, the indicator value in the indicator binary group corresponding to each evaluation indicator layer is determined by the following method:

[0026] When the evaluation index layer is database type detection accuracy, the collection point layer corresponding to the evaluation index layer is database type, and the index value in the index binary corresponding to the database type detection accuracy is determined by the following steps:

[0027] Determine whether the target host database type is the same as the database type of the target host detected by the student;

[0028] If so, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 1;

[0029] If not, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 0;

[0030] When the evaluation indicator layer is database version detection accuracy, the collection point layer corresponding to the evaluation indicator layer is database version, and the indicator value in the indicator binary corresponding to the database version detection accuracy is determined by the following steps:

[0031] Determine whether the target host database version is the same as the database version of the target host detected by the student;

[0032] If so, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 1;

[0033] If not, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 0;

[0034] When the evaluation index layer is the database-related user detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database-related users, the actual list of database-related users, the detected number of correct database-related users and the detected correct list of database-related users;

[0035] Determining the indicator value in the indicator tuple corresponding to the database-related user detection accuracy rate through the detected correct number of database-related users, the actually existing number of database-related users, the detected correct database-related user list and the actually existing database-related user list;

[0036] When the evaluation index layer is the detection accuracy of database-related users, the collection point layer corresponding to the evaluation index layer is the number of detected database-related users, the list of detected database-related users, the number of correct detected database-related users, and the list of correct detected database-related users;

[0037] Determining the indicator value in the indicator tuple corresponding to the database-related user detection accuracy rate through the detected correct number of database-related users, the detected number of database-related users, the detected correct database-related user list and the detected database-related user list;

[0038] When the evaluation index layer is the database vulnerability detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database vulnerabilities, the actual list of database vulnerabilities, the number of correct database vulnerabilities detected, and the correct list of detected database vulnerabilities;

[0039] Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection accuracy rate through the detected correct number of database vulnerabilities, the actually existing number of database vulnerabilities, the detected correct database vulnerability list and the actually existing database vulnerability list;

[0040] When the evaluation index layer is the accuracy of database vulnerability detection, the collection point layer corresponding to the evaluation index layer is the number of detected database vulnerabilities, the list of detected database vulnerabilities, the number of correct database vulnerabilities detected, and the list of correct database vulnerabilities detected;

[0041] Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection accuracy rate through the detected correct database vulnerability number, the detected database vulnerability number, the detected correct database vulnerability list and the detected database vulnerability list;

[0042] When the evaluation index layer is the database vulnerability detection rate, the collection point layer corresponding to the evaluation index layer is the time required for the database vulnerability detection and the number of correct database vulnerabilities detected;

[0043] Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection rate according to the time required for the database vulnerability detection and the number of correct database vulnerabilities detected;

[0044] When the evaluation index layer is database vulnerability detection information entropy, the collection point layer corresponding to the evaluation index layer is the number of correct database vulnerabilities detected, the number of actually existing database vulnerabilities, and the number of detected database vulnerabilities;

[0045] The indicator value in the indicator tuple corresponding to the database vulnerability detection information entropy is determined according to the detected correct number of database vulnerabilities, the actually existing number of database vulnerabilities and the detected number of database vulnerabilities.

[0046] Furthermore, the indicator binary corresponding to the evaluation indicator layer is expressed in the following form:

[0047] <value ij , weight ij >

[0048] Among them, value ij is the indicator value in the indicator binary corresponding to the evaluation indicator layer, weight ij is the indicator weight in the indicator binary group corresponding to the evaluation indicator layer, i represents the order of the atomic functional layer to which the evaluation indicator layer belongs, and j represents the order of the evaluation indicator layer in all evaluation indicator layers corresponding to the atomic functional layer to which it belongs.

[0049] Furthermore, the evaluation binary group corresponding to the atomic functional layer is expressed in the following form:

[0050] <value i , weight i >

[0051] Among them, value i is the evaluation value in the evaluation binary corresponding to the atomic functional layer, weight iis the evaluation weight in the evaluation binary group corresponding to the atomic functional layer, and i represents the order of the atomic functional layer.

[0052] Furthermore, for each atomic functional layer, the evaluation value in the evaluation binary group corresponding to the atomic functional layer is calculated by the following formula:

[0053]

[0054] Wherein, n represents the number of evaluation index layers corresponding to the atomic functional layer.

[0055] Furthermore, the database detection evaluation result is calculated by the following formula:

[0056]

[0057] Wherein, x is the database detection and evaluation result.

[0058] In a second aspect, an embodiment of the present application further provides a device for determining a database detection evaluation result, the device comprising:

[0059] An acquisition module is used to acquire at least one data source required for calculating the database detection evaluation result; wherein the data source includes the target host database type, the database type of the target host detected submitted by the trainee, the target host database version, the database version of the target host detected submitted by the trainee, the target host database related user list, the target host detected related user list submitted by the trainee, the target host database vulnerability list, the target host detected database vulnerability list submitted by the trainee, the database vulnerability detection start time and the database vulnerability detection end time;

[0060] The collection point data determination module is used to determine the collection point data corresponding to each set collection point layer by using various data sources;

[0061] The indicator binary group determination module is used to determine at least one collection point layer corresponding to each set evaluation indicator layer, and determine the indicator binary group corresponding to the evaluation indicator layer by using the collection point data corresponding to each collection point layer; wherein the indicator binary group includes the indicator value and indicator weight corresponding to the evaluation indicator layer, and the indicator weight is pre-set;

[0062] An evaluation binary group determination module is used to determine at least one evaluation index layer corresponding to each set atomic functional layer, and determine the evaluation binary group corresponding to the atomic functional layer using the index binary group corresponding to each evaluation index layer; wherein the evaluation binary group includes an evaluation value and an evaluation weight corresponding to the atomic functional layer, and the evaluation weight is pre-set;

[0063] The evaluation result determination module is used to determine the database detection evaluation result by using the evaluation binary group corresponding to each atomic functional layer.

[0064] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the method for determining the database detection evaluation results as described above are performed.

[0065] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for determining the database detection evaluation result as described above are executed.

[0066] The method and device for determining the database detection evaluation results provided in the embodiments of the present application obtain the data source that can be obtained during the detection process, determine the collection point data of each collection point layer according to the data source, determine the indicator binary group of each evaluation indicator layer according to the collection point data, and then determine the evaluation binary group corresponding to each atomic function layer according to the indicator binary group of each evaluation indicator layer, and finally determine the database detection evaluation results according to the evaluation binary group corresponding to each atomic function layer. Compared with the evaluation method in the prior art, the present application uses a constructed multi-dimensional evaluation indicator system and combines it with a plurality of designed evaluation algorithms to realize an effect evaluation method based on database information detection, improves the efficiency and accuracy of determining the database detection evaluation results, and solves the problems of low efficiency and low accuracy caused by manual database detection effect evaluation in the prior art.

[0067] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0069] Figure 1 A diagram showing the dimensional division of the database information detection capability provided in the embodiment of the present application;

[0070] Figure 2A flowchart of a method for determining a database detection evaluation result provided in an embodiment of the present application;

[0071] Figure 3 A schematic diagram of the structure of a device for determining a database detection evaluation result provided in an embodiment of the present application;

[0072] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0074] With the development of information technology and the Internet, more and more data are being produced. These data are related to all aspects of society, and their existence has become a necessary condition for the normal operation of the real world. These data are often stored in various databases, so the protection of databases has become very important. In order to better protect the database and the data in it, it is necessary to evaluate the effect of database information detection when conducting attack and defense drills on the database.

[0075] At present, the effect of database information detection is often evaluated manually, which is not only inaccurate, but also slow and time-consuming. Therefore, how to quickly and accurately evaluate the effect of database information detection has always been an urgent problem to be solved.

[0076] Based on this, an embodiment of the present application provides a method for determining database detection and evaluation results, implements an effect evaluation method based on database information detection, improves the efficiency and accuracy of determining database detection and evaluation results, and solves the problems of low efficiency and low accuracy caused by manual database detection effect evaluation in the prior art.

[0077] See also Figure 1 , Figure 1 This is a diagram showing the dimensional division of the database information detection capability provided by the embodiment of the present application. Figure 1As shown in , the database information detection capability is divided into an atomic function layer, an evaluation index layer, a collection point layer, and a data source layer. Among them, the atomic function layer is used to characterize the detection type for detecting database information. For example, the atomic function layer includes database type detection, database version detection, database-related user detection, and database vulnerability detection. The evaluation index layer is used to evaluate the detection capability of the atomic function layer. For example, the evaluation index layer includes database type detection accuracy, database-related user detection accuracy, and database vulnerability detection accuracy. The collection point layer is mainly used to determine some collection point data required for calculating the final database detection evaluation result. For example, the collection point layer includes the actual existing database-related user list, the detected database-related user list, and the correct number of database vulnerabilities detected. The data source layer is mainly responsible for collecting data sources, so that the collection point layer can determine the required collection point data based on the collected data sources. For example, the data source layer can include the database type of the target host and the database version of the target host.

[0078] According to the embodiment provided by the present application, when dividing the database information detection capability, the database information detection capability is first divided according to different capability dimensions, the different purposes of database information detection are analyzed, and divided into different dimensions to determine the atomic function layer of the database information detection capability evaluation system (A), including database type detection capability (B1), database version detection capability (B2), database related user detection capability (B3) and database vulnerability detection capability (B4). Atomic function set B = {B1, B2, B3, B4}. The elements in the set are binary tuples.<value,weight> Here, when the purpose of database information detection is different, the divided atomic functional layers can also be adaptively adjusted. For example, when the purpose of database information detection is only to detect database types and database vulnerabilities, the divided atomic functional layers only include database type detection capabilities and database vulnerability detection capabilities.

[0079] According to the capabilities of each aspect of the atomic function layer, the evaluation index layer is refined. The atomic function included in the database type detection capability is database type detection accuracy (C11). The atomic function included in the database version detection capability is database version detection accuracy (C21). The atomic functions included in the database-related user detection capability are database-related user detection accuracy (C31) and database-related user detection correctness (C32). The atomic functions included in the database vulnerability detection capability are database vulnerability detection accuracy (C41), database vulnerability detection correctness (C42), database vulnerability detection rate (C43) and database vulnerability detection information entropy (C44). The evaluation index layer set C = {C11, C21, C31, C32, C41, C42, C43, C44}, and the elements in the set are tuples.<value,weight> .

[0080] Analyze and disassemble the evaluation indicator layer, and determine the collection point layer. The database type detection accuracy corresponds to the database type (D11). The database version detection accuracy corresponds to the database version (D21). The database-related user detection accuracy is disassembled into the actual number of database-related users (D31), the actual list of database-related users (D32), the correct number of database-related users detected (D33), and the correct list of database-related users detected (D34). The database-related user detection accuracy is disassembled into the number of database-related users detected (D35), the list of database-related users detected (D36), the correct number of database-related users detected (D33), and the correct list of database-related users detected (D34). The database vulnerability detection accuracy is disassembled into the actual number of database vulnerabilities (D41), the actual list of database vulnerabilities (D42), the correct number of database vulnerabilities detected (D43), and the correct list of database vulnerabilities detected (D44). The accuracy of database vulnerability detection is decomposed into the number of detected database vulnerabilities (D45), the list of detected database vulnerabilities (D46), the number of correct database vulnerabilities detected (D43) and the list of correct database vulnerabilities detected (D44). The database vulnerability detection rate is decomposed into the time required for database vulnerability detection (D47) and the number of correct database vulnerabilities detected (D43). The information entropy of database vulnerability detection is decomposed into the number of correct database vulnerabilities detected (D43), the number of actual database vulnerabilities (D41) and the number of detected database vulnerabilities (D45). The collection point set D = {D11, D21, D31, D32, D33, D34, D35, D36, D41, D42, D43, D44, D45, D46, D47}.

[0081] According to the evaluation index layer set, select the appropriate data set and determine the data source required for the collection point layer. The selected data includes the target host database type (E1), the database type submitted by the trainee for detecting the target host (E2), the target host database version (E3), the database version submitted by the trainee for detecting the target host (E4), the target host database related user list (E5), the target host related user list submitted by the trainee for detecting the target host (E6), the target host database vulnerability list (E7), the database vulnerability list submitted by the trainee for detecting the target host (E8), the database vulnerability detection start time (E9), and the database vulnerability detection end time (E10). The data source set required for the collection point layer E = {E1, E2, E3, E4, E5, E6, E7, E8, E9, E10}.

[0082] See also Figure 2 , Figure 2The flowchart of a method for determining a database detection evaluation result provided in an embodiment of the present application is as follows. The method for determining a database detection evaluation result provided in the present application is Figure 1 This is achieved based on the dimension division effect diagram of the database information detection capability provided. Figure 2 As shown in , the method for determining the database detection evaluation result provided by the embodiment of the present application includes:

[0083] S101, obtaining at least one data source required for calculating a database detection evaluation result.

[0084] It should be noted that the database detection evaluation result refers to the final evaluation value obtained by evaluating the effect of database information detection. Figure 1 The data sources included in the data source layer in. According to the embodiment provided by the present application, the data source includes the target host database type, the database type for detecting the target host submitted by the trainee, the target host database version, the database version for detecting the target host submitted by the trainee, the target host database related user list, the target host related user list submitted by the trainee, the target host database vulnerability list, the target host database vulnerability list submitted by the trainee, the database vulnerability detection start time and the database vulnerability detection end time.

[0085] In the above step S101, in the specific implementation, at least one data source required for calculating the database detection evaluation result is obtained. Figure 1 The data sources specified in the data source layer are obtained.

[0086] S102, using various data sources to determine the collection point data corresponding to each set collection point layer.

[0087] It should be noted that the collection point data refers to the data obtained by converting or calculating the data source in the data source layer. In the specific implementation of the above step S102, the collection point data corresponding to each set collection point layer is determined by using the acquired data sources.

[0088] Specifically, for the above step S102, the collection point data corresponding to each collection point layer is determined respectively in the following manner:

[0089] When the collection point layer is an actually existing database-related user list, the collection point data corresponding to the collection point layer is the target host database-related user list.

[0090] Here, when the collection point layer is the actual database related user list, the collection point data corresponding to the collection point layer is the target host database related user list in the data source layer, that is, the actual database related user list = the target host database related user list.

[0091] When the collection point layer is the number of actually existing database-related users, the collection point data corresponding to the collection point layer is the number of related users existing in the target host database-related user list.

[0092] Here, when the collection point layer is the actual number of database-related users, the collection point data corresponding to the collection point layer is the number of related users existing in the target host database-related user list in the data source layer, that is, the actual number of database-related users = |target host database-related user list|.

[0093] When the collection point layer is a detected correct database-related user list, the collection point data corresponding to the collection point layer is the intersection between the target host database-related user list and the target host-detected related user list submitted by the student.

[0094] Here, when the collection point layer is the detected correct database-related user list, the collection point data corresponding to the collection point is determined based on the target host database-related user list in the data source layer and the target host detection related user list submitted by the trainee, which is the intersection between the target host database-related user list and the target host detection related user list submitted by the trainee, that is, the detected correct database-related user list = target host database-related user list ∩the target host detection related user list submitted by the trainee.

[0095] When the collection point layer is the correct number of database-related users detected, the collection point data corresponding to the collection point layer is the number of related users existing in the intersection between the target host database-related user list and the target host-related user list submitted by the student.

[0096] Here, when the collection point layer is the correct number of database-related users detected, the collection point data corresponding to the collection point layer is determined based on the target host database-related user list in the data source layer and the relevant user list for detecting the target host submitted by the trainee, which is the number of relevant users existing in the intersection between the target host database-related user list and the relevant user list for detecting the target host submitted by the trainee, that is, the correct number of database-related users detected = |target host database-related user list∩relevant user list for detecting the target host submitted by the trainee|.

[0097] When the collection point layer is a detected database-related user list, the collection point data corresponding to the collection point layer is a user list related to the detected target host submitted by the trainee.

[0098] Here, when the collection point layer is the detected database-related user list, the collection point data corresponding to the collection point layer is the relevant user list of the detected target host submitted by the trainees in the data source layer, that is, the detected database-related user list = the relevant user list of the detected target host submitted by the trainees.

[0099] When the collection point layer is the number of detected database-related users, the collection point data corresponding to the collection point layer is the number of related users existing in the related user list of the detected target host submitted by the trainee.

[0100] Here, when the collection point layer is the number of detected database-related users, the collection point data corresponding to the collection point layer is the number of related users existing in the related user list of the detected target host submitted by the students in the data source layer, that is, the number of detected database-related users = |the related user list of the detected target host submitted by the students|.

[0101] When the collection point layer is an actually existing database vulnerability list, the collection point data corresponding to the collection point layer is the target host database vulnerability list.

[0102] Here, when the collection point layer is an actual database vulnerability list, the collection point data corresponding to the collection point layer is the target host database vulnerability list in the data source layer, that is, the actual database vulnerability list = the target host database vulnerability list.

[0103] When the collection point layer is the number of actual database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the target host database vulnerability list.

[0104] Here, when the collection point layer is the actual number of database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the target host database vulnerability list in the data source layer, that is, the actual number of database vulnerabilities = |target host database vulnerability list|.

[0105] When the collection point layer is a correct database vulnerability list detected, the collection point data corresponding to the collection point layer is the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student.

[0106] Here, when the collection point layer is the correct database vulnerability list detected, the collection point data corresponding to the collection point layer is determined based on the target host database vulnerability list in the data source layer and the database vulnerability list for detecting the target host submitted by the student, which is the intersection between the target host database vulnerability list and the database vulnerability list for detecting the target host submitted by the student, that is, the correct database vulnerability list detected = target host database vulnerability list ∩the database vulnerability list for detecting the target host submitted by the student.

[0107] When the collection point layer is the number of correct database vulnerabilities detected, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student.

[0108] Here, when the collection point layer is the correct number of database vulnerabilities detected, the collection point data corresponding to the collection point layer is determined based on the target host database vulnerability list in the data source layer and the database vulnerability list for detecting the target host submitted by the student, which is the number of vulnerabilities existing in the intersection between the target host database vulnerability list and the database vulnerability list for detecting the target host submitted by the student, that is, the correct number of database vulnerabilities detected = |target host database vulnerability list∩database vulnerability list for detecting the target host submitted by the student|.

[0109] When the collection point layer is a detected database vulnerability list, the collection point data corresponding to the collection point layer is a vulnerability list of the detected target host submitted by the student.

[0110] Here, when the collection point layer is a detected database vulnerability list, the collection point data corresponding to the collection point layer is a vulnerability list of the detected target host submitted by the students in the data source layer, that is, the detected database vulnerability list = the vulnerability list of the detected target host submitted by the students.

[0111] When the collection point layer is the number of detected database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the vulnerability list of the detected target host submitted by the student.

[0112] Here, when the collection point layer is the number of detected database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the vulnerability list of the target host for detection submitted by the students in the data source layer, that is, the number of detected database vulnerabilities = |the database vulnerability list of the target host for detection submitted by the students|.

[0113] When the collection point layer is the time required for database vulnerability detection, the collection point data corresponding to the collection point layer is the difference between the database vulnerability detection end time and the database vulnerability detection start time.

[0114] Here, when the collection point layer is the time required for database vulnerability detection, the collection point data corresponding to the collection point layer is determined based on the database vulnerability detection end time and the database vulnerability detection start time in the data source layer, which is the difference between the database vulnerability detection end time and the database vulnerability detection start time, that is, the time required for database vulnerability detection = database vulnerability detection end time - database vulnerability detection start time.

[0115] S103, for each set evaluation index layer, determining at least one collection point layer corresponding to the evaluation index layer, and determining an index tuple corresponding to the evaluation index layer using the collection point data corresponding to each collection point layer.

[0116] The indicator binary group includes the indicator value and indicator weight corresponding to the evaluation indicator layer. The indicator value refers to the data calculated using the collection point data corresponding to each collection point layer corresponding to the evaluation indicator layer. The indicator weight refers to the weight corresponding to the evaluation indicator layer. Among them, the indicator weight is pre-set. Here, the indicator weight assignment method selects the expert assignment method to determine a set of default values ​​to construct an evaluation system, and stores the weight value of the evaluation indicator set binary group.

[0117] As an optional implementation, the indicator binary corresponding to the evaluation indicator layer is expressed in the following form:

[0118] <value ij , weight ij >

[0119] Among them, value ij is the indicator value in the indicator binary corresponding to the evaluation indicator layer, weight ij is the indicator weight in the indicator binary group corresponding to the evaluation indicator layer, i represents the order of the atomic function layer to which the evaluation indicator layer belongs, and j represents the order of the evaluation indicator layer in all evaluation indicator layers corresponding to the atomic function layer to which it belongs. Figure 1 , for example, when the evaluation indicator layer is the database-related user detection accuracy, the order of the atomic function layer to which the evaluation indicator layer belongs is 3, so i = 3, and the evaluation indicator layer in the atomic function layer to which it belongs is the database-related user detection capability. There are two evaluation indicator layers corresponding to the database-related user detection capability, and the database-related user detection capability is the first one, so j = 1. Therefore, the indicator binary corresponding to the database-related user detection accuracy is <value 31 , weight 31 >.

[0120] Specifically, for the above step S103, the indicator values ​​in the indicator binary group corresponding to each evaluation indicator layer are determined respectively in the following manner:

[0121] When the evaluation index layer is database type detection accuracy, the collection point layer corresponding to the evaluation index layer is database type, and the index value in the index binary corresponding to the database type detection accuracy is determined by the following steps:

[0122] A: Determine whether the target host database type is the same as the database type of the target host detected by the student.

[0123] B: If so, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 1.

[0124] C: If not, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 0.

[0125] For the above steps A to C, during the specific implementation, determine whether the target host database type in the data source layer is the same as the database type of the target host detected by the student. If so, execute step B, and the indicator value in the indicator tuple corresponding to the database type detection accuracy is 1; if not, execute step C, and the indicator value in the indicator tuple corresponding to the database type detection accuracy is 0.

[0126] When the evaluation indicator layer is database version detection accuracy, the collection point layer corresponding to the evaluation indicator layer is database version, and the indicator value in the indicator binary corresponding to the database version detection accuracy is determined by the following steps:

[0127] a: Determine whether the target host database version is the same as the database version of the target host detected by the student.

[0128] b: If so, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 1.

[0129] c: If not, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 0.

[0130] For the above steps a to c, during the specific implementation, determine whether the target host database version in the data source layer is the same as the database version of the target host detected by the student. If so, execute step b, and the indicator value in the indicator tuple corresponding to the database version detection accuracy is 1; if not, execute step c, and the indicator value in the indicator tuple corresponding to the database version detection accuracy is 0.

[0131] When the evaluation index layer is the database-related user detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database-related users, the actual list of database-related users, the number of detected correct database-related users, and the detected correct list of database-related users. The index value in the index tuple corresponding to the database-related user detection accuracy is determined through the above four collection point data.

[0132] Here, the indicator value in the indicator binary corresponding to the database-related user detection accuracy is determined by the following formula: value = detected correct number of database-related users / actual number of database-related users + | detected correct database-related user list ∩ actual number of database-related users list | / | actual number of database-related users list |. Specifically, first calculate the quotient of the detected correct number of database-related users and the actual number of database-related users. Then determine the number of first-related users in the intersection between the detected correct database-related user list and the actual number of database-related users list, determine the number of second-related users in the actual number of database-related users list, and then calculate the quotient of the first number of related users and the second number of related users. Finally, add the two quotients to obtain the indicator value in the indicator binary corresponding to the database-related user detection accuracy.

[0133] When the evaluation index layer is the database-related user detection accuracy, the collection point layer corresponding to the evaluation index layer is the number of detected database-related users, the detected database-related user list, the number of correct database-related users detected, and the detected correct database-related user list. The index value in the index tuple corresponding to the database-related user detection accuracy is determined through the above four collection point data.

[0134] Here, the indicator value in the indicator binary corresponding to the database-related user detection accuracy is determined by the following formula: value = number of detected correct database-related users / number of detected database-related users + |detected correct database-related user list∩detected database-related user list| / |detected database-related user list|. Specifically, first calculate the quotient of the number of detected correct database-related users and the number of detected database-related users. Then determine the number of first related users in the intersection between the detected correct database-related user list and the detected database-related user list, determine the number of second related users in the detected database-related user list, and then calculate the quotient of the number of first related users and the number of second related users. Finally, add the two quotients to obtain the indicator value in the indicator binary corresponding to the database-related user detection accuracy.

[0135] When the evaluation index layer is the database vulnerability detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database vulnerabilities, the actual list of database vulnerabilities, the number of correct database vulnerabilities detected, and the correct list of detected database vulnerabilities. The indicator value in the indicator tuple corresponding to the database vulnerability detection accuracy is determined through the above four collection point data.

[0136] Here, the indicator value in the indicator binary corresponding to the database vulnerability detection accuracy is determined by the following formula: value = number of correct database vulnerabilities detected / number of actual database vulnerabilities + | correct database vulnerability list detected ∩ actual database vulnerability list | / | actual database vulnerability list |. Specifically, first calculate the quotient of the number of correct database vulnerabilities detected and the number of actual database vulnerabilities. Then determine the number of first vulnerabilities in the intersection between the correct database vulnerability list detected and the actual database vulnerability list, determine the number of second vulnerabilities in the actual database vulnerability list, and then calculate the quotient of the first number of vulnerabilities and the second number of vulnerabilities. Finally, add the two quotients to obtain the indicator value in the indicator binary corresponding to the database vulnerability detection accuracy.

[0137] When the evaluation index layer is the database vulnerability detection accuracy, the collection point layer corresponding to the evaluation index layer is the number of detected database vulnerabilities, the list of detected database vulnerabilities, the number of correctly detected database vulnerabilities, and the list of correctly detected database vulnerabilities. The indicator values ​​in the indicator tuple corresponding to the database vulnerability detection accuracy are determined through the above four collection point data.

[0138] Here, the indicator value in the indicator binary corresponding to the database vulnerability detection accuracy is determined by the following formula: value = number of detected correct database vulnerabilities / number of detected database vulnerabilities + | detected correct database vulnerability list ∩ detected database vulnerability list | / | detected database vulnerability list |. Specifically, first calculate the quotient of the number of detected correct database vulnerabilities and the number of detected database vulnerabilities. Then determine the number of first vulnerabilities in the intersection between the detected correct database vulnerability list and the detected database vulnerability list, determine the number of second vulnerabilities in the detected database vulnerability list, and then calculate the quotient of the first number of vulnerabilities and the second number of vulnerabilities. Finally, add the two quotients to obtain the indicator value in the indicator binary corresponding to the database vulnerability detection accuracy.

[0139] When the evaluation index layer is the database vulnerability detection rate, the collection point layer corresponding to the evaluation index layer is the time required for database vulnerability detection and the number of correct database vulnerabilities detected. The index value in the index binary corresponding to the database vulnerability detection rate is determined through the above two collection point data.

[0140] Here, the indicator value in the indicator binary corresponding to the database vulnerability detection rate is determined by the following formula: value = number of correct database vulnerabilities detected / time required for database vulnerability detection. Specifically, the indicator value in the indicator binary corresponding to the database vulnerability detection rate is the quotient between the number of correct database vulnerabilities detected and the time required for database vulnerability detection.

[0141] When the evaluation index layer is database vulnerability detection information entropy, the collection point layer corresponding to the evaluation index layer is the number of correct database vulnerabilities detected, the number of actual database vulnerabilities, and the number of detected database vulnerabilities. The index value in the index tuple corresponding to the database vulnerability detection information entropy is determined through the above three collection point data.

[0142] Here, the indicator value in the indicator tuple corresponding to the database vulnerability detection information entropy is determined by the following three formulas:

[0143] X = min (the number of correct database vulnerabilities detected / the number of actual database vulnerabilities, 0.99);

[0144] Y = min (number of correct database vulnerabilities detected / number of detected database vulnerabilities, 0.99);

[0145] value = -log(1-X)-log(1-Y).

[0146] Specifically, first calculate the quotient between the number of correct database vulnerabilities detected and the number of actual database vulnerabilities, and select the smaller value between the obtained quotient and 0.99 as X, then calculate the quotient between the number of correct database vulnerabilities detected and the number of detected database vulnerabilities, and select the smaller value between the obtained quotient and 0.99 as Y. Then use -log(1-X)-log(1-Y) to calculate the indicator value in the indicator binary corresponding to the database vulnerability detection information entropy.

[0147] S104, for each set atomic functional layer, determining at least one evaluation index layer corresponding to the atomic functional layer, and using the index binary corresponding to each evaluation index layer to determine the evaluation binary corresponding to the atomic functional layer.

[0148] The evaluation tuple includes the evaluation value and evaluation weight corresponding to the atomic function layer. The evaluation value refers to the data calculated using the indicator tuple corresponding to each evaluation indicator layer corresponding to the atomic function layer. The evaluation weight refers to the weight corresponding to the atomic function layer. Among them, the evaluation weight is pre-set. Here, the evaluation weight assignment method selects the expert assignment method to determine a set of default values ​​to construct an evaluation system, and stores the weight value of the atomic function set tuple.

[0149] Regarding the above step S104, in the specific implementation, Figure 1 For each set atomic functional layer in the method, at least one evaluation index layer corresponding to the atomic functional layer is determined, and the evaluation binary group corresponding to the atomic functional layer is determined by using the index binary group corresponding to each evaluation index layer.

[0150] As an optional implementation, the evaluation tuple corresponding to the atomic functional layer is expressed in the following form:

[0151] <value i ,weitht i >

[0152] Among them, value i is the evaluation value in the evaluation binary corresponding to the atomic functional layer, weight i is the evaluation weight in the evaluation binary group corresponding to the atomic functional layer, and i represents the order of the atomic functional layer. Figure 1 For example, when the atomic function layer is the database-related user detection capability, the atomic function layer is ranked third among all the atomic function layers, so i=3, and the evaluation tuple corresponding to the database-related user detection capability is<value3,weight3> .

[0153] Regarding the above step S104, in a specific implementation, for each atomic functional layer, the evaluation value in the evaluation binary group corresponding to the atomic functional layer is calculated by the following formula:

[0154]

[0155] Wherein, n represents the number of evaluation index layers corresponding to the atomic function layer. For example, continuing with the previous embodiment, when the atomic function layer is the database-related user detection capability, the evaluation index layer corresponding to the database-related user detection capability is the database-related user detection accuracy and the database-related user detection correctness. Therefore, it is necessary to use the indicator binary corresponding to the database-related user detection accuracy and the indicator binary corresponding to the database-related user detection correctness to calculate the evaluation value in the evaluation binary corresponding to the database-related user detection capability. Therefore, the calculation formula is:

[0156]

[0157] in, <value 31 , weight 31 > is the indicator binary corresponding to the accuracy of database-related user detection, <value 32 , weight 32 >It is the indicator tuple corresponding to the accuracy of database-related user detection.

[0158] S105, using the evaluation binary group corresponding to each atomic functional layer to determine the database detection evaluation result.

[0159] Regarding the above step S105, in the specific implementation, after the evaluation binary groups corresponding to each atomic functional layer are determined, the evaluation binary groups corresponding to each atomic functional layer are used to determine the final database detection evaluation result. Specifically, the database detection evaluation result is calculated by the following formula:

[0160]

[0161] Wherein, x is the database detection and evaluation result. <value i ,weight i > is the evaluation tuple corresponding to the atomic functional layer.

[0162] The method for determining the data detection evaluation result provided in the embodiment of the present application obtains the data source that can be obtained during the detection process, determines the collection point data of each collection point layer according to the data source, determines the indicator binary group of each evaluation indicator layer according to the collection point data, and then determines the evaluation binary group corresponding to each atomic function layer according to the indicator binary group of each evaluation indicator layer, and finally determines the database detection evaluation result according to the evaluation binary group corresponding to each atomic function layer. Compared with the evaluation method in the prior art, the present application uses a constructed multi-dimensional evaluation indicator system, and combines a plurality of designed evaluation algorithms to realize an effect evaluation method based on database information detection, improves the efficiency and accuracy of determining the database detection evaluation result, and solves the problems of low efficiency and low accuracy caused by manual database detection effect evaluation in the prior art.

[0163] See also Figure 3 , Figure 3 A schematic diagram of a device for determining a database detection evaluation result provided in an embodiment of the present application. Figure 3 As shown in , the determining device 300 includes:

[0164] The acquisition module 301 is used to acquire at least one data source required for calculating the database detection evaluation result; wherein the data source includes the target host database type, the database type of the target host detected submitted by the trainee, the target host database version, the database version of the target host detected submitted by the trainee, the target host database related user list, the target host detected related user list submitted by the trainee, the target host database vulnerability list, the target host detected database vulnerability list submitted by the trainee, the database vulnerability detection start time and the database vulnerability detection end time;

[0165] The collection point data determination module 302 is used to determine the collection point data corresponding to each set collection point layer by using various data sources;

[0166] The indicator binary group determination module 303 is used to determine at least one collection point layer corresponding to each evaluation indicator layer set, and determine the indicator binary group corresponding to the evaluation indicator layer using the collection point data corresponding to each collection point layer; wherein the indicator binary group includes the indicator value and indicator weight corresponding to the evaluation indicator layer, and the indicator weight is pre-set;

[0167] The evaluation binary group determination module 304 is used to determine at least one evaluation index layer corresponding to each set atomic functional layer, and determine the evaluation binary group corresponding to the atomic functional layer by using the index binary group corresponding to each evaluation index layer; wherein the evaluation binary group includes the evaluation value and evaluation weight corresponding to the atomic functional layer, and the evaluation weight is pre-set;

[0168] The evaluation result determination module 305 is used to determine the database detection evaluation result by using the evaluation binary group corresponding to each atomic functional layer.

[0169] Furthermore, the collection point data determination module 302 determines the collection point data corresponding to each collection point layer in the following manner:

[0170] When the collection point layer is an actually existing database-related user list, the collection point data corresponding to the collection point layer is the target host database-related user list;

[0171] When the collection point layer is the number of actually existing database-related users, the collection point data corresponding to the collection point layer is the number of related users existing in the target host database-related user list;

[0172] When the collection point layer is a detected correct database-related user list, the collection point data corresponding to the collection point layer is the intersection between the target host database-related user list and the target host-related user list submitted by the student;

[0173] When the collection point layer is the number of correct database-related users detected, the collection point data corresponding to the collection point layer is the number of related users existing in the intersection between the target host database-related user list and the target host-related user list submitted by the trainee;

[0174] When the collection point layer is a detected database-related user list, the collection point data corresponding to the collection point layer is a user list of the detected target host submitted by the trainee;

[0175] When the collection point layer is the number of detected database related users, the collection point data corresponding to the collection point layer is the number of related users existing in the related user list of the detected target host submitted by the trainee;

[0176] When the collection point layer is an actually existing database vulnerability list, the collection point data corresponding to the collection point layer is the target host database vulnerability list;

[0177] When the collection point layer is the number of actual database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the target host database vulnerability list;

[0178] When the collection point layer is a correct database vulnerability list detected, the collection point data corresponding to the collection point layer is the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student;

[0179] When the collection point layer is the number of correct database vulnerabilities detected, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student;

[0180] When the collection point layer is a detected database vulnerability list, the collection point data corresponding to the collection point layer is a vulnerability list of the detected target host submitted by the student;

[0181] When the collection point layer is the number of detected database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the vulnerability list of the detected target host submitted by the student;

[0182] When the collection point layer is the time required for database vulnerability detection, the collection point data corresponding to the collection point layer is the difference between the database vulnerability detection end time and the database vulnerability detection start time.

[0183] Furthermore, the indicator binary group determination module 303 determines the indicator value in the indicator binary group corresponding to each evaluation indicator layer in the following manner:

[0184] When the evaluation index layer is database type detection accuracy, the collection point layer corresponding to the evaluation index layer is database type, and the index value in the index binary corresponding to the database type detection accuracy is determined by the following steps:

[0185] Determine whether the target host database type is the same as the database type of the target host detected by the student;

[0186] If so, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 1;

[0187] If not, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 0;

[0188] When the evaluation indicator layer is database version detection accuracy, the collection point layer corresponding to the evaluation indicator layer is database version, and the indicator value in the indicator binary corresponding to the database version detection accuracy is determined by the following steps:

[0189] Determine whether the target host database version is the same as the database version of the target host detected by the student;

[0190] If so, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 1;

[0191] If not, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 0;

[0192] When the evaluation index layer is the database-related user detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database-related users, the actual list of database-related users, the detected number of correct database-related users and the detected correct list of database-related users;

[0193] Determining the indicator value in the indicator tuple corresponding to the database-related user detection accuracy rate through the detected correct number of database-related users, the actually existing number of database-related users, the detected correct database-related user list and the actually existing database-related user list;

[0194] When the evaluation index layer is the detection accuracy of database-related users, the collection point layer corresponding to the evaluation index layer is the number of detected database-related users, the list of detected database-related users, the number of correct detected database-related users, and the list of correct detected database-related users;

[0195] Determining the indicator value in the indicator tuple corresponding to the database-related user detection accuracy rate through the detected correct number of database-related users, the detected number of database-related users, the detected correct database-related user list and the detected database-related user list;

[0196] When the evaluation index layer is the database vulnerability detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database vulnerabilities, the actual list of database vulnerabilities, the number of correct database vulnerabilities detected, and the correct list of detected database vulnerabilities;

[0197] Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection accuracy rate through the detected correct number of database vulnerabilities, the actually existing number of database vulnerabilities, the detected correct database vulnerability list and the actually existing database vulnerability list;

[0198] When the evaluation index layer is the accuracy of database vulnerability detection, the collection point layer corresponding to the evaluation index layer is the number of detected database vulnerabilities, the list of detected database vulnerabilities, the number of correct database vulnerabilities detected, and the list of correct database vulnerabilities detected;

[0199] Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection accuracy rate through the detected correct database vulnerability number, the detected database vulnerability number, the detected correct database vulnerability list and the detected database vulnerability list;

[0200] When the evaluation index layer is the database vulnerability detection rate, the collection point layer corresponding to the evaluation index layer is the time required for the database vulnerability detection and the number of correct database vulnerabilities detected;

[0201] Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection rate according to the time required for the database vulnerability detection and the number of correct database vulnerabilities detected;

[0202] When the evaluation index layer is database vulnerability detection information entropy, the collection point layer corresponding to the evaluation index layer is the number of correct database vulnerabilities detected, the number of actually existing database vulnerabilities, and the number of detected database vulnerabilities;

[0203] The indicator value in the indicator tuple corresponding to the database vulnerability detection information entropy is determined according to the detected correct number of database vulnerabilities, the actually existing number of database vulnerabilities and the detected number of database vulnerabilities.

[0204] Furthermore, the indicator binary corresponding to the evaluation indicator layer is expressed in the following form:

[0205] <value ij , weight ij >

[0206] Among them, value ij is the indicator value in the indicator binary corresponding to the evaluation indicator layer, weight ij is the indicator weight in the indicator binary group corresponding to the evaluation indicator layer, i represents the order of the atomic functional layer to which the evaluation indicator layer belongs, and j represents the order of the evaluation indicator layer in all evaluation indicator layers corresponding to the atomic functional layer to which it belongs.

[0207] Furthermore, the evaluation binary group corresponding to the atomic functional layer is expressed in the following form:

[0208] <value i , weight i >

[0209] Among them, value i is the evaluation value in the evaluation binary corresponding to the atomic functional layer, weight i is the evaluation weight in the evaluation binary group corresponding to the atomic functional layer, and i represents the order of the atomic functional layer.

[0210] Furthermore, for each atomic functional layer, the evaluation binary group determination module 304 calculates the evaluation value in the evaluation binary group corresponding to the atomic functional layer by using the following formula:

[0211]

[0212] Wherein, n represents the number of evaluation index layers corresponding to the atomic functional layer.

[0213] Furthermore, the evaluation result determination module 305 calculates the database detection evaluation result by the following formula:

[0214]

[0215] Wherein, x is the database detection and evaluation result.

[0216] See also Figure 4, Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown in , the electronic device 400 includes a processor 410 , a memory 420 and a bus 430 .

[0217] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, the above-mentioned Figure 1 as well as Figure 2 The steps of the method for determining the database detection evaluation result in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0218] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 as well as Figure 2 The steps of the method for determining the database detection evaluation result in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0219] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0220] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0221] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0222] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0223] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0224] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0225] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for determining a database detection evaluation result, characterized in that: The determination method comprises: Obtain at least one data source required for calculating the database detection evaluation result; wherein the data source includes the target host database type, the database type of the target host detected submitted by the trainee, the target host database version, the database version of the target host detected submitted by the trainee, the target host database related user list, the target host detected related user list submitted by the trainee, the target host database vulnerability list, the target host detected database vulnerability list submitted by the trainee, the database vulnerability detection start time and the database vulnerability detection end time; Using various data sources to determine the collection point data corresponding to each set collection point layer; For each set evaluation index layer, determine at least one collection point layer corresponding to the evaluation index layer, and use the collection point data corresponding to each collection point layer to determine the index binary group corresponding to the evaluation index layer; wherein the index binary group includes the index value and index weight corresponding to the evaluation index layer, and the index weight is pre-set; For each set atomic functional layer, at least one evaluation index layer corresponding to the atomic functional layer is determined, and the evaluation tuple corresponding to the atomic functional layer is determined using the index tuple corresponding to each evaluation index layer; wherein the evaluation tuple includes an evaluation value and an evaluation weight corresponding to the atomic functional layer, and the evaluation weight is pre-set; The database detection evaluation result is determined by using the evaluation binary group corresponding to each atomic functional layer.

2. The determination method according to claim 1, characterized in that: The collection point data corresponding to each collection point layer is determined in the following way: When the collection point layer is an actually existing database-related user list, the collection point data corresponding to the collection point layer is the target host database-related user list; When the collection point layer is the number of actually existing database-related users, the collection point data corresponding to the collection point layer is the number of related users existing in the target host database-related user list; When the collection point layer is a detected correct database-related user list, the collection point data corresponding to the collection point layer is the intersection between the target host database-related user list and the target host-related user list submitted by the student; When the collection point layer is the number of correct database-related users detected, the collection point data corresponding to the collection point layer is the number of related users existing in the intersection between the target host database-related user list and the target host-related user list submitted by the trainee; When the collection point layer is a detected database-related user list, the collection point data corresponding to the collection point layer is a user list of the detected target host submitted by the trainee; When the collection point layer is the number of detected database related users, the collection point data corresponding to the collection point layer is the number of related users existing in the related user list of the detected target host submitted by the trainee; When the collection point layer is an actually existing database vulnerability list, the collection point data corresponding to the collection point layer is the target host database vulnerability list; When the collection point layer is the number of actual database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the target host database vulnerability list; When the collection point layer is a correct database vulnerability list detected, the collection point data corresponding to the collection point layer is the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student; When the collection point layer is the number of correct database vulnerabilities detected, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the intersection between the target host database vulnerability list and the database vulnerability list of the target host detected by the student; When the collection point layer is a detected database vulnerability list, the collection point data corresponding to the collection point layer is a vulnerability list of the detected target host submitted by the student; When the collection point layer is the number of detected database vulnerabilities, the collection point data corresponding to the collection point layer is the number of vulnerabilities existing in the vulnerability list of the detected target host submitted by the student; When the collection point layer is the time required for database vulnerability detection, the collection point data corresponding to the collection point layer is the difference between the database vulnerability detection end time and the database vulnerability detection start time.

3. The determination method according to claim 2, characterized in that: The indicator value in the indicator binary corresponding to each evaluation indicator layer is determined in the following way: When the evaluation index layer is database type detection accuracy, the collection point layer corresponding to the evaluation index layer is database type, and the index value in the index binary corresponding to the database type detection accuracy is determined by the following steps: Determine whether the target host database type is the same as the database type of the target host detected by the student; If so, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 1; If not, the indicator value in the indicator tuple corresponding to the database type detection accuracy is 0; When the evaluation indicator layer is database version detection accuracy, the collection point layer corresponding to the evaluation indicator layer is database version, and the indicator value in the indicator binary corresponding to the database version detection accuracy is determined by the following steps: Determine whether the target host database version is the same as the database version of the target host detected by the member; If so, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 1; If not, the indicator value in the indicator tuple corresponding to the database version detection accuracy is 0; When the evaluation index layer is the database-related user detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database-related users, the actual list of database-related users, the detected number of correct database-related users and the detected correct list of database-related users; Determining the indicator value in the indicator tuple corresponding to the database-related user detection accuracy rate through the detected correct number of database-related users, the actually existing number of database-related users, the detected correct database-related user list and the actually existing database-related user list; When the evaluation index layer is the detection accuracy of database-related users, the collection point layer corresponding to the evaluation index layer is the number of detected database-related users, the list of detected database-related users, the number of correct detected database-related users, and the list of correct detected database-related users; Determining the indicator value in the indicator tuple corresponding to the database-related user detection accuracy rate through the detected correct number of database-related users, the detected number of database-related users, the detected correct database-related user list and the detected database-related user list; When the evaluation index layer is the database vulnerability detection accuracy, the collection point layer corresponding to the evaluation index layer is the actual number of database vulnerabilities, the actual list of database vulnerabilities, the number of correct database vulnerabilities detected, and the correct list of detected database vulnerabilities; Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection accuracy rate through the detected correct number of database vulnerabilities, the actually existing number of database vulnerabilities, the detected correct database vulnerability list and the actually existing database vulnerability list; When the evaluation index layer is the accuracy of database vulnerability detection, the collection point layer corresponding to the evaluation index layer is the number of detected database vulnerabilities, the list of detected database vulnerabilities, the number of correct database vulnerabilities detected, and the list of correct database vulnerabilities detected; Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection accuracy rate through the detected correct database vulnerability number, the detected database vulnerability number, the detected correct database vulnerability list and the detected database vulnerability list; When the evaluation index layer is the database vulnerability detection rate, the collection point layer corresponding to the evaluation index layer is the time required for the database vulnerability detection and the number of correct database vulnerabilities detected; Determine the indicator value in the indicator tuple corresponding to the database vulnerability detection rate according to the time required for the database vulnerability detection and the number of correct database vulnerabilities detected; When the evaluation index layer is database vulnerability detection information entropy, the collection point layer corresponding to the evaluation index layer is the number of correct database vulnerabilities detected, the number of actually existing database vulnerabilities, and the number of detected database vulnerabilities; The indicator value in the indicator tuple corresponding to the database vulnerability detection information entropy is determined according to the detected correct number of database vulnerabilities, the actually existing number of database vulnerabilities and the detected number of database vulnerabilities.

4. The determination method according to claim 1, characterized in that: The indicator binary corresponding to the evaluation indicator layer is expressed in the following form: <value ij ,weight ij >; Among them, value ij is the indicator value in the indicator binary corresponding to the evaluation indicator layer, weight ij is the indicator weight in the indicator binary group corresponding to the evaluation indicator layer, i represents the order of the atomic functional layer to which the evaluation indicator layer belongs, and j represents the order of the evaluation indicator layer in all evaluation indicator layers corresponding to the atomic functional layer to which it belongs.

5. The determination method according to claim 4, characterized in that: The evaluation tuple corresponding to the atomic functional layer is expressed in the following form: <value i ,weight i >; Among them, value i is the evaluation value in the evaluation binary corresponding to the atomic functional layer, weight i is the evaluation weight in the evaluation binary group corresponding to the atomic functional layer, and i represents the order of the atomic functional layer.

6. The determination method according to claim 5, characterized in that: For each atomic functional layer, the evaluation value in the evaluation binary group corresponding to the atomic functional layer is calculated by the following formula: Wherein, n represents the number of evaluation index layers corresponding to the atomic functional layer.

7. The determination method according to claim 6, characterized in that: The database detection evaluation result is calculated by the following formula: Wherein, x is the database detection and evaluation result.

8. A device for determining a database detection evaluation result, characterized in that: The determining device comprises: An acquisition module is used to acquire at least one data source required for calculating the database detection evaluation result; wherein the data source includes the target host database type, the database type of the target host detected submitted by the trainee, the target host database version, the database version of the target host detected submitted by the trainee, the target host database related user list, the target host detected related user list submitted by the trainee, the target host database vulnerability list, the target host detected database vulnerability list submitted by the trainee, the database vulnerability detection start time and the database vulnerability detection end time; The collection point data determination module is used to determine the collection point data corresponding to each set collection point layer by using various data sources; The indicator binary group determination module is used to determine at least one collection point layer corresponding to each set evaluation indicator layer, and determine the indicator binary group corresponding to the evaluation indicator layer by using the collection point data corresponding to each collection point layer; wherein the indicator binary group includes the indicator value and indicator weight corresponding to the evaluation indicator layer, and the indicator weight is pre-set; An evaluation binary group determination module is used to determine at least one evaluation index layer corresponding to each set atomic functional layer, and determine the evaluation binary group corresponding to the atomic functional layer using the index binary group corresponding to each evaluation index layer; wherein the evaluation binary group includes an evaluation value and an evaluation weight corresponding to the atomic functional layer, and the evaluation weight is pre-set; The evaluation result determination module is used to determine the database detection evaluation result by using the evaluation binary group corresponding to each atomic functional layer.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to perform the steps of the method for determining the database detection evaluation result as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for determining the database detection evaluation result according to any one of claims 1 to 7 are executed.

Images