Security risk monitoring method and device, terminal equipment and storage medium

Abstract

The application discloses a security risk monitoring method and device, a terminal equipment and a storage medium, and relates to the technical field of security risk monitoring. The application discloses a security risk monitoring method, device, terminal equipment and storage medium, comprising the following steps: acquiring a risk item of a protected object and a risk quantity of the risk item; obtaining a risk value of the protected object based on a risk item grade score table, the risk quantity and a preset calculation function, wherein the calculation function comprises a mapping relationship between the risk quantity and a preset function denominator, and the risk value corresponds to the risk grade of the risk item. By acquiring the risk value and the risk quantity of the protected object, combining the grade score table and the mapping relationship between the risk quantity and the function denominator in the calculation function, the technical problem that the differences between security risk items of different risk categories, different risk grades, the same risk grade but different risk quantities cannot be reflected in security risk monitoring can be solved, and the efficiency and accuracy of security risk monitoring can be improved.

Description

Technical Field

[0001] This application relates to the field of network or information security technology, and in particular to a security risk monitoring method, device, terminal equipment, and storage medium. Background Technology

[0002] Since cybersecurity or information security plays an important role in various industries, it is necessary to calculate the risk value of each security risk item in the protected objects of cybersecurity or information security, so as to provide users with corresponding data support based on the risk value.

[0003] However, certain security risk items within the protected objects may have different levels and varying quantities within the same level. Calculating based on the level weight of security risk items fails to reflect the impact of different quantities of the same level of security risk item on the risk value; similarly, calculations using a scoring system fail to reflect the impact of different levels of security risk items on the risk value, thus affecting the accuracy and efficiency of security risk monitoring. Summary of the Invention

[0004] The main objective of this application is to provide a security risk monitoring method, device, terminal equipment, and storage medium, aiming to solve the technical problem of differences between security risk items of different risk categories, different risk levels, and different numbers of risks at the same risk level in security risk monitoring, and to improve the efficiency and accuracy of security risk monitoring.

[0005] To achieve the above objectives, this application provides a security risk monitoring method, the security risk monitoring method comprising:

[0006] Obtain the risk items of the protected object and the number of risks associated with each risk item;

[0007] Based on the risk item rating table, the number of risks, and a preset calculation function, the risk value of the protected object is obtained. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item.

[0008] Optionally, before the step of obtaining the risk value of the protected object based on the risk item's rating table, the number of risks, and a preset calculation function, the method further includes:

[0009] Obtain the number of different risks at the same risk level for the risk item;

[0010] Determine the corresponding denominator for the function based on the different risk quantities.

[0011] Optionally, before the step of obtaining the risk value of the protected object based on the risk item rating table, the number of risks, and a preset calculation function, the method further includes:

[0012] Determine the total score for the aforementioned risk items;

[0013] Based on the total score of the risk item, the grade score table for determining the different risk levels of the risk item is used.

[0014] Optionally, before the step of obtaining the risk value of the protected object based on the risk item's rating table, the number of risks, and a preset calculation function, the method further includes:

[0015] Based on the changing trend of the output value of the preset hyperbolic tangent function, the mapping relationship between the number of risks and the denominator of the function is obtained;

[0016] Based on the mapping relationship, the input value of the hyperbolic tangent function is modified to obtain the calculation function.

[0017] Optionally, the step of obtaining the risk value of the protected object based on the risk item's rating table, the number of risks, and a preset calculation function includes:

[0018] Based on the different risk levels of the aforementioned risk items, select the corresponding level score from the level score table;

[0019] The grade score is used as the coefficient of the calculation function, and the corresponding risk quantity is substituted into the calculation function to obtain the risk value of the protected object.

[0020] Optionally, the step of obtaining the risk items of the protected object and the number of risks of the risk items includes:

[0021] Identify and associate risk items of the protected object;

[0022] The risk items of the protected object are written into a preset database to obtain risk items of different risk levels and the number of risks for each risk item.

[0023] Optionally, after the step of obtaining the risk value of the protected object based on the risk item's rating table, the number of risks, and a preset calculation function, the method further includes:

[0024] The risk value of the protected object is written into the database.

[0025] This application also proposes a security risk monitoring device, which includes:

[0026] The acquisition module is used to acquire the risk items of the protected object and the number of risks associated with each risk item;

[0027] The monitoring module is used to obtain the risk value of the protected object based on the risk item's level score table, the number of risks, and a preset calculation function. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item.

[0028] This application also proposes a terminal device, which includes a memory, a processor, and a security risk monitoring program stored in the memory and executable on the processor. When the security risk monitoring program is executed by the processor, it implements the steps of the security risk monitoring method described above.

[0029] This application also proposes a computer-readable storage medium storing a security risk monitoring program, which, when executed by a processor, implements the steps of the security risk monitoring method described above.

[0030] The security risk monitoring method, apparatus, terminal device, and storage medium proposed in this application obtain the denominator of a calculation function, which is based on a preset hyperbolic tangent function; determine the level scores of different risk levels of risk items; obtain the risk items and the number of risks of the protected object; and obtain the risk value of the protected object based on the function denominator, level scores, number of risks, and calculation function, whereby the risk value corresponds to each risk level of the risk item. By obtaining the risk value and number of risks of the protected object, and combining the level score table and the mapping relationship between the number of risks and the function denominator in the calculation function, the technical problem of not being able to reflect the differences between security risk items of different risk categories, different risk levels, and different numbers of risks at the same risk level can be solved in security risk monitoring, thereby improving the efficiency and accuracy of security risk monitoring. Based on the solution of this application, starting from the rule that security risk items in network or information security protected objects have different levels and different numbers at the same level, a calculation function based on the hyperbolic tangent function is set, and the effectiveness of the security risk monitoring method proposed in this application is verified by this calculation function. Finally, the difference in risk values ​​determined by the method of this application is significantly improved. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the functional modules of the terminal equipment to which the security risk monitoring device of this application belongs;

[0032] Figure 2 This is a flowchart illustrating a first exemplary embodiment of the security risk monitoring method of this application;

[0033] Figure 3 This is a flowchart illustrating a second exemplary embodiment of the security risk monitoring method of this application;

[0034] Figure 4 This is a schematic diagram of the hyperbolic tangent function involved in the security risk monitoring method of this application;

[0035] Figure 5 This is a flowchart illustrating a third exemplary embodiment of the security risk monitoring method of this application;

[0036] Figure 6 A page diagram showing the denominator settings for the risk value calculation function of the security risk monitoring method in this application;

[0037] Figure 7 This is a flowchart illustrating the fourth exemplary embodiment of the security risk monitoring method of this application;

[0038] Figure 8 A page diagram showing the level scores for the security risk monitoring method of this application;

[0039] Figure 9 This is a flowchart illustrating the fifth exemplary embodiment of the security risk monitoring method of this application;

[0040] Figure 10 A schematic diagram of the page for viewing the risk values ​​of the security risk monitoring method of this application;

[0041] Figure 11 This is a flowchart illustrating the sixth exemplary embodiment of the security risk monitoring method of this application.

[0042] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0043] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0044] The main solution of this application embodiment is: to obtain the risk items of the protected object and the number of risks of the risk items; based on the level score table of the risk items, the number of risks, and a preset calculation function, to obtain the risk value of the protected object, wherein the calculation function includes the mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item. By obtaining the risk value and number of risks of the protected object, and combining the level score table and the mapping relationship between the number of risks and the denominator of the calculation function, the technical problem of not being able to reflect the differences between security risk items of different risk categories, different risk levels, and the same risk level but different numbers of risks in security risk monitoring can be solved, thus improving the efficiency and accuracy of security risk monitoring. Based on the solution of this application, starting from the rule that security risk items in network or information security have different levels and the same level but different numbers of risks, a calculation function including the mapping relationship between the number of risks and the denominator of the preset function is set. The effectiveness of the security risk monitoring method proposed in this application is verified by this calculation function, and the difference in risk values ​​determined by the method of this application is significantly improved.

[0045] This application's embodiments take into account that a certain type of security risk item in the protected object may have different levels and different quantities of the same level. If the calculation is based on the level weight of the security risk item, it cannot reflect the impact of different quantities of the same level of security risk item on the risk value; if the calculation is based on a scoring system, it cannot reflect the impact of different levels of security risk item on the risk value, thus affecting the accuracy and efficiency of security risk monitoring.

[0046] Therefore, the embodiments of this application, starting from the practical problem of reflecting the differences between risk values ​​of security risk items, and combining the ability of the calculation function to reflect the differences between different levels of a certain type of security risk item, and between security risk items of the same level but different numbers, design a risk value calculation function based on security risk items. This solves the technical problem of differences between security risk items of different risk categories, different risk levels, and between security risk items of the same risk level but different numbers in security risk monitoring, and improves the efficiency and accuracy of security risk monitoring.

[0047] Specifically, refer to Figure 1 , Figure 1 This is a functional module diagram of the terminal device to which the security risk monitoring device of this application belongs. The security risk monitoring device can be independent of the terminal device, capable of determining function denominators, level scores, and calculation functions. It can be implemented on the terminal device in hardware or software form. The terminal device can be a smart mobile terminal with data processing capabilities, such as a mobile phone or tablet computer, or a fixed terminal device or server with data processing capabilities.

[0048] In this embodiment, the terminal device to which the security risk monitoring device belongs includes at least an output module 110, a processor 120, a memory 130, and a communication module 140.

[0049] The memory 130 stores the operating system and security risk monitoring program. The security risk monitoring device can acquire the risk items and risk quantity of the protected object; based on the risk item level score table, risk quantity, and preset calculation function, obtain the risk value of the protected object, including the calculation function of the mapping relationship between the risk quantity and the denominator of the preset function. The information such as the correspondence between the risk value and each risk level of the risk item is stored in the memory 130. The output module 110 can be a display screen, etc. The communication module 140 can include a WIFI module, a mobile communication module, and a Bluetooth module, etc., and communicates with external devices or servers through the communication module 140.

[0050] When the security risk monitoring program in memory 130 is executed by the processor, it performs the following steps:

[0051] Obtain the risk items of the protected object and the number of risks associated with each risk item;

[0052] Based on the risk item rating table, the number of risks, and a preset calculation function, the risk value of the protected object is obtained. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item.

[0053] Furthermore, when the security risk monitoring program in memory 130 is executed by the processor, it also performs the following steps:

[0054] Obtain the number of different risks at the same risk level for the risk item;

[0055] Determine the corresponding denominator for the function based on the different risk quantities.

[0056] Furthermore, when the security risk monitoring program in memory 130 is executed by the processor, it also performs the following steps:

[0057] Determine the total score for the aforementioned risk items;

[0058] Based on the total score of the risk item, the grade score table for determining the different risk levels of the risk item is used.

[0059] Furthermore, when the security risk monitoring program in memory 130 is executed by the processor, it also performs the following steps:

[0060] Based on the changing trend of the output value of the preset hyperbolic tangent function, the mapping relationship between the number of risks and the denominator of the function is obtained;

[0061] Based on the mapping relationship, the input value of the hyperbolic tangent function is modified to obtain the calculation function.

[0062] Furthermore, when the security risk monitoring program in memory 130 is executed by the processor, it also performs the following steps:

[0063] Based on the different risk levels of the aforementioned risk items, select the corresponding level score from the level score table;

[0064] The grade score is used as the coefficient of the calculation function, and the corresponding risk quantity is substituted into the calculation function to obtain the risk value of the protected object.

[0065] Furthermore, when the security risk monitoring program in memory 130 is executed by the processor, it also performs the following steps:

[0066] Identify and associate risk items of the protected object;

[0067] The risk items of the protected object are written into a preset database to obtain risk items of different risk levels and the number of risks for each risk item.

[0068] Furthermore, when the security risk monitoring program in memory 130 is executed by the processor, it also performs the following steps:

[0069] The risk value of the protected object is written into the database.

[0070] This embodiment, through the above-described scheme, specifically obtains the risk items and the number of risks associated with each risk item of the protected object; based on the risk item's level score table, the number of risks, and a preset calculation function, it obtains the risk value of the protected object. The calculation function includes a mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item. By obtaining the risk value and number of risks of the protected object, and combining the level score table and the mapping relationship between the number of risks and the denominator of the calculation function, the technical problem of not being able to reflect the differences between security risk items of different risk categories, different risk levels, and the same risk level but different numbers of risks in security risk monitoring can be solved, thus improving the efficiency and accuracy of security risk monitoring. Based on the scheme of this application, starting from the rule that security risk items in network or information security have different levels and the same level but different numbers of risks, a calculation function including a mapping relationship between the number of risks and the denominator of the preset function is set. The effectiveness of the security risk monitoring method proposed in this application is verified by this calculation function, and the difference in risk values ​​determined by the method of this application is significantly improved.

[0071] Based on, but not limited to, the terminal device architecture described above, this application proposes method embodiments.

[0072] Reference Figure 2 , Figure 2 This is a flowchart illustrating a first exemplary embodiment of the security risk monitoring method of this application. The security risk monitoring method includes:

[0073] Step S210: Obtain the risk items of the protected object and the number of risks of the risk items;

[0074] The execution subject of the method in this embodiment can be a security risk monitoring device, a security risk monitoring terminal device, or a server. This embodiment takes a security risk monitoring device as an example. The security risk monitoring device can be integrated into terminal devices such as smartphones and tablets with data processing functions.

[0075] This embodiment primarily enables the monitoring of network security or information security, especially for monitoring various security risk items within major security risk categories such as vulnerabilities, security incidents, and security weaknesses. By obtaining the risk value and number of risks of the protected object, and combining the level score table and the mapping relationship between the number of risks in the calculation function and the denominator of the function, the efficiency and accuracy of security risk monitoring can be improved.

[0076] This embodiment starts from the practical problem of reflecting the differences between the risk values ​​of security risk items, and combines the ability of the calculation function to reflect the differences between different levels of a certain type of security risk item and between different numbers of security risk items of the same level, and designs a risk value calculation function based on security risk items.

[0077] It should be noted that this embodiment uses software vulnerability risks as an example of security risks. In other embodiments, this solution can also be applied to multiple types of security risks to determine the risk value of each security risk. This includes, but is not limited to, various operating systems, hardware, and software, such as Windows, Linux, Chrome OS, office software, Internet Explorer, automotive hardware, communication hardware, and computer hardware, demonstrating its universality in security risk monitoring.

[0078] Specifically, the risk items of the protected object are obtained to determine the various vulnerability risk items of the software's protected object. It should be noted that risk items include vulnerability risk items with different risk levels, such as high-risk, extremely high-risk, medium-risk, and low-risk. The risk quantity is used to determine the corresponding quantity of vulnerability risk items at different risk levels. When users use the software product, network and information security must be ensured; therefore, it is necessary to monitor the security risk items of the protected object. By identifying and associating the relevant vulnerability risk items of the software's protected object, and writing the vulnerability risk items into a database, each vulnerability risk item and its corresponding quantity can be summarized in a data table. This yields the risk item and its corresponding risk quantity. Substituting the risk quantity into a calculation function, the risk value of the protected object is obtained, allowing users to clearly and intuitively understand the current status of each security risk item of the software.

[0079] In addition, users can determine the number of vulnerability risks in software products that need to be monitored based on their actual business needs. By setting the denominator of the calculation function according to the number of vulnerability risks that need to be monitored, the differences in risk values ​​between software vulnerabilities of the same level but with different numbers of vulnerabilities can be reflected, demonstrating the flexibility of security risk monitoring.

[0080] Step S220: Based on the risk item rating table, the number of risks, and a preset calculation function, obtain the risk value of the protected object. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function. The risk value corresponds to each risk level of the risk item.

[0081] Specifically, the calculation function is used to determine the risk value of the protected object of the software product. This function is modified based on the characteristics of the hyperbolic tangent function and includes a mapping relationship between the number of risks and the function denominator. This mapping relationship is a functional relationship between the number of risks and the function denominator. Based on this mapping relationship, the function denominator and the number of risks are substituted into the calculation function to determine the risk value. The level scores in the level score table serve as coefficients for the calculation function, ensuring that the risk value does not exceed the range in the level score table. The risk value is used to measure the differences between different levels of software vulnerabilities, and between different numbers of vulnerabilities at the same level. By combining the risk scores of different risk levels, the function denominators of different numbers of vulnerabilities at the same level, and the calculation function modified based on the hyperbolic tangent function, the risk value of the protected object can be determined. This smoothly reflects the differences between security risk items of different risk levels and different numbers of vulnerabilities at the same risk level, improving the accuracy and efficiency of security risk monitoring.

[0082] In addition, users can preset the denominator of the calculation function for major security risk categories such as vulnerabilities, security incidents, and security weaknesses according to actual business needs (the number of risks of the same level determines the setting of this denominator). Based on the risk level of different risk categories, risk score tables are set, and then the number of different risks of the same level is counted to calculate the security risk value of the protected object. This can solve the technical problem of the difference in the calculated risk value due to different risk levels, different risk categories, and different numbers of risks in security risk calculation, and ensure the consistency, rationality and controllability of the risk value calculation method of the protected object.

[0083] It should be noted that this embodiment can reflect the different risk levels of one or more security risk items, as well as the differences between different quantities of items with the same risk level, and will not exceed the set risk level score, which meets the needs of security risk calculation business.

[0084] This embodiment, through the above-described scheme, specifically obtains the risk items and the number of risks associated with each risk item of the protected object; based on the risk item's level score table, the number of risks, and a preset calculation function, it obtains the risk value of the protected object. The calculation function includes a mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item. By obtaining the risk value and number of risks of the protected object, and combining this with the level score table and the mapping relationship between the number of risks and the denominator of the calculation function, the technical problem of not being able to reflect the differences between different risk categories, different risk levels, and different numbers of risks within the same risk level in security risk monitoring can be solved, thereby improving the efficiency and accuracy of security risk monitoring.

[0085] Reference Figure 3 , Figure 3 This is a flowchart illustrating a second exemplary embodiment of the security risk monitoring method of this application. Based on the above... Figure 2 In the illustrated embodiment, step S220, based on the risk item rating table, the number of risks, and a preset calculation function, obtains the risk value of the protected object. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function. Before the risk value corresponds to each risk level of the risk item, the method further includes:

[0086] Step S310: Based on the changing trend of the output value of the preset hyperbolic tangent function, obtain the mapping relationship between the number of risks and the denominator of the function;

[0087] Specifically, this embodiment takes the operating system (OS) vulnerability risk item as an example. Assuming the total score for the vulnerability risk item is 50 points, the commonly used method for calculating the vulnerability risk value is as follows:

[0088] The first method: Calculation based on vulnerability level weight:

[0089] Grade Weight Table

[0090] 1 Critically endangered 0.6 2 High risk 0.25 3 Medium risk 0.1 4 Low risk 0.05

[0091] Referring to the risk level weighting table, if a vulnerability risk item contains vulnerabilities at the critical, high, medium, and low risk levels, then the vulnerability risk value is:

[0092] 50*0.6+50*0.25+50*0.1+50*0.05=50;

[0093] If the vulnerability risk item only includes high-risk and medium-risk vulnerabilities, then the vulnerability risk value is:

[0094] 50 * 0.25 + 50 * 0.1 = 20;

[0095] While the vulnerability level weight calculation reflects the risk value of vulnerabilities of different levels and participates in the risk value calculation, it does not reflect the impact of the different numbers of vulnerabilities of the same level on the risk value calculation, nor does it reflect the impact of the general vulnerability scoring system score on the risk value.

[0096] The second method: Calculation using the Common Vulnerability Scoring System (CVSS):

[0097] Operating System Vulnerability List

[0098]

[0099]

[0100] Referring to the operating system vulnerability list, the highest score from the Common Vulnerability Scoring System (CVSS3) is used as a reference score for vulnerability risk calculation. Taking the CVSS3 score as an example, the vulnerability risk value for this operating system is:

[0101] 50*(10 / 10)=50;

[0102] The risk value is calculated using the highest score from the general vulnerability scoring system, which reflects the impact of the most serious vulnerability on the operating system vulnerability score, but does not reflect the impact of other vulnerabilities on the risk value.

[0103] In summary, neither of the two operating system vulnerability calculation schemes considers the impact of the number of vulnerabilities of the same level. Intuitively, it is also believed that the risk values ​​calculated for no vulnerabilities and different numbers of vulnerabilities of the same level should be different. Therefore, this embodiment mainly provides a set of visual and definable algorithms that can comprehensively and intuitively present the differences in risk value calculation for different levels of operating system vulnerabilities and different numbers of vulnerabilities of the same level.

[0104] Step S320: Based on the mapping relationship, modify the input value of the hyperbolic tangent function to obtain the calculation function.

[0105] Specifically, based on the hyperbolic tangent function, the input parameters of the hyperbolic tangent function are modified to address the impact of different vulnerability levels and varying numbers of vulnerabilities at the same level on the calculated vulnerability risk value. A visual interface is provided to configure function parameters and set scores for different vulnerability levels. The differences in risk values ​​are calculated by combining different vulnerability levels and varying numbers of vulnerabilities at the same level. The specific implementation steps are as follows:

[0106] refer to Figure 4 , Figure 4 This diagram illustrates the hyperbolic tangent function involved in the safety risk monitoring method of this application. Specifically, the diagram shows the hyperbolic tangent function f(x) = tanh(x). The value of the hyperbolic tangent function lies between -1 and 1. Therefore, this embodiment takes the x-axis of the hyperbolic tangent function as the positive part, i.e., the x-axis is greater than or equal to 0, and the result lies between 0 and 1. This solves the problem that regardless of the value of x, the calculated risk value is never greater than 1. Based on the changing trend of the input value greater than 1 of the hyperbolic tangent function, the input value is modified to 1 + (x - 1) / m. This modification optimizes the input parameters of the hyperbolic tangent function, solving the problem of significant or insignificant differences between the input value and the result value. The calculation function f(x, m) is:

[0107] f(x,m)=tanh(1+(x-1) / m);

[0108] In the formula, x represents the number of vulnerabilities of the same level in the security risk item, m represents the denominator of the preset calculation function for major security risk categories such as vulnerabilities, security incidents, and security weaknesses, and 1+(x-1) / m represents the mapping relationship between the number of risks and the denominator of the function.

[0109] In this way, different types of risk scores can be set as constants in the function, so that no matter how many vulnerabilities of this level there are, the calculated risk value will not exceed this constant.

[0110] Further, in step S220, based on the risk item rating table, the number of risks, and a preset calculation function, the risk value of the protected object is obtained. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function. The risk value corresponds to each risk level of the risk item, including:

[0111] Step S330: Select the corresponding level score from the level score table according to the different risk levels of the risk items;

[0112] Specifically, risk items are used to identify the various vulnerability risk items of the operating system's protected objects, including vulnerability risk items with different risk levels. Risk quantity is used to determine the number of vulnerability risk items corresponding to different risk levels. The level score table shows the level scores corresponding to different risk levels under the same security risk item, used to limit the maximum risk value for each risk level of the current security risk item. By identifying and associating relevant vulnerability risk items of the operating system's protected objects, and writing the vulnerability risk items into the database, each vulnerability risk item and its corresponding quantity can be aggregated into the same data table, thereby obtaining the vulnerability risk items and their corresponding risk quantities. Substituting the risk quantity and the function denominator into the calculation function, the risk value of the protected object is obtained.

[0113] Step S340: Use the grade score as the coefficient of the calculation function, and substitute the corresponding risk quantity into the calculation function to obtain the risk value of the protected object.

[0114] Specifically, the steps for calculating the risk value (Risk) are as follows:

[0115] Ri sk=C*tanh(y)=C*tanh(1+(x-1) / m);

[0116] In the formula, C represents the grade score, and tanh(y) represents the calculation function.

[0117] In this embodiment, as one implementation scheme, different risk levels of current security risk items can be identified. Based on the identified risk levels, a level score table can be determined. Furthermore, the identified risk levels are combined with historical data to further determine the level score table. As another implementation scheme, the level score table can be determined by the user according to actual needs. The level score table includes the level scores corresponding to different risk levels. By using the level score of each vulnerability type as a function constant in the calculation function, the calculation result will not exceed the corresponding level score regardless of the number of vulnerabilities corresponding to the current risk level, thus improving the flexibility of security risk monitoring.

[0118] This embodiment, through the above-described scheme, specifically obtains the mapping relationship between the number of risks and the denominator of the function based on the changing trend of the output value of a preset hyperbolic tangent function; modifies the input value of the hyperbolic tangent function according to the mapping relationship to obtain the calculation function; obtains the risk items of the protected object and the risk quantity of the risk items; selects the corresponding level score from the level score table according to the different risk levels of the risk items; uses the level score as the coefficient of the calculation function, and substitutes the corresponding risk quantity into the calculation function to obtain the risk value of the protected object. By obtaining the mapping relationship between the number of risks and the denominator of the function and modifying the input value of the hyperbolic tangent function to obtain the calculation function, the technical problem of not being able to reflect the differences between different risk categories, different risk levels, and different risk quantities of safety risk items with the same risk level can be solved in safety risk monitoring. This allows the calculation function to be flexibly modified, improving the efficiency and accuracy of safety risk monitoring.

[0119] Reference Figure 5 , Figure 5 This is a flowchart illustrating a third exemplary embodiment of the security risk monitoring method of this application. Based on the above... Figure 2 In the illustrated embodiment, step S220, based on the risk item rating table, the number of risks, and a preset calculation function, obtains the risk value of the protected object. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function. Before the risk value corresponds to each risk level of the risk item, the method further includes:

[0120] Step S510: Obtain the number of different risks of the same risk level for the risk item;

[0121] Specifically, different risk quantities are used to determine the denominator of the function for the current security risk item. In this embodiment, the denominator of the calculation function can be determined by identifying the number of risks of the same risk level for the current risk item and combining it with historical data. Furthermore, the denominator can also be determined based on the number of vulnerabilities that the user needs to focus on. Thus, users can customize the function denominator to meet their business requirements. In this embodiment, the same function denominator can be set for different risk levels, different function denominators can be set for different risk levels, the same function denominator can be set for the same level, and different function denominators can be set for the same level. This embodiment preferably uses the same function denominator for the same level and different function denominators for different levels.

[0122] Comparison table of risk value calculation functions

[0123]

[0124]

[0125] Referring to the comparison table of risk value calculation functions, y(x,m) represents the mapping relationship between the risk quantity x and the function denominator m, i.e., y(x,m) = 1 + (x-1) / m; f(y) is the calculation function, i.e., f(y) = tanh(y) = tanh(1 + (x-1) / m). The table shows cases where safety risk items are of the same level but different quantities and the function denominator is 1, as well as cases where safety risk items are of the same level but different quantities and the function denominator is 10.

[0126] When the denominator of the function is 1, i.e., y(x,1), the result is 0 when the input is 0 (i.e., no vulnerability); and when the input has vulnerabilities (one or more vulnerabilities), the result is close to 1, which conforms to the characteristic that the calculated risk value differs significantly depending on whether there are vulnerabilities or not. However, when the input value x is 2, the result is 0.964, which is significantly different from the calculated result of 0.762 when the input value is 1. That is, at the same level, the calculated result for one vulnerability is significantly different from that for two vulnerabilities. Furthermore, when the input value is 5, the result is 1, which is no different from the result for an input value greater than 5, indicating that the input value has no impact on the result. For these two reasons, it is necessary to modify this calculation function, especially the denominator of the calculation function.

[0127] When the denominator of the function is 10, i.e. y(x,1), the problem of large differences in the calculation results for one vulnerability and two vulnerabilities of the same level can be solved. By modifying the denominator of the function and combining it with the actual number of different vulnerabilities, the difference in the calculation results of different risk values ​​can be smoothly reflected, which meets the requirements of security risk calculation results.

[0128] Step S520: Determine the corresponding function denominator based on the different risk quantities.

[0129] Specifically, referring to the function denominator comparison table of the calculation function, the table shows the function denominators corresponding to different numbers of vulnerabilities of the same level. As one implementation scheme, the function denominator corresponding to different numbers of vulnerabilities of the same level can be determined by identifying the number of vulnerabilities in the current protected object and combining this with the function denominator comparison table. Alternatively, users can customize the function denominator of the risk value calculation function, improving the flexibility of security risk monitoring. By setting different function denominators, the differences between different numbers of vulnerabilities of the same level can be reflected.

[0130] Comparison table of denominators for calculating functions

[0131]

[0132] refer to Figure 6 , Figure 6This is a page diagram showing the denominator settings for the risk value calculation function of the security risk monitoring method in this application. The diagram shows that the denominator of the function, as determined by the user on the visualization page, is 15. By configuring the function denominator on the visualization page, the differences between risk values ​​of security risk items can be flexibly represented, improving the visualization and convenience of security risk monitoring.

[0133] This embodiment, through the above-described scheme, specifically obtains the number of different risks at the same risk level for the risk item; and determines the corresponding function denominator based on the different risk quantities. Setting the corresponding function denominator based on different quantities at the same risk level can reflect the differences between different quantities of safety risk items at the same risk level.

[0134] Reference Figure 7 , Figure 7 This is a flowchart illustrating a fourth exemplary embodiment of the security risk monitoring method of this application. Based on the above... Figure 2 In the illustrated embodiment, step S220, based on the risk item rating table, the number of risks, and a preset calculation function, obtains the risk value of the protected object. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function. Before the risk value corresponds to each risk level of the risk item, the method further includes:

[0135] Step S710: Determine the total score for the risk item;

[0136] Specifically, the total score of the risk item is used to determine the grade score of different risk levels. That is, the grade scores of all risk levels of the safety risk item are added together to obtain the total score of the risk item.

[0137] Step S720: Based on the total score of the risk item, determine the grade score table for different risk levels of the risk item.

[0138] Specifically, refer to Comparison Tables 1, 2, and 3 for designs with different risk levels. In this embodiment, based on the different risk levels of operating system vulnerabilities, a risk value calculation function is applied to the design of vulnerabilities of different levels. The comparison tables show that the risk value calculation function yields higher results for extremely dangerous vulnerabilities than for high-risk vulnerabilities (the same applies to others), consistent with the different risk values ​​corresponding to different vulnerability levels. Thus, by setting different risk level scores and combining them with a calculation function modified from the hyperbolic tangent function, the risk value can be ensured not to exceed the range of the current risk level's score.

[0139] Comparison Table 1 of Designs for Different Risk Levels

[0140] Critically endangered 30 22.86<=f(x)<=30 High risk 10 7.62<=f(x)<=10 Medium risk 6 4.56<=f(x)<=6 Low risk 4 3.04<=f(x)<=4

[0141] Comparison Table 2 of Designs for Different Risk Levels

[0142] Critically endangered 30 22.8<=f(x)<=30 High risk 15 11<=f(x)<=15 Medium risk 5 3.8<=f(x)<=5

[0143] Comparison Table 3 of Designs for Different Risk Levels

[0144] Critically endangered 30 22.8<=f(x)<=30 High risk 20 15.2<=f(x)<=20

[0145] Specifically, refer to Figure 8 , Figure 8 This is a page diagram showing the risk level score settings for the security risk monitoring method in this application. Taking the customization of scores for different risk levels of operating system vulnerabilities as an example, users can design comparison tables 1-3 based on the different risk levels mentioned above, and customize the score values ​​for different risk levels according to their own needs to achieve their business requirements. The diagram specifically shows that on the visualization page, users determine the score values ​​for different risk levels. The security risk item is a risk vulnerability, and the total score for the security risk item is 50 points. The score for a medium-risk level is 6 points, the score for a low-risk level is 4 points, the score for a very high-risk level is 30 points, and the score for a very high-risk level is 10 points.

[0146] This embodiment, through the above-described scheme, specifically determines the total score of the risk item; based on the total score of the risk item, it determines the grade score table for different risk levels of the risk item. Setting grade score tables according to different levels can reflect the differences between different levels of safety risk items.

[0147] Reference Figure 9 , Figure 9 This is a flowchart illustrating a fifth exemplary embodiment of the security risk monitoring method of this application. Based on the above... Figure 2 In the illustrated embodiment, step S220, based on the risk item rating table, the number of risks, and a preset calculation function, obtains the risk value of the protected object. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function. Before the risk value corresponds to each risk level of the risk item, the method further includes:

[0148] Step S910: Identify and associate risk items of the protected object;

[0149] Specifically, after users set the denominator of the calculation function and the score for different risk levels on the visualization page, they can obtain the various security risk items of the protected object, the different risk levels of the security risk items, and the number of risks corresponding to each risk level by scanning and / or identifying and associating them. For example, by identifying and associating the vulnerability risk items of the operating system, it can be found that there are 2 high-risk vulnerabilities, 4 extremely high-risk vulnerabilities, and 3 medium-risk vulnerabilities.

[0150] Step S920: Write the risk items of the protected object into a preset database to obtain risk items of different risk levels and the number of risks for each risk item.

[0151] Specifically, the database is used to store data, including but not limited to function denominators, hyperbolic tangent functions, rating scores, various risk items of the protected object and their corresponding risk quantities, and the risk values ​​of the protected object. Databases include, but are not limited to: MySQL, Oracle, SQL Server, SQLite, Info.ix, Redis, MongoDB, HBase, Neo4J, CouchDB, etc. This embodiment preferably uses MySQL, but other databases can be used in other embodiments. For example, by writing the vulnerability risk items related to the protected object of the operating system into the database, it is possible to obtain the vulnerability risk items of different risk levels of the protected object, as well as the current quantity of each vulnerability risk item.

[0152] Further, in step S220, based on the risk item rating table, the number of risks, and a preset calculation function, the risk value of the protected object is obtained. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function. After the risk value corresponds to each risk level of the risk item, the method further includes:

[0153] Step S930: Write the risk value of the protected object into the database.

[0154] Specifically, after determining the risk values ​​of different risk levels for each risk item through calculation functions, the vulnerability risk values ​​of the protected objects are written into the database and displayed on the visualization page, making it convenient for users to view and saving historical data to improve traceability.

[0155] refer to Figure 10 , Figure 10 This is a schematic diagram of the page for viewing risk values ​​in the security risk monitoring method of this application. The diagram shows the various security risk items in this embodiment, including but not limited to: risk events, non-compliance items, and risk vulnerabilities. This embodiment uses risk vulnerabilities as an example. Risk vulnerabilities include three different risk levels, each corresponding to a specific number of vulnerabilities. When the user views the details of the protected object, they can see the specific risk items and their corresponding number and value. Specifically, the extremely risky level has 98 vulnerabilities, deducting 30 points; the medium risky level has 359 vulnerabilities, deducting 6 points; and the high risky level corresponds to 765 vulnerabilities, deducting 10 points.

[0156] This embodiment, through the above-described scheme, specifically identifies and associates risk items of the protected object; writes the risk items of the protected object into a preset database to obtain risk items of different risk levels and the number of risks for each risk item; based on the risk item's level score table, the number of risks, and a preset calculation function, obtains the risk value of the protected object, where the calculation function includes a mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item; and writes the risk value of the protected object into the database. By identifying and associating risk items with their current number, thereby obtaining the risk values ​​corresponding to different risk levels and writing them into the database, the discrepancies between calculating risk values ​​for different risk levels and different numbers of the same risk level for one or more types of security risk items in security risk calculation can be resolved. This also provides visualization for risk value determination and improves traceability.

[0157] Reference Figure 11 , Figure 11 This is a flowchart illustrating the sixth exemplary embodiment of the security risk monitoring method of this application.

[0158] (1) First, users set the denominator of the calculation function according to their own business needs to determine the range of vulnerabilities they are concerned about, thereby setting the denominator of the calculation function for different numbers of risk values ​​of the same level.

[0159] (2) Then, users set different levels of vulnerability scores according to their own business needs, thereby displaying the score differences between different risk levels;

[0160] (3) Then, identify and correlate the vulnerabilities related to the protected object;

[0161] (4) Then, associate the vulnerabilities related to the protected objects and write them into the database;

[0162] (5) Then, the risk value of the protected object is calculated by combining the vulnerability scores of different levels and the risk values ​​of different quantities of the same level using the function f(x,m)=tanh(1+(x-1) / m);

[0163] (6) Finally, the vulnerability risk value of the protected object is written into the database, the risk value of the protected object is updated, and it is convenient for users to view. When users view the details of the protected object, they can view the different levels of specific risk items and their corresponding risk values.

[0164] In this way, the discrepancies between the calculated risk values ​​for different risk levels of one or more types of security risk items, as well as the differences in the number of items at the same risk level, can be resolved without exceeding the set score, thus meeting the needs of security risk calculation operations.

[0165] Furthermore, this application also proposes a security risk monitoring device, which includes:

[0166] The acquisition module is used to acquire the risk items of the protected object and the number of risks associated with each risk item;

[0167] The monitoring module is used to obtain the risk value of the protected object based on the risk item's level score table, the number of risks, and a preset calculation function. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item.

[0168] The principle and implementation process of security risk monitoring in this embodiment are explained in the above embodiments and will not be repeated here.

[0169] Furthermore, this application also proposes a terminal device, which includes a memory, a processor, and a security risk monitoring program stored in the memory and executable on the processor. When the security risk monitoring program is executed by the processor, it implements the steps of the security risk monitoring method described above.

[0170] Since this security risk monitoring program employs all the technical solutions of all the aforementioned embodiments when executed by the processor, it possesses at least all the beneficial effects brought about by all the technical solutions of all the aforementioned embodiments, which will not be elaborated upon here.

[0171] Furthermore, embodiments of this application also propose a computer-readable storage medium storing a security risk monitoring program, which, when executed by a processor, implements the steps of the security risk monitoring method described above.

[0172] Since this security risk monitoring program employs all the technical solutions of all the aforementioned embodiments when executed by the processor, it possesses at least all the beneficial effects brought about by all the technical solutions of all the aforementioned embodiments, which will not be elaborated upon here.

[0173] Compared to existing technologies, the security risk monitoring method, apparatus, terminal device, and storage medium proposed in this application obtain the risk items and the number of risks associated with the protected object; based on the risk item's level score table, the number of risks, and a preset calculation function, the risk value of the protected object is obtained. The calculation function includes a mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item. By obtaining the risk value and number of risks of the protected object, and combining the level score table and the mapping relationship between the number of risks and the denominator of the calculation function, the technical problem of not being able to reflect the differences between security risk items of different risk categories, different risk levels, and the same risk level but different numbers of risks in security risk monitoring can be solved, thus improving the efficiency and accuracy of security risk monitoring. Based on the solution of this application, starting from the rule that security risk items in network or information security have different levels and the same level but different numbers of risks, a calculation function including a mapping relationship between the number of risks and the denominator of the preset function is set. The effectiveness of the security risk monitoring method proposed in this application is verified by this calculation function, and the difference in risk values ​​determined by the method of this application is significantly improved.

[0174] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0175] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0176] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, controlled terminal, or network device, etc.) to execute the methods of each embodiment of this application.

[0177] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for monitoring security risks, characterized in that, The security risk monitoring method includes the following steps: Obtain the risk items of the protected object and the number of risks associated with each risk item; Based on the risk item rating table, the number of risks, and a preset calculation function, the risk value of the protected object is obtained. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to the risk level of the risk item. Before the step of obtaining the risk value of the protected object based on the risk item's rating table, the number of risks, and a preset calculation function, the method further includes: Based on the changing trend of the output value of the preset hyperbolic tangent function, the mapping relationship between the number of risks and the denominator of the function is obtained; Based on the mapping relationship, the input value of the hyperbolic tangent function is modified to obtain the calculation function; The calculation formula for the calculation function is as follows: f(x,m)=tanh(1+(x-1) / m); Where f(x,m) represents the calculation function, x represents the number of vulnerabilities of the same level in the security risk item, m represents the denominator of the preset calculation function for the major security risk category, including vulnerabilities, security events, and security weaknesses, 1+(x-1) / m represents the mapping relationship between the number of risks and the denominator of the function, and tanh() represents the hyperbolic tangent function. The step of obtaining the risk value of the protected object based on the risk item rating table, the number of risks, and a preset calculation function includes: Based on the different risk levels of the aforementioned risk items, select the corresponding level score from the level score table; The grade score is used as the coefficient of the calculation function, and the corresponding risk quantity is substituted into the calculation function to obtain the risk value of the protected object.

2. The security risk monitoring method as described in claim 1, characterized in that, Before the step of obtaining the risk value of the protected object based on the risk item rating table, the number of risks, and a preset calculation function, the method further includes: Obtain the number of different risks at the same risk level for the risk item; Determine the corresponding denominator for the function based on the different risk quantities.

3. The security risk monitoring method as described in claim 1, characterized in that, Before the step of obtaining the risk value of the protected object based on the risk item rating table, the number of risks, and a preset calculation function, the method further includes: Determine the total score for the aforementioned risk items; Based on the total score of the risk item, the grade score table for determining the different risk levels of the risk item is used.

4. The security risk monitoring method as described in claim 1, characterized in that, The steps of obtaining the risk items of the protected object and the number of risks of the risk items include: Identify and associate risk items of the protected object; The risk items of the protected object are written into a preset database to obtain risk items of different risk levels and the number of risks for each risk item.

5. The security risk monitoring method as described in claim 4, characterized in that, After the step of obtaining the risk value of the protected object based on the risk item's rating table, the number of risks, and a preset calculation function, the method further includes: The risk value of the protected object is written into the database.

6. A safety risk monitoring device, characterized in that, The security risk monitoring device includes: The acquisition module is used to acquire the risk items of the protected object and the number of risks associated with each risk item; The monitoring module is used to obtain the risk value of the protected object based on the risk item's level score table, the number of risks, and a preset calculation function. The calculation function includes the mapping relationship between the number of risks and the denominator of the preset function, and the risk value corresponds to each risk level of the risk item. The device further includes a function module, which is used to obtain the mapping relationship between the number of risks and the denominator of the function based on the changing trend of the output value of the preset hyperbolic tangent function. Based on the mapping relationship, the input value of the hyperbolic tangent function is modified to obtain the calculation function; The calculation formula for the calculation function is as follows: f(x,m)=tanh(1+(x-1) / m); Where f(x,m) represents the calculation function; x represents the number of vulnerabilities of the same level in the security risk item; m represents the denominator of the preset calculation function for the major security risk category, including vulnerabilities, security events, and security weaknesses; 1+(x-1) / m represents the mapping relationship between the number of risks and the denominator of the function; and tanh() represents the hyperbolic tangent function. The monitoring module is also used to select the corresponding level score from the level score table according to the different risk levels of the risk items. The grade score is used as the coefficient of the calculation function, and the corresponding risk quantity is substituted into the calculation function to obtain the risk value of the protected object.

7. A terminal device, characterized in that, The terminal device includes a memory, a processor, and a security risk monitoring program stored in the memory and executable on the processor. When the security risk monitoring program is executed by the processor, it implements the steps of the security risk monitoring method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a security risk monitoring program, which, when executed by a processor, implements the steps of the security risk monitoring method as described in any one of claims 1-5.

Images