Network asset risk assessment method and device, electronic equipment and storage medium

Abstract

The application provides a network asset risk assessment method and device, electronic equipment and a storage medium. The method comprises determining an asset vulnerability score, an asset importance score and a threat occurrence possibility score of a network asset to be evaluated, wherein the asset vulnerability score is used to represent the asset vulnerability of the network asset to be evaluated; the asset importance score is used to represent the asset importance of the network asset to be evaluated; the threat occurrence possibility score is used to represent the possibility of threat occurrence against the network asset to be evaluated; and according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, an asset risk value of the network asset to be evaluated is determined to evaluate the risk of the network asset to be evaluated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a network asset risk assessment method and device, an electronic device and a storage medium. BACKGROUND

[0002] Network assets mainly refer to various devices used in computers or communication networks. In the current network environment, network assets often face various risks. For example, illegal personnel may use malicious software, vulnerabilities, viruses and other attack means to attack network assets to achieve their illegal purposes. Therefore, it is usually necessary to assess the risks faced by network assets. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a network asset risk assessment method and device, an electronic device and a storage medium for assessing the risk of network assets.

[0004] The first aspect of the embodiments of the present application provides a network asset risk assessment method, comprising:

[0005] determining an asset vulnerability score, an asset importance score and a threat occurrence possibility score of a network asset to be assessed, wherein the asset vulnerability score is used to represent the asset vulnerability of the network asset to be assessed; the asset importance score is used to represent the asset importance of the network asset to be assessed; and the threat occurrence possibility score is used to represent the possibility of threat occurrence against the network asset to be assessed;

[0006] determining an asset risk value of the network asset to be assessed according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, so as to assess the risk of the network asset to be assessed.

[0007] In an embodiment, the asset risk value of the network asset to be assessed is determined according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, specifically comprising: calculating the asset risk value through the following formula:

[0008]

[0009] wherein risk is the calculated asset risk value; Iv is the asset vulnerability score; Im is the asset importance score; P is the threat occurrence possibility score; and a and b are preset constants, and a is a positive number.

[0010] In an embodiment, the threat occurrence possibility score is determined in the following manner:

[0011] obtaining threat log data of the network asset to be evaluated in a latest statistical period, wherein each threat log data comprises a corresponding danger level score, and the danger level score is used to represent a danger level of a threat involved in the corresponding threat log data;

[0012] determining a total danger score of the network asset to be evaluated in the latest statistical period according to the danger level scores of the threat log data;

[0013] querying a threat occurrence possibility assignment table by using the total danger score to determine the threat occurrence possibility score.

[0014] In an embodiment, the method further comprises pre-generating the threat occurrence possibility assignment table by:

[0015] obtaining threat log data of a plurality of network assets in the latest n statistical periods, wherein n is a positive integer greater than or equal to 2;

[0016] dividing the obtained threat log data into a plurality of groups according to a manner of grouping threat log data of a same network asset in a same statistical period into a same group;

[0017] for each group, determining a total danger score of the group according to danger level scores of threat log data in the group;

[0018] calculating a plurality of statistical parameters of the total danger scores corresponding to the groups respectively;

[0019] generating the threat occurrence possibility assignment table according to the plurality of statistical parameters.

[0020] In an embodiment, the asset importance score is determined by:

[0021] determining a confidentiality score, an integrity score and an availability score of the network asset to be evaluated;

[0022] weighting and summing the confidentiality score, the integrity score and the availability score to obtain the asset importance score.

[0023] In an embodiment, the confidentiality score, the integrity score and the availability score of the network asset to be evaluated are determined by:

[0024] determining the confidentiality score according to a degree of damage caused by leakage of key data stored in the network asset to be evaluated;

[0025] determining the integrity score according to a degree of impact on business processing caused by absence of the network asset to be evaluated; and,

[0026] determining the availability score according to the availability and the interruption duration of the network asset to be evaluated.

[0027] In an embodiment, the asset vulnerability score is determined by:

[0028] determining a vulnerability vulnerability score and a configuration baseline vulnerability score of the network asset to be evaluated;

[0029] determining the asset vulnerability score of the network asset to be evaluated according to the vulnerability vulnerability score and the configuration baseline vulnerability score.

[0030] In an embodiment, the vulnerability vulnerability score is determined by:

[0031] determining vulnerabilities existing in the network asset to be evaluated;

[0032] determining a vulnerability danger score and a vulnerability danger level corresponding to each vulnerability according to a preset vulnerability scoring standard;

[0033] For each vulnerability danger level, calculating a vulnerability coefficient of the vulnerability danger level according to the vulnerability danger scores of the vulnerabilities in the vulnerability danger level;

[0034] determining the vulnerability vulnerability score according to the vulnerability coefficients of each vulnerability danger level.

[0035] In an embodiment, the vulnerability danger level specifically includes low, medium, high and extremely high, wherein the vulnerability danger score of the vulnerability with the vulnerability danger level of low belongs to [0, L1), the vulnerability danger score of the vulnerability with the vulnerability danger level of medium belongs to [L1, L2), the vulnerability danger score of the vulnerability with the vulnerability danger level of high belongs to [L2, L3), and the vulnerability danger score of the vulnerability with the vulnerability danger level of extremely high belongs to [L3, L4); the method further comprises:

[0036] For each vulnerability, normalizing the vulnerability danger score of the vulnerability according to the vulnerability danger level to which the vulnerability belongs and the upper limit value of the vulnerability danger score in the vulnerability danger level; and,

[0037] For each vulnerability danger level, calculating a vulnerability coefficient of the vulnerability danger level according to the vulnerability danger scores of the vulnerabilities in the vulnerability danger level, specifically comprising:

[0038] For each vulnerability danger level, calculating a vulnerability coefficient of the vulnerability danger level according to the normalized vulnerability danger scores of the vulnerabilities in the vulnerability danger level.

[0039] In an embodiment, the vulnerability coefficient of each vulnerability risk level is determined according to the vulnerability risk score of the vulnerability, specifically comprising:

[0040] determining the highest vulnerability risk level of the vulnerability existing in the network asset to be evaluated;

[0041] multiplying the vulnerability coefficient of the highest vulnerability risk level by the upper limit value of the vulnerability risk score in the highest vulnerability risk level to obtain the vulnerability risk score.

[0042] In an embodiment, for each vulnerability risk level, the vulnerability coefficient of the vulnerability risk level is calculated according to the normalized vulnerability risk score of the vulnerability in the vulnerability risk level, specifically comprising: the vulnerability coefficients of the vulnerability risk levels of low, medium, high and extremely high are calculated respectively by the following formulas:

[0043]

[0044]

[0045]

[0046]

[0047] wherein, V1 is the vulnerability coefficient of the vulnerability risk level of low; V2 is the vulnerability coefficient of the vulnerability risk level of medium; V3 is the vulnerability coefficient of the vulnerability risk level of high; V4 is the vulnerability coefficient of the vulnerability risk level of extremely high; is the normalized vulnerability risk score of vulnerability i in the corresponding vulnerability risk level; i is the number of the vulnerability; ω i is the vulnerability weight value of vulnerability i in the corresponding vulnerability risk level.

[0048] In an embodiment, the method further comprises:

[0049] determining the vulnerability weight value of vulnerability i according to the port information of the port associated with vulnerability i, wherein the port information reflects whether the port is an open port.

[0050] In an embodiment, the configuration baseline vulnerability score is determined by the following way:

[0051] baseline scanning tool to determine a compliance type and a risk level type of each baseline detection item in the network asset to be evaluated, wherein the compliance type specifically includes compliance, non-compliance and scanning failure, and each compliance type corresponds to a corresponding compliance weight and a compliance coding value respectively; the risk level type specifically includes general, low risk, medium risk and high risk, and each risk level type corresponds to a corresponding risk level weight and a risk level coding value respectively;

[0052] According to the compliance weight and the compliance coding value corresponding to the compliance type of each baseline detection item, and the risk level weight and the risk level coding value corresponding to the risk level type of each baseline detection item, the configuration baseline vulnerability score is determined.

[0053] In an embodiment, according to the compliance weight and the compliance coding value corresponding to the compliance type of each baseline detection item, and the risk level weight and the risk level coding value corresponding to the risk level type of each baseline detection item, the configuration baseline vulnerability score is determined, specifically including: the configuration baseline vulnerability score is calculated by using the following formula:

[0054]

[0055] Wherein, BL is the calculated configuration baseline vulnerability score; F n×3 is a matrix generated according to the compliance coding value corresponding to the compliance type of each baseline detection item; is a transpose matrix of the matrix generated according to the compliance weight corresponding to the compliance type of each baseline detection item; S n×4 is a matrix generated according to the risk level coding value corresponding to the risk level type of each baseline detection item; is a transpose matrix of the matrix generated according to the risk level weight corresponding to the risk level type of each baseline detection item; I 1×n is a 1*n matrix with all values being 1; c is a preset constant.

[0056] In an embodiment, according to the vulnerability score and the configuration baseline vulnerability score, the asset vulnerability score of the network asset to be evaluated is determined, specifically including:

[0057] The average value or the weighted average value of the vulnerability score and the configuration baseline vulnerability score is calculated, and the calculation result is determined as the asset vulnerability score of the network asset to be evaluated.

[0058] In an embodiment, a plurality of different asset risk levels are preset, wherein each different asset risk level corresponds to a different asset risk value interval; and the method further includes:

[0059] determine a target asset risk value interval to which the asset risk value of the network asset to be evaluated belongs;

[0060] According to the target asset risk value interval, a target asset risk level to which the network asset to be evaluated belongs is determined.

[0061] The second aspect of the embodiment of the present application provides a network asset risk assessment device, comprising:

[0062] A score determination unit is configured to determine an asset vulnerability score, an asset importance score and a threat occurrence possibility score of a network asset to be evaluated, wherein the asset vulnerability score is used to represent the asset vulnerability of the network asset to be evaluated; the asset importance score is used to represent the asset importance of the network asset to be evaluated; and the threat occurrence possibility score is used to represent the possibility of threat occurrence against the network asset to be evaluated.

[0063] An asset risk value determination unit is configured to determine an asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, so as to assess the risk of the network asset to be evaluated.

[0064] The third aspect of the embodiment of the present application provides an electronic device, comprising:

[0065] A processor;

[0066] A memory for storing processor-executable instructions; wherein the processor is configured to execute the method of any one of the above first aspect.

[0067] The fourth aspect of the embodiment of the present application provides a computer readable storage medium, wherein the storage medium stores a computer program, and the computer program is executable by a processor to complete the method of any one of the above first aspect.

[0068] The network asset risk assessment method provided by the embodiment of the present application first determines the asset vulnerability score, the asset importance score and the threat occurrence possibility score of the network asset to be evaluated, and then determines the asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, so as to assess the risk of the network asset to be evaluated. BRIEF DESCRIPTION OF DRAWINGS

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly introduced as follows. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0070] Figure 1 The specific structural schematic diagram of the electronic device provided by an embodiment of the present application is shown in the following figure.

[0071] Figure 2 The specific flowchart of the risk assessment method of network assets provided by an embodiment of the present application is shown in the following figure.

[0072] Figure 3 The specific flowchart of the method for determining the threat occurrence possibility score provided by an embodiment of the present application is shown in the following figure.

[0073] Figure 4 The specific flowchart of the method for determining the asset importance score provided by an embodiment of the present application is shown in the following figure.

[0074] Figure 5 The specific flowchart of the method for determining the asset vulnerability score provided by an embodiment of the present application is shown in the following figure.

[0075] Figure 6 The specific structural schematic diagram of the risk assessment device of network assets provided by an embodiment of the present application is shown in the following figure. DETAILED DESCRIPTION

[0076] The technical solutions in the embodiments of the present application will be described in detail below with reference to the drawings in the embodiments of the present application. In the description of the present application, the terms “first”, “second”, etc. are only used for differentiation and description, and cannot be understood as indicating or implying relative importance or sequence.

[0077] As described above, in the current network environment, network assets often face various risks. For example, illegal personnel may use malicious software, vulnerabilities, viruses, etc. as attack means to attack network assets to achieve their illegal purposes. Therefore, it is usually necessary to assess the risks faced by network assets.

[0078] Therefore, the embodiments of the present application provide a risk assessment method and device of network assets, an electronic device and a storage medium, which can be used for query of similar character sequences. Figure 1 An electronic device 1 provided by the present embodiment is shown in the following figure. The electronic device 1 comprises at least one processor 11 and a memory 12, Figure 1Taking a processor as an example. The processor 11 and the memory 12 can be connected through the bus 10. The memory 12 stores instructions executable by the processor 11. The instructions are executed by the processor 11, so that the electronic device 1 can execute all or part of the processes of the method in the embodiments described below.

[0079] In actual applications, the electronic device 1 can be a notebook computer, a desktop computer, or a server, a server cluster, etc. composed of the same. In an embodiment, the electronic device 1 receives a request from a user and evaluates the risk of a network asset.

[0080] For ease of understanding, the inventive concept of the network asset risk evaluation method provided in the embodiments of the present application can be briefly described as follows. The method provided in the embodiments of the present application, in combination with the article of the People's Republic of China National Standard GB / T 20984-2007 “Information Security Technology—Information Security Risk Assessment Specification”, evaluates the asset vulnerability, asset importance and threat occurrence possibility of the risk asset from three angles, and finally obtains the asset risk value of the network asset according to the scores of the three angles, so as to evaluate the risk of the network asset.

[0081] As shown in Figure 2 the flowchart of the network asset risk evaluation method provided in an embodiment of the present application. Part or all steps of the method can be executed by the electronic device 1 shown in Figure 1 as a server. The method comprises the following steps.

[0082] Step S21: determining the asset vulnerability score, asset importance score and threat occurrence possibility score of the network asset to be evaluated.

[0083] Among them, in combination with the article of the People's Republic of China National Standard GB / T 20984-2007 “Information Security Technology—Information Security Risk Assessment Specification”, the asset vulnerability score is used to represent the asset vulnerability of the network asset to be evaluated. For example, the greater the asset vulnerability score, the higher the asset vulnerability of the network asset to be evaluated, and vice versa. The smaller the asset vulnerability score, the lower the asset vulnerability of the network asset to be evaluated. The asset importance score is used to represent the asset importance of the network asset to be evaluated. For example, the greater the asset importance score, the higher the asset importance of the network asset to be evaluated, and vice versa. The smaller the asset importance score, the lower the asset importance of the network asset to be evaluated. The threat occurrence possibility score is used to represent the possibility of threat occurrence against the network asset to be evaluated. For example, the greater the threat occurrence possibility score, the higher the possibility of threat occurrence against the network asset to be evaluated, and vice versa. The smaller the threat occurrence possibility score, the lower the possibility of threat occurrence against the network asset to be evaluated.

[0084] The asset vulnerability is an inherent characteristic of the network asset itself, and the asset vulnerability itself does not cause damage to the network asset if it is not exploited by a corresponding threat, that is, the threat exploits the asset vulnerability of the network asset to cause damage.

[0085] The network asset to be evaluated can be any network asset that needs to be evaluated in actual application, or a specified network asset specified by a user. For example, a user request carrying the identifier of a specified network asset can be accepted, and then the specified network asset is taken as the network asset to be evaluated according to the identifier of the specified network asset in the user request. Of course, in actual application, when multiple network assets need to be evaluated respectively, the multiple network assets can also be taken as the network asset to be evaluated in turn.

[0086] Step S22: determining the asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score, and the threat occurrence possibility score, to evaluate the risk of the network asset to be evaluated.

[0087] In actual application, there can be multiple ways to determine the asset risk value according to the asset vulnerability score, the asset importance score, and the threat occurrence possibility score. For example, the first way can be to calculate the sum or arithmetic mean of the asset vulnerability score and the asset importance score, and then multiply the calculation result by the threat occurrence possibility score to calculate the asset risk value. The second way can also be to calculate the product or geometric mean of the asset vulnerability score and the asset importance score, and then multiply the calculation result by the threat occurrence possibility score to calculate the asset risk value.

[0088] In the third way, the asset risk value can also be calculated by the following formula one:

[0089]

[0090] In the formula one, risk is the calculated asset risk value; Iv is the asset vulnerability score; Im is the asset importance score; P is the threat occurrence possibility score; a and b are preset constants, and a is a positive number, for example, a can be 1 and b can be 0 in actual application.

[0091] The asset risk value calculated by the above-mentioned way one is usually smaller than max{calculated asset vulnerability score, asset importance score}, so the calculated asset risk value can be smaller. Therefore, when the asset risk value needs to be accurately calculated, the asset risk value can be calculated by the above-mentioned way two or way three.

[0092] In addition, after determining the asset risk value through the step S22, the asset risk value can be used to evaluate the risk of the network asset to be evaluated. For example, the greater the asset risk value, the higher the risk of the network asset to be evaluated, and vice versa, the smaller the asset risk value, the lower the risk of the network asset to be evaluated. Usually, the determined asset risk value can also be compared with a preset threshold. If the asset risk value is greater than the preset threshold, it means that the risk of the network asset to be evaluated is too high, and there may be a threat to cause the network asset to be evaluated to be devalued. At this time, the method can further include: generating and sending a warning information, so as to inform the relevant personnel through the warning information that the asset risk value is too high.

[0093] In addition, a plurality of different asset risk levels can also be set in advance, and each different asset risk level corresponds to a different asset risk value interval. In this way, after determining the asset risk value of the network asset to be evaluated through the step S22, the target asset risk value interval to which the asset risk value of the network asset to be evaluated belongs can be further determined, and then according to the target asset risk value interval, the asset risk level corresponding to the target asset risk value interval is determined as the target asset risk level to which the network asset to be evaluated belongs.

[0094] The risk evaluation method of the network asset provided by the embodiment of the present application can first determine the asset vulnerability score, the asset importance score and the threat occurrence possibility score of the network asset to be evaluated, and then determine the asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, so as to evaluate the risk of the network asset to be evaluated.

[0095] In the step S21, the threat occurrence possibility score of the network asset to be evaluated can be determined in combination with the method shown in FIG. 3. Figure 3 The method for determining the threat occurrence possibility score of the network asset to be evaluated includes the following steps:

[0096] Step S31: Obtain the threat log data of the network asset to be evaluated in the latest statistical period, wherein each threat log data includes a corresponding danger level score.

[0097] The danger level score is used to represent the danger level of the threat involved in the corresponding threat log data. For example, according to actual needs, the danger level of the threat is usually divided into five levels: extremely high danger, high danger, medium danger, low danger and information, and each danger level corresponds to a different danger level score. For example, the danger level score corresponding to the extremely high danger level is s1, the danger level score corresponding to the high danger level is s2, the danger level score corresponding to the medium danger level is s3, the danger level score corresponding to the low danger level is s4, and the danger level score corresponding to the information level is s5.

[0098] The threat log data is usually generated when the network asset to be evaluated is threatened, and records basic information of the threat, including IP address and port number of the threat source, type of the threat, and impact range of the threat, so that the danger level of the threat can be determined according to the basic information of the threat, and the corresponding danger level score is obtained, and the threat log data carries the danger level score. Therefore, in step S31, the threat log data of the network asset to be evaluated in the last statistical period can be obtained, and each threat log data includes a corresponding danger level score. The statistical period can be 1 day, 1 week, 10 days, 15 days, 30 days, or other time, and the specific length of the statistical period is not limited here.

[0099] In addition, considering that the threat occurrence probability score of the network asset to be evaluated may change over time, in order to accurately determine the recent threat occurrence probability score of the network asset to be evaluated, in step S31, the threat log data of the network asset to be evaluated in the last statistical period is obtained, such as the threat log data of the network asset to be evaluated in the last 1 week, so that the timeliness of the threat log data is stronger, and the threat occurrence probability score of the network asset to be evaluated can be more accurately determined.

[0100] Step S32: Determine the total danger score of the network asset to be evaluated in the last statistical period according to the danger level scores of the threat log data.

[0101] After obtaining the threat log data of the network asset to be evaluated in the last statistical period in step S31, since each threat log data includes a corresponding danger level score, the total danger score of the network asset to be evaluated in the last statistical period can be determined according to the danger level scores of the threat log data, such as summing or weighted summing the danger level scores corresponding to each threat log data, so that the summing or weighted summing result is taken as the total danger score of the network asset to be evaluated in the last statistical period.

[0102] Step S33: Query the threat occurrence probability assignment table using the total danger score to determine the threat occurrence probability score of the network asset to be evaluated.

[0103] After determining the total danger score of the network asset to be evaluated in the last statistical period in step S32, in step S33, the total danger score can be used to query the threat occurrence probability assignment table, so as to determine the threat occurrence probability score of the network asset to be evaluated.

[0104] As shown in Table 1 is a threat occurrence possibility assignment table in practical application, the threat occurrence possibility assignment table includes a danger score range field and a possibility assignment field.

[0105] Table 1

[0106] Risk score range Likelihood assignment S ∈ [X1, +∞) P1 S ∈ [X2, X1) P2 S ∈ [X3, X2) P3 S ∈ [X4, X3) P4 S ∈ (-∞, X4) P5

[0107] According to the threat occurrence possibility assignment table shown in Table 1, when the total danger score S ∈ [X1, +∞), the corresponding threat occurrence possibility score is P1, when the total danger score S ∈ [X2, X1), the corresponding threat occurrence possibility score is P2, when the total danger score S ∈ [X3, X2), the corresponding threat occurrence possibility score is P3, when the total danger score S ∈ [X4, X3), the corresponding threat occurrence possibility score is P4, and when the total danger score S ∈ (-∞, X4), the corresponding threat occurrence possibility score is P5.

[0108] Therefore, in step S33, the threat occurrence possibility assignment table shown in Table 1 can be queried by using the total danger score determined in step S32, so as to obtain the threat occurrence possibility score of the network asset to be evaluated.

[0109] Of course, in practical application, the threat occurrence possibility assignment table can also be as shown in Table 2, in which compared with Table 1, a possibility level field is added, and the other fields are the same as Table 1. The enumerated values of the possibility level can include five levels of very high, high, medium, low, and very low, which respectively reflect the possibility of threat occurrence as very high, high, medium, low, and very low.

[0110] Table 2

[0111] Risk score range Likelihood rating Likelihood assignment S ∈ [X1, +∞) Very high P1 S ∈ [X2, X1) High P2 S ∈ [X3, X2) Medium P3 S ∈ [X4, X3) Low P4 S ∈ (-∞, X4) Very low P5

[0112] It needs to be further explained that for the threat occurrence possibility assignment table mentioned in step S33, in practical application, it can be pre-generated in the following way: first, obtain threat log data of multiple network assets in the last n statistical periods, where n is a positive integer greater than or equal to 2; for example, first, obtain threat log data of multiple network assets in the last 3 statistical periods, and each threat log data also includes a corresponding danger level score.

[0113] Then, the obtained threat log data is divided into multiple groups according to the same network asset in the same statistical cycle, for example, the threat log data of m network assets in the last 3 statistical cycles is obtained, at this time, the threat log data is divided into 3m groups, and the threat log data in the same group belongs to the threat log data of the same network asset in the same statistical cycle, and the threat log data in different groups belongs to different network assets or does not belong to the same statistical cycle.

[0114] After the multiple groups are divided, for each group, the total danger score of the group is determined according to the danger level score of each threat log data in the group, for example, for the group, the danger level scores of each threat log data in the group are summed or weighted summed, and the calculation result of the summation or weighted summation is taken as the total danger score of the group.

[0115] Then, multiple statistical parameters corresponding to the total danger score of each group are calculated, which can include mathematical expectation μ and standard deviation σ, etc.; and then a threat occurrence probability assignment table is generated according to the multiple statistical parameters.

[0116] For example, in the case where the multiple statistical parameters can include mathematical expectation and standard deviation, the threat occurrence probability assignment table can be generated in combination with statistical rules, that is, X1 in the above table 1 or table 2 is set to μ+2σ, X2 is set to μ+σ, X3 is set to μ-σ, and X4 is set to μ-2σ, thereby obtaining the generated threat occurrence probability assignment table.

[0117] In the above step S21, the method shown in FIG. 8 can be combined to determine the asset importance score of the network asset to be evaluated. Figure 4 The method shown in FIG. 8 can be combined to determine the asset importance score of the network asset to be evaluated, which includes the following steps:

[0118] Step S41: determining the confidentiality score, integrity score and availability score of the network asset to be evaluated.

[0119] Step S42: weighted summing the confidentiality score, the integrity score and the availability score to obtain the asset importance score of the network asset to be evaluated.

[0120] Here, the above steps S41 and S42 can be uniformly described.

[0121] From the perspective of confidentiality, the more important the key data stored in the network asset to be evaluated is, the greater the damage caused by the leakage of the key data is, and the higher the confidentiality score is. Therefore, the confidentiality score can be determined according to the damage caused by the leakage of the key data stored in the network asset to be evaluated. For example, the degree of damage can be inquired from the confidentiality assignment table shown in Table 3, so as to determine the confidentiality score.

[0122] Table 3

[0123]

[0124] For example, for the key data stored in the network asset to be evaluated, if the key data contains the most important secrets of the organization, the future development prospects, and has a decisive influence on the fundamental interests of the organization, and the leakage of the key data will cause disastrous damage, then after inquiring from the confidentiality assignment table shown in Table 3, the confidentiality score is 10. If the key data contains general secrets of the organization, and the leakage of the key data will cause damage to the security and interests of the organization, then after inquiring from the confidentiality assignment table shown in Table 3, the confidentiality score is 6.

[0125] From the perspective of the influence of the absence of the network asset to be evaluated on the entire organization, the integrity score can be determined according to the degree of influence on business processing caused by the absence of the network asset to be evaluated. For example, the degree of influence can be inquired from the integrity assignment table shown in Table 4, so as to determine the integrity score.

[0126] For example, for the network asset to be evaluated, if the integrity value of the network asset to be evaluated is very important, and unauthorized modification or damage (which will lead to absence) will cause major or unacceptable influence on the organization, major impact on business, and possibly cause serious business interruption, which is difficult to make up, then after inquiring from the integrity assignment table shown in Table 4, the determined integrity score is 10.

[0127] Table 4

[0128]

[0129] From the availability of the network asset to be evaluated, the availability of the network asset to be evaluated can be generally reflected by the availability and interruption time. Therefore, the availability score of the network asset to be evaluated can be determined according to the availability and interruption time of the network asset to be evaluated, for example, the availability and interruption time of the network asset to be evaluated are inquired from the availability assignment table shown in Table 5, so as to determine the availability score of the network asset to be evaluated. Figure 5

[0130] Table 5

[0131] ​

[0132] For example, if the availability of the network asset to be evaluated reaches 99.9% per year or more, and the system does not have an interruption, the availability score can be 10. The availability is one of the indicators for measuring the performance of the system, and is usually expressed as the probability of the system being in a normal state at any time t. Therefore, the availability can be determined by statistical historical data or analysis of the current running parameters of the network asset to be evaluated.

[0133] For the above step S42, after determining the confidentiality score, integrity score and availability score of the network asset to be evaluated through step S41, weighted summation can be performed to obtain the asset importance score of the network asset to be evaluated. For example, the asset importance score is calculated using Formula Two.

[0134] Im=Cω c +Iω I +Aω A , Formula Two

[0135] In Formula Two, Im is the calculated asset importance score; C is the confidentiality score of the network asset to be evaluated; I is the integrity score of the network asset to be evaluated; A is the availability score of the network asset to be evaluated; ω C , ω I , ω A are the weights corresponding to confidentiality, integrity and availability, respectively, and ω C > 0, ω I > 0, ω A > 0 and ω c + ω I + ω A = 1.

[0136] In the above step S21, the asset vulnerability score of the network asset to be evaluated can be determined in combination with the method shown in FIG. 5, which includes the following steps: Figure 5

[0137] Step S51: Determine the vulnerability score and the configuration baseline vulnerability score of the network asset to be evaluated.

[0138] Step S52: Determine the asset vulnerability score of the network asset to be evaluated according to the vulnerability score and the configuration baseline vulnerability score.

[0139] ​The vulnerabilities may exist in the network asset to be evaluated, and thus the vulnerability vulnerability score reflects the vulnerability of the network asset to be evaluated caused by the vulnerabilities, for example, the greater the vulnerability vulnerability score, the higher the vulnerability of the network asset to be evaluated caused by the vulnerabilities, and vice versa, the smaller the vulnerability vulnerability score, the lower the vulnerability of the network asset to be evaluated caused by the vulnerabilities.

[0140] In actual application, the vulnerability vulnerability score of the network asset to be evaluated can be determined in the following manner: first, determine the vulnerabilities existing in the network asset to be evaluated, for example, the network asset to be evaluated can be scanned for vulnerabilities by a vulnerability scanning tool, so as to determine the vulnerabilities existing in the network asset to be evaluated.

[0141] Then, according to the preset vulnerability scoring standard, determine the vulnerability danger score and the vulnerability danger level corresponding to each vulnerability, for example, the preset vulnerability scoring standard can be the vulnerability scoring standard of the National Vulnerability Database (CNNVD), according to which the vulnerability danger score and the vulnerability danger level corresponding to the vulnerability can be calculated from the dimensions of vulnerability availability, complexity, and impact, wherein according to the CNNVD vulnerability scoring standard, the vulnerability danger score ranges from 0 to 10, and the vulnerability danger level is low, medium, high, and extremely high.

[0142] After determining the vulnerability danger score and the vulnerability danger level corresponding to each vulnerability, the vulnerability vulnerability score can be calculated according to the vulnerability danger score of the vulnerability in the vulnerability danger level for each vulnerability danger level; then, further according to the vulnerability vulnerability score of each vulnerability danger level, the vulnerability vulnerability score is determined.

[0143] For example, according to the CNNVD vulnerability scoring standard mentioned above, the vulnerability danger level specifically includes low, medium, high, and extremely high, and thus the vulnerability vulnerability score of each vulnerability danger level is calculated by the following formula.

[0144]

[0145]

[0146]

[0147]

[0148] In the formula three to formula six, V'1 is the vulnerability coefficient of the vulnerability danger level as low; V'2 is the vulnerability coefficient of the vulnerability danger level as medium; V'3 is the vulnerability coefficient of the vulnerability danger level as high; V'4 is the vulnerability coefficient of the vulnerability danger level as extremely high; a i is the vulnerability danger score of the vulnerability i in the corresponding vulnerability danger level; i is the number of the vulnerability; ω' i is the vulnerability weight value of the vulnerability i in the corresponding vulnerability danger level.

[0149] And for the vulnerability weight value ω' i of the vulnerability i, the vulnerability weight value ω' i of the vulnerability i can be determined according to the port information of the port associated with the vulnerability i, and the port information reflects whether the port is an open port. For example, if the port information reflects that the port is an open port, the vulnerability weight value ω' i of the vulnerability i is relatively high, such as 1, and if the port information reflects that the port is not an open port, the vulnerability weight value ω' i of the vulnerability i is relatively low, such as 0. i i i

[0150] On the basis that the vulnerability danger level specifically includes low, medium, high and extremely high, it is further provided herein that the vulnerability danger score of the vulnerability with the vulnerability danger level as low belongs to [0, L1), the vulnerability danger score of the vulnerability with the vulnerability danger level as medium belongs to [L1, L2), the vulnerability danger score of the vulnerability with the vulnerability danger level as high belongs to [L2, L3), and the vulnerability danger score of the vulnerability with the vulnerability danger level as extremely high belongs to [L3, L4], wherein, since the value range of the vulnerability danger score is 0-10, the L4=10; in this way, when the vulnerability danger level is low, the upper limit value of the vulnerability danger score of the vulnerability danger level is L1, when the vulnerability danger level is medium, the upper limit value of the vulnerability danger score of the vulnerability danger level is L2, when the vulnerability danger level is high, the upper limit value of the vulnerability danger score of the vulnerability danger level is L3, and when the vulnerability danger level is extremely high, the upper limit value of the vulnerability danger score of the vulnerability danger level is 10.

[0151] ​​​Therefore, after V'1, V'2, V'3 and V'4 are calculated by the above-mentioned formula three to formula six, the vulnerability vulnerability score can be further determined according to V'1, V'2, V'3 and V'4. For example, the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated can be determined first, and then the vulnerability coefficient of the highest vulnerability risk level is multiplied by the upper limit value of the vulnerability risk score of the highest vulnerability risk level to obtain the vulnerability vulnerability score. For example, if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is low, V'1 is the vulnerability coefficient of the vulnerability risk level of low, and therefore V'1*L1 can be obtained to obtain the vulnerability vulnerability score; if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is medium, V'2 is the vulnerability coefficient of the vulnerability risk level of medium, and therefore V'2*L2 can be obtained to obtain the vulnerability vulnerability score; if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is high, V'3 is the vulnerability coefficient of the vulnerability risk level of high, and therefore V'3*L3 can be obtained to obtain the vulnerability vulnerability score; if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is extremely high, V'4 is the vulnerability coefficient of the vulnerability risk level of high, and therefore V'4*L4 can be obtained to obtain the vulnerability vulnerability score.

[0152] In actual application, in order to make the obtained vulnerability vulnerability score more accurate, the vulnerability risk score can also be normalized, for example, for each vulnerability, the vulnerability risk score of the vulnerability can be normalized according to the vulnerability risk level to which the vulnerability belongs and the upper limit value of the vulnerability risk score of the vulnerability risk level, so as to obtain the normalized vulnerability risk score of the vulnerability.

[0153] For example, for the vulnerability with the vulnerability risk level of low, For the vulnerability with the vulnerability risk level of medium, For the vulnerability with the vulnerability risk level of high, For the vulnerability with the vulnerability risk level of extremely high, Wherein, a is the vulnerability risk score of the vulnerability, is the normalized vulnerability risk score of the vulnerability, L1, L2, L3 and L4 are upper limit values of the vulnerability risk score corresponding to low, medium, high and extremely high vulnerability risk levels respectively.

[0154] Thus, for each vulnerability risk level, the vulnerability coefficient of the vulnerability risk level is calculated according to the vulnerability risk score of the vulnerability in the vulnerability risk level. Specifically, for each vulnerability risk level, the vulnerability coefficient of the vulnerability risk level is calculated according to the normalized vulnerability risk score of the vulnerability in the vulnerability risk level. The vulnerability risk levels are low, medium, high, and extremely high. For each vulnerability risk level, the vulnerability coefficient of the vulnerability risk level can be calculated by the following formula.

[0155]

[0156]

[0157]

[0158]

[0159] In the modified formula seven to formula ten, V1 is the vulnerability coefficient of the vulnerability risk level of low; V2 is the vulnerability coefficient of the vulnerability risk level of medium; V3 is the vulnerability coefficient of the vulnerability risk level of high; V4 is the vulnerability coefficient of the vulnerability risk level of extremely high; is the normalized vulnerability risk score of the vulnerability i in the corresponding vulnerability risk level; i is the number of the vulnerability; ω i is the vulnerability weight value of the vulnerability i in the corresponding vulnerability risk level. The calculation method of the vulnerability weight value ω i of the vulnerability i can be the same as the above ω′ i , which will not be described here.

[0160] After V1, V2, V3 and V4 are calculated by the above-mentioned Formula Seven-Formula Ten, the vulnerability vulnerability score can also be determined according to V1, V2, V3 and V4. For example, the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated can be determined first, and then the vulnerability coefficient of the highest vulnerability risk level is multiplied by the upper limit value of the vulnerability risk score of the highest vulnerability risk level to obtain the vulnerability vulnerability score. For example, if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is low, V1 is the vulnerability coefficient of the vulnerability risk level of low, and therefore V1*L1 can be obtained to obtain the vulnerability vulnerability score; if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is medium, V2 is the vulnerability coefficient of the vulnerability risk level of medium, and therefore V2*L2 can be obtained to obtain the vulnerability vulnerability score; if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is high, V3 is the vulnerability coefficient of the vulnerability risk level of high, and therefore V3*L3 can be obtained to obtain the vulnerability vulnerability score; if the highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated is extremely high, V4 is the vulnerability coefficient of the vulnerability risk level of high, and therefore V4*L4 can be obtained to obtain the vulnerability vulnerability score.

[0161] In actual application, the configuration baseline vulnerability score of the network asset to be evaluated can be determined by the following method: first, the baseline scanning tool is used to perform baseline scanning on the network asset to be evaluated to determine the compliance type and risk level type of each baseline detection item in the network asset to be evaluated, wherein the compliance type can specifically include compliance, non-compliance and scanning failure, and each compliance type corresponds to a corresponding compliance weight and a compliance coding value; the risk level type can specifically include general, low-risk, medium-risk and high-risk, and each risk level type corresponds to a corresponding risk level weight and a risk level coding value.

[0162] For example, the compliance weight corresponding to compliance can be ωf1, and the corresponding compliance encoding value can be one-hot encoding value (1, 0, 0); the compliance weight corresponding to non-compliance can be ωf2, and the corresponding compliance encoding value can be one-hot encoding value (0, 1, 0); the compliance weight corresponding to scanning failure can be ωf3, and the corresponding compliance encoding value can be one-hot encoding value (0, 0, 1). The risk level weight corresponding to the risk level type of general can be ωs1, and the corresponding risk level encoding value can be one-hot encoding value (1, 0, 0, 0); the risk level weight corresponding to the risk level type of low risk can be ωs2, and the corresponding risk level encoding value can be one-hot encoding value (0, 1, 0, 0); the risk level weight corresponding to the risk level type of medium risk can be ωs3, and the corresponding risk level encoding value can be one-hot encoding value (0, 0, 1, 0); the risk level weight corresponding to the risk level type of high risk can be ωs4, and the corresponding risk level encoding value can be one-hot encoding value (0, 0, 0, 1).

[0163] Then, according to the compliance weight and the compliance encoding value corresponding to the compliance type of each baseline detection item, and the risk level weight and the risk level encoding value corresponding to the risk level type of each baseline detection item, the configuration baseline vulnerability score is determined. Specifically, the configuration baseline vulnerability score can be calculated by using the following formula ten

[0164] The risk level weight corresponding to the risk level type of each baseline detection item, and the risk level encoding value corresponding to the risk level type of each baseline detection item, the configuration baseline vulnerability score is determined. Specifically, the configuration baseline vulnerability score can be calculated by using the following formula ten

[0165] The configuration baseline vulnerability score is calculated as follows:

[0166]

[0167] In the formula eleven, BL is the calculated configuration baseline vulnerability score; F n×3 is a matrix generated according to the compliance encoding value corresponding to the compliance type of each baseline detection item;

[0168] is the transpose matrix of the matrix generated according to the compliance weight corresponding to the compliance type of each baseline detection item; S n×4 is a matrix generated according to the risk level encoding value corresponding to the risk level type of each baseline detection item; is the transpose matrix of the matrix generated according to the risk level weight corresponding to the risk level type of each baseline detection item; I 1×n is a 1*n matrix with all values being 1; c is a preset constant, such as c can usually be 10. Wherein,

[0169] In the step of calculating the vulnerability vulnerability score and the configuration baseline vulnerability score, in the step S52, the asset vulnerability score of the network asset to be evaluated can be determined according to the vulnerability vulnerability score and the configuration baseline vulnerability score, such as the average value or the weighted average value of the vulnerability vulnerability score and the configuration baseline vulnerability score can be calculated first, and the calculation result is determined as the asset vulnerability score of the network asset to be evaluated. For example, the asset vulnerability score of the network asset to be evaluated can be calculated by formula twelve.

[0170] Iv = μ1 x V + μ2 x BL Formula twelve

[0171] In the formula twelve, BL is the configuration baseline vulnerability score; V is the vulnerability vulnerability score μ1 and μ2 are the corresponding weights.

[0172] Based on the same inventive concept as the network asset risk assessment method provided by the embodiments of the present application, the embodiments of the present application also provide a network asset risk assessment device. For the device embodiments, if there is any unclear place, the corresponding content of the method embodiments can be referred to. For example Figure 6 As shown in FIG. 6, which is a specific structure diagram of the device 60, the device 60 includes a score determination unit 601 and an asset risk value determination unit 602, wherein:

[0173] The score determination unit 601 is configured to determine an asset vulnerability score, an asset importance score and a threat occurrence possibility score of a network asset to be evaluated, wherein the asset vulnerability score is used to represent the asset vulnerability of the network asset to be evaluated; the asset importance score is used to represent the asset importance of the network asset to be evaluated; and the threat occurrence possibility score is used to represent the possibility of threat occurrence against the network asset to be evaluated.

[0174] The asset risk value determination unit 602 is configured to determine an asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, so as to evaluate the risk of the network asset to be evaluated.

[0175] The device 60 provided by the embodiments of the present application adopts the same inventive concept as the network asset risk assessment method provided by the embodiments of the present application. On the premise that the method can solve the technical problems, the device 60 can also solve the technical problems. Here, this will not be repeated.

[0176] In addition, in actual application, the technical effects achieved by combining the device 60 with specific hardware devices are also within the protection scope of the present application, such as, in a distributed cluster manner, different units in the device 60 are arranged in different nodes in the distributed cluster, so as to further improve the processing efficiency, etc.; or, in combination with cloud technology to reduce the cost, etc.

[0177] The embodiment of the present application further provides a computer readable storage medium, the storage medium stores a computer program, the computer program can be executed by a processor to complete all or part of the processes of the method in the above embodiment. Wherein, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above types of memories.

[0178] Although the embodiments of the present application are described in conjunction with the drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes are also within the scope defined by the appended claims.

Claims

1. A method of risk assessment of network assets, characterized in that, The method comprises the following steps: determining an asset vulnerability score, an asset importance score and a threat occurrence possibility score of a network asset to be evaluated, wherein the asset vulnerability score is used to represent the asset vulnerability of the network asset to be evaluated; the asset importance score is used to represent the asset importance of the network asset to be evaluated; and the threat occurrence possibility score is used to represent the possibility of threat occurrence against the network asset to be evaluated; determining an asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, so as to evaluate the risk of the network asset to be evaluated; wherein the asset vulnerability score is determined in the following manner: determining a vulnerability vulnerability score and a configuration baseline vulnerability score of the network asset to be evaluated; determining the asset vulnerability score of the network asset to be evaluated according to the vulnerability vulnerability score and the configuration baseline vulnerability score; wherein the vulnerability vulnerability score is determined in the following manner: determining the vulnerabilities existing in the network asset to be evaluated; determining a vulnerability danger score and a vulnerability danger level corresponding to each vulnerability according to a preset vulnerability scoring standard; for each vulnerability danger level, calculating a vulnerability coefficient of the vulnerability danger level according to the vulnerability danger scores of the vulnerabilities in the vulnerability danger level; determining the vulnerability vulnerability score according to the vulnerability coefficients of each vulnerability danger level; The vulnerability danger level specifically includes low, medium, high and extremely high, wherein the vulnerability danger score of the vulnerability with the low vulnerability danger level belongs to [0, L1), the vulnerability danger score of the vulnerability with the medium vulnerability danger level belongs to [L1, L2), the vulnerability danger score of the vulnerability with the high vulnerability danger level belongs to [L2, L3), and the vulnerability danger score of the vulnerability with the extremely high vulnerability danger level belongs to [L3, L4 The method further comprises: for each vulnerability, normalizing the vulnerability danger score of the vulnerability according to the vulnerability danger level to which the vulnerability belongs and the upper limit value of the vulnerability danger score in the vulnerability danger level; and for each vulnerability danger level, calculating a vulnerability coefficient of the vulnerability danger level according to the vulnerability danger scores of the vulnerabilities in the vulnerability danger level, specifically comprising: for each vulnerability danger level, calculating a vulnerability coefficient of the vulnerability danger level according to the normalized vulnerability danger scores of the vulnerabilities in the vulnerability danger level; determining the vulnerability vulnerability score according to the vulnerability coefficients of each vulnerability danger level, specifically comprising: determining the highest vulnerability danger level of the vulnerabilities existing in the network asset to be evaluated; multiplying the vulnerability coefficient of the highest vulnerability danger level by the upper limit value of the vulnerability danger score in the highest vulnerability danger level to obtain the vulnerability vulnerability score.

2. The method of claim 1, wherein, determining the asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, specifically comprising: calculating the asset risk value by the following formula: wherein, is the calculated asset risk value; is the asset vulnerability score; is the asset importance score; is the threat likelihood score; and a and b are preset constants, with a being positive.

3. The method of claim 1, wherein, the threat occurrence possibility score is determined in the following manner: obtaining threat log data of the network asset to be evaluated in a recent statistical period, wherein each threat log data comprises a corresponding danger level score, and the danger level score is used to represent the danger level of the threat involved in the corresponding threat log data; determining a total danger score of the network asset to be evaluated in a recent statistical period according to the danger level scores of each threat log data; The total risk score is used to query a threat occurrence probability assignment table to determine a threat occurrence probability score.

4. The method of claim 3, wherein, The method further comprises pre-generating the threat occurrence probability assignment table by: obtaining threat log data of a plurality of network assets in the last n statistical periods, wherein n is a positive integer greater than or equal to 2; dividing the obtained threat log data into a plurality of groups according to a manner of grouping threat log data of the same network asset in the same statistical period; for each group, determining a total risk score of the group according to risk level scores of the threat log data in the group; calculating a plurality of statistical parameters of the total risk scores corresponding to the respective groups; generating the threat occurrence probability assignment table according to the plurality of statistical parameters.

5. The method of claim 1, wherein, The asset importance score is determined by: determining a confidentiality score, an integrity score and an availability score of the network asset to be evaluated; weighting and summing the confidentiality score, the integrity score and the availability score to obtain the asset importance score.

6. The method of claim 5, wherein, The determination of the confidentiality score, the integrity score and the availability score of the network asset to be evaluated specifically comprises: determining the confidentiality score according to the degree of damage caused by leakage of key data stored in the network asset to be evaluated; determining the integrity score according to the degree of impact on business processing caused by the absence of the network asset to be evaluated; and determining the availability score according to the availability and interruption duration of the network asset to be evaluated.

7. The method of claim 1, wherein, For each vulnerability risk level, a vulnerability coefficient of the vulnerability risk level is calculated according to a normalized vulnerability risk score of the vulnerability in the vulnerability risk level, specifically comprising: wherein, is the vulnerability coefficient for a vulnerability danger level of low; is the vulnerability coefficient for a vulnerability danger level of medium; is the vulnerability coefficient for a vulnerability danger level of high; is the vulnerability coefficient for a vulnerability danger level of very high; is the normalized vulnerability danger score of vulnerability i in the corresponding vulnerability danger level; i is the number of the vulnerability; is the vulnerability weight value of vulnerability i in the corresponding vulnerability danger level.

8. The method of claim 7, wherein, The method further comprises: determining a vulnerability weight value of vulnerability i according to port information of a port associated with vulnerability i, wherein the port information reflects whether the port is an open port.

9. The method of claim 1, wherein, The configuration baseline vulnerability score is determined by: performing baseline scanning on the network asset to be evaluated by a baseline scanning tool to determine compliance types and risk level types of each baseline detection item in the network asset to be evaluated, wherein the compliance types specifically include compliance, non-compliance and scanning failure, and each compliance type corresponds to a corresponding compliance weight and a compliance coding value; the risk level types specifically include general, low-risk, medium-risk and high-risk, and each risk level type corresponds to a corresponding risk level weight and a risk level coding value; determining the configuration baseline vulnerability score according to the compliance weight and the compliance coding value corresponding to the compliance type of each baseline detection item, and the risk level weight and the risk level coding value corresponding to the risk level type of each baseline detection item.

10. The method of claim 9, wherein, According to the compliance weight and the compliance coding value corresponding to each baseline detection item compliance type, and the risk weight and the risk coding value corresponding to each baseline detection item risk level, the configuration baseline vulnerability score is determined, specifically comprising: the configuration baseline vulnerability score is calculated by using the following formula: BL is a calculated configuration baseline vulnerability score; is a generated matrix according to compliance coding values corresponding to compliance types of each baseline detection item; is a transpose matrix of the generated matrix according to compliance weights corresponding to compliance types of each baseline detection item; is a generated matrix according to risk level coding values corresponding to risk level types of each baseline detection item; is a transpose matrix of the generated matrix according to risk level weights corresponding to risk level types of each baseline detection item; is a 1*n dimensional matrix with all values being 1; c is a preset constant.

11. The method of claim 1, wherein, According to the vulnerability vulnerability score and the configuration baseline vulnerability score, the asset vulnerability score of the network asset to be evaluated is determined, specifically comprising: The average value or weighted average value of the vulnerability vulnerability score and the configuration baseline vulnerability score is calculated, and the calculation result is determined as the asset vulnerability score of the network asset to be evaluated.

12. The method of claim 1, wherein, A plurality of different asset risk levels are preset, wherein each different asset risk level corresponds to a different asset risk value interval; and the method further comprises: Determining the target asset risk value interval to which the asset risk value of the network asset to be evaluated belongs; According to the target asset risk value interval, the target asset risk level to which the network asset to be evaluated belongs is determined.

13. A network asset risk assessment apparatus, comprising: Comprise: The score determination unit is configured to determine the asset vulnerability score, the asset importance score and the threat occurrence possibility score of the network asset to be evaluated, wherein the asset vulnerability score is used to represent the asset vulnerability of the network asset to be evaluated; the asset importance score is used to represent the asset importance of the network asset to be evaluated; and the threat occurrence possibility score is used to represent the possibility of threat occurrence against the network asset to be evaluated. The asset risk value determination unit is configured to determine the asset risk value of the network asset to be evaluated according to the asset vulnerability score, the asset importance score and the threat occurrence possibility score, so as to evaluate the risk of the network asset to be evaluated. The asset vulnerability score is determined by the following method: The vulnerability vulnerability score and the configuration baseline vulnerability score of the network asset to be evaluated are determined. According to the vulnerability vulnerability score and the configuration baseline vulnerability score, the asset vulnerability score of the network asset to be evaluated is determined. The vulnerability vulnerability score is determined by the following method: The vulnerabilities existing in the network asset to be evaluated are determined. According to the preset vulnerability scoring standard, the vulnerability risk score and the vulnerability risk level corresponding to each vulnerability are determined. For each vulnerability risk level, the vulnerability coefficient of the vulnerability risk level is calculated according to the vulnerability risk score of the vulnerability in the vulnerability risk level. According to the vulnerability coefficient of each vulnerability risk level, the vulnerability vulnerability score is determined. The vulnerability risk level specifically comprises low, medium, high and extremely high, wherein the vulnerability risk score of the vulnerability with the vulnerability risk level of low belongs to [0, L1), the vulnerability risk score of the vulnerability with the vulnerability risk level of medium belongs to [L1, L2), the vulnerability risk score of the vulnerability with the vulnerability risk level of high belongs to [L2, L3), and the vulnerability risk score of the vulnerability with the vulnerability risk level of extremely high belongs to [L3, L4]; wherein the vulnerability coefficient and the vulnerability vulnerability score are determined by the following method: normalizing, for each vulnerability, a vulnerability risk score of the vulnerability according to a vulnerability risk level to which the vulnerability belongs and an upper limit value of vulnerability risk scores in the vulnerability risk level; and calculating, for each vulnerability risk level, a vulnerability coefficient of the vulnerability risk level according to the normalized vulnerability risk scores of vulnerabilities in the vulnerability risk level; determining a highest vulnerability risk level of the vulnerabilities existing in the network asset to be evaluated; multiplying the vulnerability coefficient of the highest vulnerability risk level by the upper limit value of vulnerability risk scores in the highest vulnerability risk level to obtain the vulnerability risk score.

14. An electronic device, comprising: comprise: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method of any one of claims 1-12.

15. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which can be executed by the processor to complete the method of any one of claims 1-12.

Images