An asset vulnerability assessment method, device and equipment, medium and product

Abstract

The application provides an asset vulnerability assessment method, device and equipment, medium and product, aiming to improve the authenticity of asset vulnerability assessment. The method comprises the following steps: extracting a plurality of vulnerability factors from asset information of a target asset, and determining risk values of the plurality of vulnerability factors; determining a first initial risk value according to the risk values and distribution rates of the plurality of vulnerability factors; determining a second initial risk value according to historical security event information associated with the target asset and the risk values of the plurality of vulnerability factors; determining a third initial risk value according to a first target model and the risk values of the plurality of vulnerability factors, the first target model being obtained by training historical asset information of the target asset; determining a first target asset risk value of the target asset according to the first initial risk value, the second initial risk value and the third initial risk value; and evaluating the vulnerability of the target asset according to the first target asset risk value.

Description

Technical Field

[0001] This application relates to the field of cybersecurity application technology, and in particular to an asset vulnerability assessment method, apparatus and equipment, medium and product. Background Technology

[0002] Asset vulnerability assessment is a fundamental security identification method in asset security management. However, existing asset vulnerability assessment methods, which are based on single dimensions and rules, cannot accurately and effectively assess asset vulnerabilities and are difficult to form asset profiles to support decision-making in actual offensive and defensive situations. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide an asset vulnerability assessment method, apparatus and equipment, medium and product to overcome or at least partially solve the above problems.

[0004] A first aspect of this application provides an asset vulnerability assessment method, the method comprising:

[0005] Multiple vulnerability factors are extracted from the asset information of the target asset, and the risk values ​​of the multiple vulnerability factors are determined;

[0006] Based on the risk values ​​and distribution rates of the multiple vulnerability factors, a first initial risk value is determined;

[0007] A second initial risk value is determined based on the historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors;

[0008] Based on the risk values ​​of the first target model and the multiple vulnerability factors, a third initial risk value is determined. The first target model is trained based on the historical asset information of the target asset.

[0009] Based on the first initial risk value, the second initial risk value, and the third initial risk value, a first target asset risk value is determined for the target asset.

[0010] The vulnerability of the target asset is assessed based on the risk value of the first target asset.

[0011] Optionally, determining the first initial risk value based on the risk values ​​and distribution rates of the plurality of vulnerability factors includes:

[0012] Based on the risk values ​​and distribution rates of the multiple vulnerability factors, the impact parameters corresponding to each of the multiple vulnerability factors are determined. The impact parameters are used to describe the degree of impact of security events that occur after the vulnerability factors are exploited on the target assets.

[0013] Determine the first variance value of the influence parameters of the plurality of vulnerability factors, and the second variance value of the distribution rate of the plurality of vulnerability factors;

[0014] The sum of the first variance value and the second variance value is determined as the first initial risk value.

[0015] Optionally, determining the second initial risk value based on the historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors includes:

[0016] Based on the historical security event information associated with the target asset, determine the degree and scope of impact of multiple historical security events associated with the target asset on their respective compromised assets, and determine the protection level of the multiple compromised assets.

[0017] Based on the impact degree, impact scope and protection degree of the associated multiple historical security events, and the risk value of the multiple vulnerability factors, multiple loss impact values ​​of the target asset are determined. The loss impact values ​​are used to describe the impact on the target asset when the same security event as the multiple historical security events occurs after the vulnerability factors are exploited.

[0018] The second initial risk value is determined based on the asset operating status distribution parameters and the maximum value among the multiple loss impact values.

[0019] Optionally, before determining the third initial risk value based on the first target model and the risk values ​​of the plurality of vulnerability factors, the method further includes:

[0020] From the historical asset information of the target asset, the risk values ​​of multiple historical vulnerability factors are extracted, and the true risk values ​​corresponding to the multiple historical vulnerability factors are obtained. The true risk values ​​are used to describe the vulnerability of the historical target asset corresponding to the historical vulnerability factors.

[0021] The model is iteratively trained based on the multiple historical risk values ​​and the corresponding true risk values ​​to obtain the first target model;

[0022] The determination of the third initial risk value based on the risk values ​​of the first target model and the multiple vulnerability factors includes:

[0023] The risk values ​​of the multiple vulnerability factors are input into the first target model to obtain the third initial risk value.

[0024] Optionally, determining the first target asset risk value of the target asset based on the first initial risk value, the second initial risk value, and the third initial risk value includes:

[0025] The relevant distribution locations of security events that occur after vulnerability factors are exploited are estimated, and multiple latent factors are determined based on the relevant distribution locations;

[0026] According to the established mapping table, the multiple latent factors are mapped to multiple non-feature parameters;

[0027] By using the multiple non-characteristic parameters, the first initial risk value, the second initial risk value, and the third initial risk value are balanced and calibrated respectively to obtain multiple calibration values;

[0028] Obtain multiple first calibration values ​​from the plurality of calibration values ​​that differ within a set range, and determine the median value among the plurality of first calibration values ​​as the first target asset risk value.

[0029] Optionally, assessing the vulnerability of the target asset based on the first target asset risk value includes:

[0030] Based on the network scenario information of the target asset, the risk value of the first target asset is adjusted to obtain the risk value of the second target asset. The network scenario information includes at least one of network topology complexity, network connectivity, protocol restriction rate, and port open rate.

[0031] Based on the service scenario information of the target asset, the risk value of the second target asset is adjusted to obtain the risk value of the third target asset. The service scenario information includes at least one of the following: source code risk rate, service quality defect rate, and operation anomaly rate.

[0032] The vulnerability of the target asset is assessed based on the risk value of the third target asset.

[0033] A second aspect of this application provides an asset vulnerability assessment apparatus, the apparatus comprising:

[0034] The first processing module is used to extract multiple vulnerability factors from the asset information of the target asset and determine the risk value of the multiple vulnerability factors;

[0035] The second processing module is used to determine a first initial risk value based on the risk values ​​and distribution rates of the multiple vulnerability factors;

[0036] The third processing module is used to determine a second initial risk value based on the historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors;

[0037] The fourth processing module is used to determine a third initial risk value based on the first target model and the risk values ​​of the multiple vulnerability factors. The first target model is trained based on the historical asset information of the target asset.

[0038] The fifth processing module is used to determine the first target asset risk value of the target asset based on the first initial risk value, the second initial risk value, and the third initial risk value;

[0039] The vulnerability assessment module is used to assess the vulnerability of the target asset based on the risk value of the first target asset.

[0040] A third aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the asset vulnerability assessment method described in the first aspect.

[0041] A fourth aspect of this application provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the asset vulnerability assessment method as described in the first aspect.

[0042] A fifth aspect of this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the asset vulnerability assessment method described in the first aspect.

[0043] The embodiments of this application include the following advantages: based on multiple vulnerability dimensions, multiple vulnerability factors are extracted from the asset information of the target asset, and based on these multiple vulnerability factors, three types of algorithm models are used for collaborative calculation, thereby improving the accuracy of the obtained asset risk value and enabling the asset risk value to accurately reflect the vulnerability of the target asset. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating the implementation of an asset vulnerability assessment method according to an embodiment of this application.

[0046] Figure 2 This is a schematic diagram of the steps for determining the first initial risk value according to an embodiment of this application;

[0047] Figure 3 This is a schematic diagram illustrating the steps for determining the second initial risk value in an embodiment of this application;

[0048] Figure 4This is a schematic diagram of the training steps of the first target model in an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of the structure of an asset vulnerability assessment device according to an embodiment of this application;

[0050] Figure 6 This is a schematic diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0051] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0052] The rapid development of the digital economy has driven the digitalization of industries. 5G-based application scenarios and industrial ecosystems are rapidly emerging in various industries, and the scale of cloud and network assets is becoming increasingly large.

[0053] Asset vulnerability assessment is a fundamental security identification method in asset security management. However, existing single, rule-based asset vulnerability assessment methods for security protection and analysis equipment / software are insufficient to accurately and effectively assess asset vulnerabilities and fail to create asset profiles to support decision-making in actual attack and defense scenarios. Therefore, researching asset vulnerability assessment methods that meet the requirements of a unified architecture, logical integration, breaking down data silos, and achieving unified governance of security data is crucial.

[0054] In the game of offense and defense, the weak gaps and "unknown" weaknesses in the security environment are contained in this massive asset. This application adopts a multi-algorithm model collaboration with a unified evaluation method architecture and logic to comprehensively evaluate the vulnerability of assets, and realizes an asset security identification scheme with scenario-driven and data-driven as the core.

[0055] The asset vulnerability assessment method provided in this application will be described in detail below with reference to the accompanying drawings, through some embodiments and application scenarios.

[0056] Firstly, referring to Figure 1 The diagram shown is an implementation flowchart of an asset vulnerability assessment method provided in this application embodiment. The method may include the following steps:

[0057] Step S11: Extract multiple vulnerability factors from the asset information of the target asset and determine the risk value of the multiple vulnerability factors.

[0058] In practical implementation, asset information such as asset business information, asset vulnerability information, asset baseline violation information, and asset exposure surface information of the target asset can be analyzed and extracted to obtain the various asset vulnerabilities and asset baseline violations existing in the target asset. These individual asset vulnerabilities and asset baseline violations are the vulnerability factors that affect the vulnerability of the target asset. Subsequently, based on information such as the type and distribution location of each asset vulnerability and asset baseline violation, the degree of danger of each vulnerability factor can be assessed, and the degree of danger can be described by the risk value of the vulnerability factor. For example, the higher the risk value of a vulnerability factor, the greater the degree of danger of that vulnerability factor. This achieves standardized extraction of vulnerability influencing factors from multiple data sources and realizes unified governance of asset security-related data.

[0059] As one possible implementation method, asset information can be organized using a data warehouse (DW) and analyzed in the following ways to extract vulnerability factors and determine the risk value of the vulnerability factors.

[0060] Based on asset business information, identify the business operations of the target asset, such as whether it is an information service asset, data resource asset, or communication network asset. Then, based on the impact of attacks on information collection, transmission, storage, processing, exchange, and destruction services within the business operations, analyze the risk value of vulnerability factors. It is understandable that vulnerability factors associated with core business operations within the business operations should have a higher risk value (i.e., a higher degree of danger).

[0061] For asset vulnerability information, the asset IP address and asset category are correlated and matched with the extracted asset vulnerability information. By analyzing the vulnerability category and asset business attributes, the affected object is identified as belonging to the network structure, system software, middleware, or application system, in order to determine the vulnerability's distribution location and the hidden factors mentioned below. It is understandable that vulnerability factors distributed at lower layers (such as the network layer) have a wider impact range (affecting all upper layers) and should have a higher risk value (i.e., degree of danger).

[0062] For asset baseline information, the asset IP, asset port, and asset host ID are associated and matched with the baseline information to construct an asset baseline model to determine the compliance rate of the target asset. The system environment security configuration, system communication operation configuration, access control configuration, system maintenance configuration, and password protection configuration are extracted from two aspects: configuration quality defects and configuration security defects, so as to obtain the baseline violation type of the target asset.

[0063] For asset exposure surface information, the system correlates and matches asset IP, asset port, asset service protocol with the exposure surface information, and plots the network status of the target asset from dimensions such as asset network connectivity, asset access control list (ACL) policy, and asset routing policy. This is to analyze the degree of danger of vulnerability factors and the overall security (i.e. vulnerability) of the target asset. For example, the more complex the asset routing policy, the greater the degree of danger of the associated vulnerability factors and the lower the overall security of the target asset.

[0064] For example, after analyzing and organizing the asset information of the target asset in the above manner, the following content can be obtained:

[0065] External IP address of the asset: 106.61.163.247;

[0066] Asset intranet IP: 10.251.25.138;

[0067] Private IP address for the asset: 192.168.10.10;

[0068] There are three asset service ports: 8080, 8443, and 22.

[0069] There are three asset applications: Tomcat, Nginx, and SFTP.

[0070] There is one firewall policy for the asset host: iptables -I INPUT -p tcp -m multiport –dport 20,21,22,8443 -j ACCEPT;

[0071] There are a total of 3 asset vulnerabilities: CNVD-2022-54473 (Severity: High), CNVD-2022-66585 (Severity: High), and CNVD-2022-74082 (Severity: High).

[0072] There is one asset baseline violation: OS-LINUX-license violation.

[0073] Furthermore, the network connections of the aforementioned asset information can be organized by drawing an asset network topology diagram and deduplicating the data. This reveals that the target asset has 112 internal network connections, 25 private network connections, and 4 vulnerability factors (i.e., the aforementioned 3 asset vulnerabilities and 1 baseline violation). Combining the type and distribution of these vulnerability factors, their risk level is determined. Based on the pre-established mapping relationship between the risk level and risk value of each vulnerability factor, the risk values ​​of the 4 vulnerability factors can be obtained, such as the risk value W = [4.5, 2, 3, 1.6].

[0074] In the above embodiments, data is extracted from multiple vulnerability dimensions such as vulnerabilities, baselines, and exposure surfaces. This not only verifies and assesses the severity of asset vulnerabilities, but also conducts in-depth compliance testing in conjunction with baseline conditions, performs correlation analysis on non-compliant configurations, and finally converges based on exposure surface vulnerability (i.e., the network conditions of the target asset itself). The risk values ​​of multiple vulnerability factors are comprehensively analyzed to enable the subsequent reconstruction of the target asset's vulnerability from the attacker's perspective.

[0075] Step S12: Determine the first initial risk value based on the risk values ​​and distribution rates of the multiple vulnerability factors.

[0076] In practical implementation, the distribution rate of vulnerability factors on assets can be determined based on their location within the asset. For example, target assets can be divided into vulnerability levels from low to high, ranging from network layer, session layer, system layer, component layer to application layer; the higher the vulnerability level, the greater the distribution rate of the vulnerability factor. By fitting the risk value and distribution rate of vulnerability factors, a preliminary assessment of the overall vulnerability of the target asset can be made from the perspective of the scope of influence of vulnerability factors, thus obtaining a first initial risk value.

[0077] As one possible implementation method, such as Figure 2 As shown, the first initial risk value can be determined through the following steps:

[0078] Step S21: Based on the risk value and distribution rate of the multiple vulnerability factors, determine the impact parameter corresponding to each of the multiple vulnerability factors. The impact parameter is used to describe the degree of impact of the security event that occurs after the vulnerability factor is exploited on the target asset.

[0079] Step S22: Determine the first variance value of the influence parameters of the plurality of vulnerability factors and the second variance value of the distribution rate of the plurality of vulnerability factors;

[0080] Step S23: The sum of the first variance value and the second variance value is determined as the first initial risk value.

[0081] In this embodiment, based on the data transmission characteristics, a vulnerability factor with a lower vulnerability level will affect all layers above it. Therefore, a vulnerability factor with a lower vulnerability level (i.e., a lower distribution rate) should have a larger range of influence, meaning that the impact of a security event occurring after the vulnerability factor is exploited on the target asset (the value of the influence parameter) will also be greater. For ease of calculation, the influence parameter P corresponding to the vulnerability factor can be equal to the risk value W of the vulnerability factor and the distribution rate Q of the vulnerability factor. With the aforementioned vulnerability factor risk value W = [4.5, 2, 3, 1.6], and the vulnerability factor distribution rate Q = [0.9, 0.4, 0.6, 0.2], the influence parameter P = [5, 5, 5, 8] can be obtained. To remove noise interference and reduce data deviation, the variance values ​​of the influence parameters of the above four vulnerability factors (i.e., the first variance value) and the variance values ​​of the distribution rates of the above four vulnerability factors (i.e., the second variance value) can be calculated separately, and the first variance value and the second variance value can be summed to obtain the first initial risk value.

[0082] Step S13: Determine a second initial risk value based on the historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors.

[0083] In practice, historical security event information of the target asset (or similar assets) can be obtained. By combining the losses when the asset experienced historical security events with the degree of danger of the current vulnerability factors of the target asset, the impact on the target asset when a security event similar to the historical security event occurs due to the exploitation of the vulnerability factors can be estimated. Based on this degree of impact, the overall vulnerability of the target asset can be estimated to obtain a second initial risk value.

[0084] As one possible implementation method, such as Figure 3 As shown, the second initial risk value can be determined through the following steps:

[0085] Step S31: Based on the historical security event information associated with the target asset, determine the degree and scope of impact of multiple historical security events associated with the target asset on their respective compromised assets, and determine the protection level of the multiple compromised assets;

[0086] Step S32: Based on the impact degree, impact scope and protection degree of the multiple associated historical security events, and the risk value of the multiple vulnerability factors, determine multiple loss impact values ​​of the target asset. The loss impact values ​​are used to describe the impact on the target asset when the same security event as the multiple historical security events occurs after the vulnerability factors are exploited.

[0087] Step S33: Determine the second initial risk value based on the asset operating state distribution parameters and the maximum value among the multiple loss impact values.

[0088] In practical implementation, a set function K(V, D, C) can be constructed based on historical security event information associated with the target asset. V represents the set of variables for security events (i.e., intrusion behaviors), indicating the degree of impact of each historical security event on its respective intruded asset; D represents the scope of the security event intrusion, indicating the range of impact of each historical security event on its respective intruded asset; and C represents the constraint set for risk propagation, indicating the level of protection of the relevant assets when a security event occurs. The security event can be a technical failure event, an unauthorized behavior event, a functional impairment event, a supply chain failure event, etc.

[0089] Taking a target asset associated with four historical security events as an example, the set function for these four historical security events can be obtained as follows: V1 = 5, D1 = 0.2, C1 = 0.5; V2 = 5, D2 = 0.2, C2 = 0.4; V3 = 5, D3 = 0.7, C3 = 0.2; V4 = 8, D4 = 0.2, C4 = 0.5. Among these, the larger the variables V and D for the historical security events, the greater their impact and scope. A larger D, representing the risk propagation constraint, indicates a lower level of protection for the related assets, meaning that the assets will be more severely affected when similar security events occur.

[0090] The set function K(V, D, C) is input into a pre-built knowledge base to obtain the risk knowledge parameter M. This risk knowledge parameter M represents a parameter value used to describe the comprehensive impact of historical security events on assets, obtained by integrating various dimensions of the set function. The aforementioned loss impact value can then be obtained by combining the influencing factors of asset distribution location and the loss impact value of the asset's historical state. For example, the loss impact value g corresponding to a certain vulnerability factor is calculated as: risk knowledge parameter M * risk value w of the vulnerability factor. Subsequently, the product between the set asset operating state distribution parameter (e.g., 42) and the maximum value among multiple loss impact values ​​can be determined as the second initial risk value. Based on the knowledge recommendation algorithm, and combined with historical security events occurring due to relevant vulnerability factors, the vulnerability of the target asset is assessed.

[0091] Step S14: Determine a third initial risk value based on the first target model and the risk values ​​of the multiple vulnerability factors. The first target model is trained based on the historical asset information of the target asset.

[0092] In practical implementation, the first target model can be a sparse parameter model constructed using the Lasso regression cost function. Taking advantage of the Lasso regression cost function's ability to perform variable selection and complexity adjustment while fitting a generalized linear model, the risk values ​​of the multiple vulnerability factors can be input into the first target model for fitting. This avoids overfitting the risk values ​​of the multiple vulnerability factors, thereby reducing the error value and enabling the obtained third initial risk value to more realistically reflect the overall vulnerability of the target asset.

[0093] As one possible implementation method, such as Figure 4 As shown, the first target model can be obtained through the following training:

[0094] Step S41: Extract the risk values ​​of multiple historical vulnerability factors from the historical asset information of the target asset, and obtain the true risk values ​​corresponding to the multiple historical vulnerability factors. The true risk values ​​are used to describe the vulnerability of the historical target asset corresponding to the historical vulnerability factors.

[0095] Step S42: Iteratively train the model based on the multiple historical risk values ​​and the actual risk values ​​corresponding to the multiple historical risk values ​​to obtain the first target model.

[0096] In this embodiment, the model can be trained based on the risk values ​​of historical vulnerability factors and the corresponding overall vulnerability of the historical target asset (i.e., the true risk value). For example, a sparse parameter model f(w) = Σ(λ(φ(w1)+φ(w2)+φ(w)) is constructed using the lasso regression cost function. n Let W = [w1w2w3wn] represent the risk value of the vulnerability factor, φ() represent the lasso regression cost function, and λ represent the regression coefficient. The risk values ​​of historical vulnerability factors are input into this sparse parameter model for iterative training. By adjusting the values ​​of the regression coefficients (e.g., to 0.5), the output of the sparse parameter model is made to approximate the true risk values ​​corresponding to the historical vulnerability factors. The sparse parameter model that reaches the required number of training iterations is determined as the first target model.

[0097] Step S15: Determine the first target asset risk value of the target asset based on the first initial risk value, the second initial risk value, and the third initial risk value.

[0098] In this embodiment, the initial risk values ​​determined by different dimensions and different algorithm models are comprehensively analyzed to obtain the first target asset risk value representing the overall vulnerability of the target asset. This expands the diversity of scoring criteria, avoids vulnerability calculation errors caused by abnormal defects in a single dimension or algorithm model, and thus improves the authenticity of vulnerability assessment.

[0099] As one possible implementation, the relevant distribution locations of security events occurring after vulnerability factors are exploited are estimated, and multiple latent factors are determined based on the relevant distribution locations; according to a set mapping table, the multiple latent factors are mapped to multiple non-feature parameters; the first initial risk value, the second initial risk value, and the third initial risk value are balanced and calibrated using the multiple non-feature parameters to obtain multiple calibration values; multiple first calibration values ​​among the multiple calibration values ​​whose values ​​differ within a set range are obtained, and the median value among the multiple first calibration values ​​is determined as the first target asset risk value.

[0100] In practical implementation, the relevant distribution location of security events occurring after vulnerability factors are exploited can be the aforementioned vulnerability hierarchy. Latent factors can be the objects affected by the vulnerability factors within that vulnerability hierarchy (such as equipment manufacturers, supply times, CPU utilization, etc.). By introducing latent factors, risk values ​​are balanced and calibrated to make the three risk values ​​as close as possible. Taking the latent factor CPU utilization as an example, when the CPU utilization is 95%, its mapped non-characteristic parameter is -5. The higher the CPU utilization, the smaller the non-characteristic parameter.

[0101] Based on the non-characteristic parameters of the different latent factors introduced, as well as the first initial risk value, the second initial risk value, and the third initial risk value, multiple calibration values ​​are determined. Each calibration value is equal to the square of the difference between the initial risk value (such as the first initial risk value, the second initial risk value, or the third initial risk value) and any non-characteristic parameter.

[0102] Taking the introduction of two implicit factors and the resulting six calibration values ​​of 10, 25, 27, 26, 41, and 60 as an example, the three first calibration values ​​that are closest to each other, namely 25, 27, and 26, are selected, and the median value of these three first calibration values, 27, is determined as the first target asset risk value.

[0103] Understandably, by introducing latent factors to estimate the distribution probability of risks (i.e. security events resulting from the exploitation of vulnerability factors), the initial risk values ​​estimated by different algorithm models can be balanced and calibrated to reduce the deviation of the data and thus further improve accuracy.

[0104] Step S16: Assess the vulnerability of the target asset based on the risk value of the first target asset.

[0105] In practice, multiple tests and analyses can be conducted to determine the correlation between the risk value of the first target asset and the vulnerability of the target asset, and corresponding security maintenance operations can be performed on the target asset based on its vulnerability.

[0106] For example, if the risk value of the first target asset is set to 0-30, the vulnerability of the target asset is determined to be low-risk, and the target asset is relatively difficult to compromise, so no hardening is required; if the risk value of the first target asset is 30-60, the vulnerability of the target asset is determined to be medium-risk, and the target asset is moderately difficult to compromise, so network policy hardening is required; if the risk value of the first target asset is 60-90, the vulnerability of the target asset is determined to be high-risk, and the target asset is relatively easy to compromise, so network policy hardening and host hardening are required; if the risk value of the first target asset is 90-100, the vulnerability of the target asset is determined to be severe, and the target asset is extremely easy to compromise, so network policy hardening and host hardening are required, and a new security design and planning is needed.

[0107] As one possible implementation, the risk value of the first target asset is adjusted according to the network scenario information of the target asset to obtain the risk value of the second target asset. The network scenario information includes at least one of network topology complexity, network connectivity, protocol restriction rate, and port open rate.

[0108] Based on the service scenario information of the target asset, the risk value of the second target asset is adjusted to obtain the risk value of the third target asset. The service scenario information includes at least one of the following: source code risk rate, service quality defect rate, and operation anomaly rate.

[0109] The vulnerability of the target asset is assessed based on the risk value of the third target asset.

[0110] It should be noted that, considering that the vulnerability of a target asset changes depending on the network environment, network scenarios can be used to enhance the risk value of the target asset through network policies, firewall policies, host policies, etc. At the same time, the vulnerability of a target asset is also affected when it provides different services, so service scenarios can be used to enhance the risk value of the target asset based on service scenario types such as proprietary services, supply chain services, and open source services.

[0111] In practical implementation, the network topology complexity, network connectivity, protocol restriction rate, and port open rate of the target asset are obtained. Based on the correlation between these parameters and the vulnerability of the target asset (e.g., the greater the network topology complexity, the greater the vulnerability of the target asset, and the greater the risk value of the target asset), the risk value of the first target asset is increased or decreased to obtain the risk value of the second target asset. The second target model can be trained using a lasso regression cost function and historical network scenario information. Subsequently, the aforementioned network scenario information and the risk value of the first target asset can be input into the second target model to obtain the risk value of the second target asset.

[0112] After obtaining the risk value of the second target asset, the source code risk rate, service quality defect rate, and operational anomaly rate of the target asset are acquired. Based on the correlation between these parameters and the vulnerability of the target asset (e.g., the higher the source code risk rate, the greater the vulnerability of the target asset should be, and the higher the risk value of the target asset should be), the risk value of the second target asset is increased or decreased to obtain the risk value of the third target asset. The third target model can be trained using a lasso regression cost function and historical service scenario information. Subsequently, the aforementioned service scenario information and the risk value of the second target asset can be input into this second target model to obtain the risk value of the third target asset.

[0113] In the above embodiments, this application provides an asset vulnerability assessment method based on model co-validation. By converging asset vulnerability information, data is extracted from multiple vulnerability dimensions such as vulnerabilities, baselines, and exposure surfaces. The risk value is evaluated by co-calculating three types of algorithm models. Then, the evaluation is enhanced by network scenario and service difference scenario, so as to make a realistic assessment of asset vulnerability and obtain the asset vulnerability that is closest to the real state.

[0114] For the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of this application.

[0115] Secondly, Figure 5 This is a schematic diagram of an asset vulnerability assessment device according to an embodiment of this application. The device includes:

[0116] The first processing module is used to extract multiple vulnerability factors from the asset information of the target asset and determine the risk value of the multiple vulnerability factors;

[0117] The second processing module is used to determine a first initial risk value based on the risk values ​​and distribution rates of the multiple vulnerability factors;

[0118] The third processing module is used to determine a second initial risk value based on the historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors;

[0119] The fourth processing module is used to determine a third initial risk value based on the first target model and the risk values ​​of the multiple vulnerability factors. The first target model is trained based on the historical asset information of the target asset.

[0120] The fifth processing module is used to determine the first target asset risk value of the target asset based on the first initial risk value, the second initial risk value, and the third initial risk value;

[0121] The vulnerability assessment module is used to assess the vulnerability of the target asset based on the risk value of the first target asset.

[0122] The technical solution adopted in this application extracts multiple vulnerability factors from the asset information of the target asset based on multiple vulnerability dimensions. Based on these multiple vulnerability factors, three types of algorithm models are used for collaborative calculation, thereby improving the accuracy of the obtained asset risk value and enabling the asset risk value to accurately reflect the vulnerability of the target asset.

[0123] Optionally, the second processing module includes:

[0124] The first processing submodule is used to determine the impact parameters corresponding to each of the multiple vulnerability factors based on their risk values ​​and distribution rates. The impact parameters are used to describe the degree of impact of security events that occur after the vulnerability factors are exploited on the target assets.

[0125] The second processing submodule is used to determine the first variance value of the influence parameters of the plurality of vulnerability factors and the second variance value of the distribution rate of the plurality of vulnerability factors;

[0126] The third processing submodule is used to determine the first initial risk value by summing the first variance value and the second variance value.

[0127] Optionally, the third processing module includes:

[0128] The fourth processing submodule is used to determine the degree and scope of impact of multiple historical security events associated with the target asset on their respective compromised assets based on the historical security event information associated with the target asset, and to determine the protection level of the multiple compromised assets.

[0129] The fifth processing submodule is used to determine multiple loss impact values ​​of the target asset based on the impact degree, impact scope and protection degree of the multiple associated historical security events, as well as the risk values ​​of the multiple vulnerability factors. The loss impact values ​​are used to describe the impact on the target asset when the vulnerability factors are exploited and a security event occurs that is the same as the multiple historical security events.

[0130] The sixth processing submodule is used to determine the second initial risk value based on the asset operating state distribution parameters and the maximum value among the multiple loss impact values.

[0131] Optionally, before determining the third initial risk value based on the first target model and the risk values ​​of the plurality of vulnerability factors, the apparatus further includes:

[0132] The information extraction module is used to extract the risk values ​​of multiple historical vulnerability factors from the historical asset information of the target asset, and obtain the true risk values ​​corresponding to the multiple historical vulnerability factors. The true risk values ​​are used to describe the vulnerability of the historical target asset corresponding to the historical vulnerability factors.

[0133] The model training module is used to iteratively train the model based on the multiple historical risk values ​​and the actual risk values ​​corresponding to the multiple historical risk values ​​to obtain the first target model;

[0134] The fourth processing module includes:

[0135] The seventh processing submodule is used to input the risk values ​​of the multiple vulnerability factors into the first target model to obtain the third initial risk value.

[0136] Optionally, the fifth processing module includes:

[0137] The eighth processing submodule is used to estimate the relevant distribution locations of security events that occur after the vulnerability factors are exploited, and to determine multiple latent factors based on the relevant distribution locations;

[0138] The ninth processing submodule is used to map the multiple latent factors into multiple non-feature parameters according to the set mapping table;

[0139] The tenth processing submodule is used to perform balance calibration on the first initial risk value, the second initial risk value, and the third initial risk value using the multiple non-feature parameters, respectively, to obtain multiple calibration values;

[0140] The eleventh processing submodule is used to obtain multiple first calibration values ​​among the multiple calibration values ​​that differ within a set range, and to determine the median value among the multiple first calibration values ​​as the first target asset risk value.

[0141] Optionally, the vulnerability assessment module includes:

[0142] The first evaluation submodule is used to adjust the risk value of the first target asset based on the network scenario information of the target asset to obtain the risk value of the second target asset. The network scenario information includes at least one of network topology complexity, network connectivity, protocol restriction rate, and port open rate.

[0143] The second assessment submodule is used to adjust the risk value of the second target asset based on the service scenario information of the target asset to obtain the risk value of the third target asset. The service scenario information includes at least one of source code risk rate, service quality defect rate, and operation anomaly rate.

[0144] The third assessment submodule is used to assess the vulnerability of the target asset based on the risk value of the third target asset.

[0145] It should be noted that the device embodiments are similar to the method embodiments, so the description is relatively simple. For relevant details, please refer to the method embodiments.

[0146] This application also provides an electronic device, see embodiments thereof. Figure 6 , Figure 6 This is a schematic diagram of the electronic device proposed in an embodiment of this application. Figure 6 As shown, the electronic device 100 includes a memory 110 and a processor 120. The memory 110 and the processor 120 are connected via a bus for communication. The memory 110 stores a computer program that can run on the processor 120 to implement the steps in the asset vulnerability assessment method disclosed in the embodiments of this application.

[0147] This application also provides a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements the asset vulnerability assessment method disclosed in this application.

[0148] This application also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the asset vulnerability assessment method disclosed in this application.

[0149] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0150] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0151] This application describes embodiments of methods, systems, devices, storage media, and program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0152] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0154] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0155] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0156] The above provides a detailed description of the asset vulnerability assessment method, apparatus, equipment, medium, and product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and its core ideas. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for assessing asset vulnerability, characterized in that, The asset is a cybersecurity asset, which is software and hardware information related to network information. The method includes: Multiple vulnerability factors are extracted from the asset information of the target asset, and the risk values ​​of the multiple vulnerability factors are determined; A first initial risk value is determined based on the risk values ​​and distribution rates of the multiple vulnerability factors; wherein the distribution rate is determined based on the distribution position of the vulnerability factors in the vulnerability hierarchy of the target asset, and the higher the vulnerability hierarchy, the greater the distribution rate. A second initial risk value is determined based on the historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors; Based on the risk values ​​of the first target model and the multiple vulnerability factors, a third initial risk value is determined. The first target model is trained based on the historical asset information of the target asset. Based on the first initial risk value, the second initial risk value, and the third initial risk value, a first target asset risk value is determined for the target asset. The vulnerability of the target asset is assessed based on the risk value of the first target asset. The step of determining the first initial risk value based on the risk values ​​and distribution rates of the multiple vulnerability factors includes: Based on the risk values ​​and distribution rates of the multiple vulnerability factors, the impact parameters corresponding to each of the multiple vulnerability factors are determined. The impact parameters are used to describe the degree of impact of security events that occur after the vulnerability factors are exploited on the target assets. Determine the first variance value of the influence parameters of the plurality of vulnerability factors, and the second variance value of the distribution rate of the plurality of vulnerability factors; The sum of the first variance value and the second variance value is determined as the first initial risk value.

2. The method according to claim 1, characterized in that, The step of determining a second initial risk value based on historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors includes: Based on the historical security event information associated with the target asset, determine the degree and scope of impact of multiple historical security events associated with the target asset on their respective compromised assets, and determine the protection level of multiple compromised assets. Based on the impact degree, impact scope and protection degree of the associated multiple historical security events, and the risk value of the multiple vulnerability factors, multiple loss impact values ​​of the target asset are determined. The loss impact values ​​are used to describe the impact on the target asset when the same security event as the multiple historical security events occurs after the vulnerability factors are exploited. The second initial risk value is determined based on the asset operating status distribution parameters and the maximum value among the multiple loss impact values.

3. The method according to claim 1, characterized in that, Before determining the third initial risk value based on the first target model and the risk values ​​of the multiple vulnerability factors, the method further includes: From the historical asset information of the target asset, the risk values ​​of multiple historical vulnerability factors are extracted, and the true risk values ​​corresponding to the multiple historical vulnerability factors are obtained. The true risk values ​​are used to describe the vulnerability of the historical target asset corresponding to the historical vulnerability factors. The model is iteratively trained based on multiple historical risk values ​​and the corresponding true risk values ​​to obtain the first target model; The determination of the third initial risk value based on the risk values ​​of the first target model and the multiple vulnerability factors includes: The risk values ​​of the multiple vulnerability factors are input into the first target model to obtain the third initial risk value.

4. The method according to claim 1, characterized in that, The step of determining the first target asset risk value of the target asset based on the first initial risk value, the second initial risk value, and the third initial risk value includes: The relevant distribution locations of security events that occur after vulnerability factors are exploited are estimated, and multiple latent factors are determined based on the relevant distribution locations; According to the established mapping table, the multiple latent factors are mapped to multiple non-feature parameters; By using the multiple non-feature parameters, the first initial risk value, the second initial risk value, and the third initial risk value are balanced and calibrated respectively to obtain multiple calibration values; Obtain multiple first calibration values ​​from the plurality of calibration values ​​that differ within a set range, and determine the median value among the plurality of first calibration values ​​as the first target asset risk value.

5. The method according to any one of claims 1-4, characterized in that, The assessment of the vulnerability of the target asset based on the risk value of the first target asset includes: Based on the network scenario information of the target asset, the risk value of the first target asset is adjusted to obtain the risk value of the second target asset. The network scenario information includes at least one of network topology complexity, network connectivity, protocol restriction rate, and port open rate. Based on the service scenario information of the target asset, the risk value of the second target asset is adjusted to obtain the risk value of the third target asset. The service scenario information includes at least one of the following: source code risk rate, service quality defect rate, and operation anomaly rate. The vulnerability of the target asset is assessed based on the risk value of the third target asset.

6. An asset vulnerability assessment device, characterized in that, The asset is a cybersecurity asset, which is software and hardware information related to network information. The device includes: The first processing module is used to extract multiple vulnerability factors from the asset information of the target asset and determine the risk value of the multiple vulnerability factors; The second processing module is used to determine a first initial risk value based on the risk values ​​and distribution rates of the multiple vulnerability factors; wherein the distribution rate is determined based on the distribution position of the vulnerability factors in the vulnerability hierarchy of the target asset, and the higher the vulnerability hierarchy, the greater the distribution rate. The third processing module is used to determine a second initial risk value based on the historical security event information associated with the target asset and the risk values ​​of the multiple vulnerability factors; The fourth processing module is used to determine a third initial risk value based on the first target model and the risk values ​​of the multiple vulnerability factors, wherein the first target model is trained based on the historical asset information of the target asset; The fifth processing module is used to determine the first target asset risk value of the target asset based on the first initial risk value, the second initial risk value, and the third initial risk value; A vulnerability assessment module is used to assess the vulnerability of the target asset based on the risk value of the first target asset. The second processing module includes: The first processing submodule is used to determine the impact parameters corresponding to each of the multiple vulnerability factors based on their risk values ​​and distribution rates. The impact parameters are used to describe the degree of impact of security events that occur after the vulnerability factors are exploited on the target assets. The second processing submodule is used to determine the first variance value of the influence parameters of the plurality of vulnerability factors and the second variance value of the distribution rate of the plurality of vulnerability factors; The third processing submodule is used to determine the first initial risk value by summing the first variance value and the second variance value.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the asset vulnerability assessment method as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the asset vulnerability assessment method as described in any one of claims 1 to 5.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the asset vulnerability assessment method as described in any one of claims 1 to 5.

Images