A risk assessment method and apparatus

Abstract

This application provides a risk assessment method and apparatus. The method involves: obtaining an attack subgraph of the target object from an attack graph; simplifying the attack subgraph containing nodes to obtain a target attack subgraph; obtaining a first attack subgraph of the target object at a first time step and a second attack subgraph at a second time step from the attack subgraph of the target object that does not contain nodes and the target attack subgraph, respectively; performing threat assessment processing on the first and second attack subgraphs to obtain a first attack threat score and a second attack threat score; determining the first target threat score and the second target threat score based on security events occurring on the target object at the first and second times, respectively; determining a first risk score based on the first attack threat score and the first target threat score; determining a second risk score based on the second attack threat score and the second target threat score; and performing a risk assessment on the target object based on the first and second risk scores.

Description

Technical Field

[0001] This application relates to the field of safety technology, and in particular to a risk assessment method and apparatus. Background Technology

[0002] Security-related incidents are generally multi-source and heterogeneous, including WAF incidents, IDS incidents, firewall incidents, UEBA incidents, threat intelligence incidents, endpoint antivirus incidents, vulnerability scanning incidents, and so on. These network security-related incidents can all be expressed as a <point-edge-point>, where the "point" can be an attacked IP address or a compromised indicator (IOC) in threat intelligence, and the "edge" can be understood as a security event between the attacked IP address and the IOC in the threat intelligence. Security managers often get stuck within a single hop when investigating the "points" and "edges," unable to conduct in-depth analysis.

[0003] Furthermore, since most attack graphs rely on single-source isomorphic logs (e.g., only WAF logs), the resulting attack graphs are incomplete and fragmented, ultimately affecting risk identification based on them. Moreover, threat analysis methods on the constructed attack graphs are mostly static, such as using the total number of nodes covered by the attack subgraph to represent the scope of impact, the number of covered security events to represent the scale of the threat, and the attack path depth to represent the penetration depth, leading to inaccurate risk identification.

[0004] Therefore, how to accurately identify risks and improve cybersecurity is one of the technical issues worth considering. Summary of the Invention

[0005] In view of this, this application provides a risk assessment method and apparatus for accurately identifying risks and improving cybersecurity.

[0006] Specifically, this application is implemented through the following technical solution:

[0007] According to a first aspect of this application, a risk assessment method is provided, comprising:

[0008] Obtain the attack subgraph of the target object from the attack graph;

[0009] The attack subgraph containing the node is simplified to obtain the target attack subgraph.

[0010] From the attack subgraph of the target object that does not contain any nodes and the target attack subgraph, respectively obtain the first attack subgraph of the target object at the first time and the second attack subgraph of the target object at the second time.

[0011] Threat assessment processing is performed on the first attack subgraph and the second attack subgraph respectively to obtain the first attack threat score and the second attack threat score of the target object;

[0012] Based on the security events that occur to the target object at the first time and the second time respectively, determine the first object threat score and the second object threat score of the target object;

[0013] Based on the first attack threat score and the first object threat score, a first risk score for the target object is determined;

[0014] Based on the second attack threat score and the second object threat score, a second risk score for the target object is determined;

[0015] A risk assessment is performed on the target object based on the first risk score and the second risk score.

[0016] According to a second aspect of this application, a risk assessment apparatus is provided, comprising:

[0017] The first acquisition module is used to acquire the attack subgraph of the target object from the attack graph;

[0018] The processing module is used to simplify the attack subgraph containing the link points to obtain the target attack subgraph;

[0019] The second acquisition module is used to acquire, respectively, the first attack subgraph of the target object at a first time and the second attack subgraph of the target object at a second time from the attack subgraph of the target object that does not contain the node and the target attack subgraph;

[0020] The first evaluation module is used to perform threat evaluation processing on the first attack subgraph and the second attack subgraph respectively to obtain the first attack threat score and the second attack threat score of the target object.

[0021] The first determining module is used to determine a first object threat score and a second object threat score of the target object based on the security events that occur to the target object at the first time and the second time, respectively.

[0022] The second determining module is used to determine the first risk score of the target object based on the first attack threat score and the first object threat score;

[0023] The third determining module is used to determine the second risk score of the target object based on the second attack threat score and the second object threat score;

[0024] The second assessment module is used to assess the risk of the target object based on the first risk score and the second risk score.

[0025] According to a third aspect of this application, an electronic device is provided, including a processor and a machine-readable storage medium storing a computer program executable by the processor, the processor being prompted by the computer program to perform the method provided in the first aspect of the embodiments of this application.

[0026] According to a fourth aspect of this application, a machine-readable storage medium is provided, which stores a computer program that, when invoked and executed by a processor, causes the processor to perform the method provided in the first aspect of the embodiments of this application.

[0027] The beneficial effects of the embodiments of this application are as follows:

[0028] The risk assessment method and apparatus provided in this application involve: obtaining an attack sub-graph of the target object from an attack graph; simplifying the attack sub-graph containing critical points to obtain a target attack sub-graph; obtaining a first attack sub-graph of the target object at a first moment and a second attack sub-graph of the target object at a second moment from the attack sub-graph of the target object without critical points and the target attack sub-graph, respectively; performing threat assessment processing on the first and second attack sub-graphs to obtain a first attack threat score and a second attack threat score for the target object; determining the first and second object threat scores of the target object based on security events occurring at the first and second moments, respectively; determining a first risk score for the target object based on the first attack threat score and the first object threat score; determining a second risk score for the target object based on the second attack threat score and the second object threat score; and performing a risk assessment on the target object based on the first and second risk scores. By employing the above risk assessment method and assessing the risk of the target object at different moments, the competition between the attacker and the defense strategy can be clearly perceived, and the risk assessment results of the target object can be obtained more accurately, providing valuable reference for security administrators to better ensure the security of the target object. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a risk assessment method provided in an embodiment of this application;

[0030] Figure 2a This is a schematic diagram of an attack subgraph provided in an embodiment of this application;

[0031] Figure 2b This is a schematic diagram illustrating the construction of a target attack subgraph provided in an embodiment of this application;

[0032] Figure 3 This is a schematic diagram of the attack path included in an attack subgraph provided in an embodiment of this application;

[0033] Figure 4 This is a schematic diagram of the structure of a risk assessment device provided in an embodiment of this application;

[0034] Figure 5 This is a schematic diagram of the hardware structure of an electronic device for implementing a risk assessment method, provided in an embodiment of this application. Detailed Implementation

[0035] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0036] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used herein are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the corresponding listed items.

[0037] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0038] The risk assessment method provided in this application is described in detail below.

[0039] See Figure 1 , Figure 1 This is a flowchart of a risk assessment method provided in this application. This method can be applied to electronic devices, which may be, but are not limited to, network security devices. When implementing the above risk assessment method, the electronic device may include the following steps:

[0040] S101. Obtain the attack subgraph of the target object from the attack graph.

[0041] In this step, the attack graph is constructed based on multi-source, heterogeneous security events within a specified time period, targeting objects in the network environment that are subject to security analysis. Furthermore, as time progresses, if hacker activity increases, the attack graph will grow larger, indicating an increased risk. Conversely, if security administrators perform antivirus scans and harden the vulnerable targets, the attack graph will shrink, indicating a decreased risk. Therefore, the size of the attack graph directly reflects the magnitude of the risk.

[0042] Therefore, to facilitate risk assessment, an attack graph can be viewed as consisting of multiple attack subgraphs. The presence of risk in an object can then be assessed based on these subgraphs for accurate identification. To this end, this embodiment proposes obtaining the attack subgraph of the target object from the attack graph; that is, the attack subgraph representing the target object. For example, the obtained attack subgraph of the target object can be referenced... Figure 2a As shown, including attack sub Figure 1 And attack subgraph 2.

[0043] S102. Simplify the attack subgraph containing the node to obtain the target attack subgraph.

[0044] In this step, when constructing the attack graph, there are usually circular attacks, such as a to b, b to c, and c back to a. Such circular attacks may interfere with risk assessment. In view of this, this embodiment proposes to simplify the attack subgraph containing link points, that is, to simplify the link points in the attack subgraph into a single node; based on the single node, the other nodes in the attack subgraph and their connection relationships, the target attack subgraph is obtained.

[0045] Specifically, each node is abstracted into a super node, i.e., the single node mentioned above, and then connected with other nodes to form the target attack subgraph. For ease of understanding, it can be represented as... Figure 2b The abstract process shown is used as an example for illustration. Figure 2a attacking sub Figure 1 ( Figure 2b The left diagram contains nodes A1, A2, and A3. Therefore, A1, A2, and A3 can be abstracted into a single node A0. Then, according to the connection relationship between the node and other nodes, the target attack subgraph shown on the right is constructed.

[0046] In this way, by adopting the above process, the attack subgraphs of each target object containing link points can be simplified to obtain their respective target attack subgraphs.

[0047] S103. Obtain the first attack subgraph of the target object at the first moment and the second attack subgraph of the target object at the second moment from the attack subgraph of the target object that does not contain the node and the target attack subgraph, respectively.

[0048] It should be noted that existing solutions only rank threat nodes in the attack graph and cannot calculate the changes in the "vertices" and "edges" between yesterday's and today's attack subgraphs. This is because active hackers often accompany the expansion of the attack subgraph, while attack subgraphs formed by false positives are often static. Therefore, this step proposes comparing attack subgraphs at different times. Specifically, it proposes obtaining the first attack subgraph of the target object at the first time and the second attack subgraph of the target object at the second time.

[0049] Specifically, when selecting the first attack subgraph and the second attack subgraph, they can be selected randomly or when the time interval between the first and second moments reaches a set time interval. This is because the risk scores of attack subgraphs at adjacent moments may be similar, making it impossible to conduct an effective and accurate risk assessment. Therefore, after selecting the first attack subgraph at the first moment, the second attack subgraph at the second moment can be selected according to the set time interval.

[0050] S104. Perform threat assessment processing on the first attack subgraph and the second attack subgraph respectively to obtain the first attack threat score and the second attack threat score of the target object.

[0051] In this step, over time, a risky asset may appear in multiple attack subgraphs, and an attack subgraph may contain multiple changing risky assets. Therefore, observing the changing trends in the size of multiple attack subgraphs in which a single risky asset may reside is a complex task. Therefore, this application proposes using the target object's score within the attack subgraph to measure risk assessment; that is, by comparing the risk scores at two different times, the change in the target object's threat can be determined.

[0052] Furthermore, the more security incidents a risk asset experiences, the higher its risk score. The greater the threat within the attack subgraph in which the risk asset resides, the higher its risk score. Based on this principle, a risk asset's risk score can be determined by the sum of all its security incidents and the threat magnitude of the attack subgraph in which it resides.

[0053] Based on the above principles, in order to obtain the risk score of the target object at different times, we can first determine the first attack threat score of the target object under the first attack subgraph and the second attack threat score of the target object under the second attack subgraph.

[0054] S105. Based on the security events that occur to the target object at the first time and the second time respectively, determine the first object threat score and the second object threat score of the target object.

[0055] In this step, based on the factors influencing the analysis and scoring of the target asset, it is also necessary to confirm the first-object threat score of the target object at the first moment and the second-object threat score at the second moment. Specifically, the Siemens system can be used to score the security events occurring to the target object at the first moment to obtain the first-object threat score; similarly, the Siemens system can be used to score the security events occurring to the target object at the second moment to obtain the second-object threat score.

[0056] S106. Determine the first risk score of the target object based on the first attack threat score and the first object threat score.

[0057] In this step, the first attack threat score and the first target threat score can be weighted and summed to obtain the first risk score of the target, denoted as score1.

[0058] S107. Determine the second risk score of the target object based on the second attack threat score and the second object threat score.

[0059] In this step, referring to step S106, the second attack threat score and the second target threat score can be weighted and summed to obtain the second risk score of the target target, denoted as score2.

[0060] S108. Based on the first risk score and the second risk score, perform a risk assessment on the target object.

[0061] Specifically, the magnitudes of the first risk score and the second risk score can be compared, and the risk assessment result of the target object can be determined based on the comparison results.

[0062] By implementing the risk assessment method provided in this application, an attack subgraph of the target object is obtained from the attack graph; the attack subgraph containing loopholes is simplified to obtain the target attack subgraph; from the attack subgraph of the target object without loopholes and the target attack subgraph, a first attack subgraph of the target object at a first time and a second attack subgraph of the target object at a second time are obtained respectively; threat assessment processing is performed on the first and second attack subgraphs respectively to obtain a first attack threat score and a second attack threat score of the target object; based on the security events occurring on the target object at the first and second times respectively, a first object threat score and a second object threat score of the target object are determined; based on the first attack threat score and the first object threat score, a first risk score of the target object is determined; based on the second attack threat score and the second object threat score, a second risk score of the target object is determined; and based on the first risk score and the second risk score, a risk assessment of the target object is performed. By adopting the above risk assessment method and assessing the risk of the target object at different times, the competition between the attacker and the defense strategy can be clearly perceived, and the risk assessment results of the target object can be obtained more accurately, providing valuable reference for security administrators to better ensure the security of the target object.

[0063] Optionally, the aforementioned objects may include, but are not limited to, internal network assets (such as internal network hosts), intelligence, external network hosts, etc.

[0064] Optionally, based on the above embodiments, the attack graph can be constructed in this embodiment according to the following method:

[0065] For each object, an attack chain graph and a backtracking chain graph are constructed; by integrating the attack chain graphs and backtracking chain graphs of each target object, the above attack graph is obtained.

[0066] Furthermore, the attack chain graph for each object can be constructed as follows: For each object, taking that object as the attacker, determine the first security event that occurred on that object; then, taking the attacked object as the attacker, repeat the step of taking that object as the attacker and determining the first security event that occurred on that object, until the traversal is complete. In this way, a first structure and / or a second structure with connectivity from that object to other objects can be constructed using the determined first security event, centered on that object; integrating the first and second structures yields an attack chain graph with reachability from that object to other objects.

[0067] Specifically, taking the host as an example, if we abstract the host as a point and the attack event as an edge, security events can be divided into three categories according to attack connectivity:

[0068] (1) Host a attacked host b, which can be abstractly expressed as <point-edge-point>, with the attack direction being a pointing to b.

[0069] (2) If host b suffers from a wide-ranging attack, such as a DDoS attack, the numerous attackers can be abstracted into a single point and standardized as a case of class 1.

[0070] (3) A malicious file was found on host a, which can be abstractly expressed as a <point-edge>, and there is no attack direction at this time.

[0071] In category (1), there is a security event between the source host a and the destination host b. In general, it can be considered that host a launches an attack on host b. In some special security events, such as when the source host a is suspected of being infected with malicious programs, it is actually the destination host b launching an attack on the source host a. At this time, the expression is still in the form of <point-edge-point>, but the attack direction is from b to a.

[0072] Based on the above regulations, all security events can be classified into two categories according to connectivity: <point-edge-point> structure and <point-edge> structure. For ease of description, the <point-edge-point> structure will be referred to as the first structure above, and the <point-edge> structure will be referred to as the second structure above.

[0073] Based on this, for object a, we can first determine which objects object a, as the attacker, has security events with, and denote them as the first security events. Then, we extract the victims mentioned above, taking object b as an example, and analyze which objects object b, as the attacker, has security events with. Subsequent analysis iterates over the above process. According to the above steps, we can obtain a first structure and / or a second structure with connectivity centered on object a and in the direction of attack. Integrating all structures, we can obtain an attack chain graph from object a to every object that is reachable.

[0074] It should be noted that after identifying security incidents, these incidents can be standardized, and then attack chain diagrams can be constructed based on these standardized security incidents. This way, the resulting attack chain diagrams can be standardized.

[0075] Similarly, the backlink graph for each object can be constructed as follows: For each object, taking the object as the attacked party, determine the second security event that occurred on the object; with the object as the center, construct a first structure and / or a second structure that are connected to the object using the determined second security event; integrate the first structure and the second structure to obtain a backlink graph that is reachable from the object to other objects.

[0076] Specifically, taking object a as an example, we can first identify object a as the victim, i.e., the attacked party, and determine which objects it had security events with, denoted as the second security event. Then, we can filter out the attackers mentioned above, and then identify the attackers as victims again, determining which objects they had security events with, and the security events that occurred, also denoted as the second security event. By doing so, we can obtain a first structure and / or a second structure centered on object a, which are connected to object a. Integrating the first and second structures, we obtain a backlink graph that allows reachability from object a to other objects.

[0077] It should be noted that after traversing the security events, the security events can be standardized, and then a backtracking graph can be built based on the standardized security events. The resulting backtracking graph can be standardized, thus obtaining an attack graph with a unified standard.

[0078] Optionally, based on any of the above embodiments, step S108 can be executed in this embodiment according to the following method: when the first time is earlier than the second time, if the first risk score is higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective; if the first risk score is not higher than the second risk score, then the target object is confirmed to have a security risk.

[0079] If the first risk score is higher than the second risk score when the first time point is later than the second time point, then the target object is confirmed to have a security risk; if the first risk score is not higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective.

[0080] If the first risk score equals the second risk score, then it is confirmed that the anti-attack strategy used by the target object is equivalent to the attack that exists on the target object.

[0081] Specifically, taking time 1 as the first moment, time 2 as the second moment, and score 2 as the second risk score as an example, if at time 1, the target object's threat score in the first attack subgraph (i.e., the first risk score) is score 1, and at time 2, the target object's threat score in the second attack subgraph (i.e., the second risk score) is score 2, then when score 1 and score 2 are related to the threat magnitude of the first and second attack subgraphs and the risk magnitude of the target object at times 1 and 2, the scores at times 1 and 2 can be compared to measure the offensive and defensive confrontation between the hacker's attack and the security administrator's anti-attack strategies on the target object. If time 1 is earlier than time 2, and score 1 is greater than score 2, it indicates that the security administrator's anti-attack strategies on the target object have weakened the hacker's attack; if score 1 is less than score 2, it indicates that the hacker has bypassed the anti-attack strategies used by the target object, further indicating that the target object poses a security threat.

[0082] Similarly, if score1 is greater than score2 when time 1 is later than time 2, it indicates that the hacker has bypassed the anti-attack strategy used by the target, further indicating that the target poses a security threat; if score1 is less than score2, it indicates that the anti-attack strategy used by the security administrator on the target weakens the hacker's attack.

[0083] Furthermore, regardless of whether time 1 is earlier or later than time 2, when it is confirmed that score1 equals score2, it indicates that the hacker and the security administrator are evenly matched, meaning that the anti-attack strategy used by the target is equivalent to the attacks existing on the target.

[0084] By implementing this embodiment, not only can the risk assessment results of the target object be accurately obtained, but security administrators can also confirm whether the anti-attack strategies they have adopted are effective, as well as the attack situation of the target object being attacked by hackers.

[0085] Optionally, based on any of the above embodiments, in this embodiment, step S104 can be performed according to the following method: determining the threat level of each attack path in the first attack subgraph; performing a weighted summation of the threat levels of each attack path in the first attack subgraph to obtain a first attack threat score; determining the threat level of each attack path in the second attack graph; performing a weighted summation of the threat levels of each attack path in the second attack subgraph to obtain a second attack threat score.

[0086] Specifically, since existing attack graphs cannot be analyzed in depth, this embodiment proposes to analyze attack subgraphs by attack paths to achieve deeper analysis and more accurate risk assessment of targets. Specifically, since an attack subgraph may be represented by multiple attack paths, and the more attack paths there are, the greater the threat of the attack subgraph. Therefore, the threat score of an attack subgraph can be equal to the weighted sum of the threat levels of all attack paths. Based on this principle, the threat level of each attack path in the first or second attack subgraph can be determined, then the weight of each attack path can be confirmed, and finally, the threat levels of the attack paths are weighted and summed using the weights of each attack path to obtain the first or second attack threat score for the target.

[0087] It should be noted that, since different attack paths have many overlapping nodes, the weight of each attack path generated by an attack subgraph is positively correlated with its depth. Specifically, the weight of each attack path can be determined as follows: determine the depth of each attack path; determine the metric for each layer based on the attack path with the largest depth and its total metric; determine the total metric for other attack paths based on the metric for each layer and the depth of other attack paths; for each attack path, the ratio between its total metric and the sum of the total metric for all attack paths is determined as the weight of that attack path.

[0088] For ease of understanding, Figure 3 Taking the attack subgraph shown as an example, we can see that... Figure 3 The attack subgraph shown on the left includes two attack paths, namely... Figure 3 Considering attack paths 1 and 2 on the right, where attack path 1 is A0---B1---D1----E1 and attack path 2 is C1---D1---E1, we can define the path depth of attack path 1 as 4 and the path depth of attack path 2 as 3. Then, using the longest attack path as the total metric, and based on the proportion of its length to the depth of each layer, we can determine the metric for each layer. For example, if the longest attack path between attack paths 1 and 2 has a depth of 4, then the total metric for attack path 1 is 1, and the metric for each layer can be determined as 1 / 4 = 0.25. In this case, when attack path 2 has a depth of 3, the total metric for attack path 2 is 0.25 * 3 = 0.75. Therefore, the total metric for attack paths 1 and 2 is 1 + 0.75 = 1.75. Consequently, the weight of attack path 1 is determined to be 1 / 1.75 = 57%, and the weight of attack path 2 is 0.75 / 1.75 = 43%.

[0089] Furthermore, the threat level of each attack path in the first attack subgraph can be determined as follows: for each attack path in the first attack subgraph, the sum of the risk values ​​of each security event used to construct the attack path is determined as the threat level of the attack path.

[0090] Similarly, the threat level of each attack path in the second attack subgraph is determined as follows: for each attack path in the second attack subgraph, the sum of the risk values ​​of each security event used to construct the attack path is determined as the threat level of the attack path.

[0091] Specifically, the more risky assets and security incidents along an attack path, the greater the security threat posed by that path. Therefore, the threat level of an attack path can be defined as the sum of the risk values ​​of all security incidents that construct the attack path. The risk value of each security incident is determined by a combination of factors, including its threat level, frequency, and timing.

[0092] Specifically, it also means Figure 3 Taking attack path 1 as an example, assuming it involves four security events, and each event can be assessed using the SIEM system, yielding a risk value for each of these four events. It's important to note that each risk value characterizes the level of security risk posed by the target object. For instance, if the target object is compromised, the risk value might be 1; if the target object is at high risk, the risk value might be 0.8; if the target object is at low risk, the risk value might be 0.2, and so on. It should be emphasized that the risk values ​​of 0.2, 1, and 0.8 mentioned above are merely examples and do not constitute a limitation on the specific values ​​of the risk values.

[0093] Based on this, the threat level of attack path 1 can be obtained, which is the sum of the risk values ​​of the above four security events, denoted as sum1; similarly, the threat level of attack path 2 can be obtained, denoted as sum2, and thus the attack threat score of the attack subgraph can be obtained.

[0094] Based on any of the above embodiments, step S105 in this embodiment can be performed according to the following method: summing the risk values ​​of each security event involved in the target object at the first moment to obtain a first risk sum; determining the ratio between the first risk sum and the first attack threat score of the first attack subgraph as the first target threat score; summing the risk values ​​of each security event involved in the target object at the second moment to obtain a second risk sum; determining the ratio between the second risk sum and the second attack threat score of the second attack subgraph as the second target threat score.

[0095] Specifically, the Siem system is used to score security events occurring on the target object to obtain the risk value of each security event. This can be understood as the sum of the risk values ​​of security events of adjacent nodes in the attack graph of the current target event, for example, denoted as sum4. If the first attack threat score of the first attack subgraph is sum3, then the ratio between sum4 and sum3 can be determined as the first object threat score mentioned above. Similarly, the second object threat score mentioned above can be obtained.

[0096] Optionally, based on any of the above embodiments, step S106 in this embodiment can be performed according to the following method: calculating a first product between a set determination coefficient and a first target threat score; determining a first difference between 1 and the set determination coefficient; determining a second product between the first difference and the first attack threat score; and determining the sum of the first product and the second product as the first risk score.

[0097] Similarly, after determining the first difference, step S107 can be performed as follows: calculate the third product between the set determination coefficient and the second target threat score; determine the fourth product between the first difference and the second attack threat score; and determine the sum of the third and fourth products as the second risk score.

[0098] Specifically, the first risk score and the second risk score can be calculated using the following formula:

[0099] score=λ*k1+(1-λ)*k2

[0100] In the above formula, score is the first risk score or the second risk score; λ is the coefficient of determination; k1 is the first target threat score or the second target threat score; k2 is the first attack threat score or the second attack threat score. λ*k1 can be the first or third product; (1-λ) is the first difference; and (1-λ)*k2 is the second or fourth product.

[0101] This allows for the accurate acquisition of risk scores for the target object at different times, which in turn enables risk assessment and improves the accuracy of risk assessment results.

[0102] Optionally, after obtaining the first target threat score and the second target threat score constituted by the target's own security events, they can be normalized respectively; similarly, the first attack threat score and the second attack threat score are normalized, and then, based on this, the first risk score and the second risk score of the target are calculated according to the above formula.

[0103] Optionally, based on any of the above embodiments, this embodiment proposes that after conducting a risk assessment, the risk assessment results can also be output. This allows security administrators to better perceive the competition between the attackers and defenders of the target object. The stronger the hacker attack, the larger the attack graph; the stronger the security administrator's anti-attack strategy, the smaller the attack graph.

[0104] Based on the same inventive concept, this application also provides a risk assessment device corresponding to the above-described risk assessment method. The specific implementation of this risk assessment device can be found in the above description of the risk assessment method, and will not be elaborated upon here.

[0105] See Figure 4 , Figure 4 This application provides an exemplary embodiment of a risk assessment device, comprising:

[0106] The first acquisition module 401 is used to acquire the attack subgraph of the target object from the attack graph;

[0107] The simplification module 402 is used to simplify the attack subgraph containing the link points to obtain the target attack subgraph;

[0108] The second acquisition module 403 is used to acquire, respectively, the first attack subgraph of the target object at a first time and the second attack subgraph of the target object at a second time from the attack subgraph of the target object that does not contain the link point and the target attack subgraph;

[0109] The first evaluation module 404 is used to perform threat evaluation processing on the first attack subgraph and the second attack subgraph respectively to obtain the first attack threat score and the second attack threat score of the target object.

[0110] The first determining module 405 is used to determine a first object threat score and a second object threat score of the target object based on the security events that occur to the target object at the first time and the second time, respectively.

[0111] The second determining module 406 is used to determine the first risk score of the target object based on the first attack threat score and the first object threat score;

[0112] The third determining module 407 is used to determine the second risk score of the target object based on the second attack threat score and the second object threat score;

[0113] The second assessment module 408 is used to assess the risk of the target object based on the first risk score and the second risk score.

[0114] Optionally, based on the above embodiments, the second evaluation module 408 in this embodiment is specifically used for:

[0115] If the first time point is earlier than the second time point, and the first risk score is higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective; if the first risk score is not higher than the second risk score, then the target object is confirmed to have a security risk.

[0116] If the first time point is later than the second time point, and the first risk score is higher than the second risk score, then the target object is confirmed to have a security risk; if the first risk score is not higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective.

[0117] If the first risk score equals the second risk score, then it is confirmed that the anti-attack strategy used by the target object is equivalent to the attack on the target object.

[0118] Optionally, based on any of the above embodiments, the first evaluation module 404 in this embodiment is specifically used to determine the threat level of each attack path in the first attack subgraph; perform weighted summation on the threat levels of each attack path in the first attack subgraph to obtain the first attack threat score; and determine the threat level of each attack path in the second attack graph; perform weighted summation on the threat levels of each attack path in the second attack subgraph to obtain the second attack threat score.

[0119] Furthermore, the aforementioned first evaluation module 404 is specifically used to determine the threat level of an attack path by summing the risk values ​​of various security events used to construct the attack path for each attack path in the first attack subgraph; and to determine the threat level of an attack path by summing the risk values ​​of various security events used to construct the attack path for each attack path in the second attack subgraph.

[0120] Optionally, based on any of the above embodiments, in this embodiment, the second determining module 406 is specifically used to calculate the first product between the set determination coefficient and the first object threat score; determine the first difference between 1 and the set determination coefficient; determine the second product between the first difference and the first attack threat score; and determine the sum of the first product and the second product as the first risk score.

[0121] The aforementioned third determining module 407 is specifically used to calculate the third product between the set determination coefficient and the second target threat score; determine the fourth product between the first difference and the second attack threat score; and determine the sum of the third product and the fourth product as the second risk score.

[0122] Based on any of the above embodiments, in this embodiment, the first determining module 405 is specifically used to sum the risk values ​​of each security event involved in the target object at the first time moment to obtain a first risk sum value; determine the ratio between the first risk sum value and the first attack threat score of the first attack subgraph as the first object threat score; sum the risk values ​​of each security event involved in the target object at the second time moment to obtain a second risk sum value; and determine the ratio between the second risk sum value and the second attack threat score of the second attack subgraph as the second object threat score.

[0123] Optionally, based on any of the above embodiments, in this embodiment, the simplification module 402 is specifically used to simplify the link points in the attack subgraph into a single node; and to obtain the target attack subgraph based on the single node, other nodes in the attack subgraph and their connection relationships.

[0124] By providing the aforementioned risk assessment device, the risk of the target object at different times can be assessed, allowing for a clearer understanding of the competition between attackers and defense strategies. This results in a more accurate risk assessment of the target object, providing valuable reference for security administrators to better ensure the security of the target object.

[0125] Based on the same inventive concept, embodiments of this application provide an electronic device, such as... Figure 5 As shown, the device includes a processor 501 and a machine-readable storage medium 502. The machine-readable storage medium 502 stores a computer program executable by the processor 501. The processor 501 is prompted by the computer program to execute the risk assessment method provided in any embodiment of this application. Furthermore, the electronic device also includes a communication interface 503 and a communication bus 504, wherein the processor 501, the communication interface 503, and the machine-readable storage medium 502 communicate with each other via the communication bus 504.

[0126] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0127] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0128] The machine-readable storage medium 502 described above can be a memory, which may include random access memory (RAM), DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0129] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0130] For embodiments of electronic devices and machine-readable storage media, since the methods involved are basically similar to those described in the foregoing method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0131] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0132] The specific implementation process of the functions and roles of each unit / module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0133] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units / modules described as separate components may or may not be physically separate. The components shown as units / modules may or may not be physical units / modules, that is, they may be located in one place or distributed across multiple network units / modules. Some or all of the units / modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0134] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A risk assessment method, characterized in that, include: Obtain the attack subgraph of the target object from the attack graph; The attack subgraph containing the node is simplified to obtain the target attack subgraph. The attack subgraph containing link points is simplified, including: simplifying the link points in the attack subgraph into a single node; From the attack subgraph of the target object that does not contain any nodes and the target attack subgraph, respectively obtain the first attack subgraph of the target object at the first time and the second attack subgraph of the target object at the second time. Threat assessment processing is performed on the first attack subgraph and the second attack subgraph respectively to obtain the first attack threat score and the second attack threat score of the target object; Based on the security events that occur to the target object at the first time and the second time respectively, determine the first object threat score and the second object threat score of the target object; Based on the first attack threat score and the first object threat score, a first risk score for the target object is determined; Based on the second attack threat score and the second object threat score, a second risk score for the target object is determined; A risk assessment is performed on the target object based on the first risk score and the second risk score; Based on the first risk score and the second risk score, a risk assessment is performed on the target object, including: If the first time point is earlier than the second time point, and the first risk score is higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective; if the first risk score is not higher than the second risk score, then the target object is confirmed to have a security risk. If the first time point is later than the second time point, and the first risk score is higher than the second risk score, then the target object is confirmed to have a security risk; if the first risk score is not higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective. If the first risk score equals the second risk score, then it is confirmed that the anti-attack strategy used by the target object is equivalent to the attack on the target object.

2. The method according to claim 1, characterized in that, Threat assessments are performed on the first attack subgraph and the second attack subgraph respectively to obtain a first attack threat score and a second attack threat score for the target object, including: Determine the threat level of each attack path in the first attack subgraph; The threat levels of each attack path in the first attack subgraph are weighted and summed to obtain the first attack threat score. Determine the threat level of each attack path in the second attack subgraph; The threat levels of each attack path in the second attack subgraph are weighted and summed to obtain the second attack threat score.

3. The method according to claim 2, characterized in that, Determining the threat level of each attack path in the first attack subgraph includes: For each attack path in the first attack subgraph, the sum of the risk values ​​of each security event used to construct the attack path is determined as the threat level of the attack path. Determine the threat level of each attack path in the second attack subgraph, including: For each attack path in the second attack subgraph, the sum of the risk values ​​of the various security events used to construct the attack path is determined as the threat level of the attack path.

4. The method according to claim 1, characterized in that, Based on the first attack threat score and the first object threat score, a first risk score for the target object is determined, including: Calculate the first product between the set determination coefficient and the first target threat score; Determine the first difference between 1 and the set determination coefficient; Determine the second product of the first difference and the first attack threat score; The sum of the first product and the second product is determined as the first risk score; Based on the second attack threat score and the second object threat score, a second risk score for the target object is determined, including: Calculate the third product between the set determination coefficient and the second object threat score; Determine the fourth product of the first difference and the second attack threat score; The sum of the third product and the fourth product is determined as the second risk score.

5. The method according to claim 1, characterized in that, Based on the security events that occur to the target object at the first time and the second time, respectively, a first object threat score and a second object threat score of the target object are determined, including: The risk values ​​of each security event involving the target object at the first moment are summed to obtain a first risk sum value; The ratio between the first risk and value and the first attack threat score of the first attack subgraph is determined as the first object threat score; The risk values ​​of each security event involving the target object at the second time point are summed to obtain a second risk sum value; The ratio between the second risk and the second attack threat score of the second attack subgraph is determined as the second object threat score.

6. The method according to claim 1, characterized in that, The attack subgraph containing the node is simplified to obtain the target attack subgraph, including: The link points in the attack subgraph are simplified to a single node; The target attack subgraph is obtained based on the single node, other nodes in the attack subgraph, and their connection relationships.

7. A risk assessment device, characterized in that, include: The first acquisition module is used to acquire the attack subgraph of the target object from the attack graph; The simplification module is used to simplify the attack subgraph containing the link points to obtain the target attack subgraph; The attack subgraph containing link points is simplified, including: simplifying the link points in the attack subgraph into a single node; The second acquisition module is used to acquire, respectively, the first attack subgraph of the target object at a first time and the second attack subgraph of the target object at a second time from the attack subgraph of the target object that does not contain the node and the target attack subgraph; The first evaluation module is used to perform threat evaluation processing on the first attack subgraph and the second attack subgraph respectively to obtain the first attack threat score and the second attack threat score of the target object. The first determining module is used to determine a first object threat score and a second object threat score of the target object based on the security events that occur to the target object at the first time and the second time, respectively. The second determining module is used to determine the first risk score of the target object based on the first attack threat score and the first object threat score; The third determining module is used to determine the second risk score of the target object based on the second attack threat score and the second object threat score; The second assessment module is used to assess the risk of the target object based on the first risk score and the second risk score. The second evaluation module is specifically used for: If the first time point is earlier than the second time point, and the first risk score is higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective; if the first risk score is not higher than the second risk score, then the target object is confirmed to have a security risk. If the first time point is later than the second time point, and the first risk score is higher than the second risk score, then the target object is confirmed to have a security risk; if the first risk score is not higher than the second risk score, then the anti-attack strategy used by the target object is confirmed to be effective. If the first risk score equals the second risk score, then it is confirmed that the anti-attack strategy used by the target object is equivalent to the attack on the target object.

8. The apparatus according to claim 7, characterized in that, The first evaluation module is specifically used to determine the threat level of each attack path in the first attack subgraph; and to perform a weighted summation of the threat levels of each attack path in the first attack subgraph to obtain the first attack threat score. And determine the threat level of each attack path in the second attack subgraph; The threat levels of each attack path in the second attack subgraph are weighted and summed to obtain the second attack threat score.

9. The apparatus according to claim 8, characterized in that, The first evaluation module is specifically used to determine the threat level of an attack path by summing the risk values ​​of each security event used to construct the attack path for each attack path in the first attack subgraph; and to determine the threat level of an attack path by summing the risk values ​​of each security event used to construct the attack path for each attack path in the second attack subgraph.

10. The apparatus according to claim 7, characterized in that, The second determining module is specifically used to calculate a first product between a set determination coefficient and a first target threat score; determine a first difference between 1 and the set determination coefficient; determine a second product between the first difference and the first attack threat score; and determine the sum of the first product and the second product as the first risk score. The third determining module is specifically used to calculate the third product between the set determination coefficient and the second target threat score; determine the fourth product between the first difference and the second attack threat score; and determine the sum of the third product and the fourth product as the second risk score.

11. The apparatus according to claim 7, characterized in that, The first determining module is specifically used to sum the risk values ​​of each security event involved in the target object at the first moment to obtain a first risk sum value; and to determine the ratio between the first risk sum value and the first attack threat score of the first attack subgraph as the first object threat score. The risk values ​​of each security event involving the target object at the second time point are summed to obtain a second risk sum value; The ratio between the second risk and the second attack threat score of the second attack subgraph is determined as the second object threat score.

12. The apparatus according to claim 7, characterized in that, The simplification module is specifically used to simplify the links in the attack subgraph into a single node; and to obtain the target attack subgraph based on the single node, the other nodes in the attack subgraph, and their connection relationships.

Images