A method for quantitatively evaluating asset risk

Abstract

The application discloses a kind of asset risk quantification evaluation methods, based on 5G+ industrial internet technology field.It includes the following steps:S1, dynamically set the initial weight of vulnerability score and security event score;S2, using the initial weight of vulnerability score, combined with CVSS score value, relevant calculation is carried out through sigmoid function, and CVSS risk score value is obtained;S3, according to the level determined by security baseline check, combined with CVSS risk score value and the initial weight of vulnerability score set, dynamic adjustment is carried out, and the final vulnerability score value is calculated;S4, set the initial weight of confidentiality, integrity and availability (referred to as CIA) three types of security events, and dynamically adjust the initial weight according to the number of each type of security event, respectively calculate the risk score of CIA type event, to obtain the final security event score value;S5, add vulnerability score value and security event score value to obtain evaluation result, i.e.asset risk score value.

Description

Technical Field

[0001] This invention relates to the field of 5G+Industrial Internet technology, specifically to a method for quantitative assessment of asset risk. Background Technology

[0002] Currently, 5G technology is a pioneer in the global digital economy strategy, driving the comprehensive realization of mobility and digitalization in all countries and human society. The Industrial Internet, based on the deep integration of next-generation information and communication technologies with the new industrial economy, represents a new type of industrial infrastructure, new industrial application models, and a new industrial ecosystem. It provides a reliable path for the networking, digitalization, and informatization of new industrialization and all other related industries. The integration of 5G technology and the Industrial Internet will promote the intelligent development of Digital China and the information society, facilitate the comprehensive upgrading and transformation of new industries, and greatly promote the progress and development of my country's new economy. Based on the R&D situation of "5G + Industrial Internet" empowering different fields, it has also played an indispensable role in promoting the development of the asset risk quantitative assessment industry. Asset risk quantitative assessment, based on relevant national management regulations and technical standards, uses the scope of risk management to identify assets, employs scientific methods and means to systematically analyze the threats and vulnerabilities faced by assets, and combines appropriate security control measures to comprehensively assess risks at both the technical and management levels. Simultaneously, the results of the risk assessment are graded, and predictions and solutions are made.

[0003] With the support of various technologies in today's fields, many different types of risk quantification assessment models have emerged, such as the KMV model, VAR model, RAROC model, and EVA model. Among them, KMV is an option model for measuring risk, but it focuses more on short-term risk than long-term risk; VAR, or risk portfolio matrix, emphasizes the correlation and diversification effect between expected loss and value at risk, but the matrix itself has adjustment problems and instability; RAROC is more often used in microeconomic risk calculations, comparing it with a cost-based ratio; EVA measures corporate performance management risk in a multi-level model, but requires collaboration among personnel at different levels and relies on historical experience. Overall, because the environment in which risk quantification models assess objects is often dynamic and easily affected by external interference, and the data collected for risk quantification assessment is often unstable, inaccurate, and incomplete, and because significant and insurmountable problems exist such as time and regional differences, existing risk quantification models struggle to provide accurate quantitative assessment and prediction. Therefore, how to provide an asset risk quantification assessment method suitable for 5G+Industrial Internet technology is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing a method for quantitative assessment of asset risk, thereby meeting the current needs for quantitative risk assessment in this field. The following technical solution is provided:

[0005] Firstly, a method for quantitatively assessing asset risk includes the following steps:

[0006] S1. Dynamically set the initial weights for vulnerability risks and security event risks, using a percentage system for the initial weights;

[0007] S2. Using the initial weights of vulnerability risk and combining them with the CVSS risk value, relevant calculations are performed using the sigmoid function.

[0008] Obtain the CVSS risk score;

[0009] S3. Determine the level based on the security baseline check, and dynamically adjust it by combining the CVSS risk score and the initial weights of the vulnerabilities, and calculate the final vulnerability score.

[0010] S4. Based on the initial weights of the security event risks set in step S1, dynamically adjust the initial weights of the three types of security events—confidentiality, integrity, and availability—and calculate the risk scores for each type of security event.

[0011] This yields the final security incident score.

[0012] S5. Add the vulnerability score and the security event score to obtain the assessment result, i.e., the asset risk score;

[0013] Furthermore, the data requirements for steps S1 and S2 include: CVSSv3.1 (Common Vulnerability Scoring System), Event CI Alevel (Confidentiality, Integrity, and Availability Type), Event Level, Full Event Interval, Status of Subsequent Event Changes and Handling, and Security Baseline Check Results. The security events mentioned in steps S3 and S4 include: Event Name, Event Type, Event Risk Score, Event Start Time, Event End Time, Event Duration, Event Frequency, Number of Normal Event Processing Attempts, and Number of Abnormal Event Processing Attempts. The asset basic attributes include: IP address, Device ID, and various security events.

[0014] Secondly, the dynamic weight setting process described in step S1 includes:

[0015] The asset risk assessment methodology uses a percentage system, with weight adjustments divided into manual input and automatic adjustment. Manual input primarily performs two functions: first, it dynamically adjusts the weights of vulnerability and security incident scores overall; second, it configures specific weight information, such as the effective time of a security incident, monitoring time window, security incident duration, incident level, incident frequency, incident status changes, and hyperparameter assignments. Automatic adjustment mainly dynamically adjusts the weights of confidentiality, integrity, and availability scores locally based on the security incident score weights. Specifically, it adjusts the weights appropriately according to the number of security incidents at each of the three CIA-level levels, thus reflecting which risk factors are more important in a particular application scenario.

[0016] Thirdly, the process of calculating the CVSS risk score in step S2 includes:

[0017] (1) Accumulate the CVSS values ​​of various vulnerabilities corresponding to each asset;

[0018] (2) The accumulated result is compressed by multiplying it by a hyperparameter h1 using the sigmoid function; the initial vulnerability score weights set in step S1 are then multiplied by the compressed result from the sigmoid function to obtain the risk score. The specific calculation process is as follows:

[0019] cvss_risk_score=2*cvss_initial_value*(sigmoid(h1*sum(cvss_score))-0.5)

[0020] Wherein, cvss_risk_score represents the risk score, cvss_initial_value represents the initial weight of the vulnerability score, and cvss_score represents the cumulative CVSS value of various asset vulnerabilities;

[0021] (3) Subtract the risk score cvss_risk_score from the initial vulnerability score weight set in step S1 to obtain the CVSS score. The specific calculation process is as follows:

[0022] cvss_score=cvss_initial_value-cvss_risk_score

[0023] Fourthly, the process of calculating the vulnerability score in step S3 includes:

[0024] (1) The grade is determined based on the baseline inspection pass rate, and the grades are divided into four categories: A, B, C, and D. The specific calculation process is as follows:

[0025] Check_grade={AifCompliance_Check_ratio>90%,

[0026] Bif90%>=Compliance_Check_ratio>75%,

[0027] Cif75%>=Compliance_Check_ratio>50%,

[0028] Dif50%>=Compliance_Check_ratio}

[0029] Specifically, when the inspection rate is greater than 90%, the baseline inspection level is set to A; when the inspection rate is greater than 75% and less than or equal to 90%, the baseline inspection level is set to B; when the inspection rate is greater than 50% and less than or equal to 75%, the baseline inspection level is set to C; and when the inspection rate is less than or equal to 50%, the baseline inspection level is set to D.

[0030] (2) Based on the corresponding baseline levels, first, the minimum value of the CVSS score and the vulnerability score weight value is taken. Then, the corresponding proportion of the vulnerability score weight value is taken. Finally, the maximum value of the two updated data is taken. The result is the final vulnerability score, final_cvss_score. The specific calculation process is as follows:

[0031] Max(cvss_initial_value*4 / 5,Min(cvss_initial_value,cvss_score)),ifCheckgrade==A,

[0032] Max(cvss_initial_value*3 / 5,Min(cvss_initial_value*4 / 5,cvss_score)),ifCheckgrade==B,

[0033] Max(cvss_initial_value*1 / 2,Min(cvss_initial_value*3 / 5,cvss_score)),ifCheckgrade==C,

[0034] Min(cvss_initial_value*1 / 2,cvss_score),ifCheckgrade==D,

[0035] Fifthly, the process of calculating the security event score in step S4 includes:

[0036] Security incidents are classified into three types according to CIA level: confidentiality security incidents, integrity security incidents, and availability security incidents. Each type of security incident is further divided into three event levels: warning, alert, and event.

[0037] (1) Set initial weights for confidentiality, integrity, and availability security events, each accounting for one-third of the initial weight of the security event score. Dynamically adjust these initial weights based on the frequency of occurrence of each type of security event. The specific design process is as follows:

[0038] ifnumberofintegrityincident>10*numberofconfidentialityincident:

[0039] Integrity_value=Integrity_value+confidentiality_value*0.4

[0040] confidentiality_value=confidentiality_value*0.6

[0041] two same process of comparison

[0042] ifnumberofintegrityincident==0&&numberofconfidentialityincident==0&&

[0043] numbeofavailabilityincident==0

[0044] The initial values ​​of confidence, integrity, and availability remain unchanged. (2) Different weights are assigned to the different event types, frequencies, durations, and states of the asset. The specific setup process is as follows:

[0045] event_level_weight={5ifeventlevel==warning,10ifeventlevel==alert,

[0046] 2ifeventlevel==event};

[0047] frequency_weight={2.5iffrequency>10,

[0048] 2iffrequency>5,

[0049] 1.5iffrequency>2,

[0050] 1else};

[0051] persistent_time_weight={2ifpersistenttime>28,

[0052] 1.5if28>persistenttime>21,

[0053] 1.3 if 21 > persistenttime > 14,

[0054] 1.1if14>persistenttime>7,

[0055] 1 if persistent time < 7}

[0056] state_change_weight={0ifnum(abnormal)==0,

[0057] 2ifnum(normal)>=num(abnormal)

[0058] else4}

[0059] Where: event_level_weight represents the event level weight, frequency_weight represents the event occurrence frequency weight, persistent_time_weight represents the event duration weight (duration in days), and state_change_weight represents the event state weight.

[0060] (3) Calculate the risk value of an asset based on its IP address and the CIA type of the security event. Multiply the corresponding event level, frequency of occurrence, and duration quantification values ​​respectively, and add the event status quantification value to the result. Since an asset may have multiple security events, a summation operation based on the event name is required. The specific calculation process is as follows: ip_risk a =sum(event_level_weight*frequency_weight*persistent_time_weight+state_change_weight)ip_risk i=sum(event_level_weight*frequency_weight*persistent_time_weight+state_change_weight)ip_risk c =sum(event_level_weight*frequency_weight*persistent_time_weight+state_change_weight)

[0061] Among them, ip_risk a ip_risk represents the risk value of an asset's availability event type. i ip_risk represents the risk value for a specific asset integrity event type. c This indicates the risk value for a specific type of event related to the confidentiality of an asset.

[0062] (4) Multiply the three types of asset security event values ​​obtained in the previous step by the hyperparameter h2, compress them using the sigmoid function, and multiply the processed results by the corresponding initial weights for the three types of security events to obtain the security event score. The specific calculation process is as follows:

[0063] event_risk a =2*initial_value a *(sigmoid(h2*ip_risk a -0.5)

[0064] event_risk i =2*initial_value i *(sigmoid(h2*ip_risk i -0.5)

[0065] event_risk c =2*initial_value c *(sigmoid(h2*ip_risk c -0.5)

[0066] Among them, initial_value a The initial_value represents the dynamically adjusted initial weights of availability security events. i The initial_value represents the dynamically adjusted initial weights of integrity-safe events. c The event_risk represents the dynamically adjusted initial weights of confidentiality and security events. aThe event_risk represents the quantified availability security event risk value. i The event_risk represents the quantified integrity security event risk value. c This represents the quantified risk value of confidentiality and security incidents.

[0067] (5) Change the event_risk from the previous step a event_risk i and event_risk c Summation is performed by subtracting the summed value from the initial value of the security event to obtain the final quantified security event risk value. The specific calculation process is as follows:

[0068] event_risk_score=event_initial_value-(event_risk a +event_risk i +event_risk c )

[0069] Where event_initial_value is the initial weight of the security event risk, and event_risk_score is the quantified security event score.

[0070] Sixthly, the process of calculating the asset risk score in step S5 includes:

[0071] The final vulnerability score and the quantified security event score are added together to obtain the assessment result, i.e., the asset risk score. The specific calculation process is as follows:

[0072] asset_risk_score=final_cvss_score+event_risk_score Attached Figure Description

[0073] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0074] The technical solutions adopted in this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described examples are only a part of the asset risk quantification and assessment method, and not a complete whole. All implementation cases based on this invention fall within the patent protection scope of this invention.

[0075] Step 1: Design the model framework. The overall framework of the asset risk assessment method is mainly divided into three parts: the weight adjustment module, the vulnerability module, and the threat module. The vulnerability model is divided into two parts: the CVSS scoring module and the baseline detection module. The threat module is divided into three sub-modules according to the nature of the CIA: the confidentiality scoring module, the integrity scoring module, and the availability scoring module.

[0076] Step 2: Input and Output. Model input values ​​include vulnerability and security event weights (to reflect the importance of each risk factor in the scenario), and risk-related data files (asset-related attribute values, security event-related attribute values, and baseline detection data). Model output is the specific asset valuation value calculated and integrated based on each part of the model.

[0077] Step 3: Scenario Design Constraints. In this model design and implementation, each asset is used as a basic object. An asset base class is designed, with attributes including IP address, device ID, and various security events. Each security event category contains information required by the model, such as event name, event type, event risk score, event start time, event end time, event duration, event frequency, and event status. In actual operation, the model essentially never stops. The control class or main process should periodically retrieve data from the database according to a set time window to obtain the latest data on asset vulnerabilities, security baseline detection, and security events within the specified time period. It should also manipulate the asset entity classes to periodically update their relevant attributes for risk quantification.

[0078] Step 4: Data Design Constraints. The model uses security incident data and vulnerability data. Some security incidents occur infrequently but pose a significant threat. Incident frequency itself should be taken into account; therefore, the model includes constraints on the weights assigned to the frequency of incidents.

[0079] Step 5: Design the model class. The control class periodically retrieves newly occurring security events and vulnerability records. Then, based on the found or created asset objects, it updates their attribute values ​​and stores the corresponding security events and vulnerability records in a temporary database. Every certain period of time, the control class retrieves the temporary database, removes expired data, and updates the asset object information.

[0080] Step 6: Set Hyperparameters. The CVSS scoring module accumulates the CVSS values ​​for each type of vulnerability for each asset, and then multiplies the accumulated result by a hyperparameter h1 using the sigmoid function. The threat module multiplies the event level, frequency of occurrence, and duration quantification values, adds the event state quantification value, multiplies by the hyperparameter h2, and finally compresses the result using the sigmoid function. When setting the hyperparameter h1, the maximum value of h1*sum(cvss_score) should be around 5, so that the sigmoid function value is close to 1. For example, the sum of the cvss_scores for the IP address {192.168.56.170} in the asset table is 55.4, so setting h1 to 0.1 is more effective, and the sigmoid function has greater discriminative power. Similarly, the same method is used when setting the hyperparameter h2.

[0081] Example illustration:

[0082] Asset 1 corresponds to IP 192.168.4.141, and Asset 2 corresponds to IP 192.168.0.198. Assuming their baseline pass rates are 72% and 91% respectively, for simplicity, the cumulative CVSS value for Asset 1 is 1609, and the cumulative CVSS value for Asset 2 is 364. Assets 1 and 2 only have confidentiality-related security events. Assuming Asset 1 corresponds to three risk events named S7comm:PLC Read Var, S7comm:Get PLC status-START, and S7comm:Get PLC status, and taking S7comm:PLC Read Var as an example, the event level is "event," the frequency is once, the duration is less than seven days, and the status is null. The attributes of the risk events named S7comm:Get PLC status-START and S7comm:Get PLC status for Asset 1 are not detailed here, nor are the risk events and their attributes for Asset 2. The asset risk has been quantitatively assessed as follows:

[0083] ① The initial weights of vulnerability risk and security event risk can be dynamically set. For example, the initial weight of vulnerability risk can be set to 40 (cvss_initial_value=40), and the initial weight of security event risk can be set to 60 (event_initial_value=60).

[0084] ② Calculate the CVSS scores (cvss_score) for Asset 1 and Asset 2. Using cvss_risk_score = 2 * cvss_initial_value * (sigmoid(h1 * sum(cvss_score)) - 0.5), set the hyperparameter h1 to 0.0025, and substitute the CVSS scores of Asset 1 and Asset 2 into the sum of their CVSS values, i.e., cvss_risk_score1 = 38.5929, cvss_risk_score2 = 17.0400. Using cvss_score = cvss_initial_value - cvss_risk_score, we obtain the CVSS scores for Asset 1 and Asset 2, i.e., cvss_score1 = 1.4071, cvss_score2 = 22.9600;

[0085] ③ Determine which level (A, B, C, D) asset 1 and asset 2 belong to based on the baseline check pass rate:

[0086] Check_grade={A,if Compliance Check ratio>90%,

[0087] B,if 90%>=Compliance Check ratio>75%,

[0088] C,if 75%>=Compliance Check ratio>50%,

[0089] D,if 50%>=Compliance Check ratio}

[0090] Given baseline pass rates of 72% and 91% respectively, Asset 1 is classified as Grade C and Asset 2 as Grade A. Based on the corresponding baseline grades, combined with the CVSS score and the initial weighting of the vulnerability score, the following criteria are met:

[0091] Max(cvss_initial_value*4 / 5,Min(cvss_initial_value,cvss_score)),ifCheck grade==A,

[0092] Max(cvss_initial_value*3 / 5,Min(cvss_initial_value*4 / 5,cvss_score)),ifCheck grade==B,

[0093] Max(cvss_initial_value*1 / 2,Min(cvss_initial_value*3 / 5,cvss_score)),ifCheck grade==C,

[0094] Min(cvss_initial_value*1 / 2,cvss_score),if Check grade==D,

[0095] The final vulnerability scores for Asset 1 and Asset 2 were calculated as final_cvss_score1 = 20 and final_cvss_score2 = 32.

[0096] ④ As can be seen from ①, the initial weight of a security event is 60. Therefore, the initial weights of confidentiality, integrity, and availability security events are 20, i.e., initial_value. c =20, initial_value i =20, initial_value a =20. For Asset 1 and Asset 2, which only have security events of the confidentiality type, according to the CIA type of security events, the initial values ​​of confidentiality, integrity, and availability security events need to be dynamically adjusted through:

[0097] if number of integrity incident>10*number of confidentialityincident:

[0098] initial_value i =initial_value c +initial_value c *0.4

[0099] initial_value c =initial_value c *0.6

[0100] two same process of comparison

[0101] if number of integrity incident==0&&number of confidentialityincident==0&&

[0102] number of availability incident==0

[0103] The initial_value c initial_value i and initial_value a remain unchanged

[0104] The initial values ​​for confidentiality, integrity, and availability security events for Asset 1 and Asset 2 after dynamic adjustment are calculated as follows:

[0105] initial_value c =36, initial_value a =12, initial_value i =12.

[0106] ⑤ Different weights are assigned to the different event levels, frequencies, durations, and states of Asset 1 and Asset 2, and the risk values ​​of Asset 1 and Asset 2 are calculated sequentially according to the CIA (Contingency Event) type. (By:)

[0107] event_level_weight={5if event level==warning,10if event level==alert,

[0108] 2if event level==event};

[0109] frequency_weight={2.5if frequency>10,

[0110] 2if frequency>5,

[0111] 1.5if frequency>2,

[0112] 1else};

[0113] persistent_time_weight={2if persistent time>28,

[0114] 1.5if 28>persisten ttime>21,

[0115] 1.3 if 21>persistent time>14,

[0116] 1.1 if 14 > persistent time > 7,

[0117] 1 if persistent time < 7}

[0118] state_change_weight={0if num(abnormal)==0,

[0119] 2if num(normal)>=num(abnormal)

[0120] else 4}

[0121] The attribute weights for the risk event named S7comm:PLC Read Var for asset 1 are calculated as follows: event_level_weight = 2, frequency_weight = 1, persistent_time_weight = 1, state_change_weight = 4. This is achieved using ip_risk. c The risk event value for asset 1 named S7comm:PLC Read Var is calculated using the formula: sum(event_level_weight*frequency_weight*persistent_time_weight+state_change_weight). The result is 2*1*1+4=6. Using the same method, risk values ​​are calculated for asset 1 named S7comm:Get PLC status-START and S7comm:GetPLC status. Assuming the results are 9 and 6 respectively, the confidentiality event type risk value for asset 1 is: ip_risk. c =6+9+6=21.

[0122] Set h2 to 0.025 and utilize event_risk c =2*initial_value c *(sigmoid(h2*ip_risk c )-0.5), calculate the confidentiality security event risk value of asset 1 after quantification: event_risk c =9.2388. Using the same method, the confidentiality security event risk value of asset 2 after quantification is calculated. It is assumed that the confidentiality security event risk value of asset 2 after quantification is 23.3938.

[0123] ⑥ Asset 1 and Asset 2 only have security events of the confidentiality type. Therefore, the quantified availability security event risk value and the quantified integrity security event risk value of Asset 1 and Asset 2 are both 0, i.e., event_risk.a =0 and event_risk i =0. Use event_risk_score=event_initial_value-(event_risk a +event_risk i +event_risk c ), calculate the event risk score for asset 1 and asset 2:

[0124] Asset 1: event_risk_score1 = 60 - (9.2388 + 0 + 0) = 50.7612

[0125] Asset 2: event_risk_score1 = 60 - (23.3938 + 0 + 0) = 36.6062

[0126] ⑦ Add the final vulnerability scores and the quantified security event scores of Asset 1 and Asset 2 respectively to obtain the asset risk quantification score. Using asset_risk_score = final_cvss_score + event_risk_score, the risk quantification score of Asset 1 is calculated as: 20 + 50.7612 = 70.7612, and the risk quantification score of Asset 2 is calculated as: 32 + 36.6062 = 68.6062.

[0127] All combinations of the technical features described above, provided there are no contradictions, should be considered within the scope of this specification. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this patent application should be determined by the appended claims.

Claims

1. A method for quantitatively assessing asset risk, comprising the following steps: S1. Dynamically set the initial weights for vulnerability scores and security event scores, wherein the initial weights are based on a percentage system; S2. Using the initial weights of vulnerability risk and the CVSS risk value, calculate the CVSS risk using the sigmoid function. The scoring value, wherein the process of calculating the CVSS risk score includes: (1) accumulating the CVSS values ​​of various vulnerabilities corresponding to each asset, (2) multiplying the accumulated result by the hyperparameter h1 and compressing it by the sigmoid function, and then multiplying it by the initial weight of the vulnerability score set in S1 to obtain the risk score, (3) subtracting the risk score from the initial weight of the vulnerability score set in S1 to obtain the CVSS risk score; S3. Determine the baseline level based on the security baseline check pass rate, and dynamically adjust it in conjunction with the CVSS risk score value and the set initial vulnerability score weight to obtain the final vulnerability score value. The calculation method is as follows: According to the corresponding different baseline levels, first take the minimum value of the CVSS score value and the vulnerability score weight value, then take the corresponding proportion of the vulnerability score weight value, and finally take the maximum value of the two updated data. The result is the final vulnerability score value. S4. Calculate the security event score. The security events are divided into three types according to the CIA level: confidentiality security events, integrity security events, and availability security events. Each type of security event is further divided into three event levels: warning, alert, and event. The process of calculating the security event score includes: (1) setting the initial weights of the three types of security events: confidentiality, integrity, and availability, and dynamically adjusting the initial weights according to the occurrence frequency of each type of security event; (2) quantifying the different event types, occurrence frequencies, durations, and event states of the assets respectively, and assigning different weights; (3) for each asset IP, multiplying the corresponding event level, occurrence frequency, and duration quantification values ​​according to the CIA type and adding the event state quantification value. Since a certain asset may have multiple security events, sum them according to the event name. Multiply the result by the hyperparameter h2 and compress it through the sigmoid function. Then multiply the processing result by the dynamically adjusted initial weights of each type of event to obtain the CIA event score; (4) finally subtracting the three types of CIA from the total initial weights of the security events. The sum of the event score values ​​yields the final quantified security event score. S5. Add the vulnerability score and the security event score to obtain the asset risk score.

2. The asset risk quantification assessment method according to claim 1, characterized in that, The dynamic weight setting in step S1 includes two types: manual input and automatic adjustment. The manual input is used to dynamically adjust the weights of vulnerability scores and security event scores as a whole, and to configure the effective time of security events, monitoring time windows, security event duration, event level, event frequency, event status changes, and hyperparameter values. The automatic adjustment is used to dynamically adjust the weights of confidentiality scores, integrity scores, and availability scores locally according to the security event score weights. This allows for appropriate adjustment of the weights based on the number of security events at each of the three CIA levels, thereby reflecting which risk factors are more important in a particular application scenario.

3. The asset risk quantification assessment method according to claim 1, characterized in that, In step S3, the baseline pass rate is first used to determine the level, which is divided into four categories: A, B, C, and D. Then, based on the corresponding baseline level, the CVSS score and vulnerability score weight value are combined to calculate the final vulnerability score.

4. The asset risk quantification assessment method according to claim 1, characterized in that, Model input refers to the proportion of vulnerabilities and security events, which reflects the importance of each risk factor in the scenario; risk-related data files include asset-related attribute values, security event-related attribute values, and baseline detection-related data; model output refers to the specific asset valuation value calculated and integrated based on each part of the model.

5. The asset risk quantification assessment method according to claim 1, characterized in that, The main process of the method is as follows: the control class periodically obtains newly occurring security events and vulnerability records, then updates the attribute values ​​of the asset objects found or created, and stores the corresponding security events and vulnerability records in a temporary database. After a long event cycle, the control class will retrieve the temporary database, remove expired data, and update the asset object information.

Images