A network inspection risk vulnerability intelligent evaluation method, system and medium

Abstract

The present application provides a method, system and medium for intelligent evaluation of network patrol risk vulnerabilities, which belongs to the field of big data and network operation technology. The method includes: obtaining the patrol information and behavior log information of the subnet and extracting data, processing with the preset network risk control safety index data to obtain the risk vulnerability exceeding standard data and the operation risk exceeding standard data, and comparing with the operation risk exceeding standard distribution data to obtain the subnet group risk exceeding standard deviation index, and then correcting the operation risk exceeding standard data in combination with the environmental risk interference coefficient and the system steady-state correction coefficient to obtain the operation safety risk control deviation index, and then comparing with the security risk assessment correction threshold to evaluate the subnet risk status; thereby, based on big data, the network operation risk vulnerability situation is combined with the environmental risk interference and system stability situation to obtain the risk control deviation index to evaluate the risk exceeding standard situation of the network operation, and realize the inspection and evaluation of the network security operation status through big data.

Description

Technical Field

[0001] The present application relates to the field of big data and network operation technology, and in particular to an intelligent evaluation method, system and medium for network patrol risk vulnerabilities. Background Art

[0002] Network operation needs to remain safe and stable. Inspection of risk loopholes in network operation is an important means to ensure its safe operation. However, due to the characteristics of wide coverage, diverse risk loopholes, and many influencing and interfering factors, the detection and evaluation of network operation security is complex and non-singular. In addition, due to the differences and interference in the working environment of each branch of the network, the operation quality of the network system also has an impact and interference on the safe operation results of each branch of the network. Therefore, it is difficult to effectively evaluate the complex and diverse parameter indicators involved in network operation, as well as environmental conditions and system operating conditions. There is a lack of methods to effectively evaluate the network according to its operation status, combined with the risk management status, environment, and system operation status, and accurately judge the risk loophole status of network security operation.

[0003] In view of the above problems, effective technical solutions are urgently needed. Summary of the invention

[0004] The purpose of this application is to provide an intelligent assessment method, system and medium for network patrol risk vulnerabilities, which processes the network operation risk vulnerability situation in combination with environmental risk interference and system stability through big data to obtain a risk control deviation index, conduct patrol assessments on the risk vulnerability exceeding the standard of network security operation, and realize the evaluation of network security operation status through big data.

[0005] This application first provides an intelligent evaluation method for network patrol risk vulnerabilities, including the following steps:

[0006] Obtaining subnet patrol information and subnet behavior log information of each subnet of a preset network system within a preset time period, and extracting subnet patrol feature data of the subnet from the subnet patrol information and extracting subnet risk behavior log data from the subnet behavior log information;

[0007] Obtaining the preset network risk control security index data of the preset network system, and processing it with the subnet inspection feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then processing the risk vulnerability exceeding standard data in combination with the subnet risk behavior log data to obtain the operation risk exceeding standard data;

[0008] Obtaining the distribution data of the operation risk exceeding the standard of each sub-network within the preset time period, and comparing it with the operation risk exceeding the standard data, to obtain the sub-network group risk exceeding the standard deviation index;

[0009] Acquire the network environment dynamic detection data of the sub-network within the preset time period and the system dynamic inspection data of the preset network system, process the network environment dynamic detection data and the system dynamic inspection data respectively, and obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively;

[0010] Correct the operation risk exceeding standard data according to the environmental risk interference coefficient, the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork;

[0011] Obtaining a preset security risk assessment threshold of the subnetwork, and performing correction processing on the operational risk exceeding distribution data to obtain a security risk assessment correction threshold;

[0012] A threshold comparison is performed based on the operational security risk control deviation index of the sub-network and the security risk assessment correction threshold, and the risk assessment status of the sub-network is evaluated based on the threshold comparison result.

[0013] Optionally, in the intelligent assessment method for network patrol risk vulnerabilities described in the present application, the obtaining of subnet patrol information and subnet behavior log information of each subnet of the preset network system within a preset time period, and extracting subnet patrol feature data of the subnet from the subnet patrol information and extracting subnet risk behavior log data from the subnet behavior log information include:

[0014] Obtain subnet inspection information of each subnet in a preset network system within a preset time period, and extract subnet inspection feature data based on the subnet inspection information, including facility failure rate data, system vulnerability risk level data, server stability data, and storage information loss rate data;

[0015] The subnet behavior log information of the subnet within a preset time period is obtained, and the subnet risk behavior log data is extracted, including the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms.

[0016] Optionally, in the intelligent assessment method for network patrol risk vulnerabilities described in the present application, the preset network risk control security index data of the preset network system is obtained, and the data is processed with the subnet patrol feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then the risk vulnerability exceeding standard data is combined with the subnet risk behavior log data to obtain the operation risk exceeding standard data, including:

[0017] Obtaining preset network risk control safety index data of the preset network system through a network operation monitoring database, including facility failure rate index data, system vulnerability risk level index data, server stability index data, and storage information loss rate index data;

[0018] Processing the preset network risk control security indicator data and the subnet inspection feature data to obtain the risk vulnerability exceeding specification data of the subnet;

[0019] The risk vulnerability exceeding standard data is processed in combination with the external abnormal alarm frequency, the access intrusion attack frequency and the firewall response alarm frequency to obtain the operation risk exceeding standard data of the sub-network;

[0020] The calculation formula for the operation risk exceeding standard data is:

[0021] ;

[0022] in, To run risk exceeding data, For risk vulnerabilities exceeding the standard data, , , They are the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms. , , , is the preset characteristic coefficient.

[0023] Optionally, in the intelligent assessment method for network patrol risk vulnerabilities described in the present application, the obtaining of the operation risk exceeding standard distribution data of each sub-network within the preset time period and comparing with the operation risk exceeding standard data to obtain the sub-network group risk exceeding standard deviation index includes:

[0024] Obtaining the distribution data of the operation risk exceeding the standard of each sub-network within the preset time period, including the operation risk exceeding standard data set of multiple sub-networks;

[0025] Comparing the operation risk exceeding standard data set with the operation risk exceeding standard data of the sub-network, obtaining a sub-network group risk exceeding standard deviation index of the sub-network;

[0026] The calculation formula of the subnet group risk excess deviation index is:

[0027] ;

[0028] in, is the risk excess deviation index of the subnet group, is the operating risk exceeding standard data of the i-th sub-network, is the preset characteristic coefficient of the ith sub-network, is the preset deviation correction factor, is the operational risk exceeding standard data set, n is the number of sub-networks included in the preset network system, is the operating risk exceeding standard data of the jth sub-network among the n sub-networks, is the preset characteristic coefficient of the jth sub-network among the n sub-networks.

[0029] Optionally, in the intelligent assessment method of network patrol risk vulnerabilities described in the present application, the obtaining of the network environment dynamic detection data of the subnetwork within the preset time period and the system dynamic patrol data of the preset network system, and processing the network environment dynamic detection data and the system dynamic patrol data respectively to obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively include:

[0030] Obtaining dynamic network environment detection data of the sub-network within the preset time period, including virus dynamic activity data, access intrusion threat level data, and abnormal interference frequency data;

[0031] Acquire system dynamic inspection data of the preset network system within the preset time period, including system defense level data, system overload data, and system link failure rate data;

[0032] The environmental risk interference coefficient is obtained by calculating and processing the virus dynamic activity data, the access intrusion threat level data, and the abnormal interference frequency data through a preset environmental risk assessment model;

[0033] The virus dynamic activity data, access intrusion threat level data and abnormal interference frequency data are calculated and processed through a preset system steady-state evaluation model to obtain a system steady-state correction coefficient.

[0034] Optionally, in the intelligent assessment method for network patrol risk vulnerabilities described in the present application, the correction processing of the operation risk exceeding standard data is performed according to the environmental risk interference coefficient and the system steady-state correction coefficient and the subnet group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnet, including:

[0035] Correcting the operation risk exceeding standard data of the subnetwork according to the environmental risk interference coefficient, the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork;

[0036] The correction calculation formula of the operation safety risk control deviation index is:

[0037] ;

[0038] in, To run the security risk control deviation index, is the environmental risk interference coefficient, is the system steady-state correction coefficient, is the risk excess deviation index of the subnet group, To run risk exceeding data, , , , is the preset characteristic coefficient.

[0039] Optionally, in the intelligent assessment method for network patrol risk vulnerabilities described in the present application, the obtaining of a preset security risk assessment threshold of the subnetwork and performing correction processing with the operation risk exceeding standard distribution data to obtain a security risk assessment correction threshold includes:

[0040] Obtaining a preset security risk assessment threshold of the sub-network through the network operation monitoring database;

[0041] Performing weighted correction according to the preset safety risk assessment threshold and the operational risk exceeding data set to obtain a safety risk assessment correction threshold;

[0042] The correction formula of the security risk assessment correction threshold is:

[0043] ;

[0044] in, Modify thresholds for security risk assessment, is the operational risk exceeding standard data set, n is the number of sub-networks included in the preset network system, To preset the security risk assessment threshold, is the preset characteristic coefficient.

[0045] In a second aspect, the present application further provides a network patrol risk vulnerability intelligent assessment system, the system comprising: a memory and a processor, the memory comprising a program of an intelligent assessment method for network patrol risk vulnerabilities, and the program of the intelligent assessment method for network patrol risk vulnerabilities is executed by the processor to implement the following steps:

[0046] Obtaining subnet patrol information and subnet behavior log information of each subnet of a preset network system within a preset time period, and extracting subnet patrol feature data of the subnet from the subnet patrol information and extracting subnet risk behavior log data from the subnet behavior log information;

[0047] Obtaining the preset network risk control security index data of the preset network system, and processing it with the subnet inspection feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then processing the risk vulnerability exceeding standard data in combination with the subnet risk behavior log data to obtain the operation risk exceeding standard data;

[0048] Obtaining the distribution data of the operation risk exceeding the standard of each sub-network within the preset time period, and comparing it with the operation risk exceeding the standard data, to obtain the sub-network group risk exceeding the standard deviation index;

[0049] Acquire the network environment dynamic detection data of the sub-network within the preset time period and the system dynamic inspection data of the preset network system, process the network environment dynamic detection data and the system dynamic inspection data respectively, and obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively;

[0050] Correct the operation risk exceeding standard data according to the environmental risk interference coefficient, the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork;

[0051] Obtaining a preset security risk assessment threshold of the subnetwork, and performing correction processing on the operational risk exceeding distribution data to obtain a security risk assessment correction threshold;

[0052] A threshold comparison is performed based on the operational security risk control deviation index of the sub-network and the security risk assessment correction threshold, and the risk assessment status of the sub-network is evaluated based on the threshold comparison result.

[0053] Optionally, in the intelligent assessment system for network patrol risk vulnerabilities described in the present application, the obtaining of subnet patrol information and subnet behavior log information of each subnet of the preset network system within a preset time period, and extracting subnet patrol feature data of the subnet from the subnet patrol information and extracting subnet risk behavior log data from the subnet behavior log information include:

[0054] Obtain subnet inspection information of each subnet in a preset network system within a preset time period, and extract subnet inspection feature data based on the subnet inspection information, including facility failure rate data, system vulnerability risk level data, server stability data, and storage information loss rate data;

[0055] The subnet behavior log information of the subnet within a preset time period is obtained, and the subnet risk behavior log data is extracted, including the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms.

[0056] The third aspect of the present application provides a computer-readable storage medium, which includes a program for an intelligent assessment method for network patrol risk vulnerabilities. When the program for an intelligent assessment method for network patrol risk vulnerabilities is executed by a processor, the steps of the intelligent assessment method for network patrol risk vulnerabilities as described in any one of the above items are implemented.

[0057] The intelligent assessment method, system and medium for network patrol risk vulnerabilities provided in the present application obtain subnet patrol information and subnet behavior log information and extract subnet patrol feature data and subnet risk behavior log data, and process them with preset network risk control security indicator data to obtain risk vulnerability exceeding standard data and operation risk exceeding standard data, and compare them with the operation risk exceeding standard distribution data to obtain the subnet group risk exceeding standard deviation index, and then correct the operation risk exceeding standard data in combination with the environmental risk interference coefficient and the system steady-state correction coefficient obtained by processing the network environment dynamic detection data and the system dynamic patrol data respectively to obtain the operation safety risk control deviation index, and then compare the threshold with the security risk assessment correction threshold obtained by correcting the operation risk exceeding standard distribution data to evaluate the risk status of the subnetwork; thereby, based on big data, the network operation risk vulnerability situation is processed in combination with the environmental risk interference and the system stability situation to obtain the risk control deviation index, and the risk vulnerability exceeding standard situation of network security operation is inspected and evaluated, so as to realize intelligent assessment of network security operation status through big data. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A flowchart of the intelligent evaluation method for network inspection risk vulnerabilities of this application;

[0059] Figure 2 A flowchart of obtaining subnet patrol feature data and subnet risk behavior log data for the intelligent evaluation method of network patrol risk vulnerabilities of this application;

[0060] Figure 3 A flowchart of obtaining operation risk exceeding standard data for the intelligent evaluation method of network inspection risk vulnerabilities of this application;

[0061] Figure 4 This is a schematic diagram of the structure of the intelligent assessment system for network patrol risk vulnerabilities of this application. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present application.

[0063] Please refer to Figure 1, which is a flow chart of a method for intelligent assessment of network patrol risk vulnerabilities of the present application. The intelligent assessment method is used in terminal devices, such as computers, mobile phone terminals, etc., and specifically includes the following steps: S101, obtaining subnet patrol information and subnet behavior log information of each subnet of the preset network system within a preset time period, and extracting the subnet patrol feature data of the subnet from the subnet patrol information and extracting the subnet risk behavior log data from the subnet behavior log information; S102, obtaining the preset network risk control security indicator data of the preset network system, and processing it with the subnet patrol feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then processing the risk vulnerability exceeding standard data in combination with the subnet risk behavior log data to obtain the operation risk exceeding standard data; S103, obtaining the operation risk exceeding standard distribution data of each subnet within the preset time period, and comparing it with the operation risk exceeding standard data to obtain the subnet group risk exceeding standard deviation index; S104. Obtain the network environment dynamic detection data of the sub-network within a preset time period and the system dynamic inspection data of the preset network system, process the network environment dynamic detection data and the system dynamic inspection data respectively, and obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively; S105. Correct the operation risk exceeding standard data according to the environmental risk interference coefficient and the system steady-state correction coefficient and the sub-network group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the sub-network; S106. Obtain the preset security risk assessment threshold of the sub-network, and correct it with the operation risk exceeding standard distribution data to obtain the security risk assessment correction threshold; S107. Perform threshold comparison based on the sub-network operation safety risk control deviation index and the security risk assessment correction threshold, and evaluate the risk assessment status of the sub-network according to the threshold comparison result.

[0064] It should be noted that since the network system contains multiple branched sub-networks, each sub-network has different operating security risks due to different functions, tasks, and configurations, and the operating status of each sub-network is also affected and interfered by the network operating environment and system operating status. In addition, each sub-network has different risk vulnerability exceeding standards due to its own hardware configuration, server configuration, operating execution task volume, and docking service security. As a result, there is a situation where the exceeding degree of the operating risk vulnerability of a single sub-network deviates greatly from the exceeding degree of all sub-networks. Therefore, the risk exceeding standard of this single sub-network deviates from the sub-network group. The overall commonality of the risk exceeding the standard of the whole system leads to the situation that the risk exceeding the standard is large between each independent single sub-network. Therefore, in order to accurately evaluate the operation risk of each individual sub-network, the environmental conditions and system operation conditions of the sub-network are comprehensively considered in combination with the deviation of the operation risk exceeding the standard between the single sub-network and the sub-network group. The accurate risk vulnerability assessment results of each sub-network are obtained through correction. The sub-network inspection feature data and sub-network risk behavior log data of each sub-network of the preset network system within the preset time period are obtained and combined with the preset network risk control security indicator data for processing to obtain the risk vulnerability exceeding standard data of the sub-network and the operation risk exceeding standard data The data of the operation risk exceeding the standard of a single sub-network is then compared with the distribution data of the operation risk exceeding the standard of each sub-network to obtain the discrete index of the deviation degree of the risk exceeding the standard between a single sub-network and the sub-network group. Then, the network environment dynamic detection data of the sub-network and the system dynamic inspection data of the network system are processed separately to obtain the environmental risk interference coefficient and the system steady-state correction coefficient, that is, the influence coefficient of the environment in which the sub-network is located on the risk vulnerability and the influence coefficient of the system operation stability on the sub-network. Then, the environmental risk interference coefficient and the system steady-state correction coefficient are combined with the sub-network group risk exceeding standard deviation index to correct the operation risk exceeding standard data. The operational safety risk control deviation index of the sub-network is obtained, and then a threshold comparison is performed with the security risk assessment correction threshold obtained by correcting the preset threshold according to the operational risk exceeding distribution data. The risk assessment status of the sub-network is evaluated according to the threshold comparison result. If the operational safety risk control deviation index meets the threshold comparison requirement of the security risk assessment correction threshold, the operational safety risk of the sub-network does not exceed the control deviation range, and the sub-network operation is safe. If it does not meet the threshold comparison requirement, it indicates that the operational safety risk vulnerability of the sub-network exceeds the control deviation range, and the security risk vulnerability of the sub-network operation exceeds the standard, thereby realizing the evaluation of the risk vulnerability exceeding the standard of network security operation.

[0065] Figure 2The flowchart of the intelligent assessment method of network patrol risk vulnerabilities of the present application for obtaining subnet patrol feature data and subnet risk behavior log data. The subnet patrol information and subnet behavior log information of each subnet of the preset network system within a preset time period are obtained, and the subnet patrol feature data of the subnet is extracted from the subnet patrol information and the subnet risk behavior log data is extracted from the subnet behavior log information. Specifically, S201, obtain the subnet patrol information of each subnet in the preset network system within a preset time period, and extract the subnet patrol feature data according to the subnet patrol information, including facility failure rate data, system vulnerability danger level data, server stability data and storage information loss rate data; S202, obtain the subnet behavior log information of the subnet within the preset time period, and extract the subnet risk behavior log data, including the frequency of external abnormal alarms, the frequency of access intrusion attacks and the frequency of firewall response alarms.

[0066] It should be noted that in order to obtain the risk vulnerability exceeding standard of the safe operation status of each inspected subnet, it is first necessary to obtain the subnet inspection information of each subnet in the preset network system within a certain preset time period and extract the subnet inspection feature data. The subnet inspection information is the relevant information obtained by inspecting the facility operation, system vulnerabilities, server operation and storage information of the subnet. The obtained subnet inspection feature data includes data reflecting the facility failure rate of the subnet, the risk level of vulnerabilities in the system, the operation stability monitored by the server operation, and the loss rate of related storage information. At the same time, the subnet behavior log information of the subnet is obtained and the subnet risk behavior log data is extracted. The subnet behavior log information is the log information obtained by recording the behavior of the subnet's docking service, external access anomalies and firewall alarms. It reflects the record log of the subnet-related behavior. The subnet risk behavior log data includes the frequency of abnormal alarms of external services, the frequency of intrusion attacks recorded by external access alarms, and the frequency of response alarms issued by the firewall.

[0067] Figure 3A flowchart of obtaining operational risk exceeding standard data for the intelligent assessment method of network patrol risk vulnerabilities of the present application. Obtain the preset network risk control security index data of the preset network system, and process it with the subnet patrol feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then process the risk vulnerability exceeding standard data in combination with the subnet risk behavior log data to obtain the operational risk exceeding standard data, specifically: S301, obtain the preset network risk control security index data of the preset network system through the network operation monitoring database, including facility failure rate index data, system vulnerability danger level index data, server stability index data, and storage information loss rate index data; S302, process according to the preset network risk control security index data and the subnet patrol feature data to obtain the risk vulnerability exceeding standard data of the subnet; S303, process according to the risk vulnerability exceeding standard data in combination with the external abnormal alarm frequency, access intrusion attack frequency, and firewall response alarm frequency to obtain the operational risk exceeding standard data of the subnet;

[0068] The calculation formula for the operation risk exceeding the standard is:

[0069] ;

[0070] in, To run risk exceeding data, For risk vulnerabilities exceeding the standard data, , , They are the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms. , , , is the preset characteristic coefficient.

[0071] It should be noted that after obtaining the subnet inspection feature data and subnet risk behavior log data of the subnet, in order to evaluate the risk exceeding the standard of the subnet operation, it is necessary to obtain the preset network risk control security indicator data of the preset network system through the preset network operation monitoring database, and then process the subnet inspection feature data and the preset network risk control security indicator data through the calculation formula to obtain the risk vulnerability exceeding standard data, that is, to calculate and process the various feature data and indicator data obtained from the subnet inspection to obtain measurement data reflecting the risk vulnerability exceeding standard of the subnet operation. In order to obtain accurate data on the risk exceeding standard during the operation of the subnet, the risk vulnerability exceeding standard data is combined with the external abnormal alarm frequency, the access intrusion attack frequency and the firewall response alarm frequency to obtain the operation risk exceeding standard data. The operation risk exceeding standard data reflects the degree of risk exceeding standard of the subnet operation within the time period; the calculation formula for the risk vulnerability exceeding standard data is:

[0072] ;

[0073] in, For risk vulnerabilities exceeding the standard data, , , , They are facility failure rate data, system vulnerability risk level data, server stability data, and storage information loss rate data. , , , They are facility failure rate index data, system vulnerability risk level index data, server stability index data, and storage information loss rate index data. To preset the risk vulnerability detection compensation factor, , , , It is a preset characteristic coefficient (the risk vulnerability detection compensation factor and characteristic coefficient are obtained through the network operation monitoring database).

[0074] According to an embodiment of the present invention, the operation risk exceeding distribution data of each subnetwork within a preset time period is obtained, and compared with the operation risk exceeding data to obtain the subnetwork group risk exceeding deviation index, specifically: the operation risk exceeding distribution data of each subnetwork within a preset time period is obtained, including the operation risk exceeding data sets of multiple subnetworks; according to the operation risk exceeding data set and the operation risk exceeding data of the subnetwork, the subnetwork group risk exceeding deviation index of the subnetwork is obtained by comparing and processing; the calculation formula of the subnetwork group risk exceeding deviation index is:

[0075] ;

[0076] in, is the risk excess deviation index of the subnet group, is the operating risk exceeding standard data of the i-th sub-network, is the preset characteristic coefficient of the ith sub-network, is the preset deviation correction factor, is the operational risk exceeding standard data set, n is the number of sub-networks included in the preset network system, is the operating risk exceeding standard data of the jth sub-network among the n sub-networks, is the preset characteristic coefficient of the jth sub-network among the n sub-networks.

[0077] It should be noted that after obtaining the operational risk exceeding data of each individual sub-network, in order to measure the deviation between the operational risk exceeding situation of each sub-network and the operational risk exceeding situation of the sub-network group of all sub-networks, that is, the deviation of the operational risk exceeding data of a single sub-network relative to the whole in the sub-network group, that is, reflecting the difference between a single individual and the group in the risk exceeding index, in order to identify a single sub-network individual with a certain exceeding deviation degree that exceeds the commonality of the risk exceeding data of the sub-network group, the operational risk exceeding data of a single sub-network is compared with the operational risk exceeding data of each sub-network. The operation risk exceeding distribution data is compared and processed, and the operation risk exceeding distribution data includes the operation risk exceeding data sets of multiple sub-networks, reflecting the risk exceeding situation of discrete distribution between each sub-network in the sub-network group. By comparing the operation risk exceeding data set with the operation risk exceeding data of the sub-network, the sub-network group risk exceeding deviation index of a single sub-network is obtained, that is, the deviation between the risk exceeding situation of a single sub-network and the risk exceeding distribution set of the sub-network group, which reflects the deviation degree of the risk exceeding difference between each sub-network and the sub-network group in the network system.

[0078] According to an embodiment of the present invention, the dynamic detection data of the network environment of the sub-network within a preset time period and the system dynamic inspection data of the preset network system are obtained, and the network environment dynamic detection data and the system dynamic inspection data are processed respectively to obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively, specifically: the dynamic detection data of the network environment of the sub-network within the preset time period is obtained, including virus dynamic activity data, access intrusion threat level data and abnormal interference frequency data; the system dynamic inspection data of the preset network system within the preset time period is obtained, including system defense level data, system overload data and system link failure rate data; the environmental risk interference coefficient is obtained by calculating and processing according to the virus dynamic activity data, access intrusion threat level data and abnormal interference frequency data through a preset environmental risk assessment model; the system steady-state correction coefficient is obtained by calculating and processing according to the virus dynamic activity data, access intrusion threat level data and abnormal interference frequency data through a preset system steady-state evaluation model.

[0079] It should be noted that the assessment of the risk vulnerability status of the sub-network operation is affected by the network environment and the system operation status. Therefore, in order to assess the exceeding of the risk vulnerability of the sub-network operation, it is necessary to process the network environment and the system operation status to obtain the environmental risk interference coefficient and the system steady-state correction coefficient, that is, the influence coefficient of the sub-network environment on the risk vulnerability of the sub-network operation and the influence correction coefficient of the system operation stability on the risk vulnerability of the sub-network operation. By obtaining the network environment dynamic detection data including the dynamic activity of the monitored viruses, the intrusion threat level generated by external visitor access, and the interference frequency caused by abnormal behaviors such as attacks monitored by the environment, and the system dynamic inspection data including the defense level of the system defense response, the overload situation of the system operation, and the failure rate of the system link failure, the above data are calculated and processed by the preset environmental risk assessment model and the formula in the system steady-state evaluation model. The calculation method is as follows to obtain the corresponding environmental risk interference coefficient and system steady-state correction coefficient.

[0080] Wherein, the calculation formula of the environmental risk interference coefficient is:

[0081] ;

[0082] in, is the environmental risk interference coefficient, , , They are virus dynamic activity data, access intrusion threat level data, and abnormal interference frequency data. , , is the preset characteristic coefficient.

[0083] Among them, the calculation formula of the system steady-state correction coefficient is:

[0084] ;

[0085] in, is the system steady-state correction coefficient, , , They are virus dynamic activity data, access intrusion threat level data, and abnormal interference frequency data. is the preset system stability compensation factor, , , It is the preset characteristic coefficient (the system stability compensation factor and characteristic coefficient are obtained through the network operation monitoring database).

[0086] According to an embodiment of the present invention, the operation risk exceeding standard data is corrected and processed according to the environmental risk interference coefficient, the system steady-state correction coefficient, and the subnet group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnet, specifically: the operation risk exceeding standard data of the subnet is corrected and processed according to the environmental risk interference coefficient, the system steady-state correction coefficient, and the subnet group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnet; the correction calculation formula of the operation safety risk control deviation index is:

[0087] ;

[0088] in, To run the security risk control deviation index, is the environmental risk interference coefficient, is the system steady-state correction coefficient, is the risk excess deviation index of the subnet group, To run risk exceeding data, , , , It is the preset characteristic coefficient (the characteristic coefficient is obtained through the network operation monitoring database).

[0089] It should be noted that after obtaining the environmental risk interference coefficient and system steady-state correction coefficient corresponding to the environmental conditions and system stability conditions of the subnetwork operation, a comprehensive correction calculation is performed in combination with the subnetwork group risk excess deviation index to obtain the subnetwork operation safety risk control deviation index. That is, the operation safety risk control deviation index accurately reflects the risk control deviation of the subnetwork's safe operation under the influence of the implicit risk interference in the environment and the stability of the system. At the same time, the deviation of the risk vulnerability exceeding the standard between the subnetwork and the subnetwork group is compensated.

[0090] According to an embodiment of the present invention, the preset security risk assessment threshold of the sub-network is obtained, and the operation risk exceeding distribution data is corrected to obtain the security risk assessment correction threshold, specifically: the preset security risk assessment threshold of the sub-network is obtained through the network operation monitoring database; weighted correction is performed according to the preset security risk assessment threshold and the operation risk exceeding data set to obtain the security risk assessment correction threshold; the correction formula of the security risk assessment correction threshold is:

[0091] ;

[0092] in, Modify thresholds for security risk assessment, is the operational risk exceeding standard data set, n is the number of sub-networks included in the preset network system, To preset the security risk assessment threshold, It is the preset characteristic coefficient (the characteristic coefficient is obtained through the network operation monitoring database).

[0093] It should be noted that in order to more accurately identify the evaluation results of the security risk vulnerabilities of each sub-network, it is necessary to correct the preset security risk assessment threshold and the discrete distribution of the sub-network group's operational risk exceeding the standard. The preset security risk assessment threshold is weighted and corrected by the average exceeding standard data of the sub-network group's operational risk exceeding standard data set to obtain the security risk assessment correction threshold. Then, based on the corrected threshold, the sub-network is subjected to threshold comparison to evaluate the sub-network's operational risk vulnerability status.

[0094] like Figure 4 As shown, the present invention also discloses an intelligent assessment system 4 for network patrol risk vulnerabilities, including a memory 41 and a processor 42, wherein the memory includes an intelligent assessment method program for network patrol risk vulnerabilities, and the intelligent assessment method program for network patrol risk vulnerabilities implements the following steps when executed by the processor: obtaining subnet patrol information and subnet behavior log information of each subnet of a preset network system within a preset time period, and extracting subnet patrol feature data of the subnet from the subnet patrol information and extracting subnet risk behavior log data from the subnet behavior log information; obtaining preset network risk control security indicator data of the preset network system, and processing it with the subnet patrol feature data of the subnet to obtain risk vulnerability exceeding standard data of the subnet, and then processing the risk vulnerability exceeding standard data in combination with the subnet risk behavior log data to obtain operation risk exceeding standard data; obtaining operation risk exceeding standard distribution data of each subnet within a preset time period , and compare it with the operational risk exceeding data to obtain the subnet group risk exceeding deviation index; obtain the network environment dynamic detection data of the subnet within a preset time period and the system dynamic inspection data of the preset network system, process the network environment dynamic detection data and the system dynamic inspection data respectively, and obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively; correct the operational risk exceeding data according to the environmental risk interference coefficient and the system steady-state correction coefficient and the subnet group risk exceeding deviation index to obtain the subnet operational safety risk control deviation index; obtain the subnet's preset safety risk assessment threshold, and correct it with the operational risk exceeding distribution data to obtain the safety risk assessment correction threshold; perform a threshold comparison based on the subnet's operational safety risk control deviation index and the safety risk assessment correction threshold, and evaluate the risk assessment status of the subnet according to the threshold comparison result.

[0095] It should be noted that since the network system contains multiple branched sub-networks, each sub-network has different operating security risks due to different functions, tasks, and configurations, and the operating status of each sub-network is also affected and interfered by the network operating environment and system operating status. In addition, each sub-network has different risk vulnerability exceeding standards due to its own hardware configuration, server configuration, operating execution task volume, and docking service security. As a result, there is a situation where the exceeding degree of the operating risk vulnerability of a single sub-network deviates greatly from the exceeding degree of all sub-networks. Therefore, the risk exceeding standard of this single sub-network deviates from the sub-network group. The overall commonality of the risk exceeding the standard of the whole system leads to the situation that the risk exceeding the standard is large between each independent single sub-network. Therefore, in order to accurately evaluate the operation risk of each individual sub-network, the environmental conditions and system operation conditions of the sub-network are comprehensively considered in combination with the deviation of the operation risk exceeding the standard between the single sub-network and the sub-network group. The accurate risk vulnerability assessment results of each sub-network are obtained through correction. The sub-network inspection feature data and sub-network risk behavior log data of each sub-network of the preset network system within the preset time period are obtained and combined with the preset network risk control security indicator data for processing to obtain the risk vulnerability exceeding standard data of the sub-network and the operation risk exceeding standard data The data of the operation risk exceeding the standard of a single sub-network is then compared with the distribution data of the operation risk exceeding the standard of each sub-network to obtain the discrete index of the deviation degree of the risk exceeding the standard between a single sub-network and the sub-network group. Then, the network environment dynamic detection data of the sub-network and the system dynamic inspection data of the network system are processed separately to obtain the environmental risk interference coefficient and the system steady-state correction coefficient, that is, the influence coefficient of the environment in which the sub-network is located on the risk vulnerability and the influence coefficient of the system operation stability on the sub-network. Then, the environmental risk interference coefficient and the system steady-state correction coefficient are combined with the sub-network group risk exceeding standard deviation index to correct the operation risk exceeding standard data. The operational safety risk control deviation index of the sub-network is obtained, and then a threshold comparison is performed with the security risk assessment correction threshold obtained by correcting the preset threshold according to the operational risk exceeding distribution data. The risk assessment status of the sub-network is evaluated according to the threshold comparison result. If the operational safety risk control deviation index meets the threshold comparison requirement of the security risk assessment correction threshold, the operational safety risk of the sub-network does not exceed the control deviation range, and the sub-network operation is safe. If it does not meet the threshold comparison requirement, it indicates that the operational safety risk vulnerability of the sub-network exceeds the control deviation range, and the security risk vulnerability of the sub-network operation exceeds the standard, thereby realizing the evaluation of the risk vulnerability exceeding the standard of network security operation.

[0096] According to an embodiment of the present invention, the subnet patrol information and subnet behavior log information of each subnet of the preset network system within a preset time period are obtained, and the subnet patrol feature data of the subnet is extracted from the subnet patrol information and the subnet risk behavior log data is extracted from the subnet behavior log information, specifically:

[0097] Obtain subnet inspection information of each subnet in a preset network system within a preset time period, and extract subnet inspection feature data based on the subnet inspection information, including facility failure rate data, system vulnerability risk level data, server stability data, and storage information loss rate data;

[0098] Obtain subnet behavior log information within a preset time period, and extract subnet risk behavior log data, including external abnormal alarm frequency, access intrusion attack frequency, and firewall response alarm frequency.

[0099] It should be noted that in order to obtain the risk vulnerability exceeding standard of the safe operation status of each inspected subnet, it is first necessary to obtain the subnet inspection information of each subnet in the preset network system within a certain preset time period and extract the subnet inspection feature data. The subnet inspection information is the relevant information obtained by inspecting the facility operation, system vulnerabilities, server operation and storage information of the subnet. The obtained subnet inspection feature data includes data reflecting the facility failure rate of the subnet, the risk level of vulnerabilities in the system, the operation stability monitored by the server operation, and the loss rate of related storage information. At the same time, the subnet behavior log information of the subnet is obtained and the subnet risk behavior log data is extracted. The subnet behavior log information is the log information obtained by recording the behavior of the subnet's docking service, external access anomalies and firewall alarms. It reflects the record log of the subnet-related behavior. The subnet risk behavior log data includes the frequency of abnormal alarms of external services, the frequency of intrusion attacks recorded by external access alarms, and the frequency of response alarms issued by the firewall.

[0100] According to an embodiment of the present invention, the preset network risk control security index data of the preset network system is obtained, and the data is processed with the subnet inspection feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then the risk vulnerability exceeding standard data is combined with the subnet risk behavior log data to obtain the operation risk exceeding standard data, specifically:

[0101] Obtaining preset network risk control safety index data of the preset network system through a network operation monitoring database, including facility failure rate index data, system vulnerability risk level index data, server stability index data, and storage information loss rate index data;

[0102] Processing the preset network risk control security indicator data and subnet inspection feature data to obtain the risk vulnerability exceeding specification data of the subnet;

[0103] The risk vulnerability exceeding standard data is processed in combination with the external abnormal alarm frequency, the access intrusion attack frequency and the firewall response alarm frequency to obtain the sub-network operation risk exceeding standard data;

[0104] The calculation formula for the operation risk exceeding the standard is:

[0105] ;

[0106] in, To run risk exceeding data, For risk vulnerabilities exceeding the standard data, , , They are the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms. , , , is the preset characteristic coefficient.

[0107] It should be noted that after obtaining the subnet inspection feature data and subnet risk behavior log data of the subnet, in order to evaluate the risk exceeding the standard of the subnet operation, it is necessary to obtain the preset network risk control security indicator data of the preset network system through the preset network operation monitoring database, and then process the subnet inspection feature data and the preset network risk control security indicator data through the calculation formula to obtain the risk vulnerability exceeding standard data, that is, to calculate and process the various feature data and indicator data obtained from the subnet inspection to obtain measurement data reflecting the risk vulnerability exceeding standard of the subnet operation. In order to obtain accurate data on the risk exceeding standard during the operation of the subnet, the risk vulnerability exceeding standard data is combined with the external abnormal alarm frequency, the access intrusion attack frequency and the firewall response alarm frequency to obtain the operation risk exceeding standard data. The operation risk exceeding standard data reflects the degree of risk exceeding standard of the subnet operation within the time period;

[0108] The calculation formula for the risk vulnerability exceeding the standard data is:

[0109] ;

[0110] in, For risk vulnerabilities exceeding the standard data, , , , They are facility failure rate data, system vulnerability risk level data, server stability data, and storage information loss rate data. , , , They are facility failure rate index data, system vulnerability risk level index data, server stability index data, and storage information loss rate index data. To preset the risk vulnerability detection compensation factor, , , , It is a preset characteristic coefficient (the risk vulnerability detection compensation factor and characteristic coefficient are obtained through the network operation monitoring database).

[0111] According to an embodiment of the present invention, the operation risk exceeding standard distribution data of each sub-network within a preset time period is obtained, and compared with the operation risk exceeding standard data, to obtain the sub-network group risk exceeding standard deviation index, specifically:

[0112] Obtaining the distribution data of the operation risk exceeding the standard of each sub-network within a preset time period, including the operation risk exceeding standard data set of multiple sub-networks;

[0113] Compare and process the operational risk exceeding standard data set with the operational risk exceeding standard data of the sub-network to obtain the sub-network group risk exceeding standard deviation index of the sub-network;

[0114] The calculation formula of the subnet group risk excess deviation index is:

[0115] ;

[0116] in, is the risk excess deviation index of the subnet group, is the operating risk exceeding standard data of the i-th sub-network, is the preset characteristic coefficient of the ith sub-network, is the preset deviation correction factor, is the operational risk exceeding standard data set, n is the number of sub-networks included in the preset network system, is the operating risk exceeding standard data of the jth sub-network among the n sub-networks, is the preset characteristic coefficient of the jth sub-network among the n sub-networks.

[0117] It should be noted that after obtaining the operational risk exceeding data of each individual sub-network, in order to measure the deviation between the operational risk exceeding situation of each sub-network and the operational risk exceeding situation of the sub-network group of all sub-networks, that is, the deviation of the operational risk exceeding data of a single sub-network relative to the whole in the sub-network group, that is, reflecting the difference between a single individual and the group in the risk exceeding index, in order to identify a single sub-network individual with a certain exceeding deviation degree that exceeds the commonality of the risk exceeding data of the sub-network group, the operational risk exceeding data of a single sub-network is compared with the operational risk exceeding data of each sub-network. The operation risk exceeding distribution data is compared and processed, and the operation risk exceeding distribution data includes the operation risk exceeding data sets of multiple sub-networks, reflecting the risk exceeding situation of discrete distribution between each sub-network in the sub-network group. By comparing the operation risk exceeding data set with the operation risk exceeding data of the sub-network, the sub-network group risk exceeding deviation index of a single sub-network is obtained, that is, the deviation between the risk exceeding situation of a single sub-network and the risk exceeding distribution set of the sub-network group, which reflects the deviation degree of the risk exceeding difference between each sub-network and the sub-network group in the network system.

[0118] According to an embodiment of the present invention, the network environment dynamic detection data of the subnetwork within the preset time period and the system dynamic inspection data of the preset network system are obtained, and the network environment dynamic detection data and the system dynamic inspection data are processed respectively to obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively, specifically:

[0119] Obtain dynamic detection data of the network environment of the sub-network within a preset time period, including dynamic virus activity data, access intrusion threat level data, and abnormal interference frequency data;

[0120] Obtain system dynamic inspection data of a preset network system within a preset time period, including system defense level data, system overload data, and system link failure rate data;

[0121] The environmental risk interference coefficient is obtained by calculating and processing the virus dynamic activity data, access intrusion threat level data, and abnormal interference frequency data through a preset environmental risk assessment model;

[0122] The system steady-state correction coefficient is obtained by calculating and processing the virus dynamic activity data, access intrusion threat level data and abnormal interference frequency data through the preset system steady-state evaluation model.

[0123] It should be noted that the assessment of the risk vulnerability status of the sub-network operation is affected by the network environment and the system operation status. Therefore, in order to assess the excess status of the sub-network operation risk vulnerability, it is necessary to process the network environment and the system operation status to obtain the environmental risk interference coefficient and the system steady-state correction coefficient, that is, the influence coefficient of the sub-network environment on the risk vulnerability of the sub-network operation and the influence correction coefficient of the system operation stability on the risk vulnerability of the sub-network operation. By obtaining the network environment dynamic detection data including the monitored virus dynamic activity, the intrusion threat level generated by external visitor access, and the interference frequency caused by abnormal behaviors such as attacks monitored by the environment, and the system dynamic inspection data including the defense level of the system defense response, the overload status of the system operation, and the failure rate of the system link failure, the above data are calculated and processed by the preset environmental risk assessment model and the formula in the system steady-state evaluation model. The calculation method is as follows to obtain the corresponding environmental risk interference coefficient and system steady-state correction coefficient;

[0124] Among them, the calculation formula of environmental risk interference coefficient is:

[0125] ;

[0126] in, is the environmental risk interference coefficient, , , They are virus dynamic activity data, access intrusion threat level data, and abnormal interference frequency data. , , is the preset characteristic coefficient.

[0127] Among them, the calculation formula of the system steady-state correction coefficient is:

[0128] ;

[0129] in, is the system steady-state correction coefficient, , , They are virus dynamic activity data, access intrusion threat level data, and abnormal interference frequency data. is the preset system stability compensation factor, , , It is the preset characteristic coefficient (the system stability compensation factor and characteristic coefficient are obtained through the network operation monitoring database).

[0130] According to an embodiment of the present invention, the operation risk exceeding standard data is corrected and processed according to the environmental risk interference coefficient, the system steady-state correction coefficient, and the subnet group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnet, which is specifically:

[0131] The operation risk exceeding standard data of the subnetwork is corrected according to the environmental risk interference coefficient, the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork.

[0132] The correction calculation formula of the operation safety risk control deviation index is:

[0133] ;

[0134] in, To run the security risk control deviation index, is the environmental risk interference coefficient, is the system steady-state correction coefficient, is the risk excess deviation index of the subnet group, To run risk exceeding data, , , , It is the preset characteristic coefficient (the characteristic coefficient is obtained through the network operation monitoring database).

[0135] It should be noted that after obtaining the environmental risk interference coefficient and system steady-state correction coefficient corresponding to the environmental conditions and system stability conditions of the subnetwork operation, a comprehensive correction calculation is performed in combination with the subnetwork group risk excess deviation index to obtain the subnetwork operation safety risk control deviation index. That is, the operation safety risk control deviation index accurately reflects the risk control deviation of the subnetwork's safe operation under the influence of the implicit risk interference in the environment and the stability of the system. At the same time, the deviation of the risk vulnerability exceeding the standard between the subnetwork and the subnetwork group is compensated.

[0136] According to an embodiment of the present invention, a preset security risk assessment threshold of the subnetwork is obtained, and correction processing is performed with the operation risk exceeding distribution data to obtain a security risk assessment correction threshold, specifically:

[0137] Obtain the preset security risk assessment threshold of the sub-network through the network operation monitoring database;

[0138] Perform weighted correction based on the preset safety risk assessment threshold and the operational risk excess data set to obtain the safety risk assessment correction threshold;

[0139] The correction formula for the security risk assessment correction threshold is:

[0140] ;

[0141] in, Modify thresholds for security risk assessment, is the operational risk exceeding standard data set, n is the number of sub-networks included in the network system, To preset the security risk assessment threshold, It is the preset characteristic coefficient (the characteristic coefficient is obtained through the network operation monitoring database).

[0142] It should be noted that in order to more accurately identify the evaluation results of the security risk vulnerabilities of each sub-network, it is necessary to correct the preset security risk assessment threshold and the discrete distribution of the sub-network group's operational risk exceeding the standard. The preset security risk assessment threshold is weighted and corrected by the average exceeding standard data of the sub-network group's operational risk exceeding standard data set to obtain the security risk assessment correction threshold. Then, based on the corrected threshold, the sub-network is subjected to threshold comparison to evaluate the sub-network's operational risk vulnerability status.

[0143] The present invention also provides a readable storage medium, which includes a program for an intelligent assessment method for network patrol risk vulnerabilities. When the program for the intelligent assessment method for network patrol risk vulnerabilities is executed by a processor, the steps of the intelligent assessment method for network patrol risk vulnerabilities as described above are implemented.

[0144] The present invention obtains subnet patrol information and subnet behavior log information and extracts subnet patrol feature data and subnet risk behavior log data, and processes them with preset network risk control safety index data to obtain risk vulnerability exceeding standard data and operation risk exceeding standard data, and compares them with the operation risk exceeding standard distribution data to obtain the subnet group risk exceeding standard deviation index, and then corrects the operation risk exceeding standard data in combination with the environmental risk interference coefficient and the system steady-state correction coefficient obtained by processing the network environment dynamic detection data and the system dynamic patrol data respectively to obtain the operation safety risk control deviation index, and then compares the threshold with the security risk assessment correction threshold obtained by correcting the operation risk exceeding standard distribution data to evaluate the risk status of the subnet; thereby, based on big data, the network operation risk vulnerability situation is processed in combination with the environmental risk interference and the system stability situation to obtain the risk control deviation index, and the risk vulnerability exceeding standard situation of network security operation is inspected and evaluated, thereby realizing intelligent technology for evaluating the network security operation status through big data.

Claims

1. An intelligent evaluation method for network inspection risk vulnerabilities, characterized in that: The following steps are involved: Obtaining subnet patrol information and subnet behavior log information of each subnet of a preset network system within a preset time period, and extracting subnet patrol feature data of the subnet from the subnet patrol information and extracting subnet risk behavior log data from the subnet behavior log information; Obtaining the preset network risk control security index data of the preset network system, and processing it with the subnet inspection feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then processing the risk vulnerability exceeding standard data in combination with the subnet risk behavior log data to obtain the operation risk exceeding standard data; Obtaining the distribution data of the operation risk exceeding the standard of each sub-network within the preset time period, and comparing it with the operation risk exceeding the standard data, to obtain the sub-network group risk exceeding the standard deviation index; Acquire the network environment dynamic detection data of the sub-network within the preset time period and the system dynamic inspection data of the preset network system, process the network environment dynamic detection data and the system dynamic inspection data respectively, and obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively; Correct the operation risk exceeding standard data according to the environmental risk interference coefficient, the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork; Obtaining a preset security risk assessment threshold of the subnetwork, and performing correction processing on the operational risk exceeding distribution data to obtain a security risk assessment correction threshold; A threshold comparison is performed based on the operational security risk control deviation index of the sub-network and the security risk assessment correction threshold, and the risk assessment status of the sub-network is evaluated based on the threshold comparison result.

2. The intelligent evaluation method for network inspection risk vulnerabilities according to claim 1 is characterized in that: The obtaining of subnet inspection information and subnet behavior log information of each subnet of the preset network system within a preset time period, and extracting subnet inspection feature data of the subnet from the subnet inspection information and extracting subnet risk behavior log data from the subnet behavior log information, includes: Obtain subnet inspection information of each subnet in a preset network system within a preset time period, and extract subnet inspection feature data based on the subnet inspection information, including facility failure rate data, system vulnerability risk level data, server stability data, and storage information loss rate data; The subnet behavior log information of the subnet within a preset time period is obtained, and the subnet risk behavior log data is extracted, including the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms.

3. The intelligent evaluation method for network inspection risk vulnerabilities according to claim 2 is characterized in that: The obtaining of the preset network risk control security index data of the preset network system and processing it with the subnet inspection feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then combining the risk vulnerability exceeding standard data with the subnet risk behavior log data to obtain the operation risk exceeding standard data, includes: Obtaining preset network risk control safety index data of the preset network system through a network operation monitoring database, including facility failure rate index data, system vulnerability risk level index data, server stability index data, and storage information loss rate index data; Processing the preset network risk control security indicator data and the subnet inspection feature data to obtain the risk vulnerability exceeding specification data of the subnet; The risk vulnerability exceeding standard data is processed in combination with the external abnormal alarm frequency, the access intrusion attack frequency and the firewall response alarm frequency to obtain the operation risk exceeding standard data of the sub-network; The calculation formula for the operation risk exceeding standard data is: ； in, To run risk exceeding data, For risk vulnerabilities exceeding the standard data, , , They are the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms. , , , is the preset characteristic coefficient.

4. The intelligent evaluation method for network inspection risk vulnerabilities according to claim 3 is characterized in that: The obtaining of the operation risk exceeding standard distribution data of each sub-network within the preset time period and comparing with the operation risk exceeding standard data to obtain the sub-network group risk exceeding standard deviation index includes: Obtaining the distribution data of the operation risk exceeding the standard of each sub-network within the preset time period, including the operation risk exceeding standard data set of multiple sub-networks; Comparing the operation risk exceeding standard data set with the operation risk exceeding standard data of the sub-network, obtaining a sub-network group risk exceeding standard deviation index of the sub-network; The calculation formula of the subnet group risk excess deviation index is: ； in, is the risk excess deviation index of the subnet group, is the operating risk exceeding standard data of the i-th sub-network, is the preset characteristic coefficient of the ith sub-network, is the preset deviation correction factor, is the operational risk exceeding standard data set, n is the number of sub-networks included in the preset network system, is the operating risk exceeding standard data of the jth sub-network among the n sub-networks, is the preset characteristic coefficient of the jth sub-network among the n sub-networks.

5. The intelligent evaluation method for network inspection risk vulnerabilities according to claim 4 is characterized in that: The obtaining of the network environment dynamic detection data of the sub-network within the preset time period and the system dynamic inspection data of the preset network system, and processing the network environment dynamic detection data and the system dynamic inspection data respectively to obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively, includes: Obtaining dynamic network environment detection data of the sub-network within the preset time period, including virus dynamic activity data, access intrusion threat level data, and abnormal interference frequency data; Acquire system dynamic inspection data of the preset network system within the preset time period, including system defense level data, system overload data, and system link failure rate data; The environmental risk interference coefficient is obtained by calculating and processing the virus dynamic activity data, the access intrusion threat level data, and the abnormal interference frequency data through a preset environmental risk assessment model; The virus dynamic activity data, access intrusion threat level data and abnormal interference frequency data are calculated and processed through a preset system steady-state evaluation model to obtain a system steady-state correction coefficient.

6. The intelligent evaluation method for network inspection risk vulnerabilities according to claim 5 is characterized in that: The correcting the operation risk exceeding standard data according to the environmental risk interference coefficient and the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork includes: Correcting the operation risk exceeding standard data of the subnetwork according to the environmental risk interference coefficient, the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork; The correction calculation formula of the operation safety risk control deviation index is: ； in, To run the security risk control deviation index, is the environmental risk interference coefficient, is the system steady-state correction coefficient, is the risk excess deviation index of the subnet group, To run risk exceeding data, , , , is the preset characteristic coefficient.

7. The intelligent evaluation method for network inspection risk vulnerabilities according to claim 6 is characterized in that: The obtaining of the preset security risk assessment threshold of the sub-network and performing correction processing on the operational risk exceeding distribution data to obtain the security risk assessment correction threshold includes: Obtaining a preset security risk assessment threshold of the sub-network through the network operation monitoring database; Performing weighted correction according to the preset safety risk assessment threshold and the operational risk exceeding data set to obtain a safety risk assessment correction threshold; The correction formula of the security risk assessment correction threshold is: ； in, Modify thresholds for security risk assessment, is the operational risk exceeding standard data set, n is the number of sub-networks included in the preset network system, To preset the security risk assessment threshold, is the preset characteristic coefficient.

8. An intelligent evaluation system for network inspection risk vulnerabilities, characterized in that: The system includes: a memory and a processor, wherein the memory includes a program of an intelligent evaluation method for network patrol risk vulnerabilities, and when the program of the intelligent evaluation method for network patrol risk vulnerabilities is executed by the processor, the following steps are implemented: Obtaining subnet patrol information and subnet behavior log information of each subnet of a preset network system within a preset time period, and extracting subnet patrol feature data of the subnet from the subnet patrol information and extracting subnet risk behavior log data from the subnet behavior log information; Obtaining the preset network risk control security index data of the preset network system, and processing it with the subnet inspection feature data of the subnet to obtain the risk vulnerability exceeding standard data of the subnet, and then processing the risk vulnerability exceeding standard data in combination with the subnet risk behavior log data to obtain the operation risk exceeding standard data; Obtaining the distribution data of the operation risk exceeding the standard of each sub-network within the preset time period, and comparing it with the operation risk exceeding the standard data, to obtain the sub-network group risk exceeding the standard deviation index; Acquire the network environment dynamic detection data of the sub-network within the preset time period and the system dynamic inspection data of the preset network system, process the network environment dynamic detection data and the system dynamic inspection data respectively, and obtain the environmental risk interference coefficient and the system steady-state correction coefficient respectively; Correct the operation risk exceeding standard data according to the environmental risk interference coefficient, the system steady-state correction coefficient and the subnetwork group risk exceeding standard deviation index to obtain the operation safety risk control deviation index of the subnetwork; Obtaining a preset security risk assessment threshold of the subnetwork, and performing correction processing on the operational risk exceeding distribution data to obtain a security risk assessment correction threshold; A threshold comparison is performed based on the operational security risk control deviation index of the sub-network and the security risk assessment correction threshold, and the risk assessment status of the sub-network is evaluated based on the threshold comparison result.

9. The intelligent evaluation system for network inspection risk vulnerabilities according to claim 8 is characterized in that: The obtaining of subnet inspection information and subnet behavior log information of each subnet of the preset network system within a preset time period, and extracting subnet inspection feature data of the subnet from the subnet inspection information and extracting subnet risk behavior log data from the subnet behavior log information, includes: Obtain subnet inspection information of each subnet in a preset network system within a preset time period, and extract subnet inspection feature data based on the subnet inspection information, including facility failure rate data, system vulnerability risk level data, server stability data, and storage information loss rate data; The subnet behavior log information of the subnet within a preset time period is obtained, and the subnet risk behavior log data is extracted, including the frequency of external abnormal alarms, the frequency of access intrusion attacks, and the frequency of firewall response alarms.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a program for an intelligent assessment method for network patrol risk vulnerabilities. When the program for an intelligent assessment method for network patrol risk vulnerabilities is executed by a processor, the steps of the intelligent assessment method for network patrol risk vulnerabilities as described in any one of claims 1 to 7 are implemented.

Images