A network security status assessment system and method

Abstract

The present invention discloses a network security status assessment system and method, and relates to the field of network security technology. The specific implementation of the system includes: a sub-process assessment module, a total process assessment module, and a network security status assessment module. The sub-process assessment module is used to judge whether the independent protection performance of the sub-process is abnormal according to the first execution result of the sub-process performing independent protection; the sub-process is any sub-process in multiple sub-processes of the security protection process; the total process assessment module is used to judge whether the overall protection performance of the security protection process is qualified according to the second execution result of the sub-process and its adjacent sub-process performing collaborative protection; the network security status assessment module is used to determine the network security status of the current network according to the security protection abnormalities corresponding to multiple sub-processes and the protection of the network security process against external intrusions. This implementation reduces the probability of the network being attacked, improves the protection efficiency, and reduces the cost of network operation.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security status assessment system and method. Background Art

[0002] The network is facing various network security threats during operation, such as malware, phishing, password attacks, and denial of service attacks. It is always at risk of being invaded and attacked, so it is necessary to add security protection measures to the network. The protection capability of security protection measures directly affects the security status of the network, so the evaluation of the network security status is to evaluate the protection capability of security protection measures.

[0003] Currently, security protection measures are generally evaluated based on their protection results. For example, only after the network is attacked multiple times and at a high frequency can it be determined that the current security protection measures have poor protection capabilities and be upgraded. However, this evaluation and processing method for security protection measures is lagging and requires the network to be attacked, which makes the network operation costly and inefficient. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a network security status assessment system and method, which monitors the protection performance of each sub-process in the security protection process during the network security protection process, and evaluates the overall protection performance of the security protection process according to the protection performance of each sub-process, and then determines the security protection abnormal situation and the protection situation against external intrusion under abnormal circumstances according to the overall protection performance, thereby realizing the assessment of the network security status during the security protection process, so that problems in the protection process can be discovered in time and protection measures can be adjusted in time to prevent problems before they occur, thereby improving security protection efficiency and reducing the cost of network operation; in addition, the network security status is evaluated from multiple dimensions, the evaluation results are highly reliable, and the protection measures can be adjusted in a targeted manner to reduce the possibility of the network being attacked.

[0005] To achieve the above objective, according to one aspect of an embodiment of the present invention, a network security status assessment system and method are provided.

[0006] A network security status assessment system according to an embodiment of the present invention comprises: a sub-process assessment module, a total process assessment module, and a network security status assessment module, wherein:

[0007] The sub-process evaluation module is used to determine a first execution result of the sub-process executing independent protection, where the sub-process is any sub-process among multiple sub-processes of the security protection process of the current network, and judge whether the independent protection performance of the sub-process is abnormal according to the first execution result;

[0008] The overall process evaluation module is used to determine the second execution result of the sub-process and its adjacent sub-processes performing collaborative protection according to the first judgment result of the sub-process evaluation module; and to determine whether the overall protection performance of the security protection process is qualified according to the second execution result;

[0009] The network security status assessment module is used to determine the security protection anomalies corresponding to the multiple sub-processes and the protection status of the network security process against external intrusions based on the second judgment result of the overall process assessment module, and determine the network security status of the current network based on the security protection anomalies and the protection status against external intrusions.

[0010] Optionally, the system further comprises: a network security testing module and a network threat analysis module, wherein:

[0011] The network security testing module is used to send a network threat analysis instruction to the network threat analysis module according to the network security status determined by the network security status assessment module;

[0012] The network threat analysis module is used to determine the network threat situation faced by the current network during network operation according to the network threat analysis instruction; and determine whether the network security status is abnormal according to the network threat situation.

[0013] Optionally, the network threat analysis module is also used to determine the frequency of first external intrusions during network operation and the overall time from risk monitoring of non-first external intrusions to the completion of protection actions according to the network threat analysis instructions; and determine whether the network threat situation faced by the current network is abnormal based on the frequency of first external intrusions and the overall time.

[0014] Optionally, the sub-process evaluation module is also used to obtain the actual duration of the sub-process executing the protection action and the preset duration corresponding to the sub-process executing the protection action, and calculate the duration deviation between the actual duration and the preset duration; obtain the secondary protection frequency of the sub-process executing the same protection action again after the sub-process executes the protection action; obtain the first time interval between the first invalid execution moment of the sub-process protection action and the second execution moment; and determine whether the protection performance of the sub-process is abnormal based on the duration deviation, the secondary protection frequency and the first time interval.

[0015] Optionally, the sub-process evaluation module is also used to calculate the delay protection coefficient corresponding to the sub-process based on the duration deviation corresponding to the sub-process, the secondary protection frequency and the first time interval; compare the delay protection coefficient with a coefficient threshold; and determine that the sub-process execution protection action is abnormal when the delay protection coefficient is greater than the coefficient threshold.

[0016] Optionally, the overall process evaluation module is also used to determine the executed sub-process adjacent to the sub-process, the moment when the executed sub-process executes the protection action abnormally again in response to the abnormal execution of the protection action by the sub-process, and the second time interval between the moment of executing the protection action again and the moment when it is determined that the sub-process executes the protection action abnormally, when the first judgment result indicates that the sub-process executes the protection action abnormally; determine the unexecuted sub-process adjacent to the sub-process and the reduction in time consumed for the unexecuted sub-process to execute the corresponding protection action; and judge whether the overall protection performance of the network security process is qualified based on the second time interval and the reduction in time consumed.

[0017] Optionally, the overall process evaluation module is also used to determine whether the second time interval does not exceed the interval threshold, and whether the reduction amount exceeds the reduction threshold; when the second time interval exceeds the interval threshold, and / or the reduction amount does not exceed the reduction threshold, it is determined that the overall protection performance of the network security process is unqualified.

[0018] Optionally, the network security status assessment module is also used to obtain, based on the indication of completion of the network security status assessment included in the second judgment result, the cumulative time value of abnormal execution of the protection action of at least one sub-process among the multiple sub-processes, and the protection delay time of the network security process against external intrusion when at least one sub-process among the multiple sub-processes is abnormal; determine a first increasing rate of the cumulative time value and a second increasing rate of the protection delay time; and determine whether the network security status of the current network is abnormal based on the first increasing rate and the second increasing rate.

[0019] Optionally, the network security status assessment module is further used to determine that the network security status of the current network is abnormal when the first increase rate is greater than a first increase rate threshold and / or the second increase rate is greater than a second increase rate threshold.

[0020] Optionally, the sub-process evaluation module is used to send a sub-process protection performance abnormality signal to the network security testing module when the protection performance of at least one sub-process among the multiple sub-processes is abnormal;

[0021] The network security testing module is used to perform security protection on the network according to the abnormal signal of the sub-process protection performance.

[0022] Optionally, the network security status assessment module is used to send an overall protection performance failure signal to the network security testing module when the overall protection performance fails to meet the requirements;

[0023] The network security testing module is used to adjust the protection action of the network security process according to the overall protection performance failure signal, and monitor the execution of the adjusted protection action.

[0024] Optionally, the network threat analysis module is used to send a network threat situation abnormality signal to the network security testing module when the network threat situation faced by the current network is abnormal;

[0025] The network security testing module is used to adjust the protection actions of the network security process according to the abnormal signal of the network threat situation and modify the corresponding hardware configuration.

[0026] To achieve the above objective, according to another aspect of an embodiment of the present invention, a method for evaluating network security status is provided.

[0027] A network security status assessment method according to an embodiment of the present invention includes:

[0028] Determine, by a sub-process evaluation module, a first execution result of the sub-process executing independent protection, wherein the sub-process is any sub-process among multiple sub-processes of the security protection process of the current network, and judge whether the independent protection performance of the sub-process is abnormal according to the first execution result;

[0029] Determine, by the overall process evaluation module, a second execution result of the sub-process and its adjacent sub-processes performing collaborative protection according to the first judgment result of the sub-process evaluation module; determine whether the overall protection performance of the security protection process is qualified according to the second execution result;

[0030] The network security status assessment module determines the security protection anomalies corresponding to the multiple sub-processes and the protection status of the network security process against external intrusions based on the second judgment result of the overall process assessment module, and determines the network security status of the current network based on the security protection anomalies and the protection status against external intrusions.

[0031] To achieve the above objective, according to another aspect of an embodiment of the present invention, an electronic device for network security status assessment is provided.

[0032] An electronic device for network security status assessment according to an embodiment of the present invention comprises: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement a network security status assessment method according to an embodiment of the present invention.

[0033] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided.

[0034] A computer-readable storage medium according to an embodiment of the present invention stores a computer program, and when the program is executed by a processor, a network security status assessment method according to an embodiment of the present invention is implemented.

[0035] An embodiment of the above invention has the following advantages or beneficial effects: by monitoring the protection performance of each sub-process in the security protection process during the network security protection process, and evaluating the overall protection performance of the security protection process based on the protection performance of each sub-process, and then determining the security protection abnormal situation and the protection situation against external intrusion under abnormal circumstances based on the overall protection performance, thereby realizing the evaluation of the network security status during the security protection process, so that problems in the protection process can be discovered in time and the protection measures can be adjusted in time to prevent problems before they occur, thereby improving the security protection efficiency and reducing the cost of network operation; in addition, the network security status is evaluated from multiple dimensions, the evaluation results are highly reliable, and the protection measures can be adjusted in a targeted manner to reduce the possibility of the network being attacked.

[0036] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0038] Figure 1 is a schematic diagram of main modules of a network security status assessment system according to an embodiment of the present invention;

[0039] Figure 2 is a schematic diagram of main modules of another network security status assessment system according to an embodiment of the present invention;

[0040] Figure 3 is a flow chart of the main steps of a network security status assessment method according to an embodiment of the present invention;

[0041] Figure 4 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0042] Figure 5It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0044] It should be pointed out that the embodiments of the present invention and the technical features therein may be combined with each other without conflict.

[0045] Figure 1 4 is a schematic diagram of main modules of a network security status assessment system according to an embodiment of the present invention.

[0046] like Figure 1 As shown, the network security status assessment system 100 of the embodiment of the present invention includes: a sub-process assessment module 101, a total process assessment module 102, and a network security status assessment module 103, wherein the sub-process assessment module 101 is used to determine a first execution result of a sub-process executing independent protection, the sub-process is any sub-process in a plurality of sub-processes of a security protection process of the current network, and judge whether the independent protection performance of the sub-process is abnormal according to the first execution result; the total process assessment module 102 is used to determine a second execution result of the sub-process and its adjacent sub-process executing collaborative protection according to the first judgment result of the sub-process assessment module 101; and judge whether the overall protection performance of the security protection process is qualified according to the second execution result; the network security status assessment module 103 is used to determine the security protection abnormalities corresponding to the plurality of sub-processes and the protection status of the network security process against external intrusion according to the second judgment result of the total process assessment module 102, and determine the network security status of the current network according to the security protection abnormalities and the protection status against external intrusion.

[0047] In order to ensure the safe operation of the network and prevent it from being attacked by malware, security protection measures must be taken for each network. The security protection process corresponding to general security protection measures includes multiple sub-processes, such as risk assessment sub-process, security policy formulation sub-process, response sub-process, and recovery sub-process. Among them, the protection action corresponding to the sub-process is the running action of the sub-process, such as data collection, evaluation and analysis, formulation of network security measures, etc.

[0048] In order to timely discover problems in the security protection process, the protection capability of each sub-process is determined based on the situation of the protection action performed by each sub-process. For sub-processes with normal protection capability, its process state is set to a safe state, and a normal receipt is sent to the network security test module 104 in the system, indicating that the sub-process state is currently in a safe state; while for sub-processes with abnormal protection capability, its process state is set to an abnormal state, and an abnormal receipt is sent to the network security test module 104 in the system, so that the network security test module 104 performs security protection on the network in response to the abnormal situation, thereby serving as a remedial measure for the abnormal execution of a protection action by a certain sub-process and playing a bottom-up role.

[0049] During the security protection process, the security protection process has a certain self-repair ability. Therefore, if a sub-process has a protection execution exception, it does not mean that the protection ability of the security protection process has completely collapsed. The multiple sub-processes of the security protection process can achieve self-repair of the exception by collaboratively executing protection actions. Therefore, even if a sub-process has an exception, it cannot be directly determined that the protection ability of the security protection process will be abnormal. The overall protection performance needs to be determined based on the collaborative execution of protection actions among multiple sub-processes.

[0050] Furthermore, the ultimate goal of evaluating the protection performance of sub-processes in the security protection process and the overall protection performance is to evaluate the current security status of the network. Therefore, it is also necessary to evaluate whether the current security of the network is threatened based on the security protection anomalies of the security protection process and the protection against external intrusions.

[0051] In order to realize the evaluation of the protection capability of a single sub-process, in an optional embodiment of the present invention, the sub-process evaluation module 101 is also used to obtain the actual duration of the sub-process to perform the protection action and the preset duration corresponding to the sub-process to perform the protection action, and calculate the time deviation between the actual duration and the preset duration; obtain the secondary protection frequency of the sub-process to perform the same protection action again after the sub-process performs the protection action; obtain the first time interval between the invalid moment of the first execution of the protection action of the sub-process and the second execution moment; according to the time deviation, the secondary protection frequency and the first time interval, judge whether the protection performance of the sub-process is abnormal. In this embodiment, the deviation between the actual duration of the sub-process to perform the protection action and the preset duration is compared, and its purpose is to determine the speed of the sub-process to perform the protection action, that is, the more the actual duration is less than the preset duration, the faster its speed is, and the more it meets the preset protection requirements. The more the actual duration is greater than the preset duration, the slower its speed is, and the less it meets the preset protection requirements. In addition, the purpose of determining the secondary protection frequency of the sub-process is to determine the efficiency of the sub-process to perform the protection action, that is, the higher the secondary protection frequency, the lower the efficiency of the sub-process to perform the protection action, and vice versa. Furthermore, the time interval between the first protection failure and the execution of the second protection is determined, with the aim of evaluating the self-correction capability of the sub-process, thereby enabling an evaluation of its protection capability based on aspects such as the speed, efficiency and self-correction capability of the sub-process in executing protection actions.

[0052] In order to further evaluate the protection capability of a single sub-process, in an optional embodiment of the present invention, the sub-process evaluation module 101 is also used to calculate the delay protection coefficient corresponding to the sub-process according to the duration deviation, the secondary protection frequency and the first time interval corresponding to the sub-process; compare the delay protection coefficient with the coefficient threshold; and determine that the sub-process executes the protection action abnormally when the delay protection coefficient is greater than the coefficient threshold. In this embodiment of the present invention, the duration deviation can be recorded as SC, the secondary protection frequency can be recorded as PL, the first time interval can be recorded as HC, and the delay protection coefficient can be recorded as F. Then, F can be calculated based on SC, PL and HC. The formula is as follows:

[0053] F=β[(SC*fsd1+PL*fsd2+HC*fsd3) / 1.5(fsd1+2*fsd2+fsd3)]

[0054] Among them, F is the delay protection coefficient, SC is the duration deviation, PL is the secondary protection frequency, HC is the first time interval, β is the error correction factor, fsd1, fsd2 and fsd3 are the preset proportional coefficients corresponding to the duration deviation, the secondary protection frequency and the first time interval respectively. Among them, β can be set flexibly, for example, it can be taken as 1.85. The delay protection coefficient is compared with the coefficient threshold, and the sub-process corresponding to the delay protection coefficient greater than the coefficient threshold is judged as abnormal in executing the protection action, and the sub-process corresponding to the delay protection coefficient not greater than the coefficient threshold is judged as normal in executing the protection action.

[0055] In an optional embodiment of the present invention, the sub-process evaluation module 101 is used to send a sub-process protection performance abnormality signal to the network security testing module 104 when the protection performance of at least one sub-process among the multiple sub-processes is abnormal; the network security testing module 104 is used to perform security protection on the network according to the sub-process protection performance abnormality signal. After receiving the sub-process protection performance abnormality signal, the network security testing module 104 determines that the protection capability of the sub-process is not sufficient to perform the security protection task, and therefore directly performs a bottom-up security protection to play a bottom-up role.

[0056] In order to implement the evaluation of the overall protection performance of the security protection process, in an optional embodiment of the present invention, the overall process evaluation module 102 is also used to determine, when the first judgment result indicates that the sub-process executes the protection action abnormally, the executed sub-process adjacent to the sub-process, the moment when the executed sub-process executes the protection action again in response to the abnormal execution of the protection action by the sub-process, and the second time interval between the moment of executing the protection action again and the moment when it is determined that the sub-process executes the protection action abnormally; determine the unexecuted sub-process adjacent to the sub-process and the reduction in time consumed for the unexecuted sub-process to execute the corresponding protection action; and judge whether the overall protection performance of the network security process is qualified based on the second time interval and the reduction in time consumed.

[0057] In this embodiment, in the process of security protection, the overall protection capability of the security protection process is evaluated according to the coordination between the multiple sub-processes of the security protection process. When it is determined that a sub-process performs an abnormal protection action, its adjacent executed sub-process (i.e., the previous sub-process) and unexecuted sub-process (i.e., the next sub-process) are determined, and the interval between the moment when the executed sub-process performs secondary protection in cooperation with the abnormal sub-process and the moment when the abnormal sub-process performs an abnormal protection action is determined, i.e., the second time interval, and the shorter the interval, the higher the degree of coordination of the adjacent executed processes. In addition, when it is determined that a sub-process performs an abnormal protection action, it is also necessary to determine the adjacent unexecuted sub-process of the abnormal sub-process. Due to the reason that the abnormal sub-process fails to perform the protection action, it is necessary for itself or the adjacent executed sub-process to perform secondary protection. In the case of limited overall protection time, the time for the adjacent unexecuted sub-process to perform the protection action is naturally compressed, and the unexecuted sub-process is required to compress the time for its own execution of the protection action to ensure the overall protection capability of the security protection process. The greater the compression degree that the unexecuted sub-process can withstand for the execution time of the protection action, that is, the greater the reduction in the time spent on executing the corresponding protection action, the higher the degree of cooperation. The overall protection performance of the security protection process is evaluated based on the degree of cooperation between the adjacent executed sub-processes and the adjacent unexecuted sub-processes of the abnormal sub-process.

[0058] In order to implement the evaluation of the overall protection performance of the security protection process, in an optional embodiment of the present invention, the total process evaluation module 102 is also used to determine whether the second time interval does not exceed the interval threshold, and whether the reduction amount exceeds the reduction threshold; when the second time interval exceeds the interval threshold, and / or the reduction amount does not exceed the reduction threshold, it is determined that the overall protection performance of the network security process is unqualified. In this embodiment, the shorter the second time interval, the higher the degree of cooperation of the executed sub-process, and the larger the time reduction amount, the higher the degree of cooperation of the unexecuted sub-process. Therefore, when the second time interval does not exceed the interval threshold and the time reduction amount exceeds the reduction threshold, it is determined that the overall protection performance of the security protection process is qualified. Then, when the second time interval exceeds the interval threshold and the time reduction amount does not exceed the reduction threshold, it is determined that the overall protection performance of the security protection process is unqualified.

[0059] In an optional embodiment of the present invention, the network security status assessment module 103 is used to send an overall protection performance failure signal to the network security testing module 104 when the overall protection performance fails to meet the requirements; the network security testing module 104 is used to adjust the protection actions of the network security process according to the overall protection performance failure signal, and monitor the execution of the adjusted protection actions. Similarly, the network security testing module 104 acts as a "manager", receives receipts, determines that the overall protection performance fails to meet the requirements according to the receipts, adjusts the protection actions, and continuously monitors the adjusted protection actions.

[0060] In order to evaluate the current network security status, the network security status evaluation module 103 is also used to obtain the cumulative value of the abnormal execution time of the protection action of at least one sub-process in the multiple sub-processes, and the protection delay time of the network security process against external intrusion when at least one sub-process in the multiple sub-processes is abnormal according to the indication of the completion of the network security status evaluation included in the second judgment result; determine the first increase rate of the cumulative value of the time and the second increase rate of the protection delay time; determine whether the network security status of the current network is abnormal according to the first increase rate and the second increase rate. Although the protection performance of the security protection process corresponding to the network affects the network security status, the protection performance of the security protection process cannot directly represent the network security status. And the occurrence of protection anomalies in the network security process more times or longer durations cannot directly indicate that the network security status is poor. If it is necessary to determine the network security status, it is also necessary to refer to the external intrusion situation and the protection situation against the external intrusion. For example, on the basis of the continuous accumulation of the protection anomaly execution time of at least one sub-process, the delay time of the protection action against the external intrusion is naturally accumulated at the same time. According to the respective cumulative growth rates of the abnormal time and the protection delay time, it can be determined whether the network security status is abnormal. The faster the cumulative growth rate, the worse the network security status.

[0061] In order to evaluate the current network security status, the network security status evaluation module 103 is also used to determine that the network security status of the current network is abnormal when the first increase rate is greater than the first increase rate threshold, and / or the second increase rate is greater than the second increase rate threshold. The faster the cumulative growth rate, the worse the network security status. When at least one of the increase rate of the accumulated value of the abnormal duration and the increase rate of the protection delay duration exceeds the corresponding increase rate threshold, it can be determined that the network security status of the current network is abnormal.

[0062] In order to predict the network threats faced by the current network and take protective measures in advance when the threats are serious, in an optional embodiment of the present invention, the system network security testing module 104 and the network threat analysis module 105 are as follows: Figure 2 As shown, the network security test module 104 is used to send a network threat analysis instruction to the network threat analysis module 105 according to the network security status determined by the network security status assessment module 103; the network threat analysis module 105 is used to determine the network threat situation faced by the current network during network operation according to the network threat analysis instruction; and determine whether the network security status is abnormal according to the network threat situation. The network security test module 104 acts as a "manager" and receives receipts sent by other modules after performing corresponding operations. The network security test module 104 performs corresponding operations according to the receipt. When receiving the network security status evaluated by the network security status assessment module 103, an instruction is sent to the network threat analysis module 105 to trigger it to perform network threat analysis, and determine whether the network threat situation faced by the current network is normal, and make protection preparations in advance when the network threat is found to be abnormal, so as to prevent the network from being attacked and interrupting the network operation.

[0063] In an optional embodiment of the present invention, in order to determine the pressure of being attacked faced by the current network, the network threat analysis module 105 is also used to determine the frequency of first external intrusions during network operation and the overall time consumed from risk monitoring for non-first external intrusions to the completion of protection actions according to the network threat analysis instructions; based on the frequency of first external intrusions and the overall time consumed, determine whether the network threat situation faced by the current network is abnormal. Based on the frequency of the security protection process responding to the first external intrusion and the time taken from discovering the non-first external intrusion to completing the protection, determine the ability of the current security protection process to discover and respond to risks, and based on this ability, determine whether the network threat faced by the current network is abnormal, that is, determine whether the protection capability of the current security protection process is sufficient to deal with external network threats.

[0064] In order to improve the protection capability of the security protection process against external network threats, in an optional embodiment of the present invention, the network threat analysis module 105 is used to send a network threat situation abnormality signal to the network security testing module 104 when the network threat situation faced by the current network is abnormal; the network security testing module 104 is used to adjust the protection action of the network security process according to the network threat situation abnormality signal and modify the corresponding hardware configuration. When it is determined that the network threat is abnormal, that is, when it is determined that the protection capability of the current security protection process is insufficient to respond to external network threats, the protection action corresponding to the security protection process is reset by the network security testing module 104, and the hardware equipment is changed according to the adjusted protection action, so as to ensure that the performance of the changed hardware equipment can support the adjusted protection action.

[0065] The network security status assessment system of the embodiment of the present invention monitors the protection performance of each sub-process in the security protection process during the network security protection process, and evaluates the overall protection performance of the security protection process based on the protection performance of each sub-process, and then determines the security protection abnormal situation and the protection situation against external intrusion under abnormal circumstances based on the overall protection performance, thereby realizing the assessment of the network security status during the security protection process, so that problems in the protection process can be discovered in time and the protection measures can be adjusted in time to prevent problems before they occur, thereby improving the security protection efficiency and reducing the cost of network operation; in addition, the network security status is assessed from multiple dimensions, the assessment results are highly reliable, and the protection measures can be adjusted in a targeted manner to reduce the possibility of the network being attacked.

[0066] Figure 3 4 is a schematic diagram of main steps of a network security status assessment method according to an embodiment of the present invention.

[0067] like Figure 3 As shown, the network security status assessment method of the embodiment of the present invention includes: steps S301-S303:

[0068] Step S301: determining a first execution result of a sub-process executing independent protection through a sub-process evaluation module, wherein the sub-process is any sub-process among multiple sub-processes of the security protection process of the current network, and judging whether the independent protection performance of the sub-process is abnormal according to the first execution result;

[0069] Step S302: Determine, by the overall process evaluation module, a second execution result of the sub-process and its adjacent sub-processes performing collaborative protection according to the first judgment result of the sub-process evaluation module; determine whether the overall protection performance of the security protection process is qualified according to the second execution result;

[0070] Step S303: Determine the security protection anomalies corresponding to the multiple sub-processes and the protection status of the network security process against external intrusions through the network security status assessment module according to the second judgment result of the overall process assessment module, and determine the network security status of the current network according to the security protection anomalies and the protection status against external intrusions.

[0071] The network security status assessment method of the embodiment of the present invention monitors the protection performance of each sub-process in the security protection process during the network security protection process, and evaluates the overall protection performance of the security protection process based on the protection performance of each sub-process, and then determines the security protection abnormal situation and the protection situation against external intrusion under abnormal circumstances based on the overall protection performance, thereby realizing the assessment of the network security status during the security protection process, so that problems in the protection process can be discovered in time and protection measures can be adjusted in time to prevent problems before they occur, thereby improving security protection efficiency and reducing the cost of network operation; in addition, the network security status is assessed from multiple dimensions, the assessment results are highly reliable, and protection measures can be adjusted in a targeted manner to reduce the possibility of the network being attacked.

[0072] Figure 4 An exemplary system architecture 400 is shown to which the network security status assessment method or network security status assessment device according to the embodiment of the present invention can be applied.

[0073] like Figure 4 As shown, system architecture 400 may include security protection device 401, network 402 and server 403. Network 402 is used to provide a medium for a communication link between security protection device 401 and server 403. Network 402 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0074] The security protection device 401 interacts with the server 403 through the network 402 to receive or send data, etc. The server obtains the execution result of the security protection device executing the protection action, evaluates its overall protection performance according to the execution result, and adjusts or modifies the protection action and hardware configuration of the security protection device when the overall protection performance is unqualified, so as to ensure that the current network security status of the network protected by the security protection device is in a normal state.

[0075] It should be noted that the network security status assessment method provided in the embodiment of the present invention may be executed by the server 403 , and accordingly, the network security status assessment device may be disposed in the control server 403 .

[0076] It should be understood that Figure 4 The number of security protection devices, networks and servers in the embodiment is only for illustration. Any number of security protection devices, networks and servers may be provided according to the implementation requirements.

[0077] Reference below Figure 5 , which shows a schematic diagram of the structure of a computer system 500 of an electronic device suitable for implementing an embodiment of the present invention. Figure 5 The network security protection device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0078] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the computer system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0079] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0080] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present invention are executed.

[0081] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0082] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0083] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor. For example, they may be described as follows: a processor includes a sub-process evaluation module, a total process evaluation module, and a network security status evaluation module. The names of these modules do not, in some cases, constitute limitations on the modules themselves. For example, the network security status evaluation module may also be described as a "module for determining the network security status of the current network."

[0084] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by one of the devices, the device includes: determining the first execution result of the sub-process executing independent protection through the sub-process evaluation module, the sub-process is any sub-process in the multiple sub-processes of the security protection process of the current network, and judging whether the independent protection performance of the sub-process is abnormal according to the first execution result; determining the second execution result of the sub-process and its adjacent sub-process executing collaborative protection through the total process evaluation module according to the first judgment result of the sub-process evaluation module; judging whether the overall protection performance of the security protection process is qualified according to the second execution result; determining the security protection abnormalities corresponding to the multiple sub-processes and the protection of the network security process against external intrusion through the network security status evaluation module according to the second judgment result of the total process evaluation module, and determining the network security status of the current network according to the security protection abnormalities and the protection against external intrusion.

[0085] According to the technical solution of the embodiment of the present invention, by monitoring the protection performance of each sub-process in the security protection process during the network security protection process, and evaluating the overall protection performance of the security protection process based on the protection performance of each sub-process, and then determining the security protection abnormal situation and the protection situation against external intrusion under abnormal circumstances based on the overall protection performance, it is possible to evaluate the network security status during the security protection process, so that problems in the protection process can be discovered in time and protection measures can be adjusted in time to prevent problems before they occur, thereby improving security protection efficiency and reducing the cost of network operation; in addition, the network security status is evaluated from multiple dimensions, the evaluation results are highly reliable, and protection measures can be adjusted in a targeted manner to reduce the possibility of the network being attacked.

[0086] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security status assessment system, characterized in that: include: Sub-process evaluation module, overall process evaluation module, and network security status evaluation module, wherein: The sub-process evaluation module is used to determine a first execution result of the sub-process executing independent protection, where the sub-process is any sub-process among multiple sub-processes of the security protection process of the current network, and judge whether the independent protection performance of the sub-process is abnormal according to the first execution result; The overall process evaluation module is used to determine the second execution result of the collaborative protection of the sub-process and its adjacent sub-processes according to the first judgment result of the sub-process evaluation module; to judge whether the overall protection performance of the security protection process is qualified according to the second execution result; and is also used to determine the executed sub-process adjacent to the sub-process, the moment when the executed sub-process executes the protection action again in response to the abnormality in the protection action execution of the sub-process, and the second time interval between the moment of executing the protection action again and the moment when the sub-process is determined to have executed the protection action abnormally, when the first judgment result indicates that the sub-process executes the protection action abnormally; to determine the unexecuted sub-process adjacent to the sub-process, and the reduction in time consumed by the unexecuted sub-process to execute the corresponding protection action; and to judge whether the overall protection performance of the network security process is qualified according to the second time interval and the reduction in time consumed; The network security status assessment module is used to determine the security protection anomalies corresponding to the multiple sub-processes and the protection status of the network security process against external intrusions based on the second judgment result of the overall process assessment module, and determine the network security status of the current network based on the security protection anomalies and the protection status against external intrusions.

2. The system according to claim 1, characterized in that Also includes: Network security testing module and network threat analysis module, among which, The network security testing module is used to send a network threat analysis instruction to the network threat analysis module according to the network security status determined by the network security status assessment module; The network threat analysis module is used to determine the network threat situation faced by the current network during network operation according to the network threat analysis instruction; and determine whether the network security status is abnormal according to the network threat situation.

3. The system according to claim 2, characterized in that The network threat analysis module is also used to determine the frequency of first external intrusions during network operation and the overall time consumed from risk monitoring of non-first external intrusions to the completion of protective action execution according to the network threat analysis instructions; and determine whether the network threat situation faced by the current network is abnormal based on the frequency of first external intrusions and the overall time consumed.

4. The system according to any one of claims 1 to 3, characterized in that: The sub-process evaluation module is also used to obtain the actual duration of the sub-process executing the protection action and the preset duration corresponding to the sub-process executing the protection action, and calculate the duration deviation between the actual duration and the preset duration; obtain the secondary protection frequency of the sub-process executing the same protection action again after the sub-process executes the protection action; obtain the first time interval between the first invalid execution time of the sub-process protection action and the second execution time; and determine whether the protection performance of the sub-process is abnormal based on the duration deviation, the secondary protection frequency and the first time interval.

5. The system according to claim 4, characterized in that The sub-process evaluation module is also used to calculate the delay protection coefficient corresponding to the sub-process based on the duration deviation corresponding to the sub-process, the secondary protection frequency and the first time interval; compare the delay protection coefficient with a coefficient threshold; and determine that the sub-process executes an abnormal protection action when the delay protection coefficient is greater than the coefficient threshold.

6. The system according to claim 1, characterized in that The overall process evaluation module is also used to determine whether the second time interval does not exceed the interval threshold, and whether the reduction amount exceeds the reduction threshold; when the second time interval exceeds the interval threshold and / or the reduction amount does not exceed the reduction threshold, it is determined that the overall protection performance of the network security process is unqualified.

7. The system according to any one of claims 1 to 3, characterized in that: The network security status assessment module is further configured to obtain, according to the indication of completion of the network security status assessment included in the second judgment result, a cumulative value of the duration of abnormal execution of the protection action of at least one of the multiple sub-processes, and a protection delay duration of the network security process against external intrusion when at least one of the multiple sub-processes is abnormal; Determine a first increasing speed of the accumulated time value and a second increasing speed of the protection delay time; and determine whether the network security status of the current network is abnormal based on the first increasing speed and the second increasing speed.

8. The system according to claim 7, characterized in that The network security status evaluation module is further configured to determine that the network security status of the current network is abnormal when the first increase rate is greater than a first increase rate threshold and / or the second increase rate is greater than a second increase rate threshold.

9. The system according to claim 2 or 3, characterized in that: The sub-process evaluation module is used to send a sub-process protection performance abnormality signal to the network security testing module when the protection performance of at least one sub-process among the multiple sub-processes is abnormal; The network security testing module is used to perform security protection on the network according to the abnormal signal of the sub-process protection performance.

10. The system according to claim 2 or 3, characterized in that: The network security status evaluation module is used to send an overall protection performance failure signal to the network security testing module when the overall protection performance fails to meet the requirements; The network security testing module is used to adjust the protection action of the network security process according to the overall protection performance failure signal, and monitor the execution of the adjusted protection action.

11. The system according to claim 2 or 3, characterized in that: The network threat analysis module is used to send a network threat situation abnormality signal to the network security testing module when the network threat situation faced by the current network is abnormal; The network security testing module is used to adjust the protection actions of the network security process according to the abnormal signal of the network threat situation and modify the corresponding hardware configuration.

12. A network security status assessment method, characterized in that: include: Determine, by a sub-process evaluation module, a first execution result of the sub-process executing independent protection, wherein the sub-process is any sub-process among multiple sub-processes of the security protection process of the current network, and judge whether the independent protection performance of the sub-process is abnormal according to the first execution result; Determine, by the overall process evaluation module, a second execution result of performing collaborative protection between the sub-process and its adjacent sub-process according to the first judgment result of the sub-process evaluation module; Judging whether the overall protection performance of the security protection process is qualified according to the second execution result; specifically comprising: when the first judgment result indicates that the sub-process executes the protection action abnormally, determining the executed sub-process adjacent to the sub-process, the moment when the executed sub-process executes the protection action again in response to the abnormal execution of the protection action by the sub-process, and the second time interval between the moment of executing the protection action again and the moment when the sub-process executes the protection action abnormally; determining the unexecuted sub-process adjacent to the sub-process, and the reduction in time consumed by the unexecuted sub-process to execute the corresponding protection action; judging whether the overall protection performance of the network security process is qualified according to the second time interval and the reduction in time consumed; The network security status assessment module determines the security protection anomalies corresponding to the multiple sub-processes and the protection status of the network security process against external intrusion based on the second judgment result of the overall process assessment module, and determines the network security status of the current network based on the security protection anomalies and the protection status against external intrusion.

13. An electronic device for network security status assessment, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in claim 12.

14. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 12 is implemented.

Images