Periodic management method and device for assets

Abstract

An embodiment of the specification provides a periodic management method and device for assets, the method comprising: calculating asset risk degrees of each asset in at least one asset according to scanning results of each asset in the at least one asset in each scan in a historical monitoring period; performing asset division on the at least one asset according to a preset threshold and the asset risk degrees of the each asset to obtain a first asset set and a second asset set; calculating a set scanning time length of the first asset set according to a time length algorithm corresponding to the first asset set, and calculating asset scanning time lengths of each asset in the second asset set according to a time length algorithm corresponding to the second asset set; and calculating a period deadline time of the at least one asset in a current monitoring period based on the set scanning time length and the asset scanning time lengths, so as to perform next monitoring period update in a case where the period deadline time is detected to arrive.

Description

TECHNICAL FIELD

[0001] The present document relates to exposed asset management technology, in particular to an asset periodic management method and device. BACKGROUND

[0002] Exposed assets refer to information systems, servers, application programs, databases and other resources exposed or disclosed by enterprises or organizations on the Internet. These exposed assets may have security vulnerabilities and become targets of hacker attacks, causing serious security threats and losses to enterprises.

[0003] Currently, there are some security monitoring methods and risk assessment methods for exposed assets. The monitoring results can be compared and analyzed with historical assets or historical security threats by continuously monitoring exposed assets or security threats in exposed assets. Asset detection tools or scanning tools can be used to obtain exposed asset information, asset vulnerability data, external threat data for exposed assets, and risk assessment of exposed assets based on at least one of the above information. However, the existing methods have some unresolved problems, such as: continuous monitoring cannot automatically adjust the monitoring time after detecting abnormalities, the monitoring resource occupancy rate is high and the resource consumption is serious, the impact factor of defining asset risk is rough, and the specific operation scheme of numerical evaluation is not described. SUMMARY

[0004] An embodiment of the present specification aims to provide an asset periodic management method and device to solve the problems of periodic monitoring of exposed assets and dynamic updating of monitoring parameters.

[0005] To solve the above technical problems, an embodiment of the present specification is implemented as follows:

[0006] In a first aspect, an embodiment of the present specification provides an asset periodic management method, which comprises:

[0007] According to the scanning results of each asset in at least one asset in each scan in the historical monitoring period, the asset risk degree of each asset is calculated;

[0008] According to the preset threshold and the asset risk degree of each asset, the at least one asset is divided into assets, and a first asset set and a second asset set are obtained;

[0009] According to the time length algorithm corresponding to the first asset set, the set scanning time length of the first asset set is calculated, and according to the time length algorithm corresponding to the second asset set, the asset scanning time length of each asset in the second asset set is calculated;

[0010] Based on the set scan duration and the asset scan duration, a cycle deadline of the at least one asset in a current monitoring cycle is calculated to perform a next monitoring cycle update in case of detecting arrival of the cycle deadline.

[0011] In a second aspect, another embodiment of the present specification provides a cycle management device of an asset, the device comprising:

[0012] An asset risk degree calculation module is configured to calculate asset risk degrees of assets in the at least one asset according to scan results of each asset in the at least one asset in each scan in a historical monitoring cycle;

[0013] An asset division module is configured to perform asset division on the at least one asset according to a preset threshold and the asset risk degrees of the assets to obtain a first asset set and a second asset set;

[0014] A scan duration calculation module is configured to calculate a set scan duration of the first asset set according to a duration algorithm corresponding to the first asset set, and calculate asset scan durations of assets in the second asset set according to a duration algorithm corresponding to the second asset set;

[0015] A deadline calculation module is configured to calculate a cycle deadline of the at least one asset in a current monitoring cycle based on the set scan duration and the asset scan duration, to perform a next monitoring cycle update in case of detecting arrival of the cycle deadline.

[0016] In a third aspect, another embodiment of the present specification provides a cycle management device of an asset, the cycle management device of the asset comprising a memory, a processor, and computer executable instructions stored in the memory and executable on the processor, the computer executable instructions being executed by the processor to implement steps of the cycle management method of the asset according to the first aspect.

[0017] In a fourth aspect, another embodiment of the present specification provides a computer readable storage medium for storing computer executable instructions, the computer executable instructions being executed by a processor to implement steps of the cycle management method of the asset according to the first aspect.

[0018] In a fifth aspect, another embodiment of the present specification provides a computer program product comprising a computer program, the computer program being executed by a processor to implement steps of the cycle management method of the asset according to the first aspect.

[0019] The asset cycle management method provided by the embodiment is used to solve the problems that the factors affecting the credibility change in real time with the network and time, the asset importance changes with the external properties such as asset properties and operation business, the continuous monitoring cannot automatically adjust the monitoring time after detecting the abnormality, and the like, and the monitoring time is adjusted according to the actual situation of the managed assets in the monitoring process, and the best balance between the security and the resource consumption is fully considered. First, the managed assets are periodically monitored, the asset risk degree of each asset is calculated according to the scanning result of each asset in the at least one asset, the assets are divided according to the preset threshold and the asset risk degree of each asset, and a first asset set and a second asset set are obtained. Then, since the asset credibility is needed for calculating the scanning time length, the factors affecting the credibility change in real time with the network, the equipment change and the scanning result, and the asset importance changes with the external properties such as asset properties and operation business, the dynamic updating algorithm is adopted, the set scanning time length of the first asset set is calculated according to the time length algorithm corresponding to the first asset set, and the asset scanning time length of each asset in the second asset set is calculated according to the time length algorithm corresponding to the second asset set. The cycle end time of the at least one asset in the current monitoring cycle is calculated according to the set scanning time length and the asset scanning time length, so that the next monitoring cycle is updated in the case that the cycle end time is detected to arrive, the monitoring cycle time is dynamically adjusted according to the actual change, and the resource consumption can be reduced under the premise of ensuring the security. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the one or more embodiments of the present specification or the prior art, the drawings needed to be used in the embodiment or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can be obtained by those skilled in the art without any creative effort.

[0021] Figure 1 A process flow chart of an asset cycle management method provided by an embodiment of the present specification;

[0022] Figure 2 A process flow chart of an asset cycle management method applied to an asset monitoring scene provided by an embodiment of the present specification;

[0023] Figure 3 A schematic diagram of an asset cycle management device provided by an embodiment of the present specification;

[0024] Figure 4 A structural schematic diagram of an asset cycle management device provided by an embodiment of the present specification. DETAILED DESCRIPTION

[0025] In order to make the person skilled in the art better understand the technical solutions in one or more embodiments of the present specification, the technical solutions in one or more embodiments of the present specification will be clearly and completely described in the present specification in conjunction with the drawings in one or more embodiments of the present specification. Obviously, the described embodiments are only a part of the embodiments of the present specification, not all. Based on one or more embodiments of the present specification, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present document.

[0026] The present specification provides an embodiment of a cycle management method of an asset:

[0027] Referring to Figure 1 The cycle management method of the asset provided in the embodiment specifically includes the following steps S102 to S108.

[0028] Step S102, according to the scanning result of each asset in at least one asset in each scanning in the historical monitoring cycle, calculating the asset risk degree of the asset.

[0029] In specific implementation, according to the historical scanning result of each asset in at least one asset, the asset risk degree of each asset is calculated. In the process of calculating the asset risk degree of each asset, an optional implementation provided in the embodiment:

[0030] According to the vulnerability scanning result in the scanning result of each asset in each scanning, calculating the risk influence factor of each asset in each scanning; and,

[0031] According to the port scanning result in the scanning result of each asset in each scanning, calculating the asset abnormality degree of each asset in each scanning;

[0032] Based on the risk influence factor, asset abnormality degree and abnormal port number of each asset in each scanning, calculating the asset risk degree of each asset.

[0033] Specifically, first, according to the vulnerability scanning result in the historical scanning result of each asset, the risk influence factor of each asset in each scanning is calculated; second, according to the port scanning result in the historical scanning result of each asset, the asset abnormality degree of each asset in each scanning is calculated; finally, according to the risk influence factor, asset abnormality degree and abnormal port number in the historical scanning result of each asset, the asset abnormality degree of each asset is calculated.

[0034] Suppose there are m exposed assets NA = {NA1, NA2,..., NA m}. Suppose the scanning number set of each asset is Where represents the exposed asset NAj The total number of scans is completed Scans.

[0035] First, the risk impact factor of any asset in each scan is calculated, for any asset NA j , n Hi represents the number of high-risk vulnerabilities in the i-th scan result, n Mi represents the number of medium-risk vulnerabilities in the i-th scan result, n Li represents the number of low-risk vulnerabilities in the i-th scan result, and n Ri represents the number of weak passwords in the i-th scan result. Then the risk impact factor β(NA j ) of asset NA j in the i-th scan is:

[0036]

[0037] where γ H represents the high-risk vulnerability impact factor, γ M represents the medium-risk vulnerability impact factor, γ L represents the low-risk vulnerability impact factor, and γ R represents the weak password impact factor.

[0038] Generally, passwords that are easy to guess or cracked by cracking tools are considered weak passwords. Weak passwords refer to passwords that only contain simple numbers and letters.

[0039] Vulnerability, also known as weakness or vulnerability, is a weak link in an asset or asset group that may be exploited by a threat to cause damage. Once the vulnerability is successfully exploited by a threat, it may cause damage to the asset. Vulnerability may exist in physical environment, organization, process, personnel, management, configuration, hardware, software and information, etc. Vulnerability is a weakness in a network system that may be exploited and cause harm.

[0040] Secondly, the asset abnormality degree of any asset is calculated. An optional embodiment provided by the present embodiment is:

[0041] According to the number of port abnormalities of each port of each asset in each scan, the port abnormality degree of each port is calculated.

[0042] Based on the port abnormality degree of each port, the asset abnormality degree of each asset in each scan is calculated.

[0043] Specifically, according to the number of port abnormalities of each port in each scan of each asset, the port abnormality degree of each port is calculated, and then based on the port abnormality degree of each port, the asset abnormality degree of the asset corresponding to each port is calculated.

[0044] Based on m exposed surface assets NA = {NA1, NA2,..., NA m}, represents the number of times of port abnormality of the y-port of asset NA j at the interval of n scans from the end of the Kth scan. Set represents the vulnerability set of the y-port of asset NA j at the interval of n scans from the end of the Kth scan. Set represents the number of times of the same vulnerability point discovery in set more than once.

[0045] Suppose that at the end of the Kth scan, asset NA j has g online ports, and for any port y in the g online ports, the port abnormality degree of the port is :

[0046]

[0047] where μ p and μ v are two constants.

[0048] The asset abnormality degree α(K, NA j ) of asset NA j can be represented as:

[0049]

[0050] Finally, according to the risk impact factor, asset abnormality degree and number of abnormal ports calculated from the historical scanning results of each asset, the asset abnormality degree of each asset is calculated.

[0051] For asset NA j , represents the number of abnormal ports scanned by asset NA j in the ith scan, β(NA j ) represents the risk impact factor of asset NA j in the ith scan, and α(i, NA j ) represents the asset abnormality degree of asset NA j in the ith scan, then the asset risk degree of asset NA j after all historical scans is:

[0052]

[0053] where t i represents the time of the ith scan, represents the time of the ​The time of the secondary scan. In the formula, the scan result of the scan closest to the current time has the greatest impact on the calculation result of the asset risk degree, and the scan result of the scan farthest from the current time has the least impact on the calculation result of the asset risk degree.

[0054] In step S104, the at least one asset is asset-divided according to the preset threshold and the asset risk degrees of the assets, to obtain a first asset set and a second asset set.

[0055] In a specific implementation, all the managed assets are divided according to the relationship between the calculated values of the asset risk degrees of the assets and the preset threshold, to obtain the first asset set and the second asset set. In this process, an optional implementation provided by the embodiment is as follows:

[0056] The second asset set is constructed based on the assets with the asset risk degrees greater than the first threshold, and the first asset set is constructed based on the assets with the asset risk degrees less than or equal to the first threshold.

[0057] The assets in the first asset set are asset-divided according to the second threshold and the asset risk degrees of the assets in the first asset set, to obtain a first sub-set and a second sub-set.

[0058] The asset risk degrees of the assets in the first sub-set are less than the second threshold, and the asset risk degrees of the assets in the second sub-set are greater than or equal to the second threshold.

[0059] Specifically, the assets with the asset risk degrees greater than the first threshold are constructed as the second asset set, and the assets with the asset risk degrees less than or equal to the first threshold are constructed as the first asset set. Then, the assets in the first asset set are divided based on the second threshold, the assets with the asset risk degrees less than the second threshold in the first asset set are constructed as the first sub-set of the first asset set, and the assets with the asset risk degrees greater than or equal to the second threshold in the first asset set are constructed as the second sub-set of the first asset set.

[0060] Based on the m exposure face assets NA = {NA1, NA2,..., NA m}, let ω1 and ω2 be the first threshold and the second threshold, be the asset risk degree of any asset NA j , then:

[0061] If , then the asset NA j belongs to the first sub-set D1 of the first asset set, that is, a low-risk asset set.

[0062] If , then the asset NA ja second sub-set D2 belonging to the first asset set, i.e. a medium-risk asset set;

[0063] If the asset NA j belongs to a second asset set D3, i.e. a high-risk asset set.

[0064] In step S106, the set scanning time length of the first asset set is calculated according to the time length algorithm corresponding to the first asset set, and the asset scanning time length of each asset in the second asset set is calculated according to the time length algorithm corresponding to the second asset set.

[0065] In a specific implementation, the set scanning time length of each of the two sub-sets of the first asset set is calculated according to the time length algorithm corresponding to the two sub-sets, and the asset scanning time length of each asset in the second asset set is calculated according to the time length algorithm corresponding to the second asset set. In the specific calculation of the scanning time length, an optional implementation provided by the embodiment is as follows:

[0066] The set confidence of the first asset set is calculated according to the confidence algorithm corresponding to the first asset set, and the asset confidence of each asset in the second asset set is calculated according to the confidence algorithm corresponding to the second asset set.

[0067] The set scanning time length of the first asset set is calculated according to the set confidence and the scanning time length algorithm corresponding to the first asset set; and

[0068] The asset scanning time length of each asset in the second asset set is calculated according to the asset confidence and the asset fine-grained time consumption of each asset.

[0069] In a specific implementation, firstly, the set confidence of each of the two sub-sets of the first asset set is calculated according to the confidence algorithm corresponding to each of the two sub-sets, and the asset confidence of each asset in the second asset set is calculated according to the confidence algorithm corresponding to the second asset set; then, the set scanning time length of each of the two sub-sets of the first asset set is calculated according to the time length algorithm corresponding to each of the two sub-sets, and the asset scanning time length of each asset in the second asset set is calculated according to the time length algorithm corresponding to the second asset set. In the calculation of the set confidence of the first asset set, an optional implementation provided by the embodiment is as follows:

[0070] The first influence parameter is calculated based on the first confidence influence factor, the asset importance of each asset in the first sub-set, the importance degree and the port degree of each port.

[0071] The ratio of the first influence parameter and the sum of the asset importance degrees of the assets in the first sub-set is calculated as the sub-set confidence of the first sub-set.

[0072] as well as,

[0073] The second influence parameter is calculated based on the second credibility influence factor, the asset importance and degree of importance of each asset in the second subset, and the degree of port of each port;

[0074] The ratio of the second influence parameter to the sum of the asset risk levels of each asset in the second subset is used as the subset confidence level of the second subset.

[0075] In practice, the first influence parameter is calculated based on the first credibility influence factor, the asset importance and degree of importance of each asset in the first subset of the first asset set, and the port degree of each port. The ratio of the first influence parameter to the sum of the asset importance of each asset in the first subset is used as the set credibility of the first subset. Then, the second influence parameter is calculated based on the second credibility influence factor, the asset importance and degree of importance of each asset in the second subset of the first asset set, and the port degree of each port. The ratio of the second influence parameter to the sum of the asset importance of each asset in the second subset is used as the set credibility of the second subset.

[0076] Specifically, considering the constantly changing factors affecting the importance of exposed assets, such as asset performance and operational processes, in the actual management environment, a scan is performed on any asset NA every F scan cycles. j Update asset importance. For any asset NA j Its asset importance is defined as:

[0077]

[0078] Among them, e new It indicates that there are a total of e new Factors affecting the importance of an item Indicates the g-th new There are a total of factors affecting the importance of an item. Class of impact factors Indicates the g-th new The weights of factors influencing class importance. Indicates the g-th new The kth factor influencing class importance new The weights of class-based impact factors.

[0079] The previous text defined m exposed assets NA = {NA1,NA2,...,NA}. m The assets are divided into three asset sets based on thresholds: D1 is the first subset of the first asset set, i.e., the low-risk asset set; D2 is the second subset of the first asset set, i.e., the medium-risk asset set; and D3 is the second asset set, i.e., the high-risk asset set.

[0080] Let set represents the set confidence of the set D1 in the i-th scan, and the set confidence of the set D1 in the i-th scan is calculated as:

[0081]

[0082] wherein ζ1 represents a first confidence influencing factor, j represents any asset serial number of assets in the set D1, count(D1) represents the total number of assets in the set D1, represents the initial asset importance of the j-th asset in the set D1, m represents any port serial number of the j-th asset in the set D1, represents the number of ports of the j-th asset in the set D1, represents the initial port importance of the m-th port of the j-th asset in the set D1, represents the asset importance of the j-th asset in the set D1.

[0083] For example, in the process of calculating the set confidence, the numerator of the calculation formula can actually be regarded as the first confidence influencing factor ζ1 multiplied by the sum of the initial importance of each asset in the set D1 and then multiplied by the sum of the asset importance of each asset in the set D1 wherein the asset importance is calculated according to the scanning result of the historical scanning after each scanning, and is a bias influencing factor which dynamically changes according to actual environment and other factors; and the initial importance the initial asset importance and the initial port importance in the set D1 are initially set based on unchangeable factors when the device is connected to the network, for example: for the initial port importance the commonly used port 8080 is more likely to be attacked than the less commonly used port 303, so when the device is connected to the network, the port importance of the port 8080 is greater than that of the port 303. The set D2 is similar to the set D1.

[0084] The set D2 is composed of assets with higher risk, so the confidence is greatly influenced by the asset risk degree and the asset itself. Let the set represents the set confidence of the set D2 in the i-th scan, and the set confidence of the set D2 in the i-th scan is calculated as:

[0085]

[0086] wherein ζ2 represents a second confidence influencing factor, j represents any asset serial number of assets in the set D2, count(D2) represents the total number of assets in the set D2, ​​Let m represent the initial asset importance of the j-th asset in set D2, and m represent the port index of any asset j in set D2. This represents the number of ports for the j-th asset in set D2. This represents the initial port importance of the m-th port of the j-th asset in set D2. This represents the asset importance of the j-th asset in set D2. This represents the asset risk level of the j-th asset in set D2.

[0087] Set D3 consists of extremely high-risk assets; in this case, confidence is inversely correlated with the risk level of the assets. Let set D3 be... In Let D3 represent the set of credibility values ​​for the i-th scan. The credibility of the j-th asset in the i-th scan of set D3 is calculated as follows:

[0088]

[0089] Where ζ3 represents the credibility impact factor, This represents the asset risk level calculated for the j-th asset in set D3 after the i-th scan.

[0090] As two key factors in the periodic management process, security decreases as the periodic monitoring time increases, while resource consumption increases as the periodic monitoring time increases. The periodic monitoring time needs to minimize resource consumption while ensuring security requirements.

[0091] Let set T = {T1, T2, ..., T} n}, n→+∞, where T i T represents the set of scan durations for the i-th scan. i From elements Composition, setting in This represents the scan duration of the i-th scan of the j-th asset in set D3.

[0092] Let T min =η(NA) represents the relationship between the time required to complete the scan of managed assets and the number of managed assets NA.

[0093] For asset set D1 with relatively low asset risk, the set scan duration in the i-th scan is calculated as follows:

[0094]

[0095] in, This indicates that the discount factor has been updated.

[0096] For the asset set D2 with high asset risk, the set scan duration in the i-th scan is calculated as follows:

[0097]

[0098] wherein, represents an update discount factor.

[0099] For the asset set D3 with extremely high asset risk, at this time, security is the first influencing factor. Let T l represents the completion of a single asset granularity spending time, the asset scan duration of the j-th asset in the set D3 in the i-th scan is calculated as follows:

[0100]

[0101] wherein, represents an update discount factor.

[0102] In specific implementation, after the scan duration of each asset set and asset is calculated, the scan duration is not updated in the same monitoring period.

[0103] In step S108, based on the set scan duration and the asset scan duration, the period end time of the at least one asset in the current monitoring period is calculated to update the next monitoring period when the period end time is detected to arrive.

[0104] In specific implementation, according to the calculated set scan duration and asset scan duration, the period end time of the managed asset in the current monitoring period is calculated, when the current time reaches the period end time, the scan duration of each asset set and asset is updated, and after the update is completed, the next monitoring period after the scan duration is updated is entered; when the current time does not reach the period end time, the next scan without updating the scan duration is entered. In the process of calculating the current period end time, an optional embodiment provided by the embodiment is as follows:

[0105] The minimum scan duration is determined from the set scan duration and the asset scan duration.

[0106] The product of the minimum scan duration and a preset scan parameter is calculated as a monitoring period duration, and the period end time is determined according to the monitoring period duration and a monitoring start time.

[0107] Specifically, the minimum scan duration is determined from the calculated set scan duration and asset scan duration, the product of the minimum scan duration and a preset scan parameter is calculated as a monitoring period duration, and the period end time of the current monitoring period is determined according to the start time of the current monitoring period and the monitoring period duration.

[0108] Let the number of confirmed abnormal occurrences, the threshold value of the number of abnormal occurrences in each cycle, Cumulative from zero from the first abnormal asset, and reset at each monitoring cycle update. The monitoring cycle length calculation function of the i-th monitoring cycle is as follows:

[0109]

[0110] wherein is the minimum non-zero value in the set , ε is a constant, and n represents the total number of assets in the i-th scanning cycle set D3.

[0111] After calculating the monitoring cycle length of the current monitoring cycle, the cycle end time of the current monitoring cycle is calculated according to the monitoring start time and the monitoring cycle length of the current monitoring cycle.

[0112] If the current time reaches the cycle end time, the asset scanning duration and the set scanning duration are updated, and after the update, the next monitoring cycle is entered; if the current time does not reach the cycle end time, the next scanning of the current monitoring cycle is directly entered.

[0113] It should be noted that in step S102, if an abnormal port is monitored during scanning, the abnormal monitoring time of the asset to which the port belongs is calculated, and if the abnormal monitoring time is greater than the abnormal time threshold, the asset is offline processed; if the abnormal monitoring time is less than or equal to the abnormal time threshold, the abnormal monitoring time is taken as the continuous monitoring time and the asset is continuously monitored according to the continuous monitoring time.

[0114] Since the assets that appear abnormal in a period of time after the abnormality is found have relatively high risk, the assets in the list of confirmed abnormal assets are continuously monitored after each scanning. Let t max be the maximum continuous monitoring time, and the abnormal monitoring time The continuous monitoring time of the abnormal asset NA j is calculated as follows:

[0115]

[0116] wherein, is a constant, represents the asset risk degree of the asset NA j calculated after all historical scanning.

[0117] When the abnormal monitoring time t c is greater than the specified threshold t max , the abnormal asset is manually intervened and offline processed; when the abnormal monitoring time tc not greater than a specified threshold t max time, the abnormal asset is subjected to a persistent monitoring for a duration of t c .

[0118] To sum up, the periodic management method of assets provided by the embodiment first performs periodic scanning on the managed exposure face assets. After each asset is scanned once, the risk influence factor of each asset is calculated according to the vulnerability scanning result in the scanning result; the port abnormality of each port corresponding to the asset is calculated according to the port scanning result in the scanning result, and then the asset abnormality of each asset is calculated; the asset risk degree of the corresponding asset is calculated according to all historical scanning results and the risk influence factor and asset abnormality calculated by each scanning. In this scanning process, if a port abnormality is scanned, the abnormal monitoring time of the abnormal asset is calculated, if the abnormal monitoring time is greater than a specified time threshold, the abnormal asset is offline; if the abnormal monitoring time is less than or equal to the specified time threshold, the persistent monitoring time of the corresponding abnormal asset is calculated, and the abnormal asset is subjected to persistent monitoring for the corresponding time.

[0119] Secondly, according to the relationship between the asset risk degree of all assets and the specified first threshold and second threshold, the assets with the asset risk degree greater than the first threshold are constructed as a second asset set D3, that is, a high-risk asset set, the assets with the asset risk degree less than the second threshold are constructed as a first sub-set D1 of the first asset set, that is, a low-risk asset set, and the assets with the asset risk degree greater than or equal to the second threshold and less than or equal to the first threshold are constructed as a second sub-set D2 of the first asset set, that is, a medium-risk asset set.

[0120] Thirdly, according to the asset set divided according to the asset risk degree, different algorithms are used to calculate the confidence of the assets in different sets, it should be noted that the two sub-sets of the first asset set calculate the set confidence of the asset set, and the assets in the second asset set calculate the asset confidence of each asset. Then, different algorithms are used to calculate the scanning duration of different sets according to the calculated set confidence and asset confidence, it should be noted that the calculated scanning duration of the second asset set is the asset scanning duration of each asset, and the two sub-sets of the first asset set calculate the set scanning duration of each sub-set.

[0121] Finally, the periodic cutoff time of the current monitoring period is calculated according to the calculated asset scanning duration and set scanning duration, when the current time reaches the periodic cutoff time, the scanning duration of each asset set and asset is updated to the latest calculated scanning duration, and then the next monitoring period after the updated scanning duration is entered; if the current time does not reach the periodic cutoff time, the next scanning of the current monitoring period is directly entered, and all assets are continuously monitored.

[0122] The following combinationFigure 2 With reference to FIG. 8, the application of the asset cycle management method provided in the embodiment to the asset monitoring scenario is taken as an example to further illustrate the asset cycle management method provided in the embodiment. Figure 2 The asset cycle management method applied to the asset monitoring scenario specifically includes the following steps.

[0123] In step S202, when it is detected that the cycle end time of the last monitoring cycle arrives, the risk influence factor of each asset in each scan is calculated according to the vulnerability scanning result in the scan result of each asset in each scan.

[0124] Optionally, each scan can be each scan in the last monitoring cycle.

[0125] In step S204, the asset abnormality of each asset in each scan is calculated according to the port scanning result in the scan result of each asset in each scan.

[0126] In step S206, the asset risk degree of each asset is calculated based on the risk influence factor, the asset abnormality and the number of abnormal ports of each asset in each scan.

[0127] In step S208, the assets are divided based on the asset risk degree of each asset, the first threshold and the second threshold to obtain the first subset, the second subset and the third subset.

[0128] In step S210, the set confidence of the first subset is calculated according to the confidence algorithm corresponding to the first subset, and the set confidence of the second subset is calculated according to the confidence algorithm corresponding to the second subset.

[0129] In step S212, the asset confidence of each asset in the third subset is calculated according to the confidence algorithm corresponding to the third subset.

[0130] In step S214, the first set scan duration is calculated according to the set confidence of the first subset and the corresponding scan duration algorithm, and the second set scan duration is calculated according to the set confidence of the second subset and the corresponding scan duration algorithm.

[0131] In step S216, the asset scan duration of each asset in the third subset is calculated according to the asset confidence of each asset in the third subset and the total asset fine-grained time consumption.

[0132] In step S218, the minimum scan duration is determined from the first set scan duration, the second set scan duration and the asset scan duration of each asset.

[0133] In step S220, the product of the minimum scan duration and the preset scan parameter is calculated as the monitoring cycle duration, and the cycle end time is determined according to the monitoring cycle duration and the monitoring start time.

[0134] Step S222, in the case of detecting that the period deadline time arrives, scanning the assets in the first sub-set according to the first set scanning time length, scanning the assets in the second sub-set according to the second set scanning time length, and scanning the assets in the third sub-set according to the asset scanning time length of each asset in the third sub-set, and returning to execute steps S202 to S222.

[0135] Figure 3 A schematic diagram of a period management device for assets provided by an embodiment of the present application is shown in FIG. 1, which comprises: Figure 3

[0136] An asset risk degree calculation module 302 is configured to calculate the asset risk degree of each asset in the at least one asset according to the scanning result of each asset in the at least one asset in each scanning in the historical monitoring period;

[0137] An asset division module 304 is configured to divide the at least one asset according to the preset threshold and the asset risk degree of each asset to obtain a first asset set and a second asset set;

[0138] A scanning time length calculation module 306 is configured to calculate the set scanning time length of the first asset set according to the time length algorithm corresponding to the first asset set, and calculate the asset scanning time length of each asset in the second asset set according to the time length algorithm corresponding to the second asset set;

[0139] A deadline time calculation module 308 is configured to calculate the period deadline time of the at least one asset in the current monitoring period based on the set scanning time length and the asset scanning time length, so as to update the next monitoring period in the case of detecting that the period deadline time arrives.

[0140] The period management device for assets provided by the embodiment firstly calculates the asset risk degree of each asset in the at least one asset according to the scanning result of each asset in the at least one asset in each scanning in the historical monitoring period by running the asset risk degree calculation module 302, divides the at least one asset according to the preset threshold and the asset risk degree of each asset to obtain a first asset set and a second asset set by running the asset division module 304, calculates the set scanning time length of the first asset set according to the time length algorithm corresponding to the first asset set, and calculates the asset scanning time length of each asset in the second asset set according to the time length algorithm corresponding to the second asset set by running the scanning time length calculation module 306, and finally calculates the period deadline time of the at least one asset in the current monitoring period based on the set scanning time length and the asset scanning time length by running the deadline time calculation module 308, so as to update the next monitoring period in the case of detecting that the period deadline time arrives.

[0141] ​The asset cycle management device provided by the embodiment of the present specification can realize the processes in the foregoing method embodiments and achieve the same functions and effects, which are not repeated here.

[0142] Further, the embodiment of the present specification also provides an asset cycle management device, Figure 4 The structural diagram of the asset cycle management device provided by the embodiment of the present specification is shown in the figure, which includes a memory 401, a processor 402, a bus 403 and a communication interface 404. The memory 401, the processor 402 and the communication interface 404 communicate through the bus 403. The communication interface 404 can include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc. Figure 4

[0143] Figure 4 In the embodiment, the memory 401 stores computer executable instructions that can run on the processor 402. When the computer executable instructions are executed by the processor 402, the following processes are realized:

[0144] According to the scanning results of each asset in the at least one asset in each scanning in the historical monitoring cycle, the asset risk degree of the asset is calculated;

[0145] According to the preset threshold and the asset risk degree of the asset, the at least one asset is divided into assets, and a first asset set and a second asset set are obtained;

[0146] According to the time length algorithm corresponding to the first asset set, the collection scanning time length of the first asset set is calculated, and according to the time length algorithm corresponding to the second asset set, the asset scanning time length of each asset in the second asset set is calculated;

[0147] Based on the collection scanning time length and the asset scanning time length, the cycle deadline time of the at least one asset in the current monitoring cycle is calculated, so as to update the next monitoring cycle when the cycle deadline time is detected.

[0148] ​The asset cycle management device provided by the embodiment can realize each process in the method embodiment and achieve the same functions and effects, which will not be repeated here.

[0149] The asset cycle management device provided by the embodiment can realize each process in the method embodiment and achieve the same functions and effects, which will not be repeated here.

[0150] Further, another embodiment of the present specification also provides a computer readable storage medium for storing computer executable instructions, wherein the computer executable instructions are executed by a processor to realize the following process:

[0151] According to the scanning result of each asset in the at least one asset in each scanning in the historical monitoring cycle, the asset risk degree of each asset is calculated.

[0152] According to the scanning result of each asset in the at least one asset in each scanning in the historical monitoring cycle, the asset risk degree of each asset is calculated.

[0153] According to the scanning result of each asset in the at least one asset in each scanning in the historical monitoring cycle, the asset risk degree of each asset is calculated.

[0154] According to the scanning result of each asset in the at least one asset in each scanning in the historical monitoring cycle, the asset risk degree of each asset is calculated.

[0155] The computer readable storage medium provided by the embodiment first calculates the asset risk degree of each asset according to the scanning result of each asset in the at least one asset in each scanning in the historical monitoring period; second, performs asset division on the at least one asset according to the preset threshold and the asset risk degree of each asset, obtains a first asset set and a second asset set, calculates the set scanning time length of the first asset set according to the time length algorithm corresponding to the first asset set, and calculates the asset scanning time length of each asset in the second asset set according to the time length algorithm corresponding to the second asset set; and finally, based on the set scanning time length and the asset scanning time length, the cycle cutoff time of the at least one asset in the current monitoring period is calculated, so as to update the next monitoring period when the cycle cutoff time is detected to arrive.

[0156] The computer readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0157] The computer readable storage medium provided by the embodiment of the present specification can realize each process in the foregoing method embodiment and achieve the same function and effect, which will not be repeated here.

[0158] Further, another embodiment of the present specification also provides a computer program product, which includes a computer program, and the computer program is executed by a processor to realize each process of the foregoing asset cycle management method embodiment and achieve the same technical effect. To avoid repetition, details will not be repeated here.

[0159] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer usable program code.

[0160] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices produce a machine that implements the functions described in the flowcharts and / or block diagrams.Figure 1 one or more processes and / or blocks Figure 1 means for performing the function specified by the block or blocks.

[0161] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 one or more processes and / or blocks Figure 1 means for performing the function specified by the block or blocks.

[0162] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 one or more processes and / or blocks Figure 1 means for performing the function specified by the block or blocks.

[0163] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0164] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory. The memory can also include non-volatile memory, such as read-only memory (ROM), electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, or non-volatile random access memory (NVRAM). The memory is an example of computer readable storage media.

[0165] Computer readable storage media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable storage media does not include transitory media, such as modulated data signals and carrier waves.

[0166] It is also to be noted that the terms "comprising", "including", and any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0167] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer-readable program code.

[0168] The embodiments of the present application described above are merely given as examples and are not intended to limit the present application. Various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall fall within the scope of claims of the present application.

Claims

1. A method for the periodic management of assets, characterized in that, The method includes: The asset risk level of each asset is calculated based on the scan results of each asset in each historical monitoring period. The at least one asset is divided into a first asset set and a second asset set according to a preset threshold and the asset risk level of each asset. The scan duration of the first asset set is calculated based on the time-duration algorithm corresponding to the first asset set, and the scan duration of each asset in the second asset set is calculated based on the time-duration algorithm corresponding to the second asset set. Based on the scan duration of the set and the scan duration of the asset, the cycle end time of the at least one asset in the current monitoring period is calculated, so as to update the next monitoring period if the cycle end time is detected to have arrived.

2. The asset cycle management method according to claim 1, characterized in that, The step of calculating the asset risk level of each asset based on the scan results of each asset in each scan during the historical monitoring period includes: Based on the vulnerability scan results of each asset in each scan, calculate the risk impact factor of each asset in each scan; and, Based on the port scan results of each asset in each scan, the asset anomaly degree of each asset in each scan is calculated. The asset risk level of each asset is calculated based on the risk impact factors, asset anomaly level, and number of anomaly ports for each asset in each scan.

3. The asset periodic management method according to claim 2, characterized in that, The step of calculating the asset anomaly degree of each asset in each scan based on the port scan results of each asset in each scan includes: The port anomaly degree of each port is calculated based on the number of port anomalies of each port in each scan for each asset. Based on the port anomaly degree of each port, the asset anomaly degree of each asset in each scan is calculated.

4. The asset cycle management method according to claim 1, characterized in that, The step of classifying at least one asset according to a preset threshold and the asset risk level of each asset to obtain a first asset set and a second asset set includes: The second asset set is constructed based on assets with an asset risk level greater than a first threshold, and the first asset set is constructed based on assets with an asset risk level less than or equal to the first threshold; The assets in the first asset set are divided according to the second threshold and the asset risk level of each asset in the first asset set to obtain a first subset and a second subset. Wherein, the asset risk level of each asset in the first subset is less than the second threshold, and the asset risk level of each asset in the second subset is greater than or equal to the second threshold.

5. A lifecycle management device for assets, characterized in that, The device includes: The asset risk calculation module is used to calculate the asset risk of each asset based on the scan results of each asset in each scan during the historical monitoring period. The asset partitioning module is used to partition the at least one asset according to a preset threshold and the asset risk level of each asset to obtain a first asset set and a second asset set. The scan duration calculation module is used to calculate the scan duration of the first asset set according to the time duration algorithm corresponding to the first asset set, and to calculate the scan duration of each asset in the second asset set according to the time duration algorithm corresponding to the second asset set. The deadline calculation module is used to calculate the cycle deadline of the at least one asset in the current monitoring period based on the scan duration of the set and the scan duration of the asset, so as to update the next monitoring period when the cycle deadline is detected.

6. An asset lifecycle management device, characterized in that, The asset periodic management device includes a memory and a processor. The memory stores computer-executable instructions, which, when executed on the processor, can implement the steps of the method described in any one of claims 1-4.

7. A computer-readable storage medium storing computer-executable instructions, characterized in that, When the computer-executable instructions are executed by a processor, they can implement the steps of the method described in any one of claims 1-4.

8. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 4.

Images