Network control method and device based on attack surface assessment

Abstract

The embodiments of this specification provide a network control method and device based on attack surface assessment, wherein the network control method based on attack surface assessment includes: determining a target asset, determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score. By determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score, a multi-perspective attack surface assessment can be achieved, which improves the comprehensiveness of the attack surface assessment, thereby improving the security of network control.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of network security technology, and in particular to a network management and control method based on attack surface assessment. Background Art

[0002] Attack surface management related technologies are emerging technologies. Attack surface management is an asset security management method that detects, discovers, analyzes, warns, responds, and continuously monitors the attack surface of enterprise digital assets from the perspective of attackers. The attack surface management solution consists of five parts: asset discovery, inventory and classification, risk scoring and security rating, continuous security monitoring, and remediation measures.

[0003] The attack surface assessment method of existing attack surface solutions is mainly based on the assets and the vulnerabilities they contain, and does not reflect the attack surface from the attacker's perspective. For example, two hosts with the same vulnerability, one is not subject to network access control, and the other is subject to strict network access control, have completely different attack surfaces from the attacker's perspective. However, the existing attack surface assessment solution will assess the attack surface of the two hosts exactly the same.

[0004] Similarly, the attack surface of the assessed asset is subject to different network protection strategies for internal and external network protection devices. When the attacker is in different network locations, the attack surface he sees will be completely different. The existing attack surface assessment solution cannot make a correct assessment of the attacker's perspective at different network locations. Therefore, a better solution is urgently needed. Summary of the invention

[0005] In view of this, the embodiments of this specification provide a network control method based on attack surface assessment. One or more embodiments of this specification also relate to a network control device based on attack surface assessment, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0006] According to a first aspect of an embodiment of this specification, a network management and control method based on attack surface assessment is provided, including:

[0007] Determine the target assets and determine at least two perspectives based on the network control strategy and the target assets;

[0008] Determining at least two attack surface information based on the at least two perspective information and the asset information of the target asset;

[0009] Determine an overall attack surface score of the target asset based on at least two attack surface information;

[0010] Perform network access control based on the overall attack surface score.

[0011] In a possible implementation, a target asset is determined, and at least two perspective information is determined based on a network management and control policy and the target asset, including:

[0012] Determine the target assets; wherein the target assets include at least two assets;

[0013] Determine network access rights for at least two assets based on the network control policy;

[0014] At least two perspective information are determined based on the network access permission.

[0015] In a possible implementation, determining at least two attack surface information based on at least two perspective information and asset information of a target asset includes:

[0016] Determine vulnerability information and asset weight parameters based on asset information of target assets;

[0017] Determine vulnerability risk scores based on vulnerability information and asset weight parameters, and determine vulnerability scoring results;

[0018] At least two attack surface information are determined based on the at least two perspective information and the vulnerability scoring result.

[0019] In a possible implementation, at least two attack surface information are determined based on at least two perspective information and vulnerability scoring results, including:

[0020] Determine a remote access probability and an attack generation probability based on at least two perspective information;

[0021] Determine the probability of attack occurrence based on the attack generation probability and remote access probability;

[0022] Determine the attack effectiveness score based on the vulnerability score results, attack probability and remote access;

[0023] Determines an attack surface score based on the attack effectiveness score and the number of targeted assets;

[0024] Determines a regional attack surface score based on the attack surface score and the target asset's associated network group;

[0025] At least two attack surface information are determined based on the remote access probability, the attack generation probability, the attack effect score, the attack surface score, and the regional attack surface score.

[0026] In a possible implementation, the attack effect score includes:

[0027] ( , ;

[0028] in, ( , , , Characterizing Network Nodes The importance of the assets; Characterizing Network Nodes The probability of failure; ( , Characterize from network nodes arrive The remote access probability.

[0029] In one possible implementation, the attack surface score includes:

[0030] ;

[0031] in, Characterization Node The attack surface score of Characterization Node Vulnerability risk score, Characterizing Network Nodes The asset weight parameter, Characterization Node For network node groups The exposed surface, Represents the probability of a host in node group P being lost.

[0032] In a possible implementation, determining an overall attack surface score of a target asset based on at least two pieces of attack surface information includes:

[0033] Determine an in-group attack surface score, an out-of-group attack surface score, an intranet attack surface score, and an extranet attack surface score based on at least two attack surface information;

[0034] The overall attack surface score of the target asset is determined based on the in-group attack surface score, the out-of-group attack surface score, the internal network attack surface score, and the external network attack surface score.

[0035] According to a second aspect of an embodiment of this specification, a network management and control device based on attack surface assessment is provided, including:

[0036] An asset determination module is configured to determine a target asset and determine at least two perspective information based on a network management and control policy and the target asset;

[0037] an information determination module configured to determine at least two attack surface information based on at least two perspective information and asset information of the target asset;

[0038] A score determination module configured to determine an overall attack surface score of the target asset based on at least two attack surface information;

[0039] The network control module is configured to perform network access control based on the overall attack surface score.

[0040] According to a third aspect of an embodiment of this specification, a computing device is provided, including:

[0041] Memory and processor;

[0042] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned network control method based on attack surface assessment are implemented.

[0043] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned network control method based on attack surface assessment are implemented.

[0044] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned network control method based on attack surface assessment.

[0045] The embodiments of this specification provide a network control method and device based on attack surface assessment, wherein the network control method based on attack surface assessment includes: determining a target asset, determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score. By determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score, a multi-perspective attack surface assessment can be achieved, which improves the comprehensiveness of the attack surface assessment, thereby improving the security of network control. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a flow chart of a network control method based on attack surface assessment provided by an embodiment of this specification;

[0047] Figure 2 It is a schematic diagram of the principle of a network control method based on attack surface assessment provided by an embodiment of this specification;

[0048] Figure 3 This is a scenario diagram of a network control method based on attack surface assessment provided by an embodiment of this specification;

[0049] Figure 4 It is a data flow diagram of a network control method based on attack surface assessment provided by an embodiment of this specification;

[0050] Figure 5 It is a structural diagram of a network control device based on attack surface assessment provided by an embodiment of this specification;

[0051] Figure 6 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0052] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0053] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0054] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0055] In this specification, a network control method based on attack surface assessment is provided. This specification also relates to a network control apparatus based on attack surface assessment, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0056] See also Figure 1 , Figure 1 A flowchart of a network control method based on attack surface assessment provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0057] Step 101: Determine a target asset, and determine at least two perspective information based on a network management and control policy and the target asset.

[0058] Among them, assets can be information technology assets, which are any information or data, software or hardware used by an organization during its business operations. Hardware assets include physical computing devices, such as physical servers in data centers, desktop computers, mobile devices, laptops, keyboards, and printers. On the other hand, software assets include applications that are usually licensed per user or machine, as well as software systems and databases built with open source resources. Software assets also include cloud-based assets and cloud services, such as Software as a Service (SaaS) applications.

[0059] The perspective information may be information obtained from different perspectives of visiting and being visited.

[0060] In one possible implementation, a target asset is determined, and at least two perspective information is determined based on a network management and control policy and the target asset, including: determining a target asset; wherein the target asset includes at least two assets; determining network access rights for the at least two assets based on the network management and control policy; and determining at least two perspective information based on the network access rights.

[0061] In actual applications, network control policies will control the communication of assets. For example, asset A can access asset B, and asset C can be accessed by asset D. Based on network access rights, the accessible and inaccessible perspective information of assets A, B, C, and D can be determined.

[0062] Step 102: Determine at least two attack surface information based on at least two perspective information and asset information of the target asset.

[0063] In one possible implementation, at least two attack surface information are determined based on at least two perspective information and asset information of the target asset, including: determining vulnerability information and asset weight parameters based on the asset information of the target asset; determining a vulnerability risk score based on the vulnerability information and the asset weight parameters, and determining a vulnerability scoring result; determining at least two attack surface information based on at least two perspective information and the vulnerability scoring result.

[0064] In actual applications, the importance of each asset is different, and assets may have vulnerabilities, and the level of vulnerabilities also varies. Therefore, the vulnerability can be scored according to the importance of the asset and the level of the vulnerability, thereby determining the importance of the vulnerability among assets. Then, based on the importance of the vulnerability among assets and the above-mentioned accessible and inaccessible perspective information, the attack surface information of the asset is determined.

[0065] For example, if the importance of asset A is 0.8, asset A includes vulnerability X, and the score of vulnerability X is 0.8, then the vulnerability score result is 0.64.

[0066] It should be noted that the technology in the art can be used to score vulnerabilities, for example, the vulnerability scores can be obtained through third-party services. The embodiments of this specification are not limited to this, and it is sufficient to achieve this function.

[0067] Determining at least two attack surface information based on at least two perspective information and vulnerability scoring results is specifically described as follows.

[0068] In one possible implementation, at least two attack surface information are determined based on at least two perspective information and vulnerability scoring results, including: determining a remote access probability and an attack generation probability based on at least two perspective information; determining an attack occurrence probability based on the attack generation probability and the remote access probability; determining an attack effect score based on the vulnerability scoring results, the attack generation probability and the remote access; determining an attack surface score based on the attack effect score and the number of target assets; determining a regional attack surface score based on the attack surface score and the relevant network group of the target assets; and determining at least two attack surface information based on the remote access probability, the attack generation probability, the attack effect score, the attack surface score and the regional attack surface score.

[0069] Specifically, the attack surface information includes the following:

[0070] Definition 1 (network nodes and remotely accessible probability):

[0071] A group of network nodes, each of which can only be remotely accessed from other nodes in the group.

[0072] ( , From the network node arrive The remote network accessibility probability is also called the reachability probability. Under normal circumstances, the accessibility probability is a binary Boolean variable, 0 or 1.

[0073] Definition 2 (Probability of remote attack between network nodes):

[0074] It is a group of network nodes, each of which can only be attacked from other nodes in the group.

[0075] ( , For network nodes arrive The probability of a remote network attack is based on the independent conditional probability formula )=P(A)*P(B), where event A is the node Generate attack behavior, event B is the node To Node is reachable, so eventually ( , ,in Is a node The probability of generating attack behavior, also known as network node The probability of failure; ( , From the network node arrive The probability of being reachable.

[0076] Definition 3 (network node remote attack effect score):

[0077] ( , From the network node arrive The remote network attack effect score is defined here as attack effect score = attack consequence * attack probability. The attack consequence is determined by the attacked object. The importance of the attack and its own vulnerability risk score are determined by the final attack effect scoring formula: ( , ,in Is a node Own vulnerability risk score, Is a network node importance of assets.

[0078] Definition 4 (Network Node Attack Surface Score):

[0079] It is a group of network nodes, each of which can only be attacked from other nodes in the group.

[0080] Network Node Attack Surface Score , is the sum of the remote attack effect scores of all network nodes in the group, that is , in Is a node Own vulnerability risk score, Is a network node importance of assets.

[0081] Assume that the probability of each node in the network group P generating an attack behavior is the same, and each node The reachability probability is also the same (that is, the access policy is set according to the network group, 0 or 1), the above formula can be further simplified to , is the probability of a host falling into the network node group P, For network node group P to The probability of being reachable.

[0082] Will Extracted and defined as network nodes For network node groups The exposed surface of Instead, the network node attack surface score can be expressed as .

[0083] Definition 5 (Node attack surface scoring in a complex network environment):

[0084] In a complex network environment, there are multiple groups of network nodes. and There are three groups of network nodes.

[0085] According to Definition 4, network nodes Attack Surface Score , which can be expressed as + , in , , They are network node group P, , The probability of a host being lost is , , is the network node group P, , arrive The probability of being reachable.

[0086] Step 103: Determine an overall attack surface score of the target asset based on at least two pieces of attack surface information.

[0087] In a possible implementation, based on at least two attack surface information, an overall attack surface score of the target asset is determined, including: determining an intra-group attack surface score, an extra-group attack surface score, an intranet attack surface score, and an extranet attack surface score based on at least two attack surface information; determining an overall attack surface score of the target asset based on the intra-group attack surface score, the extra-group attack surface score, the intranet attack surface score, and the extranet attack surface score.

[0088] In practical applications, after the above attack surface information exists, the attack surface scores of the target asset relative to multiple regions can be determined, and the overall attack surface score can be determined by the attack surface scores of multiple regions. The details are as follows.

[0089] For details, see Figure 2 , network assets Attack Surface Score It is the sum of the regional attack surface scores mapped to different network areas. According to the network location and regional division, these areas include four areas: within the group, between groups, intranet and extranet.

[0090]

[0091] in, It is the attack surface score of the assessed asset within the group, that is, it refers to the asset belonging to the same network control group as the assessed asset. It is the attack surface score of the assessed asset facing outside the group, that is, it refers to the network control group that is different from the assessed asset. There can be multiple. It is the score of the intranet attack surface of the assessed assets, which refers to the collection of all network assets that do not belong to the independent network control group but belong to the company's internal network. It is the attack surface score of the assessed asset facing the external network, that is, the attack surface score of network assets that do not belong to the company's internal network.

[0092] Furthermore, network assets Mapping to a region The attack surface score (within the group, between groups, intranet, extranet) can be used ( , express.

[0093] Refer to definition 3 for details. ( , ,in Is a node Your own vulnerability risk score, Is a network node The importance of assets, It is a region The probability of attack behavior is related to factors such as the security requirements of the area and the number of hosts. Is a network asset For Region exposed surface.

[0094] After obtaining the overall attack surface score based on the above steps, network access control can be performed based on the overall attack surface score. See the following for details.

[0095] Step 104: Perform network access control based on the overall attack surface score.

[0096] In actual applications, once the overall attack surface score is obtained, network access control can be deployed for assets based on the overall attack surface score, thereby improving the security of network control.

[0097] The embodiments of this specification provide a network control method and device based on attack surface assessment, wherein the network control method based on attack surface assessment includes: determining a target asset, determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score. By determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score, a multi-perspective attack surface assessment can be achieved, which improves the comprehensiveness of the attack surface assessment, thereby improving the security of network control.

[0098] Through the description of the above embodiments, the network control method based on attack surface assessment is further explained based on the example of M Company, as described below.

[0099] In one embodiment, the network topology diagram of M company refers to Figure 3 The entire network is divided into Internet area, office area, production area and data center area, and network control is carried out between each area through firewalls and one-way network gates.

[0100] Among them, the Internet area (network segment 192.168.100.0 / 24) is mainly for hosts and servers that need to frequently access the Internet. The company's web server is also in this area and is mapped to the public network through a firewall. The office area (network segment 192.168.101.0 / 24) is the main area for employees' daily office and company operations, including important OA servers. The production area (network segment 192.168.102.0 / 24) is the main area for the company's workshop production, including industrial control equipment and production hosts. The data center area (network segment 192.168.103.0 / 24) is the company's big data center platform, which stores various data for data analysis and query. Due to the needs of mobile office and remote disaster recovery, the company rents a public cloud server to establish a cloud data center (82.129.80.100 / 29) and stores some non-sensitive data synchronously in the cloud data center.

[0101] Furthermore, the network access relationships of M Company’s daily operations include the following:

[0102] 1. The Internet zone needs to initiate access to the public network, and some hosts and web servers need to access the data center to obtain data.

[0103] 2. The web server in the Internet zone is mapped to the public network through the external network firewall for the public to access the company portal website.

[0104] 3. The office area needs to access the Internet area server, data center and some server data in the production area, and synchronize daily operation data to the data center server.

[0105] 4. The production area needs to synchronize production data to the data center server regularly, and some servers can be accessed by the office area.

[0106] 5. The data center area needs to provide data synchronization and data access to each area, and the cloud data center needs to obtain some data from the data center.

[0107] See also Figure 4 Based on the company's daily operational needs, IT configures the network access policy within the company (including the data center firewall) as follows: Allow 192.168.100.0 / 24, 192.168.101.0 / 24, 192.168.102.0 / 24, and 82.129.80.100 / 29 to access the network 192.168.103.0 / 24.

[0108] There is an Oracle server in the data center that carries important business of the company. The version is old and cannot be upgraded. The vulnerability scan results show many serious vulnerabilities. Based on the above attack surface assessment formula, we can get:

[0109]

[0110] Among them, IG represents the in-group area, EG represents the out-group area, and EN represents the external network area.

[0111] Combining the above formula, and setting the vulnerability risk score range to 0~1000, and the asset importance range to 1~10, if the vulnerability risk score of the Oracale server is 948 and the asset importance is 9, then the exposure areas of the Internet area, office network area, production network area, data center area and the Internet are 255, 255, 255, 254 and 8 respectively, and assuming that the probability of the intranet host being compromised is 1 in 10,000, and the probability of the public network host being compromised is 1 in 1,000, the following results can be obtained:

[0112] =

[0113] Based on the above results, it can be determined that the attack surface score of this Oracle server is very high and is at a critical level.

[0114] Based on the above overall attack surface score, the network control department can adopt the following attack surface convergence solution for the Oracal server:

[0115] 1. The data center will periodically synchronize the data in Oraclee to the cloud data center, thereby reducing the exposure of the Oraclee server to the Internet to zero.

[0116] 2. Limit the number of servers accessing Oracale in the Internet zone to necessary servers, and reduce the exposure from 255 to 10.

[0117] 3. Limit the number of servers accessing Oraclee in the office area to necessary servers, and reduce the exposure from 255 to 16.

[0118] 4. After evaluation, the production area does not need to access the Oraclee server. Through network policies, the production area's access to the data center area is limited to accessing individual servers, thereby reducing the exposure of the Oraclee server to the production area to zero.

[0119] After the above series of network control strategies have greatly reduced the exposure of the Oracle server, the attack surface score of the server is:

[0120] =

[0121] The attack surface level of the Oracle server was successfully reduced from critical to low risk.

[0122] It should be noted that the above-mentioned vulnerability scores and asset importance can be set according to needs, and the embodiments of this specification do not limit this.

[0123] Corresponding to the above method embodiment, this specification also provides a network control device embodiment based on attack surface assessment, Figure 5 FIG. 1 shows a schematic diagram of a network control device based on attack surface assessment provided by an embodiment of the present specification. Figure 5 As shown, the device comprises:

[0124] The asset determination module 501 is configured to determine a target asset and determine at least two perspective information based on the network management and control policy and the target asset;

[0125] An information determination module 502 is configured to determine at least two attack surface information based on at least two perspective information and asset information of a target asset;

[0126] A score determination module 503 is configured to determine an overall attack surface score of the target asset based on at least two attack surface information;

[0127] The network control module 504 is configured to perform network access control based on the overall attack surface score.

[0128] In a possible implementation, the asset determination module 501 is further configured to:

[0129] Determine the target assets; wherein the target assets include at least two assets;

[0130] Determine network access rights for at least two assets based on the network control policy;

[0131] At least two perspective information are determined based on the network access permission.

[0132] In a possible implementation, the information determination module 502 is further configured to:

[0133] Determine vulnerability information and asset weight parameters based on asset information of target assets;

[0134] Determine vulnerability risk scores based on vulnerability information and asset weight parameters, and determine vulnerability scoring results;

[0135] At least two attack surface information are determined based on the at least two perspective information and the vulnerability scoring result.

[0136] In a possible implementation, the information determination module 502 is further configured to:

[0137] Determine a remote access probability and an attack generation probability based on at least two perspective information;

[0138] Determine the probability of attack occurrence based on the attack generation probability and remote access probability;

[0139] Determine the attack effectiveness score based on the vulnerability score results, attack probability and remote access;

[0140] Determines an attack surface score based on the attack effectiveness score and the number of targeted assets;

[0141] Determines a regional attack surface score based on the attack surface score and the target asset's associated network group;

[0142] At least two attack surface information are determined based on the remote access probability, the attack generation probability, the attack effect score, the attack surface score, and the regional attack surface score.

[0143] In a possible implementation, the information determination module 502 is further configured to:

[0144] ( , ;

[0145] in, ( , , , Characterizing Network Nodes The importance of the assets; Characterizing Network Nodes The probability of failure; ( , Characterize from network nodes arrive The remote access probability.

[0146] In a possible implementation, the information determination module 502 is further configured to:

[0147] ;

[0148] in, Characterization Node The attack surface score of Characterization Node Vulnerability risk score, Characterizing Network Nodes The asset weight parameter, Characterization Node For network node groups The exposed surface, Represents the probability of a host in node group P being lost.

[0149] In a possible implementation, the score determination module 503 is further configured to:

[0150] Determine an in-group attack surface score, an out-of-group attack surface score, an intranet attack surface score, and an extranet attack surface score based on at least two attack surface information;

[0151] The overall attack surface score of the target asset is determined based on the in-group attack surface score, the out-of-group attack surface score, the internal network attack surface score, and the external network attack surface score.

[0152] The embodiments of this specification provide a network control method and device based on attack surface assessment, wherein the network control device based on attack surface assessment includes: determining a target asset, determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score. By determining at least two perspective information based on a network control strategy and the target asset; determining at least two attack surface information based on at least two perspective information and the asset information of the target asset; determining the overall attack surface score of the target asset based on at least two attack surface information; and performing network access control based on the overall attack surface score, a multi-perspective attack surface assessment can be achieved, which improves the comprehensiveness of the attack surface assessment, thereby improving the security of network control.

[0153] The above is a schematic scheme of a network control device based on attack surface assessment of this embodiment. It should be noted that the technical scheme of the network control device based on attack surface assessment and the technical scheme of the network control method based on attack surface assessment belong to the same concept, and the details not described in detail in the technical scheme of the network control device based on attack surface assessment can be referred to the description of the technical scheme of the network control method based on attack surface assessment.

[0154] Figure 6 The block diagram of a computing device 600 according to an embodiment of the present specification is shown. The components of the computing device 600 include but are not limited to a memory 610 and a processor 620. The processor 620 is connected to the memory 610 via a bus 630, and the database 650 is used to store data.

[0155] The computing device 600 also includes an access device 640 that enables the computing device 600 to communicate via one or more networks 660. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 640 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0156] In one embodiment of the present specification, the above components of the computing device 600 and Figure 6 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 6 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0157] The computing device 600 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 600 may also be a mobile or stationary server.

[0158] Among them, the processor 620 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned network control method based on attack surface assessment. The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above-mentioned network control method based on attack surface assessment belong to the same concept. For details not described in detail in the technical scheme of the computing device, please refer to the description of the technical scheme of the above-mentioned network control method based on attack surface assessment.

[0159] An embodiment of the present specification also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned network control method based on attack surface assessment.

[0160] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the network control method based on attack surface assessment belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the network control method based on attack surface assessment.

[0161] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned network control method based on attack surface assessment.

[0162] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the network control method based on attack surface assessment are of the same concept, and the details not described in detail in the technical scheme of the computer program can be found in the description of the technical scheme of the network control method based on attack surface assessment.

[0163] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0164] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0165] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0166] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0167] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A network control method based on attack surface assessment, characterized in that: include: Determine a target asset, and determine at least two perspective information based on the network management and control strategy and the target asset; Determining at least two attack surface information based on the at least two perspective information and the asset information of the target asset; Determining an overall attack surface score of the target asset based on the at least two attack surface information; Performing network access control based on the overall attack surface score; The determining at least two attack surface information based on the at least two perspective information and the asset information of the target asset includes: Determining vulnerability information and asset weight parameters based on the asset information of the target asset; Determine a vulnerability risk score based on the vulnerability information and the asset weight parameter, and determine a vulnerability score result; Determine at least two attack surface information based on the at least two perspective information and the vulnerability scoring result; The determining at least two attack surface information based on the at least two perspective information and the vulnerability scoring result includes: Determine a remote access probability and an attack generation probability based on the at least two perspective information; Determining an attack occurrence probability based on the attack generation probability and the remote access probability; Determine an attack effect score based on the vulnerability scoring result, the attack generation probability and the remote access; Determining an attack surface score based on the attack effectiveness score and the number of target assets; determining a regional attack surface score based on the attack surface score and an associated network group of the target asset; At least two attack surface information are determined based on the remote access probability, the attack generation probability, the attack effect score, the attack surface score and the regional attack surface score.

2. The method according to claim 1, characterized in that The determining of the target asset, based on the network management and control strategy and the target asset, determines at least two perspective information, including: Determine target assets; wherein the target assets include at least two assets; Determining network access rights for the at least two assets based on the network management and control policy; At least two perspective information are determined based on the network access permission.

3. The method according to claim 1, characterized in that The attack effectiveness score includes: ( , ； Among them, the ( , Characterization Node arrive The remote network attack effect score is Characterization Node The vulnerability risk score of Characterizing Network Nodes The importance of the assets; Characterizing Network Nodes The probability of failure ( , Characterize from network nodes arrive The remote access probability.

4. The method according to claim 1, characterized in that The attack surface score includes: ； Among them, the Characterization Node The attack surface score of Characterization Node The vulnerability risk score of Characterizing Network Nodes The asset weight parameter is Characterization Node For network node groups The exposed surface of Represents the probability of a host in node group P being lost.

5. The method according to claim 1, characterized in that Determining an overall attack surface score of the target asset based on the at least two pieces of attack surface information includes: Determine an in-group attack surface score, an out-of-group attack surface score, an intranet attack surface score, and an extranet attack surface score based on the at least two attack surface information; An overall attack surface score of the target asset is determined based on the in-group attack surface score, the out-of-group attack surface score, the internal network attack surface score, and the external network attack surface score.

6. A network control device based on attack surface assessment, used to implement the steps of the network control method based on attack surface assessment according to any one of claims 1 to 5, characterized in that: include: An asset determination module is configured to determine a target asset and determine at least two perspective information based on a network management and control strategy and the target asset; an information determination module, configured to determine at least two attack surface information based on the at least two perspective information and the asset information of the target asset; a score determination module configured to determine an overall attack surface score of the target asset based on the at least two attack surface information; The network control module is configured to perform network access control based on the overall attack surface score.

7. A computing device, characterized in that include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the network control method based on attack surface assessment according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the network control method based on attack surface assessment as described in any one of claims 1 to 5.

Images