Cybersecurity risk intelligence assessment system

Abstract

The application provides a network security risk intelligent evaluation system and relates to the technical field of network security, which comprises a leak scanning capability evaluator, a leak scanning capability scheduler, a vulnerability scanner, a capability verification server and a target network. The leak scanning capability evaluator acquires network information of the target network and informs the leak scanning capability scheduler to create a projection environment according to the network information. The vulnerability scanner is called to perform vulnerability scanning on the projection environment and submit a first leak scanning report of the projection environment. The capability of each vulnerability scanner is evaluated according to the first leak scanning report. The leak scanning capability scheduler calls corresponding vulnerability scanners to scan the target network according to a vulnerability scanning combination scheme and submits a second leak scanning report to the leak scanning capability evaluator. Through the evaluation of the vulnerability detection efficiency and quality, the method for improving the vulnerability detection efficiency and quality by formulating the arrangement and calling strategy of various available leak scanning systems is realized, and the leak scanning quality and efficiency are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security risk intelligent evaluation system. BACKGROUND

[0002] Internet security is a comprehensive discipline involving computer science, network technology, communication technology, cryptography, information security technology, applied mathematics, number theory, information theory and other disciplines. Internet security is essentially information security on the Internet. In a broad sense, any technology and theory related to the confidentiality, integrity, availability, authenticity and controllability of information on the Internet is a research field of network security. With the development of the Internet, network security protection has become an important guarantee for the Internet. Due to the ever-changing means of network security attacks, network security vulnerabilities are constantly being discovered, and the types of network services and services are constantly changing, so it is difficult to locate and handle unknown or newly emerging network attack behaviors when performing specific network security protection.

[0003] However, due to the large number of vulnerabilities and the large number of vulnerability scanning tools, due to the differences in product functions, false negatives and false positives often occur during vulnerability scanning, causing difficulties in identifying network vulnerabilities completely and truly. SUMMARY

[0004] The present application aims to at least solve one of the technical problems in the related art to some extent.

[0005] To this end, a first object of the present application is to provide a network security risk intelligent evaluation system.

[0006] A second object of the present application is to provide an electronic device.

[0007] A third object of the present application is to provide a computer-readable storage medium.

[0008] A fourth object of the present application is to provide a computer program product.

[0009] To achieve the above objects, an embodiment of the first aspect of the present application provides a network security risk intelligent evaluation system, comprising:

[0010] a vulnerability scanning capability evaluator, a vulnerability scanning capability scheduler, a vulnerability scanner, a capability verification server, and a target network;

[0011] The target network is configured to submit a scanning application to the vulnerability scanning capability evaluator.

[0012] The vulnerability scanning capability evaluator is configured to obtain network information of the target network and notify the vulnerability scanning capability scheduler to create a projection environment according to the network information.

[0013] The vulnerability scanner is configured to perform vulnerability scanning on the projection environment and submit a first vulnerability scanning report on the projection environment to the vulnerability scanning capability evaluation server;

[0014] The capability evaluation server is configured to evaluate the capability of each vulnerability scanner according to the first vulnerability scanning report and inform the vulnerability scanning capability scheduler of a vulnerability scanning combination scheme;

[0015] The vulnerability scanning capability scheduler is configured to perform scanning on the target network according to the vulnerability scanning combination scheme and submit a second vulnerability scanning report to the vulnerability scanning capability evaluator;

[0016] The vulnerability scanning capability evaluator is configured to submit the second vulnerability scanning report to the target network.

[0017] Optionally, the scanning application includes: security asset basic information of the target network, and account information available for logging into a corresponding device to perform basic data collection.

[0018] Optionally, the network information of the target network includes at least one of the following: device name, device type, IP address, operating system and version, application name and version, occupied port, network topology structure.

[0019] Optionally, the vulnerability scanning capability evaluator is configured to:

[0020] start a basic orchestration system of the projection environment, wherein the basic orchestration system has a component library of multiple versions of host, operating system, network device, and application program;

[0021] select components with the smallest difference from the component library to create a projection host and a projection network device of the network information, and load a corresponding version of the operating system on the basic orchestration system;

[0022] load a corresponding version of the application program in the projection device on which the operating system has been loaded;

[0023] calculate the difference degree of the components and the target system, select components with the smallest difference degree and configure IP addresses, and establish a network topology with reference to the target system.

[0024] Optionally, the difference degree of the components and the target system is the sum of the following: host difference degree D1, operating system difference degree D2, network device difference degree D3, and application program difference degree D4.

[0025] D1 = |hardware version difference| * 1000 + |firmware version difference| * 100 + |CPU version difference| * 10 + |network card difference|

[0026] D2 = |OS type difference| * 1000 + |major version difference| * 100 + |minor version difference| * 10 + |patch difference|

[0027] D3 = |network device type difference| * 1000 + |major version difference| * 100 + |minor version difference| * 10 + |patch difference|

[0028] D4 = |application type difference| * 1000 + |major version difference| * 100 + |minor version difference| * 10 + |patch difference|

[0029] Optionally, the vulnerability scanning capability scheduler is configured to:

[0030] invoke all available vulnerability scanners to perform vulnerability scanning on the projection environment, wherein a set of vulnerability scanners is S, and a set of detectable vulnerabilities is V;

[0031] sort the vulnerabilities supported by each vulnerability scanner according to their titles;

[0032] start the set of scanners S to check all the vulnerabilities in the set of detectable vulnerabilities of the mirror environment;

[0033] determine a detection success rate according to the number of successful detections and the total number of detections of the vulnerability scanner;

[0034] compose a vulnerability detection rate matrix R according to the detection success rate.

[0035] Optionally, the capability verification server is configured to evaluate the capability of each vulnerability scanner according to the vulnerability detection rate matrix R, and obtain a vulnerability detection success rate summary matrix W;

[0036] select a vulnerability greater than a preset threshold value in W as a target vulnerability, and take the serial number corresponding to the column where the target vulnerability is located as a to-be-checked serial number;

[0037] find the row number with the maximum value in the column corresponding to the to-be-checked serial number in the detection rate matrix R, and obtain a target vulnerability scanner according to the row number;

[0038] generate the vulnerability scanning combination scheme according to the correspondence between the target vulnerability and the target vulnerability scanner.

[0039] Optionally, the vulnerability scanning capability scheduler is configured to invoke corresponding vulnerability scanners in sequence according to the vulnerability scanning combination scheme to scan target vulnerabilities in a target network.

[0040] To achieve the above object, the second aspect of the present application provides an electronic device, comprising a processor and a memory connected with the processor;

[0041] The memory stores computer execution instructions.

[0042] The processor executes the computer execution instructions stored in the memory to realize the system according to any one of the first aspect.

[0043] To achieve the above object, the third aspect of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to realize the system according to any one of the first aspect.

[0044] To achieve the above object, the fourth aspect of the present application provides a computer program product, wherein the computer program is executed by a processor to realize the system according to any one of the first aspect.

[0045] The network security risk intelligent evaluation method and device, electronic device and storage medium provided by the present application can improve the vulnerability detection efficiency and quality by evaluating the vulnerability detection efficiency and quality, formulating the arrangement and calling strategy of various available vulnerability scanning systems, and improving the vulnerability detection efficiency and quality.

[0046] Additional aspects and advantages of the present application will be made apparent by the following description and the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0047] The above and / or additional aspects and advantages of the present application will become apparent and be readily understood from the following description, taken in conjunction with the accompanying drawings, in which:

[0048] Figure 1 A structural schematic diagram of a network security risk intelligent evaluation system provided by an embodiment of the present application;

[0049] Figure 2 A flowchart of a network security risk intelligent evaluation system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0050] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the drawings, in which the same or similar notations represent the same or similar elements or elements having the same or similar functions. The embodiments described below are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0051] Internet security is a comprehensive discipline involving computer science, network technology, communication technology, cryptography, information security technology, applied mathematics, number theory, information theory and other disciplines. Internet security is essentially information security on the Internet. In a broad sense, any technology and theory related to the confidentiality, integrity, availability, authenticity and controllability of information on the Internet is the research field of network security. With the development of the Internet, network security protection has become an important guarantee for the Internet. Because the means of network security attacks are constantly emerging, network security vulnerabilities are constantly being discovered, and the types of network services and services are constantly changing, it is difficult to locate and handle unknown or newly emerging network attack behaviors when performing specific network security protection.

[0052] Common vulnerability scanning tools provide automatic scanning capabilities for system vulnerabilities. To ensure system security, some organizations often require periodic scanning of systems in accordance with security standard requirements. Taking web application vulnerability scanning as an example, the security industry proposes OWASP 10 as a security vulnerability definition and example for web application security. OWASP 10 usually lists ten common vulnerabilities, and the discovery and repair of these vulnerabilities are the most effective first step to achieve software development security and source code security. Common vulnerability types include access control damage, encryption failure, injection, insecure design, security misconfiguration, vulnerable and outdated components, identification and authentication failure, security logging and monitoring failure, and server-side request forgery. Common vulnerability scanning tools used by the security industry include: 1. Nikto 2. Netsparker 3. OpenVAS 4. W3AF 5. Arachni 6. Acunetix 7. Nmap 8. OpenSCAP 9. GoLismero 10. Intruder 11. Comodo HackerProof, etc.

[0053] The prior art mainly focuses on the deployment and invocation of vulnerability scanners, including various network security vulnerability scanning systems and methods, aiming to solve the problem of applying vulnerability scanning technology and tools in network systems. However, due to the large number of vulnerabilities and the large number of vulnerability scanning tools, there are often false negatives and false positives during vulnerability scanning due to differences in product functions, making it difficult to completely and truly identify network vulnerabilities. Due to the large number of vulnerabilities and the large number of vulnerabilities, the specificity of each vulnerability scanner is different when performing network vulnerability scanning, some vulnerability scanners are good at hosts, some vulnerability scanners are good at networks, and some vulnerability scanners are good at databases, etc. A single vulnerability scanner cannot meet the comprehensive vulnerability detection requirements.

[0054] Although some technical solutions propose to improve the quality of vulnerability scanning by combining multiple scanners, these methods mainly evaluate the effect of combined scanners by comparing the detection proportion of each scanner on the CVE vulnerability library.

[0055] Since the types of vulnerabilities include not only the part listed by CVE but also many other types, the effectiveness of vulnerability assessment needs to consider not only the number of CVE but also the scanned object, the scanner, the scanning environment, the scanning efficiency, the cost, and other factors to more objectively reflect the quality of vulnerability scanning. For the execution of vulnerability scanning tasks, the ability of the scanner needs to be combined for planning and implementation. Therefore, a more comprehensive evaluation scheme is needed.

[0056] The embodiment of the present application provides a network security risk intelligent evaluation method, Figure 1 A structural schematic diagram of a network security risk intelligent evaluation system provided by the embodiment of the present application is shown in the figure. Figure 1 As shown in the figure, the system comprises a vulnerability scanning capability evaluator 10, a vulnerability scanning capability scheduler 20, a vulnerability scanner 30, a capability verification server 40, and a target network 50.

[0057] The target network 50 is configured to submit a scanning application to the vulnerability scanning capability evaluator 10.

[0058] The vulnerability scanning capability evaluator 10 is configured to acquire network information of the target network 50 and notify the vulnerability scanning capability scheduler 20 to create a projection environment according to the network information.

[0059] The vulnerability scanning capability scheduler 20 is configured to call the vulnerability scanner 30 to perform vulnerability scanning on the projection environment and submit a first vulnerability scanning report on the projection environment to the vulnerability scanning capability verification server 40.

[0060] The capability verification server 40 is configured to evaluate the capability of each vulnerability scanner 30 according to the first vulnerability scanning report and inform the vulnerability scanning capability scheduler 20 of a vulnerability scanning combination scheme.

[0061] The vulnerability scanning capability scheduler 20 is configured to call the corresponding vulnerability scanner 30 to scan the target network 50 according to the vulnerability scanning combination scheme and submit a second vulnerability scanning report to the vulnerability scanning capability evaluator 10.

[0062] The vulnerability scanning capability evaluator 10 is configured to submit the second vulnerability scanning report to the target network 50.

[0063] Figure 2 A flowchart of a network security risk intelligent evaluation system provided by the embodiment of the present application is shown in the figure. Figure 2 As shown in the figure, the workflow of the embodiment is:

[0064] Step 1, the target network submits a vulnerability scan application to the vulnerability scan capability evaluator

[0065] The target network submits a vulnerability scan application to the vulnerability scan capability evaluator. The application information includes the security asset basic information of the target network and the account information that can be used to log in to the corresponding device for basic data collection, such as:

[0066] Message field Message value Target network name net1 Occupied IP address 10.1.1.0 / 24 Length of time to request a leak scan limit ]] 5 hours Basic information collection account list 10.1.1.1 / root / jsfdlMh, 10.1.1.2 / root / xMkdflN

[0067] Among them, "the required length of time Ulimit for vulnerability scanning" indicates that the vulnerability scanning task should be completed within the time limit.

[0068] Step 2. The vulnerability scan capability evaluator obtains network information from the target network

[0069] The vulnerability scan capability evaluator obtains network information from the target network according to the vulnerability scan application information. The required network information includes at least the following contents: device name, device type, IP address, operating system and version, application name and version, occupied port, network topology structure, etc.

[0070] This information can be collected by a general network detection tool or imported manually.

[0071] Step 3. The vulnerability scan capability evaluator notifies the vulnerability scan capability scheduler to configure the projection environment T according to the network information

[0072] The vulnerability scan capability evaluator notifies the vulnerability scan capability scheduler to configure the projection environment T according to the network information, which is used to formulate the strategy and scheme of vulnerability scanning. The projection environment T is a platform for simulating the target system, which is provided with a basic orchestration system, and the orchestration system has a component library of multiple versions of host, operating system, network device and application program

[0073] The specific implementation method is:

[0074] (1) Start the basic orchestration system S of the projection environment T, which has a component library L of multiple versions of host, operating system, network device and application program.

[0075] (2) In the basic orchestration system S, select the least different components from the component library and create a projection host of network information R, and load the corresponding version of the operating system;

[0076] In the component library L, the projection image similar to the target system is selected, and for this purpose, the differences between the image in the component library and the real target system are calculated, including host difference degree D1, operating system difference degree D2, network device difference degree D3 and application program difference degree D4. The calculation methods of these difference degrees are as follows.

[0077] D1 = |hardware version difference| * 1000 + |firmware version difference| * 100 + |CPU version difference| * 10 + |network card difference|

[0078] D2 = |operating system type difference| * 1000 + |major version difference| * 100 + |minor version difference| * 10 + |patch difference|

[0079] (3) On the basis of the arrangement system S, according to the network information R, the projection network device of the original network information R is selected and created from the component library, and the corresponding version of the operating system is loaded;

[0080] D3 = |network device type difference| * 1000 + |major version difference| * 100 + |minor version difference| * 10 + |patch difference|

[0081] (4). In the projection device which has completed the operating system loading, the corresponding version of the application program is loaded;

[0082] D4 = |application program type difference| * 1000 + |major version difference| * 100 + |minor version difference| * 10 + |patch difference|

[0083] (5). Calculate the difference degree D5 of the component and the target system

[0084] D5 = D1 + D2 + D3 + D4

[0085] (6) In the basic arrangement system S, the component with the smallest difference degree D5 is selected and the IP address is configured, and the similar network topology is established with reference to the target system.

[0086] According to the above steps (1)-(5), a projection environment T with similar structure to the target network can be configured.

[0087] This step needs to calculate the difference degree between two strings (S1 and S2), such as |hardware version difference|, and for this purpose, the grouping similarity distance algorithm is proposed, and the specific algorithm steps are as follows:

[0088] Suppose there are two strings S1 and S2, and the difference degree D is calculated as follows:

[0089] (1) Convert S1 and S2 to lowercase, respectively s1, s2;

[0090] (2) If s1 == s2, then D = 0, end the calculation;

[0091] (3) Otherwise, take the first n bytes of s1 and s2 respectively, and get sn1 and sn2. The value of n can be defined by yourself.

[0092] (4) If sn1 is equal to sn2, then D = 0.1, end the calculation;

[0093] (5) Define a similar cluster X = {x1, x2,..., x3,...}, where xi is a set of strings with the same properties, for example: {centos, redhat}. These strings are defined in the same set because the operating systems they represent use similar kernels.

[0094] (6) If sn1 and sn2 belong to the same set xi, then D = 0.2, end the calculation;

[0095] (7) Otherwise, calculate the number of character replacement operations required to change string sn1 to another string sn2, which is denoted as E, for example, E of abc and adc is 1, while E of abc and acb is 2. Let D = E / len(sn1)*0.5, end the calculation.

[0096] Since the proposed method requires a traversal check of vulnerabilities, it is necessary to first cancel the traffic control and access control policies for all hosts and network devices in the projection environment.

[0097] In order to reduce false positives caused by irrelevant vulnerability detection of systems with large differences, network packet screening rules need to be set for devices with D5 values greater than a preset threshold (e.g. 3000), i.e. cancel the vulnerability scan of these projection devices to avoid introducing false data to irrelevant devices.

[0098] Step 4. The vulnerability scanning capability scheduler calls all available vulnerability scanners to perform vulnerability scanning on the projection environment T

[0099] Step 5. The vulnerability scanner performs vulnerability scanning on the projection environment T

[0100] Step 6. The vulnerability scanner returns a vulnerability scanning report for the projection environment

[0101] The vulnerability scanning capability scheduler calls all available vulnerability scanners to perform vulnerability scanning on the projection environment T, and sets the vulnerability scanning time to "required vulnerability scanning time T limit " in step 1.

[0102] In order to grasp the capabilities of each vulnerability scanner, the vulnerability scanning method proposed in this proposal is:

[0103] (1) Set N vulnerability scanners S = {s1, s2,..., s i ,...}, i from 1 to N.

[0104] (2) Sort the vulnerabilities supported by each scanner according to their titles, and the set of detectable vulnerabilities V = {v1, v2,..., v i ,...}, i from 1 to M. For each component in the mirror environment T, its vulnerability information is known.

[0105] (3) Start the scanner set S to perform multiple rounds of detection on all devices in the mirror environment T for all vulnerabilities in the set V. Record the number of rounds of scanning as t, and set the scanning time for each round to the "required vulnerability scanning time U limit " in step 1.

[0106] Take scanner s i as an example, set its successful detection times for v j as u ij , and calculate the detection success rate r ij of scanner s i for v j = u ij / t. Thus, a N*M dimensional vulnerability detection rate matrix R is obtained.

[0107]

[0108] Step 7. The vulnerability scanning capability scheduler submits a vulnerability scanning report for the projection environment T to the vulnerability scanning capability verification server

[0109] Step 8. The capability verification server evaluates the capabilities of each vulnerability scanner based on the report

[0110] The capability verification server evaluates the capabilities of each vulnerability scanner based on the N*M dimensional detection rate matrix R in the report. Multiply R by the 1*N matrix E = [1 1 1,...] from the left:

[0111] W = E * R,

[0112] Obtain the 1*M dimensional matrix W of vulnerability detection success rates:

[0113]

[0114] Set a threshold value according to the requirement for vulnerability false positive rate, for example, 0.5.

[0115] (1) Select the column number j corresponding to the vulnerability v j in W whose w j is greater than the threshold value, and set P vulnerabilities are found.

[0116] (2) According to the serial number, find the row number of the maximum value i in the column j corresponding to the detection rate matrix R, so that the corresponding leak scanner s can be obtained according to the row number i ;

[0117] (3) Combining (1) and (2), a list of P binary tuples [(leak scanner s i , vulnerability v jj )] is obtained, which is the best performance combination scheme.

[0118] Step 9. The capability verification server informs the leak scanning capability scheduler of the best performance combination scheme of multi-vulnerability scanning

[0119] The capability verification server informs the leak scanning capability scheduler of the best performance combination scheme of multi-vulnerability scanning, that is, the best performance combination scheme list calculated in step 8.

[0120] Step 10. The leak scanning capability scheduler calls the corresponding vulnerability scanner to scan the target network

[0121] The leak scanning capability scheduler calls the corresponding vulnerability scanner s i to scan the target network vulnerability v j in sequence according to the best performance combination scheme = [(leak scanner s i , vulnerability v j )].

[0122] Step 11. The leak scanning capability scheduler submits a leak scanning report to the leak scanning capability evaluator

[0123] The leak scanning capability scheduler submits a leak scanning report to the leak scanning capability evaluator

[0124] Step 12. The leak scanning capability evaluator submits a leak scanning report to the target network

[0125] The leak scanning capability evaluator submits a leak scanning report to the target network

[0126] As described above, the present proposal establishes asset collection according to the leak scanning application of the target network, creates a projection environment using various leak scanners for pre-scanning based on the information, establishes an evaluation mechanism for vulnerability detection efficiency and quality according to the pre-scanning results, and formulates a call strategy for various available leak scanning systems to improve the vulnerability detection efficiency and quality (i.e. the best performance combination scheme), thereby effectively improving the leak scanning quality and efficiency.

[0127] In order to realize the above-mentioned embodiments, the present application further proposes an electronic device, comprising: a processor, and a memory in communication connection with the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to realize the system provided by the preceding embodiments.

[0128] To achieve the above-mentioned embodiments, the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the system provided by the above-mentioned embodiments.

[0129] To achieve the above-mentioned embodiments, the present application further provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the system provided by the above-mentioned embodiments.

[0130] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present application comply with relevant laws and regulations and do not violate public order and good customs.

[0131] It should be noted that the personal information from the user should be collected for legal and reasonable purposes, and should not be shared or sold outside these legal uses. In addition, such collection / sharing should be carried out after the user's informed consent is received, including but not limited to informing the user to read the user agreement / user notice before the user uses the function, and signing the agreement / authorization including authorization of relevant user information. In addition, any necessary steps should be taken to protect and ensure access to such personal information data, and to ensure that other people with access to personal information data comply with their privacy policy and processes.

[0132] The present application is expected to provide embodiments in which the user can selectively prevent the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk is minimized by limiting data collection and deleting data. In addition, such personal information is de-identified, if applicable, to protect the privacy of the user.

[0133] In the foregoing embodiment description, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples, without contradiction.

[0134] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0135] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0136] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0137] It should be understood that parts of the present application can be realized in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be realized as software or firmware stored in a memory and executed by a suitable instruction execution system. As such, if realized in hardware, and in another embodiment, any one or a combination of the following technologies known in the art can be used: discrete logic circuitry having logic gates for implementing logic functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0138] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiments can be completed by a program instructing the relevant hardware, and the program can be stored in a computer readable storage medium. When the program is executed, it includes one of the steps of the method embodiments or a combination thereof.

[0139] In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can exist physically alone, or two or more units can be integrated into one module. The above-mentioned integrated module can be realized in the form of hardware or in the form of a software functional module. When the integrated module is realized in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer readable storage medium.

[0140] The above-mentioned storage medium can be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it should be understood that the above-mentioned embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-mentioned embodiments within the scope of the present application.

Claims

1. A cyber-security risk intelligent assessment system, characterized in that, The application relates to a vulnerability scanning capability evaluation system, which comprises a vulnerability scanning capability evaluator, a vulnerability scanning capability scheduler, a vulnerability scanner, a capability verification server and a target network. The target network is used for submitting a scanning application to the vulnerability scanning capability evaluator. The vulnerability scanning capability evaluator is used for acquiring network information of the target network and informing the vulnerability scanning capability scheduler to create a projection environment according to the network information. The vulnerability scanning capability scheduler is used for calling the vulnerability scanner to perform a vulnerability scan on the projection environment and submitting a first vulnerability scanning report on the projection environment to the capability verification server. The capability verification server is used for evaluating the capability of each vulnerability scanner according to the first vulnerability scanning report and informing the vulnerability scanning capability scheduler of a vulnerability scanning combination scheme. The vulnerability scanning capability scheduler is used for calling corresponding vulnerability scanners to perform a scan on the target network according to the vulnerability scanning combination scheme and submitting a second vulnerability scanning report to the vulnerability scanning capability evaluator. The vulnerability scanning capability evaluator is used for submitting the second vulnerability scanning report to the target network. The vulnerability scanning capability evaluator is used for starting a basic orchestration system of the projection environment, wherein the basic orchestration system has a component library of hosts, operating systems, network devices and application programs of multiple versions. In the basic orchestration system, the projection host and the projection network device of the network information are created by selecting components with the least difference from the component library, and the corresponding version of the operating system is loaded. In the projection device after the operating system is loaded, the corresponding version of the application program is loaded. The difference degree of the components and the target system is calculated, the components with the least difference degree are selected and IP addresses are configured, and the network topology is established by referring to the target system. The scanning application comprises target network security asset basic information and account information which can be used to log in to corresponding devices to perform basic data collection. The network information of the target network comprises at least one of the following: device name, device type, IP address, operating system and version, application name and version, occupied port and network topology structure.

2. The system of claim 1, wherein, The difference degree of the components and the target system is the sum of the following: host difference degree D1, operating system difference degree D2, network device difference degree D3 and application program difference degree D4.

3. The system of claim 1, wherein, D1=|hardware version difference|*1000 + |firmware version difference|*100 + |CPU version difference|*10 + |network card difference| 4. The system of claim 1, wherein, D2=|operating system type difference|*1000 + |major version difference|*100 + |minor version difference|*10 + |patch difference| D3=|network device type difference|*1000 + |major version difference|*100 + |minor version difference|*10 + |patch difference| D4=|application program type difference|*1000 + |major version difference|*100 + |minor version difference|*10 + |patch difference|. The vulnerability scanning capability scheduler is used for: ​ 5. The system of claim 4, wherein, ​ calling all available vulnerability scanners to scan the projection environment, wherein a set of vulnerability scanners is S, and a set of detectable vulnerabilities is V; sorting the vulnerabilities supported by each vulnerability scanner according to their titles; starting the set of scanners S to check all the vulnerabilities in the set of detectable vulnerabilities of the projection environment; determining a detection success rate according to the number of successful detections and the total number of detections of the vulnerability by the vulnerability scanner; composing a vulnerability detection rate matrix R according to the detection success rate.

6. The system of claim 5, wherein, The capability verification server is configured to evaluate the capabilities of each vulnerability scanner according to the vulnerability detection rate matrix R, and obtain a vulnerability detection success rate summary matrix W; selecting a vulnerability greater than a preset threshold value in W as a target vulnerability, and taking the serial number corresponding to the column where the target vulnerability is located as a to-be-inspected serial number; finding the row number with the maximum value in the column corresponding to the to-be-inspected serial number in the detection rate matrix R, and obtaining a target vulnerability scanner corresponding to the row number; generating a vulnerability scanning combination scheme according to the correspondence between the target vulnerability and the target vulnerability scanner.

7. The system of claim 5, wherein, The vulnerability scanning capability scheduler is configured to sequentially call the corresponding vulnerability scanner to scan the target vulnerability in the target network according to the vulnerability scanning combination scheme.

8. An electronic device, comprising: comprise: a processor, and a memory connected to the processor in communication; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the system of any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the system of any one of claims 1-7.

Images