Network security threat assessment method

Abstract

The invention discloses a network security threat assessment method, and relates to the technical field of network security. Comprising the steps of capturing network security event data, determining a network security threat scene, calculating a threat value, a vulnerability value and a loss value of the network security threat scene, normalizing the threat value, the vulnerability value and the loss value, calculating a threat evaluation value of the threat scene and applying an evaluation result. According to the method, a Beauty Soup crawler tool is adopted to capture data, and a proxy IP pool strategy is combined to cope with an anti-crawler mechanism, so that a stable and continuous data collection effect is realized; through detailed statistics and analysis, the threat frequency, the number of vulnerabilities and the data leakage degree are converted into specific threat values, vulnerability values and loss values, and the quantitative evaluation effect on the network security threat scene is achieved; finally, through normalization processing of the threat assessment value, an important basis is provided for formulating targeted security precautionary measures, and the effect of more intuitively knowing the security threat condition of the network is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security threat assessment method. Background Art

[0002] With the rapid development of the Internet, cybersecurity threats are becoming increasingly severe, and cyberattack methods are emerging in an endless stream, from traditional hacker attacks and malware propagation to new phishing and ransomware, which have brought huge challenges to the information security of enterprises and individual users. In order to ensure the security of the network, cybersecurity threat assessment has become a vital task. Cybersecurity threat assessment aims to comprehensively identify, quantify and evaluate potential security threats through scientific methods and processes, and provide effective security decision-making support for organizations.

[0003] However, traditional threat assessment methods often rely on static data analysis and expert experience judgment, which makes it difficult to reflect changes in network security situation in real time and dynamically. Therefore, this application proposes a comprehensive network security threat assessment method, which ensures comprehensive coverage and accurate assessment of network security threats through multi-step and multi-dimensional analysis and evaluation. Specifically, the method includes multiple links such as threat identification and analysis, threat assessment, and formulation of security measures and strategies. Through these steps, organizations can not only fully understand their own network security status, but also formulate targeted preventive measures to improve the overall security level. Summary of the invention

[0004] The present application solves the problems in the prior art of difficulty in real-time dynamic assessment of network security threats and lack of intuitiveness of assessment results by providing a network security threat assessment method.

[0005] This application provides a network security threat assessment method, including: S101, Capture network security event data: Use the Beautiful Soup crawler tool to capture network security event data, and use the proxy IP pool strategy to deal with the anti-crawler mechanism to achieve stable and continuous data collection; S102, determining network security threat scenarios: determining existing network security threat scenarios based on the captured data and the threats faced by the network; S103, calculating the threat value, vulnerability value and loss value of the network security threat scenario: by counting and analyzing the number of occurrences of the threat scenario in a specific time period and comparing it with the total number of observations, the threat frequency is obtained, and the threat frequency is converted into a specific threat value according to a mapping table of threat frequency and threat value; By carefully counting and analyzing the number of vulnerabilities in the network, the total number of vulnerabilities is obtained, and the vulnerability data is converted into specific vulnerability values ​​according to the vulnerability number and vulnerability value mapping table; By making a detailed judgment on the severity of the data leakage, and according to the data leakage degree and loss value mapping table, different data leakage degree intervals are mapped to specific loss values; S104, normalize the threat value, vulnerability value and loss value: normalize the threat value, vulnerability value and loss value by formula

[0006] Perform normalization to ensure consistency and comparability of evaluation results; S105, calculate the threat assessment value of the threat scenario: the normalized threat value, vulnerability value and loss value are calculated according to the formula Calculate threat assessment values ​​to reflect the security threat status of the network; In addition, by dynamically adjusting the time interval for the next assessment according to changes in network security threats and introducing the concept of time interval ratio TR, the original apparent threat assessment value is calculated. ; The original apparent threat assessment value The apparent threat assessment value is mapped to the range of 1-100. At the same time, the difference between the apparent threat assessment value and the normalized threat assessment value is calculated, and the threat level assessment standard is set accordingly, so as to more intuitively understand the current threat level. S106, Application of evaluation results: Based on the obtained network security threat level, the network security threat status can be more intuitively understood, providing an important basis for formulating targeted security precautions.

[0007] Preferably, the normalization process uses the normalization formula

[0008] Converting the three key indicators of threat value (T), vulnerability value (V) and loss value (L) into a unified magnitude makes the threat assessment results more accurate and reliable, avoiding calculation bias caused by magnitude differences.

[0009] Preferably, the calculation formula of the threat assessment value is: , where k is an adjustment coefficient, which plays a vital role in threat assessment and is used to adjust the scale of threat assessment value to ensure that the assessment results can accurately reflect the actual security threat situation.

[0010] Preferably, the time interval for dynamically adjusting the next evaluation will be dynamically adjusted based on the calculated threat change amplitude RC and the determined adjustment coefficients α and β, and the time interval for the next network security threat evaluation will be dynamically adjusted; the adjustment formula is specifically as follows:

[0011] in, is the preset basic time interval; when RC is positive, it means that the threat assessment value decreases and the actual threat increases, so To achieve the need to shorten the evaluation time interval to respond to threats faster; on the contrary, when RC is negative, it means that the threat assessment value increases and the actual threat decreases, so To appropriately extend the evaluation time interval to save resources.

[0012] Preferably, the threat change range RC is calculated by the formula:

[0013] To quantify the change in threat; is the last threat assessment value, The current threat assessment value; in this formula, if the threat assessment value becomes smaller (i.e. ), then RC is a positive number, indicating that the threat assessment value has decreased relative to the previous assessment; if the threat assessment value increases (i.e. ), RC is a negative number, indicating that the threat assessment value has increased compared with the previous assessment; if the threat assessment value remains unchanged, RC is equal to 0; therefore, the above formula can intuitively reflect the direction and magnitude of the change in the threat assessment value.

[0014] Preferably, the determined adjustment coefficients α and β, when the threat increases, the value of α needs to be set to a larger positive number to ensure that the time interval can be significantly shortened so that the threat can be responded to quickly; when the threat decreases, the time interval can be appropriately extended to save resources, and the value of β needs to be set to a smaller positive number or a value close to 0, so as to ensure resource efficiency while avoiding response delays caused by too long time intervals.

[0015] Preferably, the time interval ratio TR is introduced by calculating the ratio of the basic time interval of this evaluation to the actual time interval between the time nodes of the previous evaluation, and adjusting it in combination with the adjustment coefficient γ, so as to construct a quantitative standard to reflect the execution frequency of the evaluation work and its sensitivity to adapt to threat changes. The formula is:

[0016] Where T is the timestamp of this evaluation, is the timestamp of the last evaluation, is the basic time interval, and γ is the adjustment coefficient, which controls the influence of the time interval change on the threat assessment value.

[0017] Preferably, the original apparent threat assessment value , integrating the two key factors of threat change amplitude and time interval ratio, using the formula

[0018] Calculated; It provides a comprehensive assessment of threat dynamics by taking into account both the magnitude of threat change and the frequency of assessment.

[0019] Preferably, the original apparent threat assessment value Mapped to the range of 1-100, the original apparent threat assessment value is normalized to 0-100 using a linear mapping method. The specific calculation formula is as follows: ,in, is the apparent threat assessment value, is the minimum value of the original apparent threat assessment value, It is the maximum value of the original apparent threat assessment value.

[0020] Preferably, the difference between the apparent threat assessment value and the normalized threat assessment value is calculated, and the threat level assessment standard is set accordingly, by the formula:

[0021] To provide a more intuitive and quantitative indicator to capture small changes in threat levels, where D represents the difference between the two; the difference value obtained according to the formula is divided into three threat levels: when the difference value is within 0 to 20%, it is set to a low threat level; when the difference value is between 20% and 50%, it is set to a medium threat level; when the difference value exceeds 50%, it is set to a high threat level; in addition, when the apparent threat assessment value is exactly equal to the threat assessment value, that is, the difference value is 0%, it is set to a specific threat level, namely the stable level.

[0022] One or more technical solutions provided in this application have at least the following technical effects or advantages: By adopting the Beautiful Soup crawler tool and combining it with the proxy IP pool strategy, a stable and continuous collection of network security event data is achieved. At the same time, this method converts these key indicators into specific threat values, vulnerability values ​​and loss values ​​by carefully counting and analyzing threat frequency, number of vulnerabilities and degree of data leakage, thus achieving a quantitative assessment of network security threat scenarios. Furthermore, by normalizing the threat value, vulnerability value and loss value, the consistency and comparability of the assessment results are ensured. Finally, the normalized assessment value is combined with the adjustment coefficient to calculate the threat assessment value, and by dynamically adjusting the assessment time interval and introducing the time interval ratio, the assessment result can reflect the changes in network security threats in real time. Through this series of innovative steps and methods, the network security threat assessment method achieves a comprehensive, accurate and dynamic assessment of the network threat situation, providing an important basis for formulating targeted security precautions. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flowchart of a network security threat assessment method according to an embodiment of the present invention; Figure 2 A mapping table of example threat frequencies and threat values ​​of a network security threat assessment method according to an embodiment of the present invention; Figure 3 A mapping table of example vulnerability numbers and vulnerability values ​​of a network security threat assessment method in an embodiment of the present invention; Figure 4 A mapping table of example data leakage degree and loss value of a network security threat assessment method in an embodiment of the present invention; Figure 5 A flowchart of dynamically adjusting the time interval for the next evaluation in an embodiment of the present invention; Figure 6 A flowchart of calculating an original apparent threat assessment value and mapping it to a range of 1-100 in an embodiment of the present invention; Figure 7 This is a flow chart of setting a threat level assessment standard in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] To facilitate the understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more related listed items.

[0026] In view of the problems in the prior art that network security threat assessment methods are difficult to adjust dynamically in real time and the assessment results are not intuitive enough, this application uses the crawler tool Beautiful Soup to efficiently capture data, and uses the proxy IP pool strategy to deal with the anti-crawler mechanism, thereby achieving stable and continuous data collection; at the same time, it introduces normalization processing and dynamic adjustment strategies to quantitatively evaluate threat values, vulnerability values ​​and loss values, and optimizes the assessment results through adjustment coefficients, thereby achieving intuitiveness and accuracy of the assessment results, providing strong decision-making support for management.

[0027] Embodiment 1: Figure 1 As shown, a network security threat assessment method includes the following steps: S101, Capture network security event data: In order to effectively collect public network security event data and ensure the stability, efficiency, ease of use and excellent scalability of the crawler, we chose to use the crawler tool BeautifulSoup. This tool can capture the required network security event data from major security websites and vulnerability announcement platforms.

[0028] Among them, during the crawling process, special attention should be paid to handling anti-crawler mechanisms and adopting proxy IP pool strategies to effectively avoid IP blocking. The management and maintenance of the proxy IP pool is crucial, including regular updates of IP lists, real-time monitoring of IP availability and response speed, and timely removal of unavailable or slow-responding IPs to ensure the continued stable operation of crawler tools.

[0029] S102, determine network security threat scenarios: Based on the captured network security event data, further combined with the threats faced by the network, to determine possible network security threat scenarios. First, retrieve and access the captured data, and use data analysis technology to conduct in-depth exploration of the data to identify different threat types, such as DDoS attacks, SQL injections, zero-day vulnerability exploits, etc.

[0030] Secondly, the analyzed threats are compared and associated with known network security threat scenarios. In this process, a professional threat intelligence library or a known threat database is used to find threat scenarios similar to the analysis results through a feature matching algorithm. For threats that cannot be matched, they are considered new threats and analyzed in detail, including their sources, attack methods, possible impact range, etc., to ensure that the description of each threat scenario is both specific and comprehensive.

[0031] S103, calculating the threat value, vulnerability value and loss value of the network security threat scenario: After determining the network security threat scenario, in order to more comprehensively evaluate its potential threats, its threat value, vulnerability value and loss value are calculated according to the selected evaluation indicators.

[0032] First of all, the calculation of the threat value is based on the threat frequency. The threat frequency, that is, the frequency of the occurrence of the threat scenario, is an important basis for evaluating its potential threat. By counting and analyzing the number of occurrences of the threat scenario in a specific time period and comparing it with the total number of observations, the threat frequency is obtained, that is, the proportion of the number of occurrences of the threat scenario to the total number of observations. In order to more intuitively evaluate the potential threats of threat scenarios, a mapping table of threat frequencies and threat values ​​is developed based on historical data and the assessment of potential threats, and the threat frequency is converted into specific threat values ​​according to the mapping table. Specifically, a lower threat frequency corresponds to a lower threat value, indicating that the potential threat of the threat scenario is relatively small; and a higher threat frequency corresponds to a higher threat value, indicating that the potential threat of the threat scenario is greater. As an example, you can refer to Figure 2 A mapping table of threat frequency and threat value is shown.

[0033] Secondly, the number of vulnerabilities is selected as the key indicator for evaluating network security vulnerabilities. Vulnerabilities, that is, security defects existing in the system network, their number directly reflects the possibility of the network being attacked and is an important basis for evaluating vulnerabilities. By carefully counting and analyzing the number of vulnerabilities in the network, the total number of vulnerabilities is obtained, and the vulnerability data is converted into specific vulnerability values ​​according to the preset mapping table of vulnerability numbers and vulnerability values. Specifically, a smaller total number of vulnerabilities corresponds to a lower vulnerability value, indicating that the network is relatively safe; a larger total number of vulnerabilities corresponds to a higher vulnerability value, indicating that the network has greater security risks. As an example, you can refer to Figure 3 A mapping table of the number of vulnerabilities and vulnerability values ​​is shown.

[0034] Finally, the degree of data leakage is used as an evaluation indicator to determine the loss value. Data leakage is a common and serious consequence of network security incidents, and its degree is directly related to the scope of exposure of sensitive information and the potential threat of abuse. In order to accurately assess the loss value, it is necessary to make a detailed judgment based on the severity of the data leakage, and refer to the preset data leakage degree and loss value mapping table. This mapping table is based on the analysis of historical data leakage incidents and their consequences. It maps different data leakage degree intervals to specific loss values, thereby accurately quantifying the actual losses that may be caused by threat scenarios. Specifically, if the degree of data leakage is low and only involves the leakage of a small amount of non-sensitive information, it corresponds to a lower loss value, indicating that the actual loss is relatively small; conversely, if the degree of data leakage is serious and involves the leakage of a large amount of sensitive or core information, it corresponds to a higher loss value, indicating that the potential actual loss is large. As an example, you can refer to Figure 4 The mapping table of data leakage degree and loss value is shown.

[0035] In order to intuitively display the mapping relationship between threat frequency and threat value, number of vulnerabilities and vulnerability value, and degree of data leakage and loss value, such as Figure 5 The figure is used as an example. Each mapping table includes a table header and some assumed values. This figure is only used as a reference example. The range of specific mapping relationship values ​​is set according to actual conditions.

[0036] S104, normalize threat value, vulnerability value and loss value: In network security threat assessment, since the magnitude of threat value (T), vulnerability value (V) and loss value (L) may vary greatly, direct multiplication may lead to a too large range of assessment results, making it difficult to effectively assess the size of the actual threat. Therefore, normalizing these three values ​​can ensure the consistency and comparability of threat assessment.

[0037] A normalization interval is set for each evaluation indicator (i.e., T, V, L), usually between 0 and 1, as the common range after normalization of all indicators. 0 to 1 is selected as the normalization interval because this interval provides a dimensionless and relatively unified measurement standard. Compared with other intervals (such as 0 to 100), the interval from 0 to 1 is more compact and can more intuitively reflect the relative size between indicators. At the same time, it allows indicators of different magnitudes and units to be compared and calculated on the same scale, thereby greatly improving the consistency and comparability of threat assessment.

[0038] Based on historical data or industry standards, determine the maximum and minimum values ​​of each indicator as a reference for normalization. The calculation formula for normalization is:

[0039] S105, calculating the threat assessment value of the network security threat scenario: through normalization processing, obtain the normalized value T' of the threat value T, the normalized value V' of the vulnerability value V, and the normalized value L' of the loss value L. The threat assessment formula is: , where R is the threat assessment value and k is an adjustment coefficient. The adjustment coefficient k plays a vital role in threat assessment and is used to adjust the scale of the threat assessment value to ensure that the assessment results can accurately reflect the actual security threat situation. The selection of the k value is based on a careful study and understanding of historical network security events, combined with the threat assessment value at the time and the consequences of the actual security events. By comparing the threat assessment results under different k values ​​with the actual security events, the most appropriate k value is deduced.

[0040] For example, in the cybersecurity threat assessment of a certain enterprise, the original threat value (T) is 360, the vulnerability value (V) is 16, and the loss value (L) is 166. Directly multiplying these values ​​may result in a result that is too large and difficult to understand intuitively. Based on historical data, the range of threat value T is determined to be [0,500], the range of vulnerability value V is [0,50], and the range of loss value L is [0, 500], which will be used as the benchmark for normalization.

[0041] The normalized value of the threat value T is calculated as follows:

[0042] The normalized value of the vulnerability value V is calculated as follows:

[0043] The normalized value of the loss value L is calculated as follows:

[0044] The threat assessment value is calculated using the normalized value, and the formula remains unchanged: Assuming that after analysis, the adjustment coefficient k is determined to be 1, then R=1*(0.72*0.32*0.332)≈0.077. Through normalization processing, the threat assessment value R obtained is between 0 and 1, which more intuitively reflects the security threat status of the network and makes it easier to understand the threat level.

[0045] S106, application of assessment results: The normalized threat assessment value can provide a more intuitive understanding of the security threat status of the network, providing an important basis for formulating targeted security precautions.

[0046] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: This application uses crawler tools and proxy IP pools to achieve the effect of efficiently, stably and continuously collecting public network security event data. Based on the captured network security event data, it is further combined with the threats faced by the network to determine possible network security threat scenarios. By calculating the threat value, vulnerability value and loss value of the network security threat scenario and normalizing it, the threat assessment results are more accurate and reliable, avoiding calculation deviations caused by differences in magnitude, and can intuitively reflect the security threat status of the network. By calculating the network security threat assessment value, the overall level and severity of the network security threats faced can be fully reflected.

[0047] Example 2: In Example 1, it is described in detail how to capture network security event data, determine network security threat scenarios, and calculate the threat value, vulnerability value, and loss value of the threat scenario, thereby obtaining a network security threat assessment value. In order to further optimize this assessment process and enable it to be dynamically adjusted according to actual conditions, this embodiment designs a strategy for calculating the time interval for the next threat assessment value based on the numerical value of the previous threat assessment value, so as to improve the flexibility and response speed of network security threat assessment.

[0048] like Figure 6 As shown, the embodiment of the present application is optimized based on the embodiment 1, and specifically includes the following steps: S201, define the threat change range RC: In order to more accurately adjust the time interval for the next assessment according to the changes in network security threats, it is necessary to define a calculation formula to calculate the threat change range RC. This formula will be based on the last threat assessment value and the current threat assessment value , to quantify the change of threats, the calculation formula is as follows:

[0049] In this formula, if the threat assessment value becomes smaller (i.e. ), then RC is a positive number, indicating that the threat assessment value has decreased relative to the previous assessment; if the threat assessment value increases (i.e. ), RC is a negative number, indicating that the threat assessment value has increased compared with the previous assessment; if the threat assessment value remains unchanged, RC is equal to 0. Therefore, the above formula can intuitively reflect the direction and magnitude of the change in the threat assessment value.

[0050] S202, determining adjustment coefficients α and β: In order to more finely control the adjustment of the time interval, two adjustment coefficients α and β are introduced.

[0051] When threats increase, a faster response is needed to deal with potential threats. Therefore, the value of α is usually set to a large positive number to ensure that the time interval can be significantly shortened so that threats can be responded to quickly. The specific value of α is determined through historical data analysis, expert evaluation or simulation testing to ensure its effectiveness and accuracy in actual situations.

[0052] When the threat decreases, the time interval can be appropriately extended to save resources. However, in order to maintain a certain evaluation frequency and ensure timely detection of new threats, the value of β is usually set to a small positive number or a value close to 0. Therefore, while ensuring resource efficiency, response delays caused by long time intervals can be avoided. The specific value of β is also determined through historical data analysis, expert evaluation, and simulation testing to ensure that it can achieve the best effect under different threat levels.

[0053] S203, dynamically adjust the time interval for the next assessment: based on the calculated threat change range RC and the determined adjustment coefficients α and β, dynamically adjust the time interval for the next network security threat assessment. By formula:

[0054] It can intuitively reflect the change direction and magnitude of the threat assessment value, among which, is the preset basic time interval. When RC is positive, it means that the threat assessment value decreases and the actual threat increases. To achieve the need to shorten the evaluation time interval to respond to threats faster. On the contrary, when RC is negative, it means that the threat assessment value increases and the actual threat decreases, so To appropriately extend the evaluation time interval to save resources.

[0055] Assuming the base time interval day, adjustment coefficient α=0.5, β=0.25, the last threat assessment value .

[0056] When the current threat assessment value becomes When , the threat assessment value decreases and the actual threat increases, RC is positive. , days, indicating that when the threat assessment value is detected to decrease, the time interval for the next assessment will be shortened accordingly.

[0057] When the current threat assessment value becomes , RC will be a negative number. ,but days, indicating that when the threat assessment value is detected to increase, the time interval to the next detection will be shortened accordingly.

[0058] When the threat assessment value remains unchanged, that is, hour, ,and Days, indicating that when the threat assessment value is detected to be unchanged, the time interval for the next assessment remains unchanged.

[0059] S204, handling abnormal values ​​or extreme situations: When handling abnormal values ​​or extreme situations, it is necessary to set the maximum value of RC and minimum value Because when the RC value is abnormally large or small, the current time interval adjustment strategy may no longer be effective. In order to determine these limit values, we can analyze the RC distribution in historical data and select reasonable thresholds to ensure that the time interval adjustment is within a reasonable range. Specifically, when When Processing; when When This can prevent extreme situations from causing the time interval to be adjusted too large or too small, thereby ensuring the stability and effectiveness of the evaluation strategy.

[0060] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: This application uses the calculation formula of threat change amplitude RC and combines the adjustment coefficients α and β to adjust the time interval of the next evaluation according to the dynamic changes of network security threats, thereby improving the timeliness of threat response and the efficiency of resource use. At the same time, by handling outliers or extreme situations, the stability and effectiveness of the evaluation strategy are ensured.

[0061] Example 3: In order to further improve the accuracy and intuitiveness of network security threat assessment, this example introduces a new evaluation indicator - apparent threat assessment value on the existing basis, and combines it with a dynamically adjusted basic time interval strategy to enhance the real-time response capability to network security threats.

[0062] like Figure 7 As shown, the embodiment of the present application is optimized based on the second embodiment, and specifically includes the following steps: S301, record threat assessment value and timestamp: After each network security threat assessment is completed, in order to ensure that historical threat changes can be traced and analyzed, the threat assessment value obtained in this assessment is recorded. , and synchronously mark the exact time corresponding to this evaluation, that is, the timestamp .

[0063] S302, calculate the time interval ratio TR: In order to more accurately measure the relationship between the assessment frequency and the dynamic change of threats, the concept of time interval ratio is introduced. This indicator calculates the ratio of the basic time interval of this assessment to the actual time interval between the time nodes of the previous assessment, and adjusts it in combination with the adjustment coefficient γ, thereby constructing a quantitative standard to reflect the execution frequency of the assessment work and its sensitivity to adapt to threat changes. The formula is:

[0064] Where T is the timestamp of this evaluation, is the timestamp of the last evaluation, is the basic time interval, that is, the preset evaluation frequency, and γ is used as an adjustment coefficient to control the degree of influence of time interval changes on threat assessment values. The selection of γ is based on the statistical analysis of historical evaluation data, and it is necessary to balance the response speed and security monitoring accuracy. Generally, a larger γ value is more sensitive to changes in time intervals, while a smaller γ value is the opposite. This sensitivity adjustment can better adapt to the rhythm of threat changes and improve the accuracy of assessments.

[0065] The time interval ratio TR can intuitively reflect the close relationship between the assessment frequency and the dynamic changes of threats. When the threat level changes, the ideal assessment frequency should be able to adjust accordingly to more accurately capture the dynamics of the threat. By calculating the time interval ratio, this adaptability of the assessment frequency can be quantified, thereby better understanding whether the assessment work can respond to the changes in threats in a timely and effective manner.

[0066] Specifically, when the threat level increases, the assessment frequency should be increased accordingly to monitor and assess threats more frequently. At this time, the time interval will be relatively small compared to the TR value, indicating that the actual assessment frequency is higher than the basic time interval, and the response to threat changes is more sensitive. On the contrary, when the threat level decreases, the assessment frequency needs to be appropriately reduced to save resources. At this time, the time interval will be relatively large compared to the TR value, indicating that the actual assessment frequency is lower than the basic time interval.

[0067] S303, calculating the original apparent threat assessment value : In the actual network security environment, the threat level is not only affected by the current threat assessment value, but also closely related to its change range and assessment frequency. Therefore, a single threat assessment value often cannot fully reflect the actual situation of the threat. In order to more comprehensively assess the threat, the two key elements of threat change range RC and time interval ratio TR are integrated, and the formula is used:

[0068] Calculate the raw apparent threat assessment value , which comprehensively considers the magnitude of threat changes and the frequency of assessment, thus providing a comprehensive assessment of the threat. The time interval ratio TR reflects the adaptability of the assessment frequency to the threat changes, that is, the timeliness of the assessment. The threat change magnitude RC measures the degree of fluctuation of the threat level. Whether the threat increases or decreases, |RC| ensures that this change is correctly reflected in the assessment value.

[0069] S304, determining the minimum and maximum original apparent threat assessment values: Generally, when the threat assessment value R and the time interval ratio TR are both close to the minimum value, the original apparent threat assessment value The minimum value will be obtained. However, considering that R is unlikely to be 0 in actual situations, the minimum value of the original apparent threat assessment value can be determined based on the minimum R value in historical data and the minimum reasonable TR value. Similarly, when the threat assessment value R and the time interval ratio TR are close to the maximum value, and the threat change amplitude RC is also large, the original apparent threat assessment value will achieve its maximum value .

[0070] S305, mapping the original apparent threat assessment value to a range of 1-100: In order to map the original apparent threat assessment value to a range of 0-100, a linear mapping method is used to normalize it to 0-100. The specific calculation formula is as follows:

[0071] in, The apparent threat assessment value is mapped to a range of 1-100, making the assessment result more intuitive and easy to understand, and improving the accuracy and real-time response capability of network security threat assessment.

[0072] Assume that the last normalized threat assessment value is 0.5, the current normalized threat assessment value is 0.7, and the interval between the last threat assessment and the current normalized threat assessment is 5 days. The time period is 3 days, the adjustment coefficient is γ=0.5, and the maximum and minimum values ​​of the original apparent threat assessment value are 1 and 0.01 respectively. Calculated according to the formula:

[0073]

[0074]

[0075]

[0076] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: This application achieves a more comprehensive, dynamic and accurate assessment of network security threats by introducing a new assessment indicator, the original apparent threat assessment value, combined with a dynamic adjustment strategy for the time interval ratio. The original apparent threat assessment value integrates the two major elements of the threat change amplitude and the time interval ratio, comprehensively reflects the dynamic changes of the threat, and solves the problem that a single threat assessment value is difficult to capture the real-time fluctuations of the threat. At the same time, the threat value and timestamp of each assessment are recorded to ensure the traceability of the assessment results and provide strong support for historical analysis. In addition, by calculating the time interval ratio TR and combining it with the adjustment coefficient γ, the assessment frequency can be flexibly adjusted to improve the sensitivity to threat changes. Finally, the original apparent threat assessment value is normalized to the range of 0-100, making the assessment results more intuitive and easy to understand, improving the accuracy and real-time response capabilities of network security threat assessments, and providing organizations with more reliable security protection.

[0077] Example 4: In Example 3, the real-time and dynamic nature of network security threat assessment is further optimized by introducing the apparent threat assessment value The concept of , combined with the two key elements of time interval ratio TR and threat change amplitude RC, achieves a more comprehensive and dynamic evaluation of network security threats. In order to further improve the intuitiveness and practicality of the evaluation, Example 4 will focus on optimizing the representation of threat assessment results based on Example 3, by calculating the difference between the apparent threat assessment value and the normalized threat assessment value, and setting the threat level assessment standard accordingly, so as to help users understand the current threat level more intuitively.

[0078] The present embodiment is optimized based on the third embodiment, and specifically includes the following steps: S401, mapping the threat assessment value to a range of 1-100: In the first embodiment, the threat assessment value has been normalized to obtain a value between 0 and 1. In order to more intuitively represent the threat level, this normalized value is mapped to a range of 0-100. The specific mapping formula is as follows:

[0079] Among them, R represents the normalized threat assessment value, that is, a value between 0 and 1, and R' is the result of mapping this value to the range of 0-100.

[0080] S402, calculating the difference between the apparent threat assessment value and the threat assessment value: In order to evaluate the change in the threat level, it is necessary to calculate the difference between the apparent threat assessment value and the threat assessment value. This difference can be measured by the absolute difference or relative difference between the two, but in this embodiment, the relative difference (expressed in percentage) is selected to provide a more intuitive and quantitative indicator. The specific formula is as follows:

[0081] in, represents the apparent threat assessment value, R' represents the threat assessment value mapped to the range of 0-100, and D represents the difference between the two.

[0082] By calculating the relative difference, we can more accurately understand how the threat level changes over time, rather than relying solely on absolute threat assessment values. This approach can more sensitively capture small changes in the threat level and take appropriate security measures in a timely manner to deal with potential threats.

[0083] S403, setting the threat level assessment standard: according to actual needs, different difference value ranges correspond to different threat levels. When the difference value is within 0 to 20%, it is set to a low threat level. This range means that the change in the threat assessment value is relatively small, which may be caused by some normal fluctuations or minor threat changes; when the difference value is between 20% and 50%, it is set to a medium threat level. This range indicates that the change in the threat assessment value is more significant, and some threat dynamics that need attention may have appeared; when the difference value exceeds 50%, it is set to a high threat level. This range means that the change in the threat assessment value is very large, which may indicate that the threat level has changed significantly, or a new and more serious threat has appeared. In addition, when the apparent threat assessment value is completely equal to the threat assessment value, that is, the difference value is 0%, it is set to a specific threat level, that is, a stable level, which indicates that the threat level has not changed, or the change is so small that it can be ignored.

[0084] The selection of 20% and 50% as the dividing points for low, medium, and high threat levels is based on the analysis of historical threat assessment data and the consideration of sensitivity to threat changes. Such a division helps to more intuitively reflect the relative changes in threat levels and provide clear guidance for security response. By setting these threat level assessment standards, we can better respond to threat challenges of different severity and ensure that network security is effectively maintained and protected.

[0085] S404, evaluating the current threat level: searching for the corresponding threat level in the set evaluation criteria according to the calculated difference value.

[0086] If, when the apparent threat assessment value , mapped to a threat assessment value in the range of 0-100 When According to the threat level assessment criteria, this D value corresponds to a medium threat level.

[0087] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: By calculating the difference value, the effect of more accurately reflecting the changes in network security threats is achieved, solving the problem that previous evaluation methods only consider the absolute size of the threat and ignore the trend of change. The threat level value output by this method is a single value, which can intuitively and quickly judge the threat level based on the value, and then formulate targeted security strategies, thereby effectively improving the efficiency and accuracy of network security management.

[0088] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security threat assessment method, characterized in that: include: S101, Capture network security event data: Use the Beautiful Soup crawler tool to capture network security event data, and use the proxy IP pool strategy to deal with the anti-crawler mechanism to achieve stable and continuous data collection; S102, determining network security threat scenarios: determining existing network security threat scenarios based on the captured data and the threats faced by the network; S103, calculating the threat value, vulnerability value and loss value of the network security threat scenario: by counting and analyzing the number of occurrences of the threat scenario in a specific time period and comparing it with the total number of observations, the threat frequency is obtained, and the threat frequency is converted into a specific threat value according to a mapping table of threat frequency and threat value; By carefully counting and analyzing the number of vulnerabilities in the network, the total number of vulnerabilities is obtained, and the vulnerability data is converted into specific vulnerability values ​​according to the vulnerability number and vulnerability value mapping table; By making a detailed judgment on the severity of the data leak and mapping different data leak severity intervals to specific loss values ​​according to the data leak severity and loss value mapping table; S104, normalize the threat value, vulnerability value and loss value: normalize the threat value, vulnerability value and loss value by formula Perform normalization to ensure consistency and comparability of evaluation results; S105, calculate the threat assessment value of the threat scenario: the normalized threat value, vulnerability value and loss value are calculated according to the formula Calculate threat assessment values ​​to reflect the security threat status of the network; In addition, by dynamically adjusting the time interval for the next assessment according to changes in network security threats and introducing the concept of time interval ratio TR, the original apparent threat assessment value is calculated. ; The original apparent threat assessment value The apparent threat assessment value is mapped to the range of 1-100. At the same time, the difference between the apparent threat assessment value and the normalized threat assessment value is calculated, and the threat level assessment standard is set accordingly, so as to more intuitively understand the current threat level. S106, Application of evaluation results: Based on the obtained network security threat level, the network security threat status can be more intuitively understood, providing an important basis for formulating targeted security precautions.

2. A network security threat assessment method as claimed in claim 1, characterized in that: The normalization process uses the normalization formula Converting the three key indicators, threat value T, vulnerability value V and loss value L, into a unified magnitude makes the threat assessment results more accurate and reliable, and avoids calculation bias caused by magnitude differences.

3. A network security threat assessment method as claimed in claim 1, characterized in that: The calculation formula of the threat assessment value is: , where k is an adjustment coefficient, which plays a vital role in threat assessment and is used to adjust the scale of threat assessment value to ensure that the assessment results can accurately reflect the actual security threat situation.

4. A network security threat assessment method as claimed in claim 1, characterized in that: The dynamic adjustment of the time interval for the next evaluation will dynamically adjust the time interval for the next network security threat evaluation based on the calculated threat change range RC and the determined adjustment coefficients α and β; the adjustment formula is as follows: in, is the preset basic time interval; when RC is positive, it means that the threat assessment value decreases and the actual threat increases, so To achieve the need to shorten the evaluation time interval to respond to threats faster; on the contrary, when RC is negative, it means that the threat assessment value increases and the actual threat decreases, so To appropriately extend the evaluation time interval to save resources.

5. A network security threat assessment method as claimed in claim 4, characterized in that: The threat change amplitude RC is calculated by the formula: To quantify the change in threat; is the last threat assessment value, The current threat assessment value; in this formula, if the threat assessment value becomes smaller, , then RC is a positive number, indicating that the threat assessment value has decreased compared with the previous assessment; if the threat assessment value increases, , then RC is a negative number, indicating that the threat assessment value has increased compared with the previous assessment; if the threat assessment value remains unchanged, RC is equal to 0; therefore, the above formula can intuitively reflect the direction and magnitude of the change in the threat assessment value.

6. A network security threat assessment method as claimed in claim 4, characterized in that: The determined adjustment coefficients α and β, when the threat increases, the value of α needs to be set to a larger positive number to ensure that the time interval can be significantly shortened so that the threat can be responded to quickly; when the threat decreases, the time interval can be appropriately extended to save resources, and the value of β needs to be set to a smaller positive number or a value close to 0, so as to ensure resource efficiency while avoiding response delays caused by too long time intervals.

7. A network security threat assessment method as claimed in claim 1, characterized in that: The time interval ratio TR is introduced by calculating the ratio of the basic time interval of this assessment to the actual time interval between the time nodes of the previous assessment, and adjusting it in combination with the adjustment coefficient γ, so as to construct a quantitative standard to reflect the execution frequency of the assessment work and its sensitivity to adapt to threat changes. The formula is: Where T is the timestamp of this evaluation, is the timestamp of the last evaluation, is the basic time interval, and γ is the adjustment coefficient, which controls the influence of the time interval change on the threat assessment value.

8. A network security threat assessment method as claimed in claim 1, characterized in that: The raw apparent threat assessment value , integrating the two key factors of threat change amplitude and time interval ratio, using the formula Calculated; It provides a comprehensive assessment of threat dynamics by taking into account both the magnitude of threat change and the frequency of assessment.

9. A network security threat assessment method as claimed in claim 1, characterized in that: The original apparent threat assessment value Mapped to the range of 1-100, the original apparent threat assessment value is normalized to 0-100 using a linear mapping method. The specific calculation formula is as follows: ,in, is the apparent threat assessment value, is the minimum value of the original apparent threat assessment value, It is the maximum value of the original apparent threat assessment value.

10. A network security threat assessment method as claimed in claim 1, characterized in that: The difference between the apparent threat assessment value and the normalized threat assessment value is calculated, and the threat level assessment standard is set accordingly, through the formula: To provide a more intuitive and quantitative indicator to capture small changes in threat levels, where D represents the difference between the two; the difference value obtained according to the formula is divided into three threat levels: when the difference value is within 0 to 20%, it is set to a low threat level; when the difference value is between 20% and 50%, it is set to a medium threat level; when the difference value exceeds 50%, it is set to a high threat level; in addition, when the apparent threat assessment value is exactly equal to the threat assessment value, that is, the difference value is 0%, it is set to a specific threat level, namely the stable level.

Images