Information security risk quantification method based on risk harmfulness and asset structure decomposition

Abstract

The invention relates to the technical field of information security, in particular to an information security risk quantification method based on risk harmfulness and asset structure decomposition, and the method comprises the steps: generating a probability value and an influence value of each information security risk on each underlying asset based on each vulnerability faced by a business informatization asset system; calculating a hazard quantized value of each kind of information security risk generated by each kind of vulnerability on each underlying asset; combining at least two asset types and the underlying assets corresponding to the two asset types, generating a weighted hypermatrix of the combined underlying assets by adopting a network analysis method, and solving the weight of each underlying asset based on the weighted hypermatrix; and calculating an overall information security risk value of the business informatization asset system based on the harmfulness quantized value and the weight. An asset system structure and a vulnerability risk distribution structure are integrated, asset association importance analysis is carried out by flexibly utilizing a network analysis method, and comprehensive information security risk assessment and analysis of the system are carried out.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to an information security risk quantification method based on risk hazard and asset structure decomposition. Background Art

[0002] With the rapid iteration and development of information technology and its applications, informatization has penetrated into all aspects of economic and social development. The level of informatization in the business field, to some extent, represents the advancement of productivity and the efficiency of management, which directly determines market competitiveness. The informatization of business logic, along with the improvement of the degree of electronicization and the accumulation of business data, has highlighted the vulnerability of information business under the combined effects of the complex and ever-changing external environment and internal technical management defects. Even if the security technology capabilities and management levels are continuously optimized and improved, information security still faces all-round threats and hidden dangers, resulting in complex and ever-changing security risks for information business and assets, affecting the continuous output and delivery capabilities of business implementation and production and manufacturing, and is not conducive to the stability and security of business development. Even worse, it may lead to catastrophic consequences. Ensuring information security is a common problem faced by organizations. Information security risk assessment is the key work and fundamental basis for information security protection and management, and is an important part of information risk management. Through information security risk assessment, risks can be identified in the planning, design, implementation, operation and maintenance, and abandonment stages of information systems, so that corresponding response measures can be taken, risk factors can be comprehensively analyzed, the construction of information system security management systems can be guided, and comprehensive and targeted security strategies and rectification measures can be formulated to provide scientific basis and decision-making support for preventing, resolving and controlling information security risks and ensuring the level of information security.

[0003] Traditional security risk assessment methods mainly adopt qualitative assessment methods, combining the estimated occurrence of security incidents and the loss of incidents to conduct security risk assessment. When conducting risk assessment, traditional methods only identify and rank risk factors, and integrate and calculate to form risk assessment results. They do not comprehensively consider the distribution characteristics of risks and their hazards, the associated attributes of asset structures, etc., and lack correlation analysis and system considerations for risk assessment. Therefore, the risk assessment results are not systematic and comprehensive. Summary of the invention

[0004] The present invention provides an information security risk quantification method based on risk hazard and asset structure decomposition to obtain a comprehensive risk assessment result.

[0005] In a first aspect, the present disclosure provides an information security risk quantification method based on risk hazardness and asset structure decomposition, comprising:

[0006] Based on the probability value and impact value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset, a quantitative value of the harmfulness of each information security risk generated by each vulnerability on each underlying asset is calculated, wherein the asset structure in the business information asset system includes multiple asset categories and underlying assets under each asset category;

[0007] Merge at least two asset classes and the underlying assets corresponding to the two asset classes, generate a weighted supermatrix of the merged underlying assets using a network analysis method, and solve for the weight of each underlying asset based on the weighted supermatrix;

[0008] The overall information security risk value of the business information asset system is calculated based on the quantitative value of the criticality and the weight.

[0009] In some embodiments, the information security risk quantification method further includes:

[0010] The first calculation formula is used to calculate the probability value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset;

[0011] The second calculation formula is used to calculate the impact value of each information security risk generated by each vulnerability faced by the business information asset system on each underlying asset;

[0012] The first calculation formula is as follows:

[0013]

[0014] In the formula, pr(i)(j)(p) represents the probability value of the i-th vulnerability generating the p-th information security risk on the j-th underlying asset, and the interval is [0,1], r h (i)(j)(p) represents the number of votes that the ith vulnerability will generate the pth information security risk on the jth underlying asset, n a Indicates the number of first assessors;

[0015] The second calculation formula is as follows:

[0016]

[0017] Where ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset; ef(i)(j)(p)(a) represents the impact value of the information security risk given by the ath assessor when the ith vulnerability generates the pth information security risk on the jth underlying asset; and L represents the number of second assessors.

[0018] In some embodiments, a third calculation formula is used to calculate a quantitative value of the harmfulness of each information security risk generated by each vulnerability on each underlying asset;

[0019] The third calculation formula is as follows:

[0020] rc(i)(j)(p)=ef(i)(j)(p)×pr(i)(j)(p)

[0021] Where rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset, ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset, and pr(i)(j)(p) represents the probability value of the ith vulnerability generating the pth information security risk on the jth underlying asset.

[0022] In some embodiments, the asset types include technology stack assets, organizational management assets, and technology management assets; the step of merging at least two asset types and the underlying assets corresponding to the two asset types, and using a network analysis method to generate a weighted supermatrix of the merged underlying assets, includes:

[0023] Merge organizational management assets and technical management assets, and merge the underlying assets under organizational management assets and technical management assets;

[0024] Taking the underlying assets in the technology stack assets, the merged organizational management assets, and the technology management assets as criteria, a judgment matrix is ​​formed and the corresponding weight vector is calculated to obtain the initial supermatrix. The column vectors corresponding to the merged part of the initial supermatrix are split and restored into the column vectors of the corresponding part before the merge and normalized to obtain the final supermatrix.

[0025] Taking technology stack assets, organizational management assets, and technology management assets as criteria, a judgment matrix is ​​formed and the corresponding weight vector is calculated to obtain a weighted matrix;

[0026] Each element in the weighted matrix is ​​multiplied by the block in the supermatrix that represents the dominant relationship between the underlying assets under each type of asset to form a weighted supermatrix.

[0027] In some embodiments, each underlying asset in the technology stack assets, the merged organizational management assets, and the technology management assets is used as a criterion to form a judgment matrix and calculate the corresponding weight vector to obtain an initial supermatrix, and the column vectors corresponding to the merged part of the initial supermatrix are split and restored into column vectors of the corresponding part before the merger and normalized to obtain the final supermatrix, including:

[0028] For each underlying asset in the technology stack assets, a judgment matrix of the underlying assets dominated by the underlying asset is formed based on each underlying asset. Based on the judgment matrix, the corresponding weight vector is calculated as the column vector of the first m rows of the super matrix, where m represents the number of underlying assets in the technology stack assets;

[0029] For the underlying assets under the merged organizational management assets and technical management assets, a judgment matrix of the underlying assets dominated by each underlying asset is formed based on the judgment matrix. The corresponding weight vector is calculated based on the judgment matrix. The weight vector is split and restored into two column vectors according to the segmentation boundary of the underlying assets corresponding to the organizational management assets and the technical management assets. The two column vectors correspond to the two parts before the merger, respectively. The two column vectors are normalized and used as the column vectors from the m+1th row to the m+nth row and the column vectors from the m+n+1th row to the m+n+qth row of the supermatrix, respectively. n represents the number of underlying assets in the organizational management assets, and q represents the number of underlying assets in the technical management assets.

[0030] In some embodiments, solving the weight of each underlying asset based on the weighted supermatrix includes:

[0031] Iterative calculation of WHMA N =WHMA N-1 ×WHMA;

[0032] The termination conditions of the iterative calculation are as follows:

[0033]

[0034] Where WHMA represents the weighted super matrix and i represents WHMA n The row index of j represents WHMA N Column index, WHMA N ij WHMA N The element of the i-th row and j-th column, max represents the maximum value of the orientation, min represents the minimum value of the orientation, cov represents the threshold, and N represents the current number of iterations;

[0035] Get WHMA N The median value of each row, forming the WHMA NThe row median column vector RMC is taken as the row median column vector, where each element in the row median column vector RMC is the weight of the corresponding underlying asset. The row median column vector RMC is summed and normalized, and the normalized row median column vector is recorded as MC. The first m elements in the row median column vector MC represent the weights of the corresponding underlying assets in the technology stack assets, the m+1th element to the m+nth element represent the weights of the corresponding underlying assets in the organizational management assets, and the m+n+1th element to the m+n+qth element represent the weights of the corresponding underlying assets in the technology management assets.

[0036] In some embodiments, the overall information security risk value of the business information asset system is calculated based on the quantified value of the criticality and the weight, using the following fourth calculation formula:

[0037]

[0038] Where Rw represents the overall information security risk value of the business information asset system, which takes values ​​in the interval [0,1]. The larger the overall information security risk value, the greater the risk; MC(j) represents the weight of the j-th underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the p-th information security risk generated by the ith vulnerability on the j-th underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the j-th underlying asset.

[0039] In some embodiments, the information security risk quantification method further includes:

[0040] Using the fifth calculation formula, based on the quantified value of the harmfulness and the weight, the risk coefficient of each information security risk of the business information asset system is calculated;

[0041] The fifth calculation formula is as follows:

[0042]

[0043] Where Rc(p) represents the risk coefficient of the pth information security risk, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the information security risk on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk caused by the ith vulnerability on the jth underlying asset.

[0044] In some embodiments, the information security risk quantification method further includes:

[0045] Using the sixth calculation formula, based on the criticality quantification value and the weight, the risk coefficient of each vulnerability of the business information asset system is calculated;

[0046] The sixth calculation formula is as follows:

[0047]

[0048] Where Rv(i) represents the risk coefficient of the ith vulnerability, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the vulnerability on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the jth underlying asset.

[0049] In some embodiments, the information security risk quantification method further includes:

[0050] The seventh calculation formula is used to calculate the risk value of each underlying asset of the business information asset system based on the quantified value of the criticality and the weight;

[0051] The seventh calculation formula is as follows:

[0052]

[0053] Where Ra(j) represents the risk value of the jth underlying asset, which is in the range of [0,1]. The larger the risk value, the greater the risk to the asset. MC(j) represents the weight of the jth underlying asset. rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk caused by the ith vulnerability on the jth underlying asset. rkn(i)(j) represents the number of information security risks caused by the ith vulnerability on the jth underlying asset.

[0054] In a second aspect, the present disclosure provides an information security risk quantification device based on risk hazardness and asset structure decomposition, comprising:

[0055] A criticality quantification module is used to calculate the criticality quantification value of each information security risk generated by each vulnerability on each underlying asset based on the probability value and impact value of each information security risk generated by each vulnerability on each underlying asset, wherein the asset structure in the business information asset system includes multiple asset categories and underlying assets under each asset category;

[0056] A weight solving module, used to merge at least two asset classes and the underlying assets corresponding to the two asset classes, generate a weighted supermatrix of the merged underlying assets using a network analysis method, and solve the weight of each underlying asset based on the weighted supermatrix;

[0057] The risk calculation module is used to calculate the overall information security risk value of the business information asset system based on the quantified value of the criticality and the weight.

[0058] In a third aspect, the present disclosure provides a computer device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method described in the first aspect.

[0059] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method described in the first aspect when executed by a processor.

[0060] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program / instructions, which implements the steps of the method described in the first aspect when the computer program is executed by a processor.

[0061] The scheme provided by the present disclosure integrates the asset system structure and the vulnerability risk distribution structure, flexibly uses the network analysis method (Analytic Network Process, referred to as ANP) to analyze the importance of asset association, and conducts comprehensive information security risk assessment and analysis of the system, so as to quantify the risk value of the overall information business, the risk value of the asset, the risk coefficient of vulnerability and the risk coefficient of risk. The method is scientific and reasonable, has high technical advancement and reliability, and the assessment system is complete and has high practical value. It solves the problems of unsystematic risk assessment methods in related technologies, lack of system asset element correlation analysis, difficulty in quantifying risk assessment results, scattered and independent analysis elements, and difficulty in integrated analysis, a large number of judgment matrices in the supermatrix of the ANP algorithm, high computational complexity of eigenvector solution, quantification of vulnerability hazard degree, quantification of risk hazard degree, and quantification of specified asset risk value. It is conducive to the security management of information construction, improves the efficiency of information business security management, and can effectively cope with complex and changeable information security environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The present disclosure will be described in more detail below based on embodiments and with reference to the accompanying drawings:

[0063] Figure 1 A flowchart of an information security risk quantification method based on risk hazardness and asset structure decomposition provided in an embodiment of the present disclosure;

[0064] Figure 2 A schematic diagram of the element structure of information security risk quantitative analysis and assessment based on risk hazard and asset structure decomposition provided in an embodiment of the present disclosure;

[0065] Figure 3 A schematic diagram of information security risks caused by vulnerabilities provided in an embodiment of the present disclosure;

[0066] Figure 4 A schematic diagram of asset decomposition for business informatization provided by an embodiment of the present disclosure;

[0067] Figure 5 A schematic diagram of an application example provided for an embodiment of the present disclosure;

[0068] In the drawings, the same reference numerals are used for the same components, and the drawings are not drawn to scale. DETAILED DESCRIPTION

[0069] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, and to fully understand and implement how the present disclosure applies technical means to solve technical problems and achieve the corresponding technical effects, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only embodiments of a part of the present disclosure, not all of the embodiments. The embodiments of the present disclosure and the various features in the embodiments can be combined with each other without conflict, and the technical solutions formed are all within the scope of protection of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present disclosure.

[0070] In information security risk assessment, due to the complex relationship of mutual influence and mutual condition between assets, the traditional assessment method has limited quantitative means of risk assessment and coarse granularity, and does not consider the complex correlation between assets, so the assessment method has limitations. The solution provided by the present disclosure integrates the asset system structure and the vulnerability risk distribution structure, flexibly uses the network analysis method (Analytic Network Process, referred to as ANP) to analyze the importance of asset correlation, and conducts comprehensive information security risk assessment and analysis of the system, so as to quantify the risk value of the overall information business, the risk value of assets, the risk factor of vulnerability and the risk factor of risk. This method is scientific and reasonable, has high technical advancement and reliability, and the assessment system is complete and has high practical value.

[0071] In the scheme disclosed in this paper, the asset system structure and vulnerability risk distribution structure are integrated, and the network analysis method (Analytic Network Process, referred to as ANP) is flexibly used to analyze the importance of asset association, and the comprehensive information security risk assessment and analysis of the system is carried out, so as to quantify the risk value of the overall information business, the risk value of the asset, the risk factor of the vulnerability and the risk factor of the risk. This method is scientific and reasonable, has high technical advancement and reliability, and the assessment system is complete and has high practical value.

[0072] The following introduces the symbolic expression system of the relationship between the elements (nodes) involved in this method:

[0073] The following is the convention for symbolic representation of the relationships between nodes in the application of ANP.

[0074] Bidirectional association: Nodes v1,…,vn are dependent on each other, represented by (v1,…,vn), abbreviated as (vi|i∈{1,…,n}).

[0075] One-way association: Node v1 dominates v2, with<v1,v2> express.

[0076] Set: Nodes v1,…,vn form a set, represented by {v1,…,vn}, abbreviated as {vi|i∈{1,…,n}}, and the corresponding set can also be obtained by function. The elements in the set can be represented by bidirectional or unidirectional associations based on the actual logical relationship. There can also be no dependency between the elements in the set.

[0077] The following is an example of a composite association. This example is a two-layer case, and the multi-layer case can be deduced similarly:

[0078] 1) {v1, (v2, ..., vn)} means that v2, ..., vn are interdependent, and v1 and (v2, ..., vn) form a set. It is mainly used for the structural representation of ANP and does not involve the weight quantization between v1 and {v2, ..., vn}.

[0079] 2)<v1,{v2,…,vn}> It indicates that the upper node v1 dominates the lower node set {v2, ..., vn}, which is abbreviated as<v1,{vi|i∈{2,…,n}}> . Mainly used for the structural representation of ANP, involving the weight quantization between v1 and {v2,…,vn}.

[0080] 3){<v1,S1> ,…<vn,Sn>} indicates that the upper nodes v1,..vn dominate the lower node sets S1,…Sn respectively, which can be abbreviated as {<vi,Si> |i∈{1,…,n}}. Mainly used for the structural representation of ANP, involving the weight quantization between vi and the nodes in Si.

[0081] In the above “<>”, nodes or node sets separated by “,” (the corresponding set of nodes or functions enclosed by {} is obtained), nodes or node sets are referred to as parts here. From left to right, the left part is the upper part of the right part, and the right part is the lower part of the left part, and the upper part dominates the lower part. In the ANP method, a bidirectional association relationship can be decomposed into several unidirectional association relationships. Since the nodes in the network relationship are mostly composed of bidirectional associations and unidirectional associations, the unidirectional relationship can be directly applied to the analytic hierarchy process (Analytic Hierarchy Process, referred to as AHP) to quantify the model weights. The bidirectional association can be decomposed into unidirectional associations, and the AHP method can be used to determine the weighted supermatrix in the ANP method. In addition, in the above symbol representation, the left part and the right part separated by “,” in “<>” are the positions where the relevant weights need to be determined. “()” is finally decoupled into multiple “<>” representations. “{}” is only used for the structural representation of hierarchies or networks. This application uses a combination of “<>”, “()” and “{}” to construct an asset structure representation, and to represent and decompose the relationship between assets.

[0082] The following is an introduction to the principles of the analytic hierarchy process (AHP):

[0083] 1) Judgment Matrix

[0084] The elements of the judgment matrix represent the importance of the lower nodes of the row number and the lower nodes of the column number relative to the upper node in terms of the composition relationship, with the upper node as the goal or criterion. The elements of the judgment matrix adopt the 1-9 scale method, and the table lists the meaning of the scale of 1-9 and its reciprocal.

[0085] Table 1 Scaling method for judgment matrix elements 1-9

[0086]

[0087] 2) Calculate weight

[0088] First, the judgment matrix is ​​normalized by column (each element is divided by the sum of its column), then the normalized columns are added together (summed by row), and finally, each element in the vector obtained after addition is divided by n to obtain the weight vector.

[0089]

[0090] In the formula, w i is the weight of the ith indicator or requirement.

[0091] 3) Calculate the maximum eigenvalue of the judgment matrix

[0092] The maximum eigenvalue of the judgment matrix is ​​calculated as follows:

[0093]

[0094] In the formula, λ max is the maximum eigenvalue of the judgment matrix.

[0095] 4)Consistency test

[0096] In order to verify the logical rationality, it is necessary to perform a consistency check on the judgment matrix.

[0097] The inspection steps are as follows:

[0098] 4.1) Calculate the consistency index CI:

[0099]

[0100] In the formula, λ max is the maximum eigenvalue of the judgment matrix, and n is the matrix order.

[0101] 4.2) Calculate the consistency ratio CR:

[0102]

[0103] Where RI is the average random consistency index, which can be obtained by looking up the table.

[0104] 4.3)Consistency judgment:

[0105] When CR < 0.1, the consistency of the judgment matrix is ​​considered acceptable.

[0106] When CR≥0.1, the judgment matrix does not meet the consistency requirements. It is necessary to correct the judgment matrix, recalculate CR and make judgments until the consistency requirements of the matrix are met, and accept the weights calculated in 2).

[0107] In the scheme disclosed in the present invention, the information security risk assessment of information-based business is divided into two dimensions: First, the business information asset system (business information asset system) is decomposed to obtain different types of information assets, and the dependency relationship between the decomposed elements is combined to form a network association relationship, so as to determine the weight of each asset. The second is the vulnerability risk harmfulness structure decomposition, that is, quantifying the harmfulness of different risks that may be caused by each vulnerability, and mapping the corresponding harmfulness to different assets. In this way, by integrating the two major elements of the harmfulness of each risk of each vulnerability and the importance of the asset to which the risk corresponds, the information security risk assessment result of the overall information-based business is formed, that is, the information security risk value of the overall information-based business. At the same time, through the data collection of the model, the degree of harm of the risk, the degree of harm of the vulnerability, and the risk value of the asset can be analyzed in multiple dimensions.

[0108] Embodiment 1

[0109] Figure 1 A schematic diagram of the information security risk quantification method based on risk hazard and asset structure decomposition is shown. Figure 1 As shown, the information security risk quantification method based on risk hazard and asset structure decomposition provided in this embodiment includes:

[0110] Step S11, based on the probability value and impact value of each information security risk generated by each vulnerability faced by the business information asset system on each underlying asset, calculate the quantitative value of the harmfulness of each information security risk generated by each vulnerability on each underlying asset, wherein the asset structure in the business information asset system includes multiple asset types and underlying assets under each asset type.

[0111] In this embodiment, the element structure of information security risk quantitative analysis and assessment based on risk hazard and asset structure decomposition can be as follows: Figure 2 As shown. The method of this embodiment performs quantitative analysis and assessment of information security risks based on the decomposition of vulnerability risk hazard and asset structure, and forms an element structure of information security risk assessment by decomposing the business information asset system B and the vulnerability information security risk hazard. Among them, the information security risk hazard of vulnerability V refers to the risk destructive capacity of various risks that can be generated by the vulnerability on assets of a certain degree of importance, that is, on designated assets, the assessor evaluates the destructive capacity of designated risks generated by designated vulnerabilities on designated assets through factors such as the security measures taken by the vulnerability, the threats faced by the vulnerability, the ease of exploitation of the vulnerability, and the impact of the risks generated after the vulnerability is exploited on the asset. The asset weights in the business information system reflect the importance of the underlying assets, and these weights are quantified using the ANP method. As Figure 2 As shown in the figure, the √ is the correlation distribution of the risk formed by a vulnerability in all assets. The logic of risk analysis and assessment of this method is: the risk value is related to the importance of the asset and the harmfulness of various risks generated by the vulnerability on it. The harmfulness of each risk of each vulnerability on each asset is integrated, and combined with the importance of each asset, the quantitative results of risk assessment and analysis are obtained.

[0112] Before step S11, the probability value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset and the impact value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset are calculated, and then the quantitative value of the harmfulness of each vulnerability generating each information security risk on each underlying asset is calculated. Therefore, the information security risk quantification method of this embodiment also includes:

[0113] The first calculation formula is used to calculate the probability value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset;

[0114] The second calculation formula is used to calculate the impact value of each information security risk generated by each vulnerability faced by the business information asset system on each underlying asset;

[0115] Vulnerability V has the probability of generating corresponding risks for different underlying assets based on factors such as the security measures taken, the threats faced, and the ease of being exploited, and then quantifies the harmfulness of each risk by combining the impact of the risk on the underlying assets. Fixed the i-th vulnerability and the j-th underlying asset, the vulnerability can generate different risks. Fixed the p-th risk, there is a probability of generating the p-th risk. In some specific implementations, this probability can be generated by obtaining the statistically obtained votes of the assessors on the occurrence of the p-th risk. It should be understood that the risk here refers to information security risk.

[0116] The first calculation formula is as follows:

[0117]

[0118] Where pr(i)(j)(p) represents the probability value of the i-th vulnerability generating the p-th information security risk on the j-th underlying asset, with an interval of [0,1], and is an estimated value; r h (i)(j)(p) represents the number of votes that the ith vulnerability will generate the pth information security risk on the jth underlying asset, n a Indicates the number of first assessors;

[0119] In some specific implementations, the impact of risk on assets can be quantified as a continuous variable between [0,1] based on the judgment of the assessor, where 0 represents no impact and 1 represents the maximum impact. If the i-th vulnerability generates the p-th risk on the j-th underlying asset, then the impact on the j-th underlying asset is recorded as ef(i)(j)(p), which takes a value in the interval [0,1].

[0120] The second calculation formula is as follows:

[0121]

[0122] Where ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset; ef(i)(j)(p)(a) represents the impact value of the information security risk given by the ath assessor when the ith vulnerability generates the pth information security risk on the jth underlying asset; and L represents the number of second assessors.

[0123] The impact value of the risk can be taken from the table below.

[0124] Table 2 Risk impact value table

[0125] Risk Impact Value meaning 5 Risks have a huge impact on assets 4 Risk has a great impact on assets 3 Risk has a general impact on assets 2 Risk has little impact on assets 1 Risk has little impact on assets 0 Risk has no impact on assets

[0126] In some specific implementations, a third calculation formula may be further used to calculate the quantitative value of the harmfulness of each information security risk generated by each vulnerability on each underlying asset;

[0127] The third calculation formula is as follows:

[0128] rc(i)(j)(p)=ef(i)(j)(p)×pr(i)(j)(p)

[0129] Where rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset, ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset, and pr(i)(j)(p) represents the probability value of the ith vulnerability generating the pth information security risk on the jth underlying asset.

[0130] Based on the above calculation formula, p, j, and i are changed respectively to calculate the quantitative value of the harmfulness of each information security risk.

[0131] Step S12: merge at least two asset types and the underlying assets corresponding to the two asset types, use network analysis method to generate a weighted supermatrix of the merged underlying assets, and solve the weight of each underlying asset based on the weighted supermatrix.

[0132] like Figure 4As shown, in this embodiment, the evaluation entity of business informatization B is decomposed into three dimensions (asset types) of technology stack T, organizational management O, and technical management M, that is, the asset types include technology stack assets, organizational management assets, and technical management assets, which can be simplified as {B, (T, O, M)}, where the technology stack includes system hardware, software and other assets, organizational management includes environmental management, operation management, system development management, operation and maintenance management, business continuity management and other assets, and technical management includes security policies, organizational security, asset classification and control, compliance application management and other assets. The relevant processes of technology stack, organizational management, and technical management are transformed from vertical to flat structure. The relationship between the technology stack and its subordinate underlying assets is expressed as {T, (T1, ..., Tm)}, where m is the number of underlying assets of the technology stack. The relationship between organizational management and its subordinate underlying assets is expressed as {O, (O1, ..., On)}, where n is the number of underlying assets of organizational management. The relationship between technical management and its subordinate underlying assets is expressed as {M, (M1, ..., Mq)}, where q is the number of underlying assets of organizational management. Figure 4 The relationship structure of business information-oriented assets in the symbol system used to obtain weights includes:

[0133] 1)(T,O,M) 2)

[0135] {<Ai,RE(Ai)> |i∈{1,…,m+n+q}}={<T1,RE(T1)> ,…,<Tm,RE(Tm)> ,<O1,RE(O1)> ,…,<On,RE(On)> ,<M1,RE(M1)> ,…,<Mq,RE(Mq)>}

[0136] Among them, Ai represents the i-th underlying asset, Ai,…,Am are T1,…,Tm respectively; Am+1,…,Am+n are O1,…,On respectively; Am+n+1,…,Am+n+q are M1,…,Mq respectively. m is the number of underlying assets in the technology stack, n is the number of underlying assets managed by the organization, and q is the number of underlying assets managed by the organization. RE is a function for obtaining the set of underlying assets controlled by a certain underlying asset, and the output is the set of underlying assets that the corresponding underlying asset can control. For example, RE(Ai) represents the set of underlying assets controlled by Ai, which includes Ai itself. The weight quantization process is as follows:

[0137] The above-mentioned merging of at least two asset classes and the underlying assets corresponding to the two asset classes, and using a network analysis method to generate a weighted supermatrix of the merged underlying assets, may include:

[0138] Step S12a: merge the organizational management assets and the technical management assets, and merge the underlying assets under the organizational management assets and the technical management assets.

[0139] In order to reduce the time complexity and space complexity of ANP calculation, this embodiment adopts the method of merging elements to reduce the generation of judgment matrix, and then reduce the number of times the matrix is ​​solved by the eigenvalue method, thereby reducing the complexity of solution. Here, O and M are logically merged, recorded as OM = O∪M, and the underlying assets are logically merged at the same time, OMi represents the i-th underlying asset corresponding to OM, OM1, ..., OMn are O1, ..., On respectively;

[0140] OMn+1,…,OMn+q are M1,…,Mq respectively. T is not merged. Thus, according to the ANP method, variables T, O, and M generate the relationship between asset elements, and the number of judgment matrices formed is originally 3 (m+n+q). After merging, the number of judgment matrices is 2 (m+n+q), thereby reducing the number of times the judgment matrix is ​​decomposed to solve the weights, and reducing the space complexity and time complexity.

[0141] Step S12b, taking each underlying asset in the technology stack assets, the merged organizational management assets and the technology management assets as criteria, respectively, forming a judgment matrix and calculating the corresponding weight vector to obtain an initial supermatrix, splitting and restoring the column vectors corresponding to the merged part of the initial supermatrix into the column vectors of the corresponding part before the merge and normalizing them to obtain the final supermatrix.

[0142] Let TOM = T∪O∪M, take T1,…Tm,O1,…On,M1…Mq as the criteria, and form a judgment matrix, that is, for {<Ai,RE(Ai)> |i∈{1,…,m+n+q}} is decomposed one by one to form a corresponding judgment matrix. Furthermore, the underlying assets in the technology stack assets, the merged organizational management assets, and the technology management assets are used as criteria to form a judgment matrix and calculate the corresponding weight vector to obtain the initial super matrix. The column vectors corresponding to the merged part of the initial super matrix are split and restored to the column vectors of the corresponding part before the merge and normalized to obtain the final super matrix, including:

[0143] For each underlying asset in the technology stack assets, a judgment matrix of the underlying assets dominated by the underlying asset is formed based on each underlying asset. Based on the judgment matrix, the corresponding weight vector is calculated as the column vector of the first m rows of the super matrix, where m represents the number of underlying assets in the technology stack assets;

[0144] For the underlying assets under the merged organizational management assets and technical management assets, a judgment matrix of the underlying assets dominated by each underlying asset is formed based on the judgment matrix. The corresponding weight vector is calculated based on the judgment matrix. The weight vector is split and restored into two column vectors according to the segmentation boundary of the underlying assets corresponding to the organizational management assets and the technical management assets. The two column vectors correspond to the two parts before the merger, respectively. The two column vectors are normalized and used as the column vectors from the m+1th row to the m+nth row and the column vectors from the m+n+1th row to the m+n+qth row of the supermatrix, respectively. n represents the number of underlying assets in the organizational management assets, and q represents the number of underlying assets in the technical management assets.

[0145] In some specific implementations, the supermatrix is ​​generated as follows:

[0146] For each Ai, According to the method of scaling the elements 1-9 of the judgment matrix in the analytic hierarchy process introduced above, the judgment matrices JMi of the factors dominated by Ai are formed respectively with Ai as the criterion. len(RE(Ai)) represents the number of elements in RE(Ai). Each judgment matrix is ​​a square matrix of len(RE(Ai)) order, and JMi is used to calculate the corresponding len(RE(Ai))×1 weight vector WVi. For the elements Ti in T that Ai cannot dominate, according to the position of Ti in T, 0 is inserted in the corresponding position of WVi, so that WVi becomes an m×1 column vector. If Ai cannot dominate all elements in T, the corresponding WVi is an m×1 column vector with all elements being 0. Ai and WVi are respectively used as the column vectors of the first m rows of the supermatrix HMA.

[0147] For each Ai, According to the method of scaling the elements 1-9 of the judgment matrix in the hierarchical analysis method introduced above, the judgment matrices JMi of the factors dominated by Ai are formed respectively with Ai as the criterion. Len(RE(Ai)) represents the number of elements in RE(Ai). Each judgment matrix is ​​a square matrix of len(RE(Ai)) order, and the corresponding weight vector WVi of len(RE(Ai))×1 is calculated by JMi. For the elements OMi in OM that Ai cannot dominate, 0 is inserted in the corresponding position of WVi according to the position of OMi in OM, so that WVi becomes a column vector of (n+q)×1. If Ai cannot dominate all elements in OM, the corresponding WVi is a column vector of (n+q)×1 with all elements being 0. Divide WVi into two column vectors WVOi and WVMi according to the underlying asset partition boundaries of O and M. If WVOi and WVMi are non-zero vectors, sum and normalize them respectively. Use the normalized WVOi and WVMi as the column vectors from m+1 to m+n rows and from m+n+1 to m+n+q rows of the super matrix HMA respectively.

[0148] The above method of generating a supermatrix based on the merging and splitting of logical boundaries of elements can reduce the generation of judgment matrices, and then reduce the number of times the matrix solves weights through the eigenvalue method, thereby reducing the complexity of subsequent weight solutions. The ANP (Analytic Network Process) method is used in the asset decomposition of risk assessment modeling, and the supermatrix generation method of merging and splitting logical boundaries of elements is creatively adopted, which effectively reduces the computational time complexity and space complexity of ANP.

[0149] Step S12c: using the technology stack assets, organizational management assets and technology management assets as criteria, respectively, to form a judgment matrix and calculate the corresponding weight vector to obtain a weighted matrix.

[0150] Take T, O, and M as criteria respectively to form a judgment matrix, that is, decompose (T, O, M) one by one to form the corresponding judgment matrix: decompose (T, O, M) into {<T,{T,O,M}> ,<O,{O,T,M}> ,<M,{M,T,O}>}, according to the scaling method of the judgment matrix elements 1-9 in the hierarchical analysis method introduced above, three 3×3 judgment matrices are formed respectively, and the corresponding three 3×1 weight vectors are calculated as the column vectors of the 3×3 weighted matrix WM respectively.

[0151] Step S12d: Each element in the weighted matrix is ​​multiplied by a block in the supermatrix representing the dominance relationship between the underlying assets under each asset class to form a weighted supermatrix. The dominance relationship between the underlying assets under each asset class includes the dominance relationship between the underlying assets under the same asset class and the dominance relationship between the underlying assets under different asset classes.

[0152] The supermatrix HMA is divided into 9 blocks corresponding to<T,T> ,<T,O> ,<T,M> ,<O,T> ,<O,O> ,<O,M> ,<M,T> ,<M,O> ,<M,M> Each element of the weighted matrix WM obtained above is multiplied by a block of the supermatrix HMA to form the weighted supermatrix WHMA.

[0153] Furthermore, the weight of each underlying asset is solved based on the weighted super matrix, including:

[0154] Iterative calculation of WHMA N =WHMA N-1 ×WHMA;

[0155] The termination conditions of the iterative calculation are as follows:

[0156]

[0157] Where WHMA represents the weighted super matrix and i represents WHMAN The row index of j represents WHMA N Column index, WHMA N ij WHMA N The element in the i-th row and j-th column of is, max represents the maximum value of the orientation amount, min represents the minimum value of the orientation amount, and cov represents the threshold value;

[0158] Get WHMA N The median value of each row, forming the WHMA N The row median column vector RMC is taken as the row median column vector, where each element in the row median column vector RMC is the weight of the corresponding underlying asset. The row median column vector RMC is summed and normalized, and the normalized row median column vector is recorded as MC. The first m elements in the row median column vector MC represent the weights of the corresponding underlying assets in the technology stack assets, the m+1th element to the m+nth element represent the weights of the corresponding underlying assets in the organizational management assets, and the m+n+1th element to the m+n+qth element represent the weights of the corresponding underlying assets in the technology management assets.

[0159] The above iterative calculation until WHMA N The difference between each column vector in the becomes narrower. Ideally, each column vector is consistent. In this way, the corresponding elements of the column vector are the weights of each underlying asset, and the solution is completed. The threshold cov set in the WHMA constraint N The column vectors of are approximately convergent.

[0160] It should be understood that the formation of the above judgment matrices requires the collaboration of multiple experts and the passing of consistency checks.

[0161] Step S13: Calculate the overall information security risk value of the business information asset system based on the quantified value of the criticality and the weight.

[0162] In some specific implementations, the overall information security risk value of the business information asset system is calculated based on the quantified value of the criticality and the weight, using the following fourth calculation formula:

[0163]

[0164] Where Rw represents the overall information security risk value of the business information asset system, which takes values ​​in the interval [0,1]. The larger the overall information security risk value, the greater the risk; MC(j) represents the weight of the j-th underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the p-th information security risk generated by the ith vulnerability on the j-th underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the j-th underlying asset.

[0165] In some specific implementations, the method can also calculate the risk coefficient of each information security risk of the business information asset system, the risk coefficient of each vulnerability, and the risk value of each underlying asset to further realize information security risk analysis and assessment.

[0166] Specifically, the method may further include:

[0167] The fifth calculation formula is used to calculate the risk coefficient of each information security risk of the business information asset system based on the quantified value of the harmfulness and the weight;

[0168] The fifth calculation formula is as follows:

[0169]

[0170] Where Rc(p) represents the risk coefficient of the pth information security risk, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the information security risk on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk caused by the ith vulnerability on the jth underlying asset.

[0171] The sixth calculation formula is used to calculate the risk factor of each vulnerability of the business information asset system based on the quantified value of the criticality and the weight;

[0172] The sixth calculation formula is as follows:

[0173]

[0174] Where Rv(i) represents the risk coefficient of the ith vulnerability, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the vulnerability on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the jth underlying asset.

[0175] The seventh calculation formula is used to calculate the risk value of each underlying asset of the business information asset system based on the quantified value of the criticality and the weight;

[0176] The seventh calculation formula is as follows:

[0177]

[0178] Where Ra(j) represents the risk value of the jth underlying asset, which is in the range of [0,1]. The larger the risk value, the greater the risk to the asset. MC(j) represents the weight of the jth underlying asset. rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk caused by the ith vulnerability on the jth underlying asset. rkn(i)(j) represents the number of information security risks caused by the ith vulnerability on the jth underlying asset.

[0179] Furthermore, the method of this embodiment may also include:

[0180] The above risk factors and risk values ​​are sorted respectively to obtain a quantitative information security risk report based on risk hazard and asset structure decomposition, so as to realize data processing of information security risk information based on risk hazard and asset structure decomposition, so as to further analyze assets, vulnerabilities and risks. Information security risk information includes the overall information security risk value of the business information asset system, the risk factor of each information security risk, the risk factor of each vulnerability, and at least one of the risk values ​​of each underlying asset.

[0181] This method integrates the asset system structure and vulnerability risk distribution structure, flexibly uses the network analysis method (Analytic Network Process, referred to as ANP) to analyze the importance of asset association, and conducts comprehensive information security risk assessment and analysis of the system, thereby quantifying the risk value of the overall information business, the risk value of assets, the risk coefficient of vulnerability and the risk coefficient of risk. This method is scientific and reasonable, has high technical advancement and reliability, and has a complete assessment system and high practical value.

[0182] Specifically, it solves the problems of unsystematic risk assessment methods in related technologies, lack of correlation analysis of system asset elements, difficulty in quantifying risk assessment results, scattered and independent analysis elements, difficulty in integrated analysis, large number of judgment matrices in the supermatrix of the ANP algorithm, high computational complexity of eigenvector solution, quantification of vulnerability hazard degree, quantification of risk hazard degree, and quantification of risk value of specified assets. It is conducive to the security management of information construction, improving the efficiency of information business security management, and can effectively cope with the complex and changing information security environment. It can also promote the continuous output and delivery capabilities of business implementation and production manufacturing, and is conducive to the stability and security of business development. It can be applied to the planning, design, implementation, operation and maintenance of information systems and the identification of risks in each stage of abandonment, guide the construction of information system security management system, support the formulation of comprehensive and targeted security strategies and rectification measures, and provide scientific basis and decision-making support for preventing, resolving and controlling information security risks and ensuring information security levels. It improves the comprehensive and systematic nature of information security risk assessment, supports risk assessment and analysis of different granularities, promotes the improvement of fine-grained and multi-dimensional analysis and assessment capabilities of information security risks, and helps fine-grained and multi-dimensional decision-making.

[0183] Embodiment 2

[0184] Corresponding to the first embodiment, this embodiment provides an information security risk quantification device based on risk severity and asset structure decomposition, including:

[0185] The criticality quantification module is used to calculate the probability value and impact value of each information security risk generated by each vulnerability on each underlying asset based on each vulnerability faced by the business information asset system, and calculate the criticality quantification value of each information security risk generated by each vulnerability on each underlying asset, wherein the asset structure in the business information asset system includes multiple asset categories and the underlying assets under each asset category;

[0186] A weight solving module, used to merge at least two asset classes and the underlying assets corresponding to the two asset classes, generate a weighted supermatrix of the merged underlying assets using a network analysis method, and solve the weight of each underlying asset based on the weighted supermatrix;

[0187] The risk calculation module is used to calculate the overall information security risk value of the business information asset system based on the hazard quantification value and weight.

[0188] In this embodiment, the element structure of information security risk quantitative analysis and assessment based on risk hazard and asset structure decomposition can be as follows: Figure 2As shown. The method of this embodiment performs quantitative analysis and assessment of information security risks based on the decomposition of vulnerability risk hazard and asset structure, and forms an element structure of information security risk assessment by decomposing the business information asset system B and the vulnerability information security risk hazard. Among them, the information security risk hazard of vulnerability V refers to the risk destructive capacity of various risks that can be generated by the vulnerability on assets of a certain degree of importance, that is, on designated assets, the assessor evaluates the destructive capacity of designated risks generated by designated vulnerabilities on designated assets through factors such as the security measures taken by the vulnerability, the threats faced by the vulnerability, the ease of exploitation of the vulnerability, and the impact of the risks generated after the vulnerability is exploited on the asset. The asset weights in the business information system reflect the importance of the underlying assets, and these weights are quantified using the ANP method. As Figure 2 As shown in the figure, the √ is the correlation distribution of the risk formed by a vulnerability in all assets. The logic of risk analysis and assessment of this method is: the risk value is related to the importance of the asset and the harmfulness of various risks generated by the vulnerability on it. The harmfulness of each risk of each vulnerability on each asset is integrated, and combined with the importance of each asset, the quantitative results of risk assessment and analysis are obtained.

[0189] In this embodiment, the first calculation formula is used to calculate the probability value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset; the second calculation formula is used to calculate the impact value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset;

[0190] The first calculation formula is as follows:

[0191]

[0192] Where pr(i)(j)(p) represents the probability value of the i-th vulnerability generating the p-th information security risk on the j-th underlying asset, with an interval of [0,1], and is an estimated value; r h (i)(j)(p) represents the number of votes that the ith vulnerability will generate the pth information security risk on the jth underlying asset, n a Indicates the number of first assessors;

[0193] The second calculation formula is as follows:

[0194]

[0195] Where ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset; ef(i)(j)(p)(a) represents the impact value of the information security risk given by the ath assessor when the ith vulnerability generates the pth information security risk on the jth underlying asset; and L represents the number of second assessors.

[0196] The impact value of the risk can be taken from the table below.

[0197] Table 2 Risk impact value table

[0198] Risk Impact Value meaning 5 Risks have a huge impact on assets 4 Risk has a great impact on assets 3 Risk has a general impact on assets 2 Risk has little impact on assets 1 Risk has little impact on assets 0 Risk has no impact on assets

[0199] In some specific implementations, a third calculation formula may be further used to calculate the quantitative value of the harmfulness of each information security risk generated by each vulnerability on each underlying asset;

[0200] The third calculation formula is as follows:

[0201] rc(i)(j)(p)=ef(i)(j)(p)×pr(i)(j)(p)

[0202] Where rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset, ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset, and pr(i)(j)(p) represents the probability value of the ith vulnerability generating the pth information security risk on the jth underlying asset.

[0203] Based on the above calculation formula, p, j, and i are changed respectively to calculate the quantitative value of the harmfulness of each information security risk.

[0204] The above-mentioned merging of at least two asset classes and the underlying assets corresponding to the two asset classes, and using a network analysis method to generate a weighted supermatrix of the merged underlying assets, may include:

[0205] Merge organizational management assets and technical management assets, and merge the underlying assets under organizational management assets and technical management assets; take the technical stack assets, each underlying asset in the merged organizational management assets and technical management assets as criteria, form a judgment matrix and calculate the corresponding weight vector to obtain an initial super matrix, split and restore the column vector corresponding to the merged part of the initial super matrix into the column vector of the corresponding part before the merger and normalize it to obtain the final super matrix; take the technical stack assets, organizational management assets and technical management assets as criteria, form a judgment matrix and calculate the corresponding weight vector to obtain a weighted matrix; and multiply each element in the weighted matrix with the block in the super matrix that represents the dominant relationship between the underlying assets under each type of assets to form a weighted super matrix.

[0206] For each underlying asset in the technology stack assets, a judgment matrix of the underlying assets dominated by the underlying asset is formed based on each underlying asset. Based on the judgment matrix, the corresponding weight vector is calculated as the column vector of the first m rows of the super matrix, where m represents the number of underlying assets in the technology stack assets;

[0207] For the underlying assets under the merged organizational management assets and technical management assets, a judgment matrix of the underlying assets dominated by each underlying asset is formed based on the judgment matrix. The corresponding weight vector is calculated based on the judgment matrix. The weight vector is split and restored into two column vectors according to the segmentation boundary of the underlying assets corresponding to the organizational management assets and the technical management assets. The two column vectors correspond to the two parts before the merger, respectively. The two column vectors are normalized and used as the column vectors from the m+1th row to the m+nth row and the column vectors from the m+n+1th row to the m+n+qth row of the supermatrix, respectively. n represents the number of underlying assets in the organizational management assets, and q represents the number of underlying assets in the technical management assets.

[0208] Take T, O, and M as criteria respectively to form a judgment matrix, that is, decompose (T, O, M) one by one to form the corresponding judgment matrix: decompose (T, O, M) into {<T,{T,O,M}> ,<O,{O,T,M}> ,<M,{M,T,O}>}, according to the scaling method of the judgment matrix elements 1-9 in the hierarchical analysis method introduced above, three 3×3 judgment matrices are formed respectively, and the corresponding three 3×1 weight vectors are calculated as the column vectors of the 3×3 weighted matrix WM respectively.

[0209] The supermatrix HMA is divided into 9 blocks corresponding to<T,T> ,<T,O> ,<T,M> ,<O,T> ,<O,O> ,<O,M> ,<M,T> ,<M,O> ,<M,M> Each element of the weighted matrix WM obtained above is multiplied by a block of the supermatrix HMA to form the weighted supermatrix WHMA.

[0210] Furthermore, the weight of each underlying asset is solved based on the weighted super matrix, including:

[0211] Iterative calculation of WHMA N =WHMA N-1 ×WHMA;

[0212] The termination conditions of the iterative calculation are as follows:

[0213]

[0214] Where WHMA represents the weighted super matrix and i represents WHMA N The row index of j represents WHMA N Column index, WHMA N ij WHMA N The element in the i-th row and j-th column of is, max represents the maximum value of the orientation amount, min represents the minimum value of the orientation amount, and cov represents the threshold value;

[0215] Get WHMA N The median value of each row, forming the WHMA N The row median column vector RMC is taken as the row median column vector, where each element in the row median column vector RMC is the weight of the corresponding underlying asset. The row median column vector RMC is summed and normalized, and the normalized row median column vector is recorded as MC. The first m elements in the row median column vector MC represent the weights of the corresponding underlying assets in the technology stack assets, the m+1th element to the m+nth element represent the weights of the corresponding underlying assets in the organizational management assets, and the m+n+1th element to the m+n+qth element represent the weights of the corresponding underlying assets in the technology management assets.

[0216] The above iterative calculation until WHMA N The difference between each column vector in the becomes narrower. Ideally, each column vector is consistent. In this way, the corresponding elements of the column vector are the weights of each underlying asset, and the solution is completed. The threshold cov set in the WHMA constraint N The column vectors of are approximately convergent.

[0217] It should be understood that the formation of the above judgment matrix requires the collaboration of multiple experts (evaluators) and the passing of consistency checks.

[0218] In some specific implementations, the overall information security risk value of the business information asset system is calculated based on the quantified value of the criticality and the weight, using the following fourth calculation formula:

[0219]

[0220] Where Rw represents the overall information security risk value of the business information asset system, which takes values ​​in the interval [0,1]. The larger the overall information security risk value, the greater the risk; MC(j) represents the weight of the j-th underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the p-th information security risk generated by the ith vulnerability on the j-th underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the j-th underlying asset.

[0221] In some specific implementations, the risk coefficient of each information security risk of the business information asset system, the risk coefficient of each vulnerability, and the risk value of each underlying asset can also be calculated to further implement information security risk analysis and assessment.

[0222] Specifically, the fifth calculation formula may be used to calculate the risk coefficient of each information security risk of the business information asset system based on the quantified value of the harmfulness and the weight;

[0223] The fifth calculation formula is as follows:

[0224]

[0225] Where Rc(p) represents the risk coefficient of the pth information security risk, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the information security risk on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk caused by the ith vulnerability on the jth underlying asset.

[0226] The sixth calculation formula is used to calculate the risk factor of each vulnerability of the business information asset system based on the quantified value of the criticality and the weight;

[0227] The sixth calculation formula is as follows:

[0228]

[0229] Where Rv(i) represents the risk coefficient of the ith vulnerability, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the vulnerability on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the jth underlying asset.

[0230] The seventh calculation formula is used to calculate the risk value of each underlying asset of the business information asset system based on the quantified value of the criticality and the weight;

[0231] The seventh calculation formula is as follows:

[0232]

[0233] Where Ra(j) represents the risk value of the jth underlying asset, which is in the range of [0,1]. The larger the risk value, the greater the risk to the asset. MC(j) represents the weight of the jth underlying asset. rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk caused by the ith vulnerability on the jth underlying asset. rkn(i)(j) represents the number of information security risks caused by the ith vulnerability on the jth underlying asset.

[0234] Furthermore, the device of this embodiment may also include:

[0235] The report generation module is used to sort the above-mentioned risk factors and risk values ​​respectively, and obtain a quantitative information security risk report based on risk hazard and asset structure decomposition, so as to realize data processing of information security risk information based on risk hazard and asset structure decomposition, so as to further analyze assets, vulnerabilities and risks. The information security risk information includes the overall information security risk value of the business information asset system, the risk factor of each information security risk, the risk factor of each vulnerability, and at least one of the risk values ​​of each underlying asset.

[0236] The device of this embodiment has all the beneficial effects of the method of embodiment 1, which will not be described in detail here.

[0237] Embodiment 3

[0238] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory, and the processor executes the computer program to implement the steps of the method of the first embodiment.

[0239] Embodiment 4

[0240] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the method of the first embodiment are implemented.

[0241] Embodiment 5

[0242] This embodiment provides a computer program product, including a computer program / instructions. When the computer program is executed by a processor, the steps of the method of the first embodiment are implemented.

[0243] The processor may include, but is not limited to, one or more processors or microprocessors, etc. Each processor may be an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor or other electronic components to execute the methods in the above embodiments.

[0244] The computer-readable storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, and the computer-readable storage medium may include but is not limited to, for example, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (e.g., hard disk, floppy disk, solid-state drive, removable disk, CD-ROM, DVD-ROM, Blu-ray disc, etc.).

[0245] The computer-readable storage medium may also store at least one computer executable program / instruction, which may be, for example, a computer-readable instruction. The computer-readable storage medium includes, but is not limited to, for example, a volatile memory and / or a non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The computer-readable storage medium may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. For example, a non-transitory computer-readable storage medium may be connected to a computing device such as a computer, and then, when the computing device runs the computer-readable instructions stored on the computer-readable storage medium, the various methods described above may be performed.

[0246] In addition, the computer device may also include (but not limited to) a data bus, an input / output (I / O) bus, a display, and input / output devices (eg, keyboard, mouse, speaker, etc.), etc.

[0247] The processor may communicate with external devices via an I / O bus via a wired or wireless network.

[0248] In one embodiment, the at least one computer executable instruction may also be compiled into or constitute a software product / computer program product, wherein one or more computer executable instructions are executed by a processor to perform the various functions and / or method steps in the embodiments described in the present technology.

[0249] Embodiment 6

[0250] This embodiment provides an application example of the above method. Figure 5 shown.

[0251] The information security risk quantification method in the aforementioned embodiment is implemented as a software system.

[0252] Submit and display the following information on the software front end:

[0253] Experts decompose the assets in the business information asset system in the form of (T, M, O), and compare the scale relationship between the submitted (T, M, O) and its underlying assets;

[0254] The vulnerabilities of information assets discovered by the assessors and the resulting risks added by the assessors. The risks are mainly proposed by the assessors based on the protection measures of the vulnerabilities, the threats faced, the characteristics of the assets, etc.

[0255] Fix the pth risk, the assessors vote on the occurrence of the pth risk, and the vulnerability can generate different risks when the ith vulnerability and the jth underlying asset are fixed;

[0256] The risk impact value of the p-th risk caused by the ith vulnerability on the j-th underlying asset, submitted by the a-th assessor; and

[0257] After completing the asset weights and all risk quantification calculations, i, j, and p are set.

[0258] The submitted information is obtained by the backend and processed.

[0259] The backend performs the following information processing:

[0260] 1) Calculate the probability that the i-th vulnerability generates the p-th risk on the j-th underlying asset;

[0261] 2) Calculate the impact of the pth risk generated by the ith vulnerability on the jth underlying asset;

[0262] 3) Calculate the quantitative value of the harmfulness of the pth risk generated by the i-th vulnerability on the j-th underlying asset;

[0263] Determine whether the quantitative calculation of the harmfulness of all risks corresponding to all vulnerabilities has been completed. If not, feedback is given to the assessor, who then continues to add risks, submit votes, and submit risk impact values ​​through the front end.

[0264] While executing the information processing steps 1) to 3) above, 4) to 7) are also executed:

[0265] 4) Generate a supermatrix using a supermatrix generation method based on element logical boundary merging and segmentation;

[0266] 5) Generate a weighting matrix;

[0267] 6) Generate a weighted super matrix;

[0268] 7) Solve the underlying asset weights;

[0269] During the execution of 4) to 7), the corresponding results are stored synchronously, and it is determined whether the weight calculation is completed. If not, feedback is given to the expert, and the comparison scale relationship is continued through the front end.

[0270] If the quantitative calculation of the harmfulness and weight calculation of all risks corresponding to all vulnerabilities are completed, then: calculate the overall information security risk value of business informatization, calculate the risk value of the jth underlying asset based on the front-end input j, calculate the risk coefficient of the ith vulnerability based on the front-end input i, and calculate the risk coefficient of the pth risk based on the front-end input p.

[0271] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0272] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0273] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0274] It should be noted that in the present disclosure, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element limited by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0275] Although the embodiments disclosed in the present disclosure are as above, the above contents are only embodiments adopted for facilitating the understanding of the present disclosure and are not intended to limit the present disclosure. Any technician in the technical field to which the present disclosure belongs can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed in the present disclosure, but the scope of patent protection of the present disclosure shall still be subject to the scope defined in the attached claims.

Claims

1. A method for quantifying information security risks based on risk severity and asset structure decomposition, characterized in that: include: Based on the probability value and impact value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset, a quantitative value of the harmfulness of each information security risk generated by each vulnerability on each underlying asset is calculated, wherein the asset structure in the business information asset system includes multiple asset categories and underlying assets under each asset category; Merge at least two asset classes and the underlying assets corresponding to the two asset classes, generate a weighted supermatrix of the merged underlying assets using a network analysis method, and solve for the weight of each underlying asset based on the weighted supermatrix; The overall information security risk value of the business information asset system is calculated based on the quantitative value of the criticality and the weight.

2. The information security risk quantification method according to claim 1, characterized in that: Also includes: The first calculation formula is used to calculate the probability value of each vulnerability faced by the business information asset system generating each information security risk on each underlying asset; The second calculation formula is used to calculate the impact value of each information security risk generated by each vulnerability faced by the business information asset system on each underlying asset; The first calculation formula is as follows: In the formula, pr(i)(j)(p) represents the probability value of the i-th vulnerability generating the p-th information security risk on the j-th underlying asset, and the interval is [0,1], r h (i)(j)(p) represents the number of votes that the ith vulnerability will generate the pth information security risk on the jth underlying asset, n a Indicates the number of first assessors; The second calculation formula is as follows: Where ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset; ef(i)(j)(p)(a) represents the impact value of the information security risk given by the ath assessor when the ith vulnerability generates the pth information security risk on the jth underlying asset; and L represents the number of second assessors.

3. The information security risk quantification method according to claim 1, characterized in that: The third calculation formula is used to calculate the quantitative value of the harmfulness of each information security risk generated by each vulnerability on each underlying asset; The third calculation formula is as follows: rc(i)(j)(p)=ef(i)(j)(p)×pr(i)(j)(p) Where rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset, ef(i)(j)(p) represents the impact of the pth information security risk on the jth underlying asset when the ith vulnerability generates the pth information security risk on the jth underlying asset, and pr(i)(j)(p) represents the probability value of the ith vulnerability generating the pth information security risk on the jth underlying asset.

4. The information security risk quantification method according to claim 1, characterized in that: The asset categories include technology stack assets, organizational management assets, and technology management assets; The step of combining at least two asset classes and the underlying assets corresponding to the two asset classes and using a network analysis method to generate a weighted supermatrix of the combined underlying assets includes: Merge organizational management assets and technical management assets, and merge the underlying assets under organizational management assets and technical management assets; Taking the underlying assets in the technology stack assets, the merged organizational management assets, and the technology management assets as criteria, a judgment matrix is ​​formed and the corresponding weight vector is calculated to obtain the initial supermatrix. The column vectors corresponding to the merged part of the initial supermatrix are split and restored into the column vectors of the corresponding part before the merge and normalized to obtain the final supermatrix. Taking technology stack assets, organizational management assets, and technology management assets as criteria, a judgment matrix is ​​formed and the corresponding weight vector is calculated to obtain a weighted matrix; Each element in the weighted matrix is ​​multiplied by the block in the supermatrix that represents the dominant relationship between the underlying assets under each type of asset to form a weighted supermatrix.

5. The information security risk quantification method according to claim 4, characterized in that: Taking each underlying asset in the technology stack assets, the merged organizational management assets, and the technology management assets as criteria, a judgment matrix is ​​formed and the corresponding weight vector is calculated to obtain the initial super matrix. The column vectors corresponding to the merged part of the initial super matrix are split and restored into the column vectors of the corresponding part before the merger and normalized to obtain the final super matrix, including: For each underlying asset in the technology stack assets, a judgment matrix of the underlying assets dominated by the underlying asset is formed based on each underlying asset. Based on the judgment matrix, the corresponding weight vector is calculated as the column vector of the first m rows of the super matrix, where m represents the number of underlying assets in the technology stack assets; For the underlying assets under the merged organizational management assets and technical management assets, a judgment matrix of the underlying assets dominated by each underlying asset is formed based on the judgment matrix. The corresponding weight vector is calculated based on the judgment matrix. The weight vector is split and restored into two column vectors according to the segmentation boundary of the underlying assets corresponding to the organizational management assets and the technical management assets. The two column vectors correspond to the two parts before the merger, respectively. The two column vectors are normalized and used as the column vectors from the m+1th row to the m+nth row and the column vectors from the m+n+1th row to the m+n+qth row of the supermatrix, respectively. n represents the number of underlying assets in the organizational management assets, and q represents the number of underlying assets in the technical management assets.

6. The information security risk quantification method according to claim 4, characterized in that: Solving the weight of each underlying asset based on the weighted supermatrix includes: Iterative calculation of WHMA N =WHMA N-1 ×WHMA; The termination conditions of the iterative calculation are as follows: Where WHMA represents the weighted super matrix and i represents WHMA N The row index of j represents WHMA N Column index, WHMA N ij WHMA N The element of the i-th row and j-th column, max represents the maximum value of the orientation, min represents the minimum value of the orientation, cov represents the threshold, and N represents the current number of iterations; Get WHMA N The median value of each row, forming the WHMA N The row median column vector RMC is taken as the row median column vector, where each element in the row median column vector RMC is the weight of the corresponding underlying asset. The row median column vector RMC is summed and normalized, and the normalized row median column vector is recorded as MC. The first m elements in the row median column vector MC represent the weights of the corresponding underlying assets in the technology stack assets, the m+1th element to the m+nth element represent the weights of the corresponding underlying assets in the organizational management assets, and the m+n+1th element to the m+n+qth element represent the weights of the corresponding underlying assets in the technology management assets.

7. The information security risk quantification method according to claim 1, characterized in that: The overall information security risk value of the business information asset system is calculated based on the quantified value of the harmfulness and the weight, using the following fourth calculation formula: Where Rw represents the overall information security risk value of the business information asset system, which takes values ​​in the interval [0,1]. The larger the overall information security risk value, the greater the risk; MC(j) represents the weight of the j-th underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the p-th information security risk generated by the ith vulnerability on the j-th underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the j-th underlying asset.

8. The information security risk quantification method according to claim 1, characterized in that: Also includes: Using the fifth calculation formula, based on the quantified value of the harmfulness and the weight, the risk coefficient of each information security risk of the business information asset system is calculated; The fifth calculation formula is as follows: Where Rc(p) represents the risk coefficient of the pth information security risk, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the information security risk on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk caused by the ith vulnerability on the jth underlying asset.

9. The information security risk quantification method according to claim 1, characterized in that: Also includes: Using the sixth calculation formula, based on the criticality quantification value and the weight, the risk coefficient of each vulnerability of the business information asset system is calculated; The sixth calculation formula is as follows: Where Rv(i) represents the risk coefficient of the ith vulnerability, which takes values ​​in the interval [0,1]. The larger the risk coefficient, the greater the destructive effect of the vulnerability on the business information asset system; MC(j) represents the weight of the jth underlying asset; rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the jth underlying asset.

10. The information security risk quantification method according to claim 1, characterized in that: Also includes: The seventh calculation formula is used to calculate the risk value of each underlying asset of the business information asset system based on the quantified value of the criticality and the weight; The seventh calculation formula is as follows: Where Ra(j) represents the risk value of the jth underlying asset, which is in the range of [0,1]. The larger the risk value, the greater the risk of the asset. MC(j) represents the weight of the jth underlying asset. rc(i)(j)(p) represents the quantitative value of the harmfulness of the pth information security risk generated by the ith vulnerability on the jth underlying asset; rkn(i)(j) represents the number of information security risks generated by the ith vulnerability on the jth underlying asset.

11. An information security risk quantification device based on risk hazard and asset structure decomposition, characterized in that: include: A criticality quantification module is used to calculate the criticality quantification value of each information security risk generated by each vulnerability on each underlying asset based on the probability value and impact value of each information security risk generated by each vulnerability on each underlying asset, wherein the asset structure in the business information asset system includes multiple asset categories and underlying assets under each asset category; A weight solving module, used to merge at least two asset classes and the underlying assets corresponding to the two asset classes, generate a weighted supermatrix of the merged underlying assets using a network analysis method, and solve the weight of each underlying asset based on the weighted supermatrix; The risk calculation module is used to calculate the overall information security risk value of the business information asset system based on the quantified value of the criticality and the weight.

12. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program / instructions, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images