System network security assessment method and device
By obtaining the correspondence between attack information and security measures and calculating the network security score, the problem of low evaluation accuracy in the prior art is solved, and a more accurate and personalized network security assessment is achieved, and a dynamic response to network security changes can be carried out.
Patent Information
- Application Number
- CN202411119377.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-14
- Publication Date
- 2024-12-10
AI Technical Summary
The existing network security assessment methods mainly rely on cyber attack data modeling, and fail to fully consider system security measures, resulting in reduced evaluation accuracy.
By obtaining the correspondence between attack information and security measures, determining the security level and reference relationship of the system, calculating security scores, and evaluating it in combination with the correspondence between attack information and security measures, improving the accuracy and personalization of the evaluation.
Quantitative representation and accurate evaluation of network security situations are realized, the accuracy and personalization of evaluations are improved, and dynamic adjustments can be made to cope with the evolution and changes of network security.
Smart Images
Figure CN119109623A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to a method and device for system network security assessment. Background Art
[0002] With the advent of the information age, cybersecurity threats are becoming increasingly serious, seriously affecting social security, stability, and economic order. For systems exposed to the Internet, it is particularly important to evaluate their security level in a cybersecurity environment and provide a basis for cybersecurity adjustments.
[0003] Currently, most popular network security assessments use network attack data modeling for assessment. For example, network traffic data, system log data, attack data in intrusion detection systems and intrusion prevention systems, etc., are modeled and assessed using clustering, dynamic Bayesian network models, and other methods.
[0004] However, network security not only involves the system's attacks, but also the system's security measures. If the assessment is made solely based on network attack data, the accuracy of the assessment will be reduced. Summary of the invention
[0005] The present invention provides a method and device for evaluating the network security of a system, which utilizes the corresponding relationship between attack information and security measures to evaluate the network security of the system, thereby improving the accuracy of the evaluation compared to an algorithm that only utilizes attack information for evaluation.
[0006] In a first aspect, an embodiment of the present invention provides a method for system network security assessment, comprising:
[0007] Obtaining the security level and network security information of the system to be evaluated that characterize the importance of the system; wherein the network security information includes at least one attack information and at least one security measure;
[0008] Determine a reference relationship corresponding to the security level of the system to be evaluated; wherein the reference relationship corresponding to the security level is a correspondence between reference attack information that the system at the security level needs to resist and reference security measures that need to be deployed;
[0009] Determining a corresponding relationship between at least one attack information and at least one security measure of the system to be evaluated according to a reference relationship corresponding to the security level of the system to be evaluated;
[0010] The security score of the system to be evaluated is determined according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated.
[0011] The above method can obtain the security level and network security information of the system to be evaluated, determine the corresponding relationship between the attack information and the security measures in the network security information of the system to be evaluated based on the reference relationship corresponding to the security level of the system to be evaluated, and evaluate the network security of the system using the corresponding relationship between the attack information and the security measures in the network security information of the system to be evaluated. Compared with the algorithm that only uses attack information for evaluation, the accuracy of the evaluation is improved.
[0012] In a possible implementation, determining the security score of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated, includes:
[0013] Determine the security strength value of the security measure corresponding to each attack information of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated;
[0014] Selecting a security strength value of a security measure corresponding to each attack information of the system to be evaluated from the security strength values of the security measures corresponding to each attack information of the system to be evaluated;
[0015] The security score of the system to be evaluated is determined according to the sum of each selected security strength value.
[0016] The above method can determine the security score of the system to be evaluated through the security strength value of the security measure corresponding to each attack information of the system to be evaluated, thereby achieving a quantitative representation of the security situation of the system to be evaluated.
[0017] In a possible implementation, determining the security score of the system to be evaluated according to the sum of each selected security strength value includes:
[0018] Determining the security level value of the system to be evaluated;
[0019] The ratio between the sum of each selected security strength value and the security level value of the system to be evaluated is used as the security score of the system to be evaluated.
[0020] The above method quantifies the security situation of the system to be evaluated by taking into account the two factors of the security strength of the attack information of the system to be evaluated and the security level of the attack system to be evaluated, thereby improving the accuracy of quantification.
[0021] In one possible implementation, the method further includes:
[0022] Determine the online level of the system to be evaluated;
[0023] The product of the online coefficient corresponding to the online level of the system to be evaluated and the safety score of the system to be evaluated is used as the online limit of the system to be evaluated;
[0024] If the online limit value of the system to be evaluated exceeds the threshold value corresponding to the security level of the system to be evaluated, the user responsible for the system to be evaluated is notified to allow the system to be evaluated to go online.
[0025] The above method can determine the exclusive online limit of the system to be evaluated based on the upper limit level provided by the system to be evaluated and the security score of the system to be evaluated, and use the exclusive online limit to determine whether the system to be evaluated can go online, thereby improving the personalization of going online.
[0026] In a possible implementation, the preset conditions include some or all of the following:
[0027] The start time of the evaluation period is reached;
[0028] Receiving an evaluation request for the system to be evaluated;
[0029] Update information of a basic information base is received; wherein the basic information base stores reference relationships corresponding to multiple security levels.
[0030] The above method can be evaluated on a periodic basis, on a system request basis, or on an updated reference relationship basis, thereby keeping pace with the evolution of network security and improving the accuracy of the evaluation.
[0031] In one possible implementation, the method further includes:
[0032] Monitoring the attack status of the system to be evaluated;
[0033] If the system to be evaluated is successfully attacked, and the attack information of the system to be evaluated is not the reference attack information corresponding to the security level of the system to be evaluated, or the hazard intensity value of the attack information of the system to be evaluated exceeds the hazard boundary value corresponding to the security level of the system to be evaluated, then notify the user responsible for the system to be evaluated to strengthen the network security of the system to be evaluated;
[0034] If the system to be evaluated is successfully attacked, and the attack information of the successful attack on the system to be evaluated is the reference attack information corresponding to the security level of the system to be evaluated, and the hazard intensity value of the attack information of the successful attack on the system to be evaluated does not exceed the hazard boundary value corresponding to the security level of the system to be evaluated, then the reference relationship corresponding to the security level of the system to be evaluated is updated.
[0035] The above method can monitor the situation of the system to be evaluated being attacked. If the attack is successful, the system to be evaluated can be reinforced or the reference relationship corresponding to the security level of the system to be evaluated can be updated based on the attack information of the successful attack on the system to be evaluated, so that the evaluation system can adapt to the new attack situation, thereby enhancing the network security of the system.
[0036] In a second aspect, an embodiment of the present invention provides a device for system network security assessment, including:
[0037] An acquisition module, used to acquire the security level and network security information of the system to be evaluated, which characterize the importance of the system; wherein the network security information includes at least one attack information and at least one security measure;
[0038] A determination module, used to determine a reference relationship corresponding to the security level of the system to be evaluated; wherein the reference relationship corresponding to the security level is a correspondence between reference attack information that the system at the security level needs to resist and reference security measures that need to be deployed; according to the reference relationship corresponding to the security level of the system to be evaluated, determine a correspondence between at least one attack information and at least one security measure of the system to be evaluated;
[0039] The evaluation module is used to determine the security score of the system to be evaluated according to the corresponding relationship between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated.
[0040] In a possible implementation, the evaluation module is specifically used to:
[0041] Determine the security strength value of the security measure corresponding to each attack information of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated;
[0042] Selecting a security strength value of a security measure corresponding to each attack information of the system to be evaluated from the security strength values of the security measures corresponding to each attack information of the system to be evaluated;
[0043] The security score of the system to be evaluated is determined according to the sum of each selected security strength value.
[0044] In a third aspect, an embodiment of the present invention provides an electronic device, including:
[0045] processor;
[0046] A processor is used to execute the computer program or instructions in the memory so that the method for system network security assessment as described in any one of the first aspects is executed.
[0047] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium. When instructions in the storage medium are executed by a processor, the processor is enabled to perform a method for system network security assessment as described in any one of the first aspects.
[0048] In a fifth aspect, an embodiment of the present invention provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method for system network security assessment as described in any one of the first aspects.
[0049] In addition, the technical effects brought about by any implementation method in the second to fifth aspects can refer to the technical effects brought about by different implementation methods in the first aspect, and will not be repeated here.
[0050] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS
[0051] Figure 1 A structural diagram of an evaluation system provided by an embodiment of the present invention;
[0052] Figure 2 A flowchart of a method for system network security provided by an embodiment of the present invention;
[0053] Figure 3 A schematic diagram of a network security information hit reference relationship of a system to be evaluated provided by an embodiment of the present invention;
[0054] Figure 4 A flowchart of a method for determining a security score of a system to be evaluated provided by an embodiment of the present invention;
[0055] Figure 5 A flowchart of a method for determining whether a system to be evaluated is online provided by an embodiment of the present invention;
[0056] Figure 6 A flowchart of a method for monitoring a system to be evaluated provided by an embodiment of the present invention;
[0057] Figure 7 A structural diagram of a system network security device provided by an embodiment of the present invention;
[0058] Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0059] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0060] In the description of the embodiments of the present application, unless otherwise specified, in the description of the embodiments of the present application, "plurality" refers to two or more than two.
[0061] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.
[0062] Glossary:
[0063] CVSS: Common Vulnerability Scoring System, is designed to assess the severity of vulnerabilities and help determine the urgency and importance of the response required. CVSS is part of the Security Content Automation Protocol (SCAP). Usually CVSS and CVE are published together by the Vulnerability Database (NVD) to keep the data updated. The CVSS standard was developed by FIRST and improved and promoted by its organization team SIG (The CVSS Special Interest Group). After a comprehensive assessment of the difficulty of the vulnerability and its impact on confidentiality, integrity, and availability, a score between 0 and 10 is generated to assess the severity of the vulnerability.
[0064] The present invention is described in detail below with reference to the accompanying drawings:
[0065] Combination Figure 1As shown, an embodiment of the present invention provides an evaluation system, including multiple systems participating in the evaluation and electronic devices; the multiple systems participating in the evaluation include system 1, system 2, ..., system n; the security level and network security information of system 1 representing the importance of system 1, the security level and network security information of system 2 representing the importance of system 2, ..., the security level and network security information of system n representing the importance of system n are sent to the electronic device 100; the electronic device 100 determines the security score of system 1 according to the security level and network security information of system 1 representing the importance of system 1; the electronic device 100 determines the security score of system 2 according to the security level and network security information of system 2 representing the importance of the system to be evaluated; and so on, until the security score of system n is obtained.
[0066] The specific implementation method of the electronic device 100 determining the security score of the system according to the security level and network security information representing the importance of the system is as follows:
[0067] Combination Figure 2 As shown, an embodiment of the present invention provides a method for system network security assessment, including:
[0068] S200: After a preset condition is met, a security level and network security information of the system to be evaluated that characterizes the importance of the system are obtained; wherein the network security information includes at least one attack information and at least one security measure.
[0069] In some embodiments, the security level is an indicator that represents the importance of the system.
[0070] In some embodiments, the attack information is an example of attack means, and existing examples of attack means include DNS (Domain Name System) hijacking, DOS (Disk Operating System) attack, DDOS (Distributed Denial of Service) attack, vulnerability exploitation attack, etc.; existing security measures, such as: patching, firewalls, honeypots, encryption, intrusion prevention systems, threat perception systems, various security management regulations, etc.
[0071] In some embodiments, the acquisition method includes active reporting by the system to be evaluated.
[0072] S201: Determine a reference relationship corresponding to the security level of the system to be evaluated; wherein the reference relationship corresponding to the security level is a correspondence between reference attack information that the system at the security level needs to resist and reference security measures that need to be deployed;
[0073] In some embodiments, a plurality of security levels are stored in the security level library, and a reference relationship corresponding to each security level is stored; the reference relationship corresponding to the security level can be understood as a corresponding relationship between the security level, the reference attack information, and the reference security measure. Each security level corresponds to at least one reference attack means instance, and each reference attack instance corresponding to each security level corresponds to at least one reference security measure.
[0074] Optionally, each reference attack information corresponding to a security level specifies a minimum security strength value at the security level, and then the security strength value of the reference security measure corresponding to each reference attack information is greater than the specified minimum security strength value.
[0075] For example, as shown in Table 1:
[0076]
[0077] The jth security level l j , security level l j Corresponding reference attack method example a j1 ~a jx , refer to the security measures set M j1 ~M jx , refer to attack method example a j1 The corresponding reference security measures set M j1 , refer to attack method example a j2 The corresponding reference security measures set M j2 , and so on, refer to attack method example a jx The corresponding reference security measures set M jx Each reference security measure set includes at least one reference security measure, for example, a reference attack method instance a j1 The corresponding reference security measures set M j1 Including {Firewall A; Firewall B; …}.
[0078] S202: Determine a correspondence between at least one attack information and at least one security measure of the system to be evaluated according to a reference relationship corresponding to the security level of the system to be evaluated;
[0079] In detail, for any attack information of the system to be evaluated, the reference security measures corresponding to the reference attack information that is the same as the attack information of the system to be evaluated are extracted from the reference relationship corresponding to the security level of the system to be evaluated; from the security measures of the system to be evaluated, the security measures that are the same as the above-extracted reference security measures are found, and the found security measures are used as the security measures corresponding to the attack information of the system to be evaluated.
[0080] In some embodiments, a specific implementation method of determining reference attack information that is identical to the attack information of the system to be evaluated is as follows: calculating the similarity between the attack information of the system to be evaluated and the reference attack information in the reference relationship, and identifying the reference attack information that has the highest similarity to the attack information of the system to be evaluated as the reference attack information that is identical to the attack information of the system to be evaluated.
[0081] Likewise, in some embodiments, finding the security measures that are identical to the reference security measures extracted above is also determined by similarity calculation.
[0082] S203: Determine a security score of the system to be evaluated according to a correspondence between at least one attack information of the system to be evaluated and at least one security measure, and a security strength value of the reference security measure corresponding to the security level of the system to be evaluated.
[0083] The embodiment of the present invention can evaluate the network security of the system through the correspondence between attack information and security measures in the network security information of the system to be evaluated, which improves the accuracy of the evaluation compared to an algorithm that only uses attack information for evaluation.
[0084] Exemplary, combined Figure 3 As shown, the reference attack information in the reference relationship corresponding to the security level l2 of the system to be evaluated includes attack means instance a1, attack means instance a2, attack means instance a5, and attack means instance a7; the reference security measures corresponding to the attack means instance a1 include security measures M 12 、Safety Measures 22 、Safety Measures 23 、Safety Measures 13 , the reference security measures corresponding to the attack method instance a2 include security measures M 22 、Safety Measures 13 、Safety Measures 32 、Safety Measures 42 , the reference security measures corresponding to the attack method instance a5 include security measures M 13 、Safety Measures 32 , the reference security measures corresponding to the attack method instance a7 include security measures M 12 、Safety Measures 32 、Safety Measures 42 、Safety Measures 52 .
[0085] The attack information of the system to be evaluated includes attack method instance a2 and attack method instance a7; the security measures of the system to be evaluated include security measures M 13 、Safety Measures 42 、Safety Measures 12 、Safety Measures 32、Safety Measures 52 .
[0086] In summary, the attack information of the system to be evaluated hits the attack means instance a2 and the attack means instance a7 in the reference relationship, and the reference security measure corresponding to the attack means instance a2 in the reference relationship corresponding to the reference security level l2, that is, the security measure M 22 、Safety Measures 13 、Safety Measures 32 、Safety Measures 42 , the safety measures of the system to be evaluated hit the safety measures M 13 、Safety Measures 32 、Safety Measures 42 ( Figure 3 The gray part of a2 in the attack information of the system to be evaluated, then the security measures corresponding to the attack means instance a2 include security measures M 13 、Safety Measures 32 、Safety Measures 42 ;
[0087] The reference security measure corresponding to the attack method instance a7 in the reference relationship corresponding to the reference security level l2, that is, the security measure M 12 、Safety Measures 32 、Safety Measures 42 、Safety Measures 52 , the safety measures of the system to be evaluated hit the safety measures M 12 、Safety Measures 32 、Safety Measures 42 、Safety Measures 52 ( Figure 3 The gray part of a7 in the attack information of the system to be evaluated corresponds to the security measure M 12 、Safety Measures 32 、Safety Measures 42 、Safety Measures 52 .
[0088] Finally, the security measures corresponding to the attack means instance a2 in the attack information of the system to be evaluated include security measures M 13 、Safety Measures 32 、Safety Measures 42 , and the security measure M corresponding to the attack method instance a7 12 、Safety Measures 32 、Safety Measures 42 、Safety Measures 52 , and the security strength value of the reference security measures corresponding to the security level of the system to be evaluated, determine the security score of the system to be evaluated.
[0089] In some embodiments, in combination Figure 4 As shown, step 203 specifically includes:
[0090] S400: Determine the security strength value of the security measure corresponding to each attack information of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated;
[0091] S401: Selecting a security strength value of a security measure corresponding to each attack information of the system to be evaluated from the security strength values of the security measures corresponding to each attack information of the system to be evaluated;
[0092] In some embodiments, a minimum value of the security strength value of the security measure corresponding to each attack information of the system to be evaluated may be selected.
[0093] S402: Determine a security score of the system to be evaluated according to the sum of each selected security strength value.
[0094] Specifically, the security level value of the system to be evaluated is determined; and the ratio between the sum of each selected security strength value and the security level value of the system to be evaluated is used as the security score of the system to be evaluated.
[0095] In some embodiments, the security level value of the system to be evaluated is determined based on the assignment of values to three grading factors: the social influence, scale and service scope of the system to be evaluated, and the importance of the services provided.
[0096] Optionally, the security level value of the above-mentioned system to be evaluated is achieved with reference to the "YD / T 3799-2020 Implementation Guidelines for Security Classification and Filing of Telecommunications and Internet Networks".
[0097] Recombination Figure 3 As shown, from the security strength value of the reference security measure corresponding to the security level of the system to be evaluated, the security measures corresponding to the attack means instance a2 in the attack information of the system to be evaluated are extracted, including security measures M 13 、Safety Measures 32 、Safety Measures 42 , and the security measure M corresponding to the attack method instance a7 12 、Safety Measures 32 、Safety Measures 42 、Safety Measures 52 , the above security strength value.
[0098] The security measures corresponding to the attack means instance a2 in the attack information of the system to be evaluated include security measures M 13 、Safety Measures 32 、Safety Measures42 If the safety measure M 13 、Safety Measures 32 、Safety Measures 42 The minimum value of the security strength value is security measure M 42 The security strength value of the selected attack method instance a2 of the system to be evaluated is the security strength value of the security measure M 42 The security strength value of
[0099] If the safety measure M 12 、Safety Measures 32 、Safety Measures 42 、Safety Measures 52 The minimum value of the security strength value is security measure M 12 The security strength value of the selected attack method instance a7 of the system to be evaluated is the security strength value of the security measure M 12 The security strength value.
[0100] Security measures M corresponding to attack method instance a2 42 The security strength value and the security measure M corresponding to the attack method instance a7 12 The sum of the security strength values divided by the security level value of the system to be evaluated is the security score of the system to be evaluated.
[0101] In some embodiments, in combination Figure 5 As shown, after step 203, the method further includes:
[0102] S500: Determine the online level of the system to be evaluated;
[0103] S501: taking the product of the online coefficient corresponding to the online level of the system to be evaluated and the safety score of the system to be evaluated as the online limit of the system to be evaluated;
[0104] S502: If the online limit of the system to be evaluated exceeds the threshold corresponding to the security level of the system to be evaluated, the user responsible for the system to be evaluated is notified to allow the system to be evaluated to go online.
[0105] S503: If the online limit of the system to be evaluated does not exceed the threshold corresponding to the security level of the system to be evaluated, the user responsible for the system to be evaluated is notified not to allow the system to be evaluated to go online.
[0106] The online level is exemplarily the lowest level, low level, middle level and high level. The lowest level can also be called the current online level, the online coefficient corresponding to the current online level, the online coefficient corresponding to the low level, the online coefficient corresponding to the middle level and the online coefficient corresponding to the high level.
[0107] If the online level of the system to be evaluated is the current online level, the product of the online coefficient corresponding to the current online level and the safety score of the system to be evaluated is used as the online limit of the system to be evaluated.
[0108] If the online level of the system to be evaluated is a low level, the product of the online coefficient corresponding to the low level and the safety score of the system to be evaluated is used as the online limit of the system to be evaluated.
[0109] Similarly, if the online level of the system to be evaluated is a medium level, the online limit of the system to be evaluated is calculated; if the online level of the system to be evaluated is a high level, the online limit of the system to be evaluated is calculated.
[0110] In some embodiments, the threshold corresponding to the security level of the system to be evaluated may be preset, or may be calculated according to the security level of the system to be evaluated.
[0111] The threshold corresponding to the security level of the system to be evaluated is calculated based on the security level of the system to be evaluated, including:
[0112] From the reference relationship corresponding to the security level of the system to be evaluated, find the minimum security strength value of the reference security measure corresponding to each reference attack information in the reference relationship, and use the ratio between the sum of the multiple minimum security strength values found and the security level value of the system to be evaluated as the threshold value corresponding to the security level of the system to be evaluated.
[0113] The security level of the system to be evaluated is security level l j Take the following formula as an example to determine the threshold corresponding to the security level of the system to be evaluated:
[0114] S j =∑S jx / k j ;
[0115] Among them, ∑S jx Indicates security level l j The corresponding reference security measure set M j1 ~M jx The minimum security strength value in the sum of the two, combined with Table 1, the reference security measure set M j1 The minimum security strength value s1 of the reference security measure, the reference security measure set M j2 The minimum security strength value s2 of the reference security measure, the reference security measure set M jx The minimum security strength value s of the reference security measures x ;∑S jx for s1, s2, …, s x The sum of j is the security level value of the system to be evaluated. 1≤x≤n.
[0116] Combined with Table 1, for security level l j , set the online coefficient c0 corresponding to the current online level, the online coefficient c1 corresponding to the low level, the online coefficient c2 corresponding to the medium level, and the online coefficient c3 corresponding to the high level, and calculate the online limit S corresponding to the current online level j0 =S j *c0, upper limit S corresponding to the low level j1 =S j *c1, upper limit S corresponding to the middle level j2 =S j *c2, upper limit S corresponding to the high level j3 =S j *c3.
[0117] In some embodiments, the preset conditions include some or all of the following:
[0118] Precondition 1: The start time of the evaluation cycle is reached. When the start time of the evaluation cycle is reached, the security score of the system to be evaluated is determined. This indicates that the security score of the system to be evaluated is recalculated periodically.
[0119] Precondition 2: An evaluation request for the system to be evaluated is received.
[0120] Pre-condition 3: receiving update information of a basic information database; wherein the basic information database stores reference relationships corresponding to multiple security levels.
[0121] In some embodiments, the basic information library includes multiple sub-libraries, and the multiple sub-libraries are respectively a security measure library, an attack library, a security level library, and a system library.
[0122] The security measures library includes various security measures examples and their security strength values for network security. Security measures include but are not limited to patching, firewalls, honeypots, encryption, intrusion prevention systems, threat perception systems, various security management regulations, etc. For different security measures, security strength values (numbers from 1 to 10, with one decimal place reserved) are assigned. Note that the same type of security measures may be assigned different security strength values due to their different strengths. For example, when deploying the same firewall, different firewall products and architectures may be assigned different security strength values. Optionally, different security measures can be set with different security strength values manually. For example, different security measures constitute a security measure set M (m1, m2, ...).
[0123] The attack library includes various attack methods existing in the existing network, their hazard intensity values and corresponding security measures. Among them, the attack methods are organized according to "attack type-attack subclass-attack method instance". Attack types include network attacks, system attacks, web (World Wide Web, global wide area network or World Wide Web) attacks, malicious programs, security detection, suspicious activities, sensitive operations, other suspicious activities, etc. Each attack type also includes subtypes, such as network attacks include brute force cracking, DNS hijacking, DOS attacks, DDOS attacks, vulnerability exploitation attacks, network deception attacks, protocol deception attacks, APT (Advanced Packaging Tool, command line utility) attacks, other network attacks and other subtypes. Attack subtypes include various attack method instances, such as vulnerability exploitation attacks include attacks using different vulnerabilities. Assign a hazard intensity value to each attack method instance (a number from 1 to 10, retaining one decimal place, the hazard intensity value of the vulnerability is scored using CVSS, and the hazard intensity values of other attack method instances are scored according to the CVSS standard). The corresponding security measures are the set of security measures that can defend against the attack method instance (a subset of the security measures set in the security measures library). For example, different attack means instances constitute the attack means instance library A (a1, a2, ...), for a certain attack means instance ai, its corresponding security measure set Mi, Mi is a subset of M.
[0124] Security level library: a list of security levels, examples of attack methods that systems at different security levels need to defend against and corresponding security measures, as well as the security score at that security level, as shown in Table 1.
[0125] System library: Information about multiple participating systems to be evaluated, including security level values, deployed security measures, attack information, security scores, and security levels.
[0126] When new attacks or new security measures appear, the security measures library and attack library will be updated.
[0127] When some of the following information of the system to be evaluated changes, the information includes some or all of the following attack information, security measures, and security levels, according to the security score of the system to be evaluated.
[0128] When the correspondence between attacks and security measures changes, the security level library will be updated, the security level value will be recalculated, the threshold corresponding to the security level of the system to be evaluated will be recalculated, the security scores of multiple systems to be evaluated will be recalculated, and the hazard boundary value corresponding to the security level of the system to be evaluated will be recalculated.
[0129] When the calculation method of the security level value changes, the security level value is recalculated, the security scores of the multiple systems to be evaluated are recalculated, and the thresholds corresponding to the security levels of the systems to be evaluated are recalculated.
[0130] As can be seen from the above, the embodiment of the present invention scores the security status of the system to be evaluated through the information of the attack library, security measures library, security level library and system library, and dynamically evaluates the system to be evaluated based on the evolving network security information, especially the evolution of security measures, and the information of the system to be evaluated itself. Based on the evolution of attacks and security measures, the embodiment of the present invention takes security measures as the most important object of evaluation and dynamically evaluates the security score of the system at the current security level. It can keep up with the evolution of network security and facilitate the direct deployment or optimization and upgrading of security measures by the system. It is a practical network security evaluation method that keeps up with the continuous evolution of network security.
[0131] Recombination Figure 1 As shown, multiple systems participating in the evaluation synchronize the security level values of multiple systems participating in the evaluation and the security measures deployed by multiple systems participating in the evaluation with the electronic device 100; multiple systems participating in the evaluation report the attack situation to the electronic device 100, so that the electronic device 100 can perform a dynamic evaluation based on the attack. Multiple systems participating in the evaluation build or optimize their own security measures based on their own security level and level information issued by the electronic device 100, the network security attack instances that should be defended at this level, and the security measures library.
[0132] In some embodiments, in combination Figure 6 As shown, the method provided by the embodiment of the present invention also includes:
[0133] S600: monitoring the attack status of the system to be evaluated;
[0134] S601: If the system to be evaluated is successfully attacked, and the attack information of the system to be evaluated is not the reference attack information corresponding to the security level of the system to be evaluated, or the hazard intensity value of the attack information of the system to be evaluated exceeds the hazard boundary value corresponding to the security level of the system to be evaluated, then notify the user responsible for the system to be evaluated to strengthen the network security of the system to be evaluated;
[0135] S602: If the system to be evaluated is successfully attacked, and the attack information of the successful attack on the system to be evaluated is the reference attack information corresponding to the security level of the system to be evaluated, and the hazard intensity value of the attack information of the successful attack on the system to be evaluated does not exceed the hazard boundary value corresponding to the security level of the system to be evaluated, then the reference relationship corresponding to the security level of the system to be evaluated is updated.
[0136] In this way, the embodiment of the present invention monitors the attack situation of the system to be evaluated, and monitors the situation that the system to be evaluated is successfully attacked. If the attack information of the system to be evaluated that is successfully attacked does not belong to the reference attack information in the reference relationship, or exceeds the hazard boundary value, it means that the security measures of the system to be evaluated are not perfect and have loopholes, so it will be attacked by new attack information, and it is necessary to notify the user responsible for the system to be evaluated to strengthen the network security of the system to be evaluated. If the attack information of the system to be evaluated that is successfully attacked belongs to the reference attack information in the reference relationship and does not exceed the hazard boundary value, but the attack is still successful, it means that the reference relationship is not accurate, and the reference relationship corresponding to the security level of the system to be evaluated needs to be updated.
[0137] In some embodiments, the maximum value of the hazard intensity values of the reference attack information in the reference relationship corresponding to the security level of the system to be evaluated is the hazard boundary value corresponding to the security level of the system to be evaluated, or the average value of the hazard intensity values of the reference attack information in the reference relationship corresponding to the security level of the system to be evaluated is the hazard boundary value corresponding to the security level of the system to be evaluated.
[0138] When the present invention is implemented, the method can be adjusted and the parameters can be set in the following aspects to improve the scope of application of the present invention, the accuracy of the method and the system performance:
[0139] First point: Optimization of basic information database: the scope of the basic information database can be adjusted according to its own situation to make it more targeted; it can be connected with the intelligence platform to realize the automatic update of the basic information database;
[0140] Second point: Security level library optimization: Based on the actual operation and attack situation of the systems involved in the assessment, adjust the division of security levels, examples of attack methods to be defended at different security levels, corresponding security measures and their security strength values;
[0141] The third point: Coefficient optimization: optimize each coefficient according to the actual operation situation, including the current online coefficient c0, low-level coefficient c1, medium-level coefficient c2, and high-level coefficient c3, to make it more in line with actual needs.
[0142] The embodiment of the present invention dynamically scores system security based on the dynamic update of the security measure library, attack library, security level library, and system library, and keeps up with the evolution and changes of network security.
[0143] The embodiment of the present invention is based on the correspondence between attack means examples, security measures and security levels, takes security measures as the most important object of evaluation, and performs security evaluation on the system to be evaluated, making the evaluation more direct and more convenient for the deployment and optimization and upgrading of security measures.
[0144] The embodiment of the present invention can configure different security measures for systems at different security levels based on security level evaluation, which is more practical and more practicable.
[0145] like Figure 7 As shown, the present invention also provides a device for system network security assessment, comprising:
[0146] The acquisition module 700 is used to acquire the security level and network security information of the system to be evaluated, which represent the importance of the system; wherein the network security information includes at least one attack information and at least one security measure;
[0147] Determination module 701, used to determine the reference relationship corresponding to the security level of the system to be evaluated; wherein the reference relationship corresponding to the security level is the corresponding relationship between the reference attack information that the system at the security level needs to resist and the reference security measures that need to be deployed; according to the reference relationship corresponding to the security level of the system to be evaluated, determine the corresponding relationship between at least one attack information and at least one security measure of the system to be evaluated;
[0148] The evaluation module 702 is used to determine the security score of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated.
[0149] Optionally, the evaluation module 702 is specifically configured to:
[0150] Determine the security strength value of the security measure corresponding to each attack information of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated;
[0151] Selecting a security strength value of a security measure corresponding to each attack information of the system to be evaluated from the security strength values of the security measures corresponding to each attack information of the system to be evaluated;
[0152] The security score of the system to be evaluated is determined according to the sum of each selected security strength value.
[0153] Optionally, the evaluation module 702 is further configured to:
[0154] Determining the security level value of the system to be evaluated;
[0155] The ratio between the sum of each selected security strength value and the security level value of the system to be evaluated is used as the security score of the system to be evaluated.
[0156] Optionally, the device further comprises: an online evaluation module;
[0157] The online evaluation module is used to determine the online level of the system to be evaluated;
[0158] The product of the online coefficient corresponding to the online level of the system to be evaluated and the safety score of the system to be evaluated is used as the online limit of the system to be evaluated;
[0159] If the online limit value of the system to be evaluated exceeds the threshold value corresponding to the security level of the system to be evaluated, the user responsible for the system to be evaluated is notified to allow the system to be evaluated to go online.
[0160] Optionally, the preset conditions include some or all of the following:
[0161] The start time of the evaluation period is reached;
[0162] Receiving an evaluation request for the system to be evaluated;
[0163] Update information of a basic information base is received; wherein the basic information base stores reference relationships corresponding to multiple security levels.
[0164] Optionally, the device further includes: a monitoring module;
[0165] The monitoring module is used to:
[0166] Monitoring the attack status of the system to be evaluated;
[0167] If the system to be evaluated is successfully attacked, and the attack information of the system to be evaluated is not the reference attack information corresponding to the security level of the system to be evaluated, or the hazard intensity value of the attack information of the system to be evaluated exceeds the hazard boundary value corresponding to the security level of the system to be evaluated, then notify the user responsible for the system to be evaluated to strengthen the network security of the system to be evaluated;
[0168] If the system to be evaluated is successfully attacked, and the attack information of the successful attack on the system to be evaluated is the reference attack information corresponding to the security level of the system to be evaluated, and the hazard intensity value of the attack information of the successful attack on the system to be evaluated does not exceed the hazard boundary value corresponding to the security level of the system to be evaluated, then the reference relationship corresponding to the security level of the system to be evaluated is updated.
[0169] In addition, combined Figure 1-Figure 7 The method and apparatus for system network security assessment described in the embodiments of the present invention may be implemented by an electronic device.
[0170] Electronic devices, including: processors;
[0171] a memory for storing instructions executable by the processor;
[0172] The processor is configured to execute the instructions to implement the method for system network security assessment as described in any one of the above descriptions.
[0173] Based on the above introduction, an exemplary Figure 8 electronic equipment structure.
[0174] The electronic device may include a processor 810 and a memory 820 storing computer program instructions.
[0175] Specifically, the processor 810 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present invention.
[0176] The memory 820 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 820 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 820 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 820 may be inside or outside a data processing device. In a specific embodiment, the memory 820 is a non-volatile solid-state memory. In a specific embodiment, the memory 820 includes a read-only memory (ROM). In appropriate cases, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM) or a flash memory or a combination of two or more of these.
[0177] The processor 810 implements any one of the methods for performing tasks in the above embodiments by reading and executing computer program instructions stored in the memory 820 .
[0178] In one example, the electronic device may further include a communication interface 830 and a bus 840. Figure 8 As shown, the processor 810, the memory 820, and the communication interface 830 are connected via a bus 840 and communicate with each other.
[0179] The communication interface 830 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiment of the present invention.
[0180] Bus 840 includes hardware, software or both, and the parts of electronic equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 840 may include one or more buses. Although the embodiment of the present invention describes and shows a specific bus, the present invention considers any suitable bus or interconnection.
[0181] The electronic device can execute the method for system network security assessment in the embodiment of the present invention based on the received task, thereby realizing the combination of Figure 1-Figure 7 A method and apparatus for network security assessment of a system is described.
[0182] In addition, in combination with the electronic device in the above embodiments, an embodiment of the present invention may provide a storage medium, and when the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the method of system network security assessment as described in any of the above items.
[0183] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0184] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0186] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.
[0187] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.
Claims
1. A method for system network security assessment, characterized in that: include: After the preset conditions are met, the security level and network security information of the system to be evaluated, which characterize the importance of the system, are obtained; wherein the network security information includes at least one attack information and at least one security measure; Determine a reference relationship corresponding to the security level of the system to be evaluated; wherein the reference relationship corresponding to the security level is a correspondence between reference attack information that the system at the security level needs to resist and reference security measures that need to be deployed; Determining a corresponding relationship between at least one attack information and at least one security measure of the system to be evaluated according to a reference relationship corresponding to the security level of the system to be evaluated; The security score of the system to be evaluated is determined according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated.
2. The method for system network security assessment according to claim 1, characterized in that: Determining the security score of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated, includes: Determine the security strength value of the security measure corresponding to each attack information of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated; Selecting a security strength value of a security measure corresponding to each attack information of the system to be evaluated from the security strength values of the security measures corresponding to each attack information of the system to be evaluated; The security score of the system to be evaluated is determined according to the sum of each selected security strength value.
3. The method for system network security assessment according to claim 2, characterized in that: Determining the security score of the system to be evaluated according to the sum of each selected security strength value includes: Determining the security level value of the system to be evaluated; The ratio between the sum of each selected security strength value and the security level value of the system to be evaluated is used as the security score of the system to be evaluated.
4. The method for system network security assessment according to claim 1, characterized in that: The method further comprises: Determine the online level of the system to be evaluated; The product of the online coefficient corresponding to the online level of the system to be evaluated and the safety score of the system to be evaluated is used as the online limit of the system to be evaluated; If the online limit value of the system to be evaluated exceeds the threshold value corresponding to the security level of the system to be evaluated, the user responsible for the system to be evaluated is notified to allow the system to be evaluated to go online.
5. The method for system network security assessment according to claim 1, characterized in that: The preset conditions include some or all of the following: The start time of the evaluation period is reached; Receiving an evaluation request for the system to be evaluated; Update information of a basic information base is received; wherein the basic information base stores reference relationships corresponding to multiple security levels.
6. The method for system network security assessment according to any one of claims 1 to 5, characterized in that: The method further comprises: Monitoring the attack status of the system to be evaluated; If the system to be evaluated is successfully attacked, and the attack information of the system to be evaluated is not the reference attack information corresponding to the security level of the system to be evaluated, or the hazard intensity value of the attack information of the system to be evaluated exceeds the hazard boundary value corresponding to the security level of the system to be evaluated, then notify the user responsible for the system to be evaluated to strengthen the network security of the system to be evaluated; If the system to be evaluated is successfully attacked, and the attack information of the successful attack on the system to be evaluated is the reference attack information corresponding to the security level of the system to be evaluated, and the hazard intensity value of the attack information of the successful attack on the system to be evaluated does not exceed the hazard boundary value corresponding to the security level of the system to be evaluated, then the reference relationship corresponding to the security level of the system to be evaluated is updated.
7. A device for system network security assessment, characterized in that: include: An acquisition module, used to acquire the security level and network security information of the system to be evaluated, which characterize the importance of the system; wherein the network security information includes at least one attack information and at least one security measure; A determination module, used to determine a reference relationship corresponding to the security level of the system to be evaluated; wherein the reference relationship corresponding to the security level is a correspondence between reference attack information that the system at the security level needs to resist and reference security measures that need to be deployed; according to the reference relationship corresponding to the security level of the system to be evaluated, determine a correspondence between at least one attack information and at least one security measure of the system to be evaluated; The evaluation module is used to determine the security score of the system to be evaluated according to the corresponding relationship between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated.
8. The system network security assessment device according to claim 7, characterized in that: The evaluation module is specifically used for: Determine the security strength value of the security measure corresponding to each attack information of the system to be evaluated according to the correspondence between at least one attack information and at least one security measure of the system to be evaluated, and the security strength value of the reference security measure corresponding to the security level of the system to be evaluated; Selecting a security strength value of a security measure corresponding to each attack information of the system to be evaluated from the security strength values of the security measures corresponding to each attack information of the system to be evaluated; The security score of the system to be evaluated is determined according to the sum of each selected security strength value.
9. An electronic device, characterized in that: include: Memory, used to store computer programs or instructions; A processor is used to execute the computer program or instructions in the memory so that the method for system network security assessment as claimed in any one of claims 1 to 6 is executed.
10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method for system network security assessment as described in any one of claims 1 to 6.