Risk assessment method and device for network security and network security system

Abstract

The invention provides a risk assessment method and device for network security and a network security system, and the method comprises the steps: obtaining target log information, and determining a first risk coefficient according to the type of the target log information; determining a corresponding second risk value according to each monitoring parameter in the monitoring parameter group, and carrying out weighted calculation to obtain a second risk coefficient; performing cross validation on the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list; performing static analysis and dynamic analysis according to the vulnerability risk list to obtain a fourth risk coefficient; inputting the vulnerability risk list into an auditing tool to obtain a fifth risk coefficient; and performing weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value. The method solves the problems that in the prior art, network security assessment needs workers to reach an assessment site, and manpower and time consumption is large.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a network security risk assessment method, device, computer-readable storage medium and network security system. Background Art

[0002] Network security refers to the protection of the hardware, software and data in the network system from damage, change or leakage due to accidental or malicious reasons. The system runs continuously, reliably and normally, and network services are not interrupted. Network security usually refers to the security of computer networks. In fact, it can also refer to the security of computer communication networks. A computer communication network is a system that interconnects several computers with independent functions through communication equipment and transmission media to achieve information transmission and exchange between computers with the support of communication software.

[0003] At present, the existing security network risk assessment process relies on workers to conduct network risk assessment on site, which consumes a lot of time and manpower. It is not convenient to conduct network security assessment on network information of a certain period on the network, and it is not convenient to provide instructions for subsequent network security, which can easily lead to great problems in network security assessment. Summary of the invention

[0004] The main purpose of the present application is to provide a network security risk assessment method, device, computer-readable storage medium and network security system, so as to at least solve the problem in the prior art that network security assessment requires staff to arrive at the assessment site, which consumes a lot of manpower and time.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a network security risk assessment method is provided, including: obtaining target log information, determining a corresponding first risk value according to different types of the target log information and performing weighted calculation to obtain a first risk coefficient, the target log information including access logs, security logs, version application logs and database logs; obtaining a monitoring parameter group, determining a corresponding second risk value according to each monitoring parameter in the monitoring parameter group and performing weighted calculation to obtain a second risk coefficient, the monitoring parameter group including device abnormality identification, CPU occupancy, memory occupancy, disk occupancy, interface traffic and number of interface data packets; comparing the target log information, the first risk coefficient, the monitoring parameter group and the The second risk coefficient is cross-validated to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes first risk information and first vulnerability information existing in the network; a third risk value is obtained by static analysis based on the vulnerability risk list, a fourth risk value is obtained by dynamic analysis based on the vulnerability risk list, and a fourth risk coefficient is obtained by weighted calculation based on the third risk value and the fourth risk value; the vulnerability risk list is input into an audit tool to obtain a fifth risk coefficient, and the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list; a risk assessment value is obtained by weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient.

[0006] Optionally, determining a corresponding first risk value according to different types of target log information and performing weighted calculation to obtain a first risk coefficient includes: determining the user's abnormal behavior according to the access log, and determining the ratio of the number of abnormal behaviors to the total number of behaviors as the first risk value corresponding to the access log; determining attack information according to the security log, determining the number of times the network is attacked according to the attack information, and determining the ratio of the number of times the network is attacked to the number of times the network is accessed as the first risk value corresponding to the security log; determining second vulnerability information and second risk information existing in the current version according to the version application log, and determining the first risk value corresponding to the version application log according to the number of the second vulnerability information and the second risk information; determining abnormal data according to the database log, and determining the ratio of the number of abnormal data to the total number of all data as the first risk value corresponding to the database log; determining corresponding weights according to the type of the target log information corresponding to each first risk value to obtain multiple first weights, and the first weights correspond to the first risk values ​​one by one; calculating the product of each first risk value and the corresponding first weight and summing them to obtain the first risk coefficient.

[0007] Optionally, a second risk coefficient is obtained by weighted calculation based on the corresponding second risk value determined according to each monitoring parameter in the monitoring parameter group, including: determining the number of abnormal devices according to the device abnormality identifier, and determining the ratio of the number of abnormal devices to the total number of devices as the second risk value corresponding to the device abnormality identifier; calculating the difference between the CPU occupancy rate and the preset CPU occupancy rate to obtain a first difference, and determining the second risk value corresponding to the CPU occupancy rate according to the interval to which the first difference belongs; calculating the difference between the memory occupancy rate and the preset memory occupancy rate to obtain a second difference, and determining the second risk value corresponding to the memory occupancy rate according to the interval to which the second difference belongs; calculating the difference between the disk occupancy rate and the preset disk occupancy rate The difference is calculated to obtain a third difference, and the second risk value corresponding to the disk occupancy rate is determined according to the interval to which the third difference belongs; the difference between the interface traffic and the preset traffic is calculated to obtain a fourth difference, and the second risk value corresponding to the interface traffic is determined according to the interval to which the fourth difference belongs; the difference between the number of interface data packets and the preset number of data packets is calculated to obtain a fifth difference, and the second risk value corresponding to the number of interface data packets is determined according to the interval to which the fifth difference belongs; the second weight corresponding to the second risk value is determined according to the monitoring parameters corresponding to each second risk value, and the second weight corresponds to the second risk value one-to-one; the product of each second risk value and the corresponding second weight is calculated and the sum is calculated to obtain the second risk coefficient.

[0008] Optionally, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are cross-validated to obtain a third risk coefficient, including: dividing a first training set according to the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient; a division step, dividing the first training set into multiple training subsets, determining any one of the training subsets as a validation set, and determining the training subsets other than the validation set as a second training set; a verification step, training an analysis model according to the second training set and verifying it according to the validation set to obtain a fourth risk value; repeating the division step and the verification step in sequence at least once until the fourth risk values ​​corresponding to all the validation sets are obtained, and calculating the average value of the fourth risk values ​​to obtain the third risk coefficient.

[0009] Optionally, a third risk value is obtained by performing static analysis based on the vulnerability risk list, including: determining a first target code by determining a corresponding code field based on the first risk information in the vulnerability risk list, and obtaining a second target code by determining a corresponding code field based on the first vulnerability information; determining a sixth risk value by matching the first target code with a preset code template, and determining a seventh risk value by matching the second target code with the preset code template; and calculating the average of the sixth risk value and the seventh risk value to obtain the third risk value.

[0010] Optionally, a fourth risk value is obtained by dynamic analysis based on the vulnerability risk list, including: building a simulation environment based on the first risk information and / or the first vulnerability information in the vulnerability risk list, the simulation environment being a network environment under attack; verifying the first risk information and the first vulnerability information based on the simulation environment to determine a first target risk and a first target vulnerability, the first target risk being the first risk information triggered in the simulation environment, and the first target vulnerability being the first vulnerability information triggered in the simulation environment; determining an eighth risk value based on the ratio of the first target risk to the first risk information, determining a ninth risk value based on the ratio of the first target vulnerability to the first vulnerability information, and calculating the average of the eighth risk value and the ninth risk value to obtain the fourth risk value.

[0011] Optionally, a fourth risk coefficient is obtained by performing a weighted calculation based on the third risk value and the fourth risk value, including: obtaining a third weight and a fourth weight, the third weight being the weight corresponding to the third risk value, and the fourth weight being the weight corresponding to the fourth risk value; calculating the product of the third risk value and the third weight and the product of the fourth risk value and the fourth weight, and summing them up to obtain the fourth risk coefficient.

[0012] According to another aspect of the present application, a network security risk assessment device is provided, the device comprising: a first acquisition unit, used to acquire target log information, determine a corresponding first risk value according to different types of the target log information and perform weighted calculation to obtain a first risk coefficient, the target log information comprising access logs, security logs, version application logs and database logs; a second acquisition unit, used to acquire a monitoring parameter group, determine a corresponding second risk value according to each monitoring parameter in the monitoring parameter group and perform weighted calculation to obtain a second risk coefficient, the monitoring parameter group comprising a device abnormality flag, CPU occupancy, memory occupancy, disk occupancy, interface traffic and number of interface data packets; a first calculation unit, used to combine the target log information, the first risk coefficient, the monitoring parameter group and the second The risk coefficient is cross-validated to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes first risk information and first vulnerability information existing in the network; a second calculation unit is used to perform static analysis according to the vulnerability risk list to obtain a third risk value, perform dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and perform weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; a third calculation unit is used to input the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, wherein the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list; a fourth calculation unit is used to perform weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0013] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the methods described.

[0014] According to another aspect of the present application, a network security system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include methods for executing any one of the described methods.

[0015] Applying the technical solution of the present application, in the above-mentioned network security risk assessment method, first, obtain target log information, determine the corresponding first risk value according to different types of the above-mentioned target log information, and perform weighted calculation to obtain a first risk coefficient, the above-mentioned target log information includes access logs, security logs, version application logs and database logs; then, obtain a monitoring parameter group, determine the corresponding second risk value according to each monitoring parameter in the above-mentioned monitoring parameter group, and perform weighted calculation to obtain a second risk coefficient, the above-mentioned monitoring parameter group includes device abnormality identification, CPU occupancy, memory occupancy, disk occupancy, interface traffic and interface data packet quantity; then, the above-mentioned target log information, the above-mentioned first risk coefficient, the above-mentioned monitoring parameter group and the above-mentioned second risk coefficient are combined. Cross-validation is performed to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network; then, a static analysis is performed according to the vulnerability risk list to obtain a third risk value, a dynamic analysis is performed according to the vulnerability risk list to obtain a fourth risk value, and a weighted calculation is performed according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; then, the vulnerability risk list is input into the audit tool to obtain a fifth risk coefficient, and the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list; finally, a weighted calculation is performed according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value. This application quantifies all threats faced in network security scenarios, determines the corresponding risk values, and calculates the final risk value based on various risk values, which is used to characterize the risk situation of network security of information systems. This application solves the problem that network security assessment in the prior art requires staff to reach the assessment site, which consumes a lot of manpower and time. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A hardware structure block diagram of a mobile terminal according to a network security risk assessment method provided in an embodiment of the present application is shown;

[0017] Figure 2 A schematic diagram of a process for risk assessment of network security provided according to an embodiment of the present application is shown;

[0018] Figure 3 A structural block diagram of a network security risk assessment device provided according to an embodiment of the present application is shown.

[0019] The above drawings include the following reference numerals:

[0020] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0021] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] As introduced in the background technology, network security assessment in the prior art requires staff to arrive at the assessment site to be carried out. In order to solve the problem that network security assessment in the prior art requires staff to arrive at the assessment site, which consumes a lot of manpower and time, the embodiments of the present application provide a network security risk assessment method, device, computer-readable storage medium and network security system.

[0025] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0026] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a network security risk assessment method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0027] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0028] In this embodiment, a network security risk assessment method running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 2 1 is a flow chart of a method for risk assessment of network security according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0030] Step S201, obtaining target log information, determining corresponding first risk values ​​according to different types of target log information and performing weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs;

[0031] Specifically, the operation logs of the security devices in the platform of the target security system are fully collected, including access logs, security logs, version application logs and database logs, to obtain the above target log information, which covers various system operation details, including but not limited to kernel messages, user login events and program errors. Then, the proportion of abnormal information in each type of log is determined to obtain the above first risk value, and then the above first risk values ​​corresponding to various logs are weighted to obtain the above first risk coefficient.

[0032] Step S202, obtaining a monitoring parameter group, determining a corresponding second risk value according to each monitoring parameter in the above monitoring parameter group, and performing weighted calculation to obtain a second risk coefficient, wherein the above monitoring parameter group includes a device abnormality flag, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and a number of interface data packets;

[0033] Specifically, in order to further ensure the accuracy of the risk assessment, in addition to analyzing the log information, the present application is configured to monitor the operating status parameters of the security device to obtain the above-mentioned monitoring parameter group, including the device abnormality identification, CPU occupancy, memory occupancy, disk occupancy, interface traffic and the number of interface data packets, and evaluate each operating status parameter to obtain the corresponding second risk value, and then weight the above-mentioned second risk value to obtain the above-mentioned second risk coefficient.

[0034] Step S203, cross-validating the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network;

[0035] Specifically, in order to avoid inaccurate analysis results, the present application is arranged to perform cross-validation based on the above analysis results, integrate the analysis results based on logs and device operating parameters, determine the possible vulnerabilities and risks in the network security system to obtain the above vulnerability risk list, and then score the security system according to the vulnerability risk list to obtain the above third risk coefficient.

[0036] Step S204, performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient;

[0037] Specifically, a static analysis is performed on the risks and code fields corresponding to the vulnerabilities included in the above-mentioned vulnerability risk list to obtain the above-mentioned third risk value, and then a corresponding simulation environment is constructed according to the above-mentioned code fields for simulation operation, and an evaluation is performed based on the operation results to obtain the above-mentioned fourth risk coefficient, and then the above-mentioned fourth risk coefficient is obtained by weighting based on the above-mentioned third risk value and the above-mentioned fourth risk value.

[0038] Step S205, inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list;

[0039] Specifically, based on the existing audit tools, the risk loopholes in the above vulnerability risk list are checked and supplemented, and then the above fifth risk coefficient is obtained by evaluation.

[0040] Step S206, performing weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0041] Specifically, the risk coefficients obtained by evaluating in different ways are weighted and calculated to obtain a final risk evaluation value, which is used to characterize the size of the potential risk of the current security system.

[0042] Through this embodiment, first, the target log information is obtained, and the corresponding first risk value is determined according to different types of the above target log information and a first risk coefficient is obtained by weighted calculation, and the above target log information includes access logs, security logs, version application logs and database logs; then, the monitoring parameter group is obtained, and the corresponding second risk value is determined according to each monitoring parameter in the above monitoring parameter group to obtain a second risk coefficient by weighted calculation, and the above monitoring parameter group includes device abnormality identification, CPU occupancy, memory occupancy, disk occupancy, interface traffic and number of interface data packets; thereafter, the above target log information, the above first risk coefficient, the above monitoring parameter group and the above second risk coefficient are cross-validated to obtain a third risk coefficient. Risk coefficient and vulnerability risk list, the above vulnerability risk list includes the first risk information and the first vulnerability information existing in the network; then, static analysis is performed according to the above vulnerability risk list to obtain the third risk value, dynamic analysis is performed according to the above vulnerability risk list to obtain the fourth risk value, and weighted calculation is performed according to the above third risk value and the above fourth risk value to obtain the fourth risk coefficient; then, the above vulnerability risk list is input into the audit tool to obtain the fifth risk coefficient, and the above fifth risk coefficient is the risk coefficient of the configuration information corresponding to the above vulnerability risk list; finally, the risk assessment value is obtained by weighted calculation according to the above first risk coefficient, the above second risk coefficient, the above third risk coefficient, the fourth risk coefficient and the fifth risk coefficient. This application quantifies all threats faced in network security scenarios, determines the corresponding risk values, and calculates the final risk value based on various risk values, which is used to characterize the risk situation of network security of information systems. This application solves the problem that network security assessment in the prior art requires staff to reach the assessment site, which consumes a lot of manpower and time.

[0043] In order to obtain the first risk coefficient, in an optional implementation, the step S201 includes:

[0044] Step S2011, determining the abnormal behavior of the user according to the access log, and determining the ratio of the number of the abnormal behavior to the total number of behaviors as the first risk value corresponding to the access log;

[0045] Specifically, the user's access behavior to the security equipment in the security system is determined based on the above-mentioned access log, and the risk behavior therein is then analyzed, that is, the above-mentioned abnormal behavior is obtained, and then based on the ratio of the number of abnormal operations performed by the user to the total number of user accesses, the first risk value corresponding to the access log is determined.

[0046] Step S2012, determining attack information according to the security log, determining the number of times the network has been attacked according to the attack information, and determining the ratio of the number of times the network has been attacked to the number of times the network has been accessed as the first risk value corresponding to the security log;

[0047] Specifically, by reading the security log of the security device, the record of the security system being attacked can be determined, that is, the above-mentioned attack information is obtained, and then the first risk value corresponding to the security log is determined according to the ratio of the number of attacks on the security system to the total number of accesses.

[0048] Step S2013, determining the second vulnerability information and the second risk information existing in the current version according to the version application log, and determining the first risk value corresponding to the version application log according to the number of the second vulnerability information and the second risk information;

[0049] Specifically, based on the above-mentioned version application log, the version information of the current security system can be determined, and then based on the configuration information of the security system, the vulnerability information and risk information that have not been resolved during the development process of the current security system can be determined, and the above-mentioned second risk information and the above-mentioned second vulnerability information can be obtained, and then the first risk value corresponding to the version application log can be determined according to the number of vulnerabilities and risks existing in the version system.

[0050] Step S2014, determining abnormal data according to the database log, and determining the ratio of the number of the abnormal data to the total number of all data as the first risk value corresponding to the database log;

[0051] Specifically, by extracting the database log corresponding to the above database, abnormal data in the database can be determined, and then the first risk value corresponding to the above database log can be determined according to the ratio of the number of abnormal data to the number of data included in the database.

[0052] Step S2015, determining corresponding weights according to the types of the target log information corresponding to the first risk values ​​to obtain a plurality of first weights, wherein the first weights correspond to the first risk values ​​one by one;

[0053] Specifically, the corresponding preset weight is determined according to the log type corresponding to each of the target log information, that is, the first weight is obtained, and the sum of the first weights is 1.

[0054] Step S2016, calculating the product of each of the above-mentioned first risk values ​​and the corresponding first weights and summing them up to obtain the above-mentioned first risk coefficient.

[0055] Specifically, the first risk coefficient is obtained by performing weighted calculation according to each of the first risk values ​​and the first weights.

[0056] In order to obtain the second risk coefficient, in an optional implementation, the step S202 includes:

[0057] Step S2021, determining the number of abnormal devices according to the device abnormality identifier, and determining the ratio of the number of abnormal devices to the total number of devices as the second risk value corresponding to the device abnormality identifier;

[0058] Specifically, according to the device abnormality identification, the number of abnormal devices is determined, and then the ratio of the number of abnormal devices to the total number of devices in the network security system is determined as the second risk value corresponding to the abnormal device identification.

[0059] Step S2022, calculating the difference between the CPU occupancy rate and the preset CPU occupancy rate to obtain a first difference value, and determining the second risk value corresponding to the CPU occupancy rate according to the interval to which the first difference value belongs;

[0060] Specifically, the higher the current CPU occupancy, the worse the ability of the network security system to respond to attacks. Therefore, the present application sets the above-mentioned preset CPU occupancy rate, that is, the maximum CPU occupancy rate allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned CPU occupancy rate and the preset CPU occupancy rate is calculated. When the CPU occupancy rate is greater than the preset CPU occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned CPU occupancy rate is obtained.

[0061] Step S2023, calculating the difference between the memory occupancy rate and the preset memory occupancy rate to obtain a second difference value, and determining the second risk value corresponding to the memory occupancy rate according to the interval to which the second difference value belongs;

[0062] Specifically, the higher the current memory usage, the worse the ability of the network security system to respond to attacks. Therefore, the present application sets the above-mentioned preset memory usage, that is, the maximum memory usage allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned memory usage and the preset memory usage is calculated. When the memory usage is greater than the preset memory usage, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned memory usage is obtained.

[0063] Step S2024, calculating the difference between the disk occupancy rate and the preset disk occupancy rate to obtain a third difference value, and determining the second risk value corresponding to the disk occupancy rate according to the interval to which the third difference value belongs;

[0064] Specifically, the higher the current occupancy of the disk, the worse the ability of the network security system to respond to attacks. Therefore, the present application sets the above-mentioned preset disk occupancy rate, that is, the maximum disk occupancy rate allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned disk occupancy rate and the preset disk occupancy rate is calculated. When the disk occupancy rate is greater than the preset disk occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned disk occupancy rate is obtained.

[0065] Step S2025, calculating the difference between the interface flow and the preset flow to obtain a fourth difference, and determining the second risk value corresponding to the interface flow according to the interval to which the fourth difference belongs;

[0066] Specifically, the larger the interface flow, the greater the impact of the network security system when attacked. Therefore, the present application sets the above-mentioned preset flow, that is, the maximum interface flow allowed without affecting the security equipment in the network security system to respond to attacks. Then, the difference between the above-mentioned interface flow and the preset flow occupancy rate is calculated. When the interface flow is greater than the preset flow, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned interface flow is obtained.

[0067] Step S2026, calculating the difference between the number of interface data packets and the preset number of data packets to obtain a fifth difference, and determining the second risk value corresponding to the number of interface data packets according to the interval to which the fifth difference belongs;

[0068] Specifically, the larger the number of interface data packets, the greater the impact of the network security system when attacked. Therefore, the present application sets the above-mentioned preset number of data packets, that is, the maximum number of interface data packets allowed without affecting the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned number of interface data packets and the occupancy rate of the preset number of data packets is calculated. When the number of interface data packets is greater than the preset number of data packets, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned number of interface data packets is obtained.

[0069] Step S2027, determining a second weight corresponding to the second risk value according to the monitoring parameters corresponding to each of the second risk values, wherein the second weight corresponds to the second risk value one-to-one;

[0070] Specifically, the corresponding preset weight is determined according to each of the above monitoring parameters, that is, the above second weight is obtained, and the sum of the above second weights is 1.

[0071] Step S2028, calculating the product of each of the above-mentioned second risk values ​​and the corresponding second weights and summing them up to obtain the above-mentioned second risk coefficient.

[0072] Specifically, the second risk coefficient is obtained by performing weighted calculation according to each of the second risk values ​​and the corresponding second weights.

[0073] In order to obtain the third risk coefficient, in an optional implementation, the step S203 includes:

[0074] Step S2031, dividing a first training set according to the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient;

[0075] Specifically, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are determined as the first training set.

[0076] Step S2032, a division step, dividing the first training set into a plurality of training subsets, determining any one of the training subsets as a validation set, and determining the training subsets other than the validation set as second training sets;

[0077] Specifically, the first training set is divided into k subsets of equal size to obtain the training subsets, and then one of the training subsets is determined as the validation set, and then the other training subsets are determined as the second training sets.

[0078] Step S2033, a verification step, training the analysis model according to the second training set and verifying it according to the verification set to obtain a fourth risk value;

[0079] Specifically, the analysis model is trained based on the second training set, and the performance of the analysis model is evaluated based on the validation set. The validation results, including the accuracy, precision and recall rate of the model, are recorded, and the corresponding risk value is determined based on the validation results to obtain the fourth risk value.

[0080] Step S2034, repeat the above-mentioned division step and the above-mentioned verification step at least once in sequence until the above-mentioned fourth risk values ​​corresponding to all the above-mentioned verification sets are obtained, and the average value of the above-mentioned fourth risk values ​​is calculated to obtain the above-mentioned third risk coefficient.

[0081] Specifically, the above division step and the above verification step are repeated, and the above training subsets are respectively used as verification sets, and the corresponding fourth risk values ​​are obtained, and then the average value of k fourth risk values ​​is calculated to obtain the third risk coefficient.

[0082] In order to obtain the third risk value, in an optional implementation, the step S204 includes:

[0083] Step S2041, determining the corresponding code field according to the first risk information in the vulnerability risk list to obtain a first target code, and determining the corresponding code field according to the first vulnerability information to obtain a second target code;

[0084] Specifically, based on the risk information in the above vulnerability risk list, the corresponding application and system source code or binary code is determined to obtain the above first target code, and based on the vulnerability information in the above vulnerability risk list, the corresponding application and system source code or binary code is determined to obtain the above second target code.

[0085] Step S2042, determining a sixth risk value by matching the first target code with a preset code template, and determining a seventh risk value by matching the second target code with the preset code template;

[0086] Specifically, the present application introduces a standard risk model, and calculates vulnerabilities and risks based on existing databases and third-party databases to obtain the sixth risk value and the seventh risk value.

[0087] Step S2043: Calculate the average of the sixth risk value and the seventh risk value to obtain the third risk value.

[0088] Specifically, the third risk value is obtained by calculating the average value according to the sixth risk value and the seventh risk value.

[0089] In order to obtain the fourth risk value, in an optional implementation, the step S204 further includes:

[0090] Step S2044, constructing a simulation environment according to the first risk information and / or the first vulnerability information in the vulnerability risk list, wherein the simulation environment is a network environment under attack;

[0091] Specifically, the present application is configured to combine the above-mentioned first risk information and the above-mentioned first vulnerability information, and construct a corresponding scenario simulating a real attack to obtain the above-mentioned simulation environment.

[0092] Step S2045, verifying the first risk information and the first vulnerability information according to the simulation environment to determine a first target risk and a first target vulnerability, wherein the first target risk is the first risk information triggered in the simulation environment, and the first target vulnerability is the first vulnerability information triggered in the simulation environment;

[0093] Specifically, in the simulation environment, the system is attacked through a series of simulated attacks to determine the first risk information and the first vulnerability information that can be exploited, and to determine them as the first target risk and the first target vulnerability.

[0094] Step S2046, determining an eighth risk value according to the ratio of the first target risk to the first risk information, determining a ninth risk value according to the ratio of the first target vulnerability to the first vulnerability information, and calculating the average of the eighth risk value and the ninth risk value to obtain the fourth risk value.

[0095] Specifically, the eighth risk value is determined based on the ratio of the amount of risk information used in the verification process to the total amount of risk information, and the ninth risk value is determined based on the ratio of the amount of vulnerability information used in the verification process to the total amount of vulnerability information. The fourth risk value is then determined based on the average of the eighth risk value and the ninth risk value.

[0096] In order to obtain the fourth risk coefficient, in an optional implementation, the step S204 further includes:

[0097] Step S2047, obtaining a third weight and a fourth weight, wherein the third weight is a weight corresponding to the third risk value, and the fourth weight is a weight corresponding to the fourth risk value;

[0098] Specifically, the results of the static analysis and the dynamic analysis, ie, the third risk value and the fourth risk value, are obtained respectively, and the corresponding emphasis ratios, ie, the third weight and the fourth weight, are read.

[0099] Step S2048, calculating the product of the third risk value and the third weight and the product of the fourth risk value and the fourth weight, and summing them up to obtain the fourth risk coefficient.

[0100] Specifically, the fourth risk coefficient is obtained by performing a weighted average calculation based on the third risk value, the fourth risk value, the third weight and the fourth weight.

[0101] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0102] The present application embodiment also provides a risk assessment device for network security. It should be noted that the risk assessment device for network security of the present application embodiment can be used to execute the risk assessment method for network security provided by the present application embodiment. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions thereof will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0103] The following is an introduction to the network security risk assessment device provided in an embodiment of the present application.

[0104] Figure 3 is a structural block diagram of a network security risk assessment device according to an embodiment of the present application. Figure 3 As shown, the device comprises:

[0105] A first acquisition unit 10 is used to acquire target log information, determine corresponding first risk values ​​according to different types of target log information, and perform weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs;

[0106] Specifically, the operation logs of the security devices in the platform of the target security system are fully collected, including access logs, security logs, version application logs and database logs, to obtain the above target log information, which covers various system operation details, including but not limited to kernel messages, user login events and program errors. Then, the proportion of abnormal information in each type of log is determined to obtain the above first risk value, and then the above first risk values ​​corresponding to various logs are weighted to obtain the above first risk coefficient.

[0107] A second acquisition unit 20 is used to acquire a monitoring parameter group, determine a corresponding second risk value according to each monitoring parameter in the above monitoring parameter group, and perform weighted calculation to obtain a second risk coefficient, wherein the above monitoring parameter group includes a device abnormality flag, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and an interface data packet quantity;

[0108] Specifically, in order to further ensure the accuracy of the risk assessment, in addition to analyzing the log information, the present application is configured to monitor the operating status parameters of the security device to obtain the above-mentioned monitoring parameter group, including the device abnormality identification, CPU occupancy, memory occupancy, disk occupancy, interface traffic and the number of interface data packets, and evaluate each operating status parameter to obtain the corresponding second risk value, and then weight the above-mentioned second risk value to obtain the above-mentioned second risk coefficient.

[0109] A first calculation unit 30 is used to cross-validate the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network;

[0110] Specifically, in order to avoid inaccurate analysis results, the present application is arranged to perform cross-validation based on the above analysis results, integrate the analysis results based on logs and device operating parameters, determine the possible vulnerabilities and risks in the network security system to obtain the above vulnerability risk list, and then score the security system according to the vulnerability risk list to obtain the above third risk coefficient.

[0111] A second calculation unit 40 is configured to perform static analysis according to the vulnerability risk list to obtain a third risk value, perform dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and perform weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient;

[0112] Specifically, a static analysis is performed on the risks and code fields corresponding to the vulnerabilities included in the above-mentioned vulnerability risk list to obtain the above-mentioned third risk value, and then a corresponding simulation environment is constructed according to the above-mentioned code fields for simulation operation, and an evaluation is performed based on the operation results to obtain the above-mentioned fourth risk coefficient, and then the above-mentioned fourth risk coefficient is obtained by weighting based on the above-mentioned third risk value and the above-mentioned fourth risk value.

[0113] A third calculation unit 50 is used to input the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list;

[0114] Specifically, based on the existing audit tools, the risk loopholes in the above vulnerability risk list are checked and supplemented, and then the above fifth risk coefficient is obtained by evaluation.

[0115] The fourth calculation unit 60 is used to perform weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0116] Specifically, the risk coefficients obtained by evaluating in different ways are weighted and calculated to obtain a final risk evaluation value, which is used to characterize the size of the potential risk of the current security system.

[0117] Through this embodiment, the first acquisition unit acquires target log information, determines the corresponding first risk value according to different types of the above target log information, and performs weighted calculation to obtain a first risk coefficient, wherein the above target log information includes access logs, security logs, version application logs, and database logs; the second acquisition unit acquires a monitoring parameter group, determines the corresponding second risk value according to each monitoring parameter in the above monitoring parameter group, and performs weighted calculation to obtain a second risk coefficient, wherein the above monitoring parameter group includes device abnormality identification, CPU occupancy, memory occupancy, disk occupancy, interface traffic, and number of interface data packets; the first calculation unit cross-validates the above target log information, the above first risk coefficient, the above monitoring parameter group, and the above second risk coefficient to obtain a third Risk coefficient and vulnerability risk list, the above-mentioned vulnerability risk list includes the first risk information and the first vulnerability information existing in the network; the second calculation unit performs static analysis according to the above-mentioned vulnerability risk list to obtain the third risk value, performs dynamic analysis according to the above-mentioned vulnerability risk list to obtain the fourth risk value, and performs weighted calculation according to the above-mentioned third risk value and the above-mentioned fourth risk value to obtain the fourth risk coefficient; the third calculation unit inputs the above-mentioned vulnerability risk list into the audit tool to obtain the fifth risk coefficient, and the above-mentioned fifth risk coefficient is the risk coefficient of the configuration information corresponding to the above-mentioned vulnerability risk list; the fourth calculation unit performs weighted calculation according to the above-mentioned first risk coefficient, the above-mentioned second risk coefficient, the above-mentioned third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain the risk assessment value. The present application quantifies all threats faced in the network security scenario, determines the corresponding risk value, and calculates the final risk value by integrating various risk values, which is used to characterize the risk situation of the network security of the information system. The present application solves the problem that the network security assessment in the prior art requires staff to arrive at the assessment site, which consumes a lot of manpower and time.

[0118] In order to obtain the first risk coefficient, in an optional implementation manner, the first obtaining unit includes:

[0119] A first determination module, configured to determine the abnormal behavior of the user according to the access log, and determine the ratio of the number of the abnormal behavior to the total number of behaviors as the first risk value corresponding to the access log;

[0120] Specifically, the user's access behavior to the security equipment in the security system is determined based on the above-mentioned access log, and the risk behavior therein is then analyzed, that is, the above-mentioned abnormal behavior is obtained, and then based on the ratio of the number of abnormal operations performed by the user to the total number of user accesses, the first risk value corresponding to the access log is determined.

[0121] A second determination module is used to determine the attack information according to the security log, determine the number of times the network has been attacked according to the attack information, and determine the ratio of the number of times the network has been attacked to the number of times the network has been accessed as the first risk value corresponding to the security log;

[0122] Specifically, by reading the security log of the security device, the record of the security system being attacked can be determined, that is, the above-mentioned attack information is obtained, and then the first risk value corresponding to the security log is determined according to the ratio of the number of attacks on the security system to the total number of accesses.

[0123] A third determination module is used to determine the second vulnerability information and the second risk information existing in the current version according to the version application log, and determine the first risk value corresponding to the version application log according to the number of the second vulnerability information and the second risk information;

[0124] Specifically, based on the above-mentioned version application log, the version information of the current security system can be determined, and then based on the configuration information of the security system, the vulnerability information and risk information that have not been resolved during the development process of the current security system can be determined, and the above-mentioned second risk information and the above-mentioned second vulnerability information can be obtained, and then the first risk value corresponding to the version application log can be determined according to the number of vulnerabilities and risks existing in the version system.

[0125] a fourth determination module, configured to determine abnormal data according to the database log, and determine a ratio of the number of the abnormal data to the total number of all data as the first risk value corresponding to the database log;

[0126] Specifically, by extracting the database log corresponding to the above database, abnormal data in the database can be determined, and then the first risk value corresponding to the above database log can be determined according to the ratio of the number of abnormal data to the number of data included in the database.

[0127] A fifth determining module, configured to determine corresponding weights according to the types of the target log information corresponding to the first risk values ​​to obtain a plurality of first weights, wherein the first weights correspond to the first risk values ​​one by one;

[0128] Specifically, the corresponding preset weight is determined according to the log type corresponding to each of the target log information, that is, the first weight is obtained, and the sum of the first weights is 1.

[0129] The first calculation module is used to calculate the product of each of the above-mentioned first risk values ​​and the corresponding first weights and sum them up to obtain the above-mentioned first risk coefficient.

[0130] Specifically, the first risk coefficient is obtained by performing weighted calculation according to each of the first risk values ​​and the first weights.

[0131] In order to obtain the second risk coefficient, in an optional implementation manner, the second obtaining unit includes:

[0132] A sixth determination module, configured to determine the number of abnormal devices according to the device abnormality identifier, and determine the ratio of the number of abnormal devices to the total number of devices as the second risk value corresponding to the device abnormality identifier;

[0133] Specifically, according to the device abnormality identification, the number of abnormal devices is determined, and then the ratio of the number of abnormal devices to the total number of devices in the network security system is determined as the second risk value corresponding to the abnormal device identification.

[0134] a seventh determination module, configured to calculate a difference between the CPU occupancy rate and a preset CPU occupancy rate to obtain a first difference value, and determine the second risk value corresponding to the CPU occupancy rate according to an interval to which the first difference value belongs;

[0135] Specifically, the higher the current CPU occupancy, the worse the ability of the network security system to respond to attacks. Therefore, the present application sets the above-mentioned preset CPU occupancy rate, that is, the maximum CPU occupancy rate allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned CPU occupancy rate and the preset CPU occupancy rate is calculated. When the CPU occupancy rate is greater than the preset CPU occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned CPU occupancy rate is obtained.

[0136] an eighth determination module, configured to calculate a difference between the memory occupancy rate and a preset memory occupancy rate to obtain a second difference value, and determine the second risk value corresponding to the memory occupancy rate according to an interval to which the second difference value belongs;

[0137] Specifically, the higher the current memory usage, the worse the ability of the network security system to respond to attacks. Therefore, the present application sets the above-mentioned preset memory usage, that is, the maximum memory usage allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned memory usage and the preset memory usage is calculated. When the memory usage is greater than the preset memory usage, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned memory usage is obtained.

[0138] a ninth determination module, configured to calculate a difference between the disk occupancy rate and a preset disk occupancy rate to obtain a third difference value, and determine the second risk value corresponding to the disk occupancy rate according to an interval to which the third difference value belongs;

[0139] Specifically, the higher the current occupancy of the disk, the worse the ability of the network security system to respond to attacks. Therefore, the present application sets the above-mentioned preset disk occupancy rate, that is, the maximum disk occupancy rate allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned disk occupancy rate and the preset disk occupancy rate is calculated. When the disk occupancy rate is greater than the preset disk occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned disk occupancy rate is obtained.

[0140] a tenth determination module, configured to calculate the difference between the interface flow and the preset flow to obtain a fourth difference, and determine the second risk value corresponding to the interface flow according to the interval to which the fourth difference belongs;

[0141] Specifically, the larger the interface flow, the greater the impact of the network security system when attacked. Therefore, the present application sets the above-mentioned preset flow, that is, the maximum interface flow allowed without affecting the security equipment in the network security system to respond to attacks. Then, the difference between the above-mentioned interface flow and the preset flow occupancy rate is calculated. When the interface flow is greater than the preset flow, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned interface flow is obtained.

[0142] An eleventh determination module, configured to calculate the difference between the number of interface data packets and the preset number of data packets to obtain a fifth difference, and determine the second risk value corresponding to the number of interface data packets according to the interval to which the fifth difference belongs;

[0143] Specifically, the larger the number of interface data packets, the greater the impact of the network security system when attacked. Therefore, the present application sets the above-mentioned preset number of data packets, that is, the maximum number of interface data packets allowed without affecting the security devices in the network security system to respond to attacks. Then, the difference between the above-mentioned number of interface data packets and the occupancy rate of the preset number of data packets is calculated. When the number of interface data packets is greater than the preset number of data packets, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned number of interface data packets is obtained.

[0144] A twelfth determination module, used to determine a second weight corresponding to the second risk value according to the monitoring parameters corresponding to each of the second risk values, wherein the second weight corresponds to the second risk value one-to-one;

[0145] Specifically, the corresponding preset weight is determined according to each of the above monitoring parameters, that is, the above second weight is obtained, and the sum of the above second weights is 1.

[0146] The second calculation module is used to calculate the product of each of the above-mentioned second risk values ​​and the corresponding second weights and sum them up to obtain the above-mentioned second risk coefficient.

[0147] Specifically, the second risk coefficient is obtained by performing weighted calculation according to each of the second risk values ​​and the corresponding second weights.

[0148] In order to obtain the third risk coefficient, in an optional implementation manner, the first calculation unit includes:

[0149] A first division module, used for dividing the first training set according to the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient;

[0150] Specifically, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are determined as the first training set.

[0151] A second division module is used to perform the division step, divide the first training set into a plurality of training subsets, determine any one of the training subsets as a validation set, and determine the training subsets other than the validation set as second training sets;

[0152] Specifically, the first training set is divided into k subsets of equal size to obtain the training subsets, and then one of the training subsets is determined as the validation set, and then the other training subsets are determined as the second training sets.

[0153] A first verification module, used in a verification step, training the analysis model according to the second training set and verifying it according to the verification set to obtain a fourth risk value;

[0154] Specifically, the analysis model is trained based on the second training set, and the performance of the analysis model is evaluated based on the validation set. The validation results, including the accuracy, precision and recall rate of the model, are recorded, and the corresponding risk value is determined based on the validation results to obtain the fourth risk value.

[0155] A repeating module is used to repeat the above-mentioned division step and the above-mentioned verification step in sequence at least once until the above-mentioned fourth risk values ​​corresponding to all the above-mentioned verification sets are obtained, and the average value of the above-mentioned fourth risk values ​​is calculated to obtain the above-mentioned third risk coefficient.

[0156] Specifically, the above division step and the above verification step are repeated, and the above training subsets are respectively used as verification sets, and the corresponding fourth risk values ​​are obtained, and then the average value of k fourth risk values ​​is calculated to obtain the third risk coefficient.

[0157] In order to obtain the third risk value, in an optional implementation manner, the second calculation unit includes:

[0158] A thirteenth determination module is used to determine the corresponding code field according to the first risk information in the vulnerability risk list to obtain the first target code, and to determine the corresponding code field according to the first vulnerability information to obtain the second target code;

[0159] Specifically, based on the risk information in the above vulnerability risk list, the corresponding application and system source code or binary code is determined to obtain the above first target code, and based on the vulnerability information in the above vulnerability risk list, the corresponding application and system source code or binary code is determined to obtain the above second target code.

[0160] A fourteenth determination module, configured to determine a sixth risk value by matching the first target code with a preset code template, and to determine a seventh risk value by matching the second target code with the preset code template;

[0161] Specifically, the present application introduces a standard risk model, and calculates vulnerabilities and risks based on existing databases and third-party databases to obtain the sixth risk value and the seventh risk value.

[0162] The third calculation module is used to calculate the average of the sixth risk value and the seventh risk value to obtain the third risk value.

[0163] Specifically, the third risk value is obtained by calculating the average value according to the sixth risk value and the seventh risk value.

[0164] In order to obtain the fourth risk value, in an optional implementation manner, the second calculation unit further includes:

[0165] A construction module, used to construct a simulation environment according to the first risk information and / or the first vulnerability information in the vulnerability risk list, wherein the simulation environment is a network environment under attack;

[0166] Specifically, the present application is configured to combine the above-mentioned first risk information and the above-mentioned first vulnerability information, and construct a corresponding scenario simulating a real attack to obtain the above-mentioned simulation environment.

[0167] A second verification module is used to verify the first risk information and the first vulnerability information according to the simulation environment to determine a first target risk and a first target vulnerability, wherein the first target risk is the first risk information triggered in the simulation environment, and the first target vulnerability is the first vulnerability information triggered in the simulation environment;

[0168] Specifically, in the simulation environment, the system is attacked through a series of simulated attacks to determine the first risk information and the first vulnerability information that can be exploited, and to determine them as the first target risk and the first target vulnerability.

[0169] The fourth calculation module is used to determine the eighth risk value according to the ratio of the above-mentioned first target risk and the above-mentioned first risk information, determine the ninth risk value according to the ratio of the above-mentioned first target vulnerability and the above-mentioned first vulnerability information, and calculate the average of the above-mentioned eighth risk value and the above-mentioned ninth risk value to obtain the above-mentioned fourth risk value.

[0170] Specifically, the eighth risk value is determined based on the ratio of the amount of risk information used in the verification process to the total amount of risk information, and the ninth risk value is determined based on the ratio of the amount of vulnerability information used in the verification process to the total amount of vulnerability information. The fourth risk value is then determined based on the average of the eighth risk value and the ninth risk value.

[0171] In order to obtain the fourth risk coefficient, in an optional implementation manner, the second calculation unit further includes:

[0172] An acquisition module, used to acquire a third weight and a fourth weight, wherein the third weight is a weight corresponding to the third risk value, and the fourth weight is a weight corresponding to the fourth risk value;

[0173] Specifically, the results of the static analysis and the dynamic analysis, ie, the third risk value and the fourth risk value, are obtained respectively, and the corresponding emphasis ratios, ie, the third weight and the fourth weight, are read.

[0174] The fifth calculation module is used to calculate the product of the third risk value and the third weight and the product of the fourth risk value and the fourth weight and sum them up to obtain the fourth risk coefficient.

[0175] Specifically, the fourth risk coefficient is obtained by performing a weighted average calculation based on the third risk value, the fourth risk value, the third weight and the fourth weight.

[0176] The network security risk assessment device includes a processor and a memory. The first acquisition unit, the second acquisition unit, the first calculation unit, the second calculation unit, the third calculation unit and the fourth calculation unit are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The modules are all located in the same processor; or, the modules are located in different processors in any combination.

[0177] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the efficiency of network security risk assessment can be improved by adjusting kernel parameters.

[0178] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0179] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the network security risk assessment method.

[0180] Specifically, the risk assessment methods for network security include:

[0181] Step S201, obtaining target log information, determining corresponding first risk values ​​according to different types of target log information and performing weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs;

[0182] Step S202, obtaining a monitoring parameter group, determining a corresponding second risk value according to each monitoring parameter in the above monitoring parameter group, and performing weighted calculation to obtain a second risk coefficient, wherein the above monitoring parameter group includes a device abnormality flag, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and a number of interface data packets;

[0183] Step S203, cross-validating the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network;

[0184] Step S204, performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient;

[0185] Step S205, inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list;

[0186] Step S206, performing weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0187] An embodiment of the present invention provides a processor, and the processor is used to run a program, wherein the network security risk assessment method is executed when the program is running.

[0188] Specifically, the risk assessment methods for network security include:

[0189] Step S201, obtaining target log information, determining corresponding first risk values ​​according to different types of target log information and performing weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs;

[0190] Step S202, obtaining a monitoring parameter group, determining a corresponding second risk value according to each monitoring parameter in the above monitoring parameter group, and performing weighted calculation to obtain a second risk coefficient, wherein the above monitoring parameter group includes a device abnormality flag, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and a number of interface data packets;

[0191] Step S203, cross-validating the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network;

[0192] Step S204, performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient;

[0193] Step S205, inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list;

[0194] Step S206, performing weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0195] An embodiment of the present invention provides a network security system, the network security system includes a processor, a memory, and a program stored in the memory and executable on the processor, and when the processor executes the program, at least the following steps are implemented:

[0196] Step S201, obtaining target log information, determining corresponding first risk values ​​according to different types of target log information and performing weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs;

[0197] Step S202, obtaining a monitoring parameter group, determining a corresponding second risk value according to each monitoring parameter in the above monitoring parameter group, and performing weighted calculation to obtain a second risk coefficient, wherein the above monitoring parameter group includes a device abnormality flag, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and a number of interface data packets;

[0198] Step S203, cross-validating the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network;

[0199] Step S204, performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient;

[0200] Step S205, inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list;

[0201] Step S206, performing weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0202] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0203] Step S201, obtaining target log information, determining corresponding first risk values ​​according to different types of target log information and performing weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs;

[0204] Step S202, obtaining a monitoring parameter group, determining a corresponding second risk value according to each monitoring parameter in the above monitoring parameter group, and performing weighted calculation to obtain a second risk coefficient, wherein the above monitoring parameter group includes a device abnormality flag, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and a number of interface data packets;

[0205] Step S203, cross-validating the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network;

[0206] Step S204, performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient;

[0207] Step S205, inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list;

[0208] Step S206, performing weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0209] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0210] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0211] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0212] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0213] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0214] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0215] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0216] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0217] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0218] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0219] 1) The network security risk assessment method of the present application first obtains target log information, determines a corresponding first risk value according to different types of the target log information, and performs weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs; then, obtains a monitoring parameter group, determines a corresponding second risk value according to each monitoring parameter in the monitoring parameter group, and performs weighted calculation to obtain a second risk coefficient, wherein the monitoring parameter group includes device abnormality identification, CPU occupancy, memory occupancy, disk occupancy, interface traffic, and number of interface data packets; then, cross-calculates the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient. Verify and obtain the third risk coefficient and the vulnerability risk list, the above vulnerability risk list includes the first risk information and the first vulnerability information existing in the network; then, static analysis is performed according to the above vulnerability risk list to obtain the third risk value, dynamic analysis is performed according to the above vulnerability risk list to obtain the fourth risk value, and weighted calculation is performed according to the above third risk value and the above fourth risk value to obtain the fourth risk coefficient; then, the above vulnerability risk list is input into the audit tool to obtain the fifth risk coefficient, and the above fifth risk coefficient is the risk coefficient of the configuration information corresponding to the above vulnerability risk list; finally, the risk assessment value is obtained by weighted calculation according to the above first risk coefficient, the above second risk coefficient, the above third risk coefficient, the fourth risk coefficient and the fifth risk coefficient. This application quantifies all threats faced in network security scenarios, determines the corresponding risk values, and calculates the final risk value based on various risk values, which is used to characterize the risk situation of network security of information systems. This application solves the problem that network security assessment in the prior art requires staff to reach the assessment site, which consumes a lot of manpower and time.

[0220] 2) The network security risk assessment device of the present application comprises: a first acquisition unit acquires target log information, determines a corresponding first risk value according to different types of the target log information, and performs weighted calculation to obtain a first risk coefficient, wherein the target log information comprises access logs, security logs, version application logs, and database logs; a second acquisition unit acquires a monitoring parameter group, determines a corresponding second risk value according to each monitoring parameter in the monitoring parameter group, and performs weighted calculation to obtain a second risk coefficient, wherein the monitoring parameter group comprises a device abnormality mark, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic, and number of interface data packets; a first calculation unit cross-calculates the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient. Verify to obtain a third risk coefficient and a vulnerability risk list, the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network; the second calculation unit performs static analysis according to the vulnerability risk list to obtain a third risk value, performs dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performs weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; the third calculation unit inputs the vulnerability risk list into the audit tool to obtain a fifth risk coefficient, the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list; the fourth calculation unit performs weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value. This application quantifies all threats faced in network security scenarios, determines the corresponding risk values, and calculates the final risk value based on multiple risk values ​​to characterize the risk situation of network security of information systems. This application solves the problem that network security assessment in the prior art requires staff to reach the assessment site, which consumes a lot of manpower and time.

[0221] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network security risk assessment method, characterized in that: include: Obtain target log information, determine corresponding first risk values ​​according to different types of target log information, and perform weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs; Obtain a monitoring parameter group, determine a corresponding second risk value according to each monitoring parameter in the monitoring parameter group, and perform weighted calculation to obtain a second risk coefficient, wherein the monitoring parameter group includes a device abnormality identifier, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and a number of interface data packets; Cross-validating the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes first risk information and first vulnerability information existing in the network; Performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; Inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list; A risk assessment value is obtained by performing weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient.

2. The method according to claim 1, characterized in that: Determining the corresponding first risk value according to different types of target log information and performing weighted calculation to obtain a first risk coefficient includes: Determine the abnormal behavior of the user according to the access log, and determine the ratio of the number of the abnormal behavior to the total number of behaviors as the first risk value corresponding to the access log; Determine attack information according to the security log, determine the number of times the network has been attacked according to the attack information, and determine the ratio of the number of times the network has been attacked to the number of times the network has been accessed as the first risk value corresponding to the security log; Determine the second vulnerability information and the second risk information existing in the current version according to the version application log, and determine the first risk value corresponding to the version application log according to the number of the second vulnerability information and the second risk information; Determine abnormal data according to the database log, and determine the ratio of the number of the abnormal data to the total number of all data as the first risk value corresponding to the database log; Determine a corresponding weight according to the type of the target log information corresponding to each first risk value to obtain a plurality of first weights, wherein the first weights correspond to the first risk values ​​one by one; The product of each first risk value and the corresponding first weight is calculated and summed to obtain the first risk coefficient.

3. The method according to claim 1, characterized in that Determining the corresponding second risk value according to each monitoring parameter in the monitoring parameter group and performing weighted calculation to obtain a second risk coefficient includes: Determine the number of abnormal devices according to the device abnormality identifier, and determine the ratio of the number of abnormal devices to the total number of devices as the second risk value corresponding to the device abnormality identifier; Calculating a difference between the CPU occupancy rate and a preset CPU occupancy rate to obtain a first difference value, and determining the second risk value corresponding to the CPU occupancy rate according to an interval to which the first difference value belongs; Calculating a difference between the memory occupancy rate and a preset memory occupancy rate to obtain a second difference value, and determining the second risk value corresponding to the memory occupancy rate according to the interval to which the second difference value belongs; Calculate the difference between the disk occupancy rate and the preset disk occupancy rate to obtain a third difference value, and determine the second risk value corresponding to the disk occupancy rate according to the interval to which the third difference value belongs; Calculate the difference between the interface flow and the preset flow to obtain a fourth difference, and determine the second risk value corresponding to the interface flow according to the interval to which the fourth difference belongs; Calculate the difference between the number of interface data packets and the preset number of data packets to obtain a fifth difference value, and determine the second risk value corresponding to the number of interface data packets according to the interval to which the fifth difference value belongs; Determine a second weight corresponding to the second risk value according to the monitoring parameters corresponding to each second risk value, wherein the second weight corresponds to the second risk value one-to-one; The product of each second risk value and the corresponding second weight is calculated and summed to obtain the second risk coefficient.

4. The method according to claim 1, characterized in that: Cross-validating the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient to obtain a third risk coefficient includes: Divide a first training set according to the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient; A division step, dividing the first training set into a plurality of training subsets, determining any one of the training subsets as a validation set, and determining the training subsets other than the validation set as second training sets; A verification step, training the analysis model according to the second training set and verifying it according to the verification set to obtain a fourth risk value; Repeat the dividing step and the verifying step at least once in sequence until the fourth risk values ​​corresponding to all the verification sets are obtained, and calculate the average value of the fourth risk values ​​to obtain the third risk coefficient.

5. The method according to claim 1, characterized in that A third risk value is obtained by performing static analysis according to the vulnerability risk list, including: Determine the corresponding code field according to the first risk information in the vulnerability risk list to obtain a first target code, and determine the corresponding code field according to the first vulnerability information to obtain a second target code; Determine a sixth risk value by matching the first target code with a preset code template, and determine a seventh risk value by matching the second target code with the preset code template; The third risk value is obtained by calculating an average of the sixth risk value and the seventh risk value.

6. The method according to claim 1, characterized in that A fourth risk value is obtained by dynamically analyzing the vulnerability risk list, including: Building a simulation environment according to the first risk information and / or the first vulnerability information in the vulnerability risk list, wherein the simulation environment is a network environment under attack; Verify the first risk information and the first vulnerability information according to the simulation environment to determine a first target risk and a first target vulnerability, wherein the first target risk is the first risk information triggered in the simulation environment, and the first target vulnerability is the first vulnerability information triggered in the simulation environment; An eighth risk value is determined according to a ratio of the first target risk to the first risk information, a ninth risk value is determined according to a ratio of the first target vulnerability to the first vulnerability information, and an average of the eighth risk value and the ninth risk value is calculated to obtain the fourth risk value.

7. The method according to claim 1, characterized in that The fourth risk coefficient is obtained by weighted calculation according to the third risk value and the fourth risk value, including: Obtaining a third weight and a fourth weight, wherein the third weight is a weight corresponding to the third risk value, and the fourth weight is a weight corresponding to the fourth risk value; The product of the third risk value and the third weight and the product of the fourth risk value and the fourth weight are calculated and summed to obtain the fourth risk coefficient.

8. A network security risk assessment device, characterized in that: The device comprises: A first acquisition unit is used to acquire target log information, determine corresponding first risk values ​​according to different types of target log information, and perform weighted calculation to obtain a first risk coefficient, wherein the target log information includes access logs, security logs, version application logs, and database logs; A second acquisition unit is used to acquire a monitoring parameter group, determine a corresponding second risk value according to each monitoring parameter in the monitoring parameter group, and perform weighted calculation to obtain a second risk coefficient, wherein the monitoring parameter group includes a device abnormality identifier, a CPU occupancy rate, a memory occupancy rate, a disk occupancy rate, an interface flow rate, and a number of interface data packets; A first calculation unit is used to cross-validate the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network; a second calculation unit, configured to perform static analysis according to the vulnerability risk list to obtain a third risk value, perform dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and perform weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; A third calculation unit is used to input the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, where the fifth risk coefficient is a risk coefficient of the configuration information corresponding to the vulnerability risk list; The fourth calculation unit is used to perform weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A network security system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include methods for executing any one of claims 1 to 7.

Images