Cybersecurity risk assessment method, apparatus, and cybersecurity system

Abstract

The application provides a network security risk assessment method, device and system, the method comprising: obtaining target log information, determining a first risk coefficient according to the type of the target log information; determining a corresponding second risk value according to each monitoring parameter in a monitoring parameter group, and performing weighted calculation to obtain a second risk coefficient; performing cross-validation on the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list; performing static analysis and dynamic analysis according to the vulnerability risk list to obtain a fourth risk coefficient; inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient; and performing weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value. The method solves the problem that in the prior art, a staff member needs to reach an evaluation site, and a large amount of manpower and time is consumed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication security, in particular to a network security risk assessment method and device, a computer readable storage medium and a network security system. BACKGROUND

[0002] Network security refers to the protection of the hardware, software and data in the system from being damaged, altered or leaked due to accidental or malicious reasons, and the continuous, reliable and normal operation of the system, uninterrupted network service, network security, usually refers to the security of computer network, in fact, it can also refer to the security of computer communication network, computer communication network is a system that connects several computers with independent functions through communication equipment and transmission media, and realizes information transmission and exchange between computers under the support of communication software.

[0003] At present, in the existing network security risk assessment process, workers rely on on-site network risk assessment, which consumes a lot of time and manpower, is not convenient for network security assessment of network information in a certain period, is not convenient for providing instructions for subsequent network security, and is easy to cause great problems in network security assessment. SUMMARY

[0004] The main purpose of the present application is to provide a network security risk assessment method, device, computer readable storage medium and network security system, to at least solve the problem of network security assessment in the prior art that requires workers to reach the evaluation site, and consumes a lot of manpower and time.

[0005] In order to achieve the above object, according to one aspect of the present application, a network security risk assessment method is provided, comprising: obtaining target log information, determining corresponding first risk values according to different types of the target log information and performing weighted calculation to obtain a first risk coefficient, the target log information including access logs, security logs, version application logs and database logs; obtaining a monitoring parameter group, determining corresponding second risk values according to each monitoring parameter in the monitoring parameter group and performing weighted calculation to obtain a second risk coefficient, the monitoring parameter group including device anomaly identifiers, CPU occupancy, memory occupancy, disk occupancy, interface traffic and interface data packet quantity; cross- verifying the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, the vulnerability risk list including first risk information and first vulnerability information existing in the network; performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; inputting the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, the fifth risk coefficient being a risk coefficient of configuration information corresponding to the vulnerability risk list; and performing weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0006] Optionally, determining corresponding first risk values according to different types of the target log information and performing weighted calculation to obtain a first risk coefficient comprises: determining abnormal behaviors of users according to the access logs, determining a ratio of the number of abnormal behaviors to the number of total behaviors as the first risk value corresponding to the access logs; determining attack information according to the security logs, determining the number of times of network attacks according to the attack information, and determining a ratio of the number of network attacks to the number of accesses as the first risk value corresponding to the security logs; determining second vulnerability information and second risk information existing in the current version according to the version application logs, determining the first risk value corresponding to the version application logs according to the number of the second vulnerability information and the second risk information; determining abnormal data according to the database logs, determining a ratio of the number of abnormal data to the total number of all data as the first risk value corresponding to the database logs; determining corresponding weights according to the types of the target log information corresponding to each first risk value to obtain a plurality of first weights, the first weights corresponding one-to-one to the first risk values; and calculating the product of each first risk value and the corresponding first weight and summing to obtain the first risk coefficient.

[0007] Optionally, the second risk values corresponding to the monitoring parameters in the monitoring parameter group are determined to obtain a second risk coefficient through weighted calculation, including: determining the number of abnormal devices according to the device anomaly identifier, and determining the ratio of the number of abnormal devices to the total number of devices as the second risk value corresponding to the device anomaly identifier; calculating a first difference value between the CPU occupancy rate and a preset CPU occupancy rate, and determining the second risk value corresponding to the CPU occupancy rate according to the interval to which the first difference value belongs; calculating a second difference value between the memory occupancy rate and a preset memory occupancy rate, and determining the second risk value corresponding to the memory occupancy rate according to the interval to which the second difference value belongs; calculating a third difference value between the disk occupancy rate and a preset disk occupancy rate, and determining the second risk value corresponding to the disk occupancy rate according to the interval to which the third difference value belongs; calculating a fourth difference value between the interface traffic and a preset traffic, and determining the second risk value corresponding to the interface traffic according to the interval to which the fourth difference value belongs; calculating a fifth difference value between the interface packet quantity and a preset packet quantity, and determining the second risk value corresponding to the interface packet quantity according to the interval to which the fifth difference value belongs; determining a second weight corresponding to each second risk value according to the monitoring parameter corresponding to the second risk value, the second weight corresponding to the second risk value in one-to-one manner; calculating the product of each second risk value and the corresponding second weight and summing to obtain the second risk coefficient.

[0008] Optionally, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are cross-verified to obtain a third risk coefficient, including: dividing a first training set according to the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient; in the dividing step, dividing the first training set into a plurality of training subsets, determining any one of the training subsets as a verification set, and determining the training subsets other than the verification set as a second training set; in the verification step, training an analysis model according to the second training set and verifying according to the verification set to obtain a fourth risk value; sequentially repeating the dividing step and the verification step at least once until the fourth risk values corresponding to all the verification sets are obtained, and calculating the average of the fourth risk values to obtain the third risk coefficient.

[0009] Optionally, the third risk value is obtained by static analysis according to the vulnerability risk list, including: determining a first target code according to a corresponding code field of the first risk information in the vulnerability risk list, and determining a second target code according to a corresponding code field of the first vulnerability information; determining a sixth risk value by matching the first target code with a preset code template, and determining a seventh risk value by matching the second target code with the preset code template; and calculating a mean value of the sixth risk value and the seventh risk value to obtain the third risk value.

[0010] Optionally, the fourth risk value is obtained by dynamic analysis according to the vulnerability risk list, including: constructing a simulation environment according to the first risk information and / or the first vulnerability information in the vulnerability risk list, the simulation environment being a network environment under an attack; verifying the first risk information and the first vulnerability information according to the simulation environment, to determine a first target risk and a first target vulnerability, the first target risk being the first risk information triggered in the simulation environment, and the first target vulnerability being the first vulnerability information triggered in the simulation environment; determining an eighth risk value according to a ratio of the first target risk to the first risk information, and determining a ninth risk value according to a ratio of the first target vulnerability to the first vulnerability information, and calculating a mean value of the eighth risk value and the ninth risk value to obtain the fourth risk value.

[0011] Optionally, a fourth risk coefficient is obtained by weighted calculation according to the third risk value and the fourth risk value, including: obtaining a third weight and a fourth weight, the third weight being a weight corresponding to the third risk value, and the fourth weight being a weight corresponding to the fourth risk value; calculating a product of the third risk value and the third weight and a product of the fourth risk value and the fourth weight, and summing the products to obtain the fourth risk coefficient.

[0012] According to another aspect of the present application, there is provided a network security risk assessment apparatus, comprising: a first obtaining unit configured to obtain target log information, determine a corresponding first risk value according to different types of the target log information, and perform weighted calculation to obtain a first risk coefficient, wherein the target log information comprises access logs, security logs, version application logs and database logs; a second obtaining unit configured to obtain a monitoring parameter group, determine a corresponding second risk value according to each monitoring parameter in the monitoring parameter group, and perform weighted calculation to obtain a second risk coefficient, wherein the monitoring parameter group comprises device anomaly identifiers, CPU occupancy, memory occupancy, disk occupancy, interface traffic and interface data packet quantity; a first calculation unit configured to cross-verify the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list comprises first risk information and first vulnerability information existing in a network; a second calculation unit configured to perform static analysis according to the vulnerability risk list to obtain a third risk value, perform dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and perform weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; a third calculation unit configured to input the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, wherein the fifth risk coefficient is a risk coefficient of configuration information corresponding to the vulnerability risk list; and a fourth calculation unit configured to perform weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk assessment value.

[0013] According to still another aspect of the present application, there is provided a computer readable storage medium comprising a stored program, wherein the program, when executed, controls a device in which the computer readable storage medium is located to perform any of the methods.

[0014] According to yet another aspect of the present application, there is provided a network security system, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs comprise instructions for performing any of the methods.

[0015] The technical scheme is applied to the network security risk assessment method, first, target log information is acquired, a first risk value corresponding to different types of the target log information is determined and weighted calculation is performed to obtain a first risk coefficient, the target log information includes access log, security log, version application log and database log; then, a monitoring parameter group is acquired, a second risk value corresponding to each monitoring parameter in the monitoring parameter group is determined and weighted calculation is performed to obtain a second risk coefficient, the monitoring parameter group includes device exception identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface flow and interface data packet quantity; then, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are cross-verified to obtain a third risk coefficient and a vulnerability risk list, the vulnerability risk list includes first risk information and first vulnerability information existing in the network; then, a third risk value is obtained by performing static analysis according to the vulnerability risk list, a fourth risk value is obtained by performing dynamic analysis according to the vulnerability risk list, and a fourth risk coefficient is obtained by performing weighted calculation according to the third risk value and the fourth risk value; then, the vulnerability risk list is input into an audit tool to obtain a fifth risk coefficient, the fifth risk coefficient is a risk coefficient of configuration information corresponding to the vulnerability risk list; finally, a risk assessment value is obtained by performing weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient. The present application quantifies all threats faced in the network security scene, determines corresponding risk values, and calculates the final risk value by comprehensively considering the risk values from multiple aspects, which is used to represent the risk situation of the network security of the information system. The present application solves the problem that in the prior art, the staff needs to reach the evaluation site, and the manpower and time consumption is large. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A hardware structure block diagram of a mobile terminal showing a network security risk assessment method provided in an embodiment of the present application is shown;

[0017] Figure 2 A flowchart showing a network security risk assessment method provided in an embodiment of the present application is shown;

[0018] Figure 3 A structure block diagram of a network security risk assessment device provided in an embodiment of the present application is shown.

[0019] Among them, the above-mentioned drawings include the following reference signs:

[0020] 102, processor; 104, memory; 106, transmission device; 108, input and output device. DETAILED DESCRIPTION

[0021] It should be noted that the embodiments and features of the embodiments in the present application can be combined with each other in the case of no conflict. The present application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0022] In order for those skilled in the technical field to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] As introduced in the background, the network security assessment in the prior art needs the staff to reach the assessment site. To solve the problem of large consumption of manpower and time in the prior art that the network security assessment needs the staff to reach the assessment site, the embodiments of the present application provide a network security risk assessment method, device, computer readable storage medium and network security system.

[0025] The technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application.

[0026] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking the case of running on a mobile terminal, Figure 1 is a hardware structure block diagram of a mobile terminal of a network security risk assessment method of the embodiments of the present application. As Figure 1 shown, the mobile terminal can include one or more Figure 1The mobile terminal can further include a transmission device 106 for communication function and an input / output device 108. Those skilled in the art can understand that, Figure 1 The structure shown is only schematic and does not limit the structure of the mobile terminal. For example, the mobile terminal can include more or less components than those shown, or have a different configuration or arrangement of the components. Figure 1 The mobile terminal can include more or less components than those shown, or have a different configuration or arrangement of the components. Figure 1 The mobile terminal can include more or less components than those shown, or have a different configuration or arrangement of the components.

[0027] The memory 104 can be used to store computer programs, such as software programs of application software and modules, such as the computer program corresponding to the method for displaying device information in the embodiments of the present application. The processor 102 can execute various functional applications and data processing by running the computer programs stored in the memory 104, i.e., implement the method described above. The memory 104 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, and the remote memory can be connected to the mobile terminal through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The specific examples of the network can include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet in a wireless manner.

[0028] In the embodiments, a network security risk assessment method running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 2 is a flowchart of the network security risk assessment method according to the embodiments of the present application. As Figure 2 shown, the method includes the following steps:

[0030] Step S201, obtaining target log information, determining corresponding first risk values according to different types of the target log information and performing weighted calculation to obtain a first risk coefficient, the target log information including access logs, security logs, version application logs and database logs;

[0031] Specifically, the running logs of the security devices in the platform of the target security system are comprehensively collected, including access logs, security logs, version application logs and database logs, to obtain the target log information. These running log information covers various running details of the system, including but not limited to kernel messages, user login events and program errors. Then, the proportion of abnormal information in each type of log is determined to obtain the first risk value, and the first risk values corresponding to various logs are weighted to obtain the first risk coefficient.

[0032] Step S202, obtaining a monitoring parameter group, determining corresponding second risk values according to each monitoring parameter in the monitoring parameter group and performing weighted calculation to obtain a second risk coefficient, the monitoring parameter group including device abnormality identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic and interface data packet quantity;

[0033] Specifically, in order to further ensure the accuracy of risk assessment, in addition to analyzing the log information, the application sets to monitor the running state parameters of the security devices to obtain the monitoring parameter group, which includes device abnormality identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic and interface data packet quantity. Each running state parameter is evaluated to obtain the corresponding second risk value, and the second risk values are weighted to obtain the second risk coefficient.

[0034] Step S203, cross-verification of the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, the vulnerability risk list including first risk information and first vulnerability information existing in the network;

[0035] Specifically, in order to avoid inaccurate analysis results, the application sets to cross-verify the analysis results according to the analysis results, fuse the analysis results based on logs and device running parameters, determine the possible vulnerabilities and risks in the network security system to obtain the vulnerability risk list, and then score the security system according to the vulnerability risk list to obtain the third risk coefficient.

[0036] Step S204, performing static analysis according to the vulnerability risk list to obtain a third risk value, performing dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performing weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient.

[0037] Specifically, the third risk value is obtained by performing static analysis on the code field corresponding to the risks and vulnerabilities included in the vulnerability risk list, and then a corresponding simulation environment is constructed according to the code field, and the fourth risk coefficient is obtained by evaluating the running result, and then the fourth risk coefficient is obtained by weighting the third risk value and the fourth risk value.

[0038] In step S205, the fifth risk coefficient is obtained by inputting the vulnerability risk list into the audit tool, and the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list.

[0039] Specifically, the risks and vulnerabilities in the vulnerability risk list are checked and supplemented based on the existing audit tool, and then the fifth risk coefficient is obtained by evaluation.

[0040] In step S206, the risk assessment value is obtained by weighting calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient.

[0041] Specifically, the risk coefficients obtained by different ways are weighted and calculated to obtain the final risk assessment value, which is used to represent the size of the potential risk of the current security system.

[0042] By the embodiment, first, target log information is acquired, a corresponding first risk value is determined according to different types of the target log information, and a first risk coefficient is obtained through weighted calculation, the target log information including access logs, security logs, version application logs and database logs; then, a monitoring parameter group is acquired, a corresponding second risk value is determined according to each monitoring parameter in the monitoring parameter group, and a second risk coefficient is obtained through weighted calculation, the monitoring parameter group including device exception identifiers, CPU occupancy, memory occupancy, disk occupancy, interface traffic and interface data packet quantity; thereafter, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are cross-verified to obtain a third risk coefficient and a vulnerability risk list, the vulnerability risk list including first risk information and first vulnerability information existing in the network; thereafter, a third risk value is obtained through static analysis according to the vulnerability risk list, a fourth risk value is obtained through dynamic analysis according to the vulnerability risk list, and a fourth risk coefficient is obtained through weighted calculation according to the third risk value and the fourth risk value; thereafter, the vulnerability risk list is input into an audit tool to obtain a fifth risk coefficient, the fifth risk coefficient being a risk coefficient of configuration information corresponding to the vulnerability risk list; finally, a risk assessment value is obtained through weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient. The application quantifies all threats faced in a network security scene, determines corresponding risk values, and calculates a final risk value by comprehensively considering multiple risk values, for representing a risk situation of network security of an information system. The application solves the problem of large consumption of manpower and time in network security evaluation in the prior art.

[0043] To obtain the first risk coefficient, in an optional embodiment, the step S201 includes:

[0044] In step S2011, abnormal behaviors of users are determined according to the access logs, and a ratio of a number of the abnormal behaviors to a total number of behaviors is determined as the first risk value corresponding to the access logs.

[0045] Specifically, access behaviors of users to security devices in a security system are determined according to the access logs, and risk behaviors are analyzed to obtain the abnormal behaviors, and a ratio of a number of abnormal operations to a total number of accesses of users is determined as the first risk value corresponding to the access logs.

[0046] In step S2012, attack information is determined according to the security logs, a number of times of network attacks is determined according to the attack information, and a ratio of the number of times of network attacks to a number of times of accesses is determined as the first risk value corresponding to the security logs.

[0047] Specifically, reading the security log of the security device, it can be determined that the security system is attacked, that is, the attack information is obtained, and then according to the ratio of the number of attacks to the total access times of the security system, the first risk value corresponding to the security log is determined.

[0048] Step S2013, according to the version application log, the second vulnerability information and the second risk information existing in the current version are determined, and the first risk value corresponding to the version application log is determined according to the number of the second vulnerability information and the second risk information.

[0049] Specifically, based on the version application log, the version information of the current security system can be determined, and then according to the configuration information of the security system, the vulnerability information and risk information that the current security system fails to solve in the development process can be determined, that is, the second risk information and the second vulnerability information are obtained, and then the first risk value corresponding to the version application log is determined according to the number of vulnerabilities and risks existing in the version system.

[0050] Step S2014, according to the database log, the abnormal data is determined, and the ratio of the number of abnormal data to the total number of all data is determined as the first risk value corresponding to the database log.

[0051] Specifically, according to the database log corresponding to the database, the abnormal data in the database can be determined, and then the first risk value corresponding to the database log is determined according to the ratio of the number of abnormal data to the number of data included in the database.

[0052] Step S2015, according to the type of the target log information corresponding to each of the first risk values, a corresponding weight is determined to obtain a plurality of first weights, and the first weight corresponds to the first risk value one by one.

[0053] Specifically, according to the type of the target log information corresponding to each of the first risk values, a corresponding weight is determined to obtain a plurality of first weights, and the first weight corresponds to the first risk value one by one.

[0054] Step S2016, the product of each of the first risk values and the corresponding first weight is calculated and summed to obtain the first risk coefficient.

[0055] Specifically, according to each of the first risk values and the first weight, the first risk coefficient is obtained by weighted calculation.

[0056] In order to obtain the second risk coefficient, in an optional embodiment, the step S202 comprises:

[0057] Step S2021, according to the device exception identifier, the number of abnormal devices is determined, and the ratio of the number of abnormal devices to the total number of devices is determined as the second risk value corresponding to the device exception identifier;

[0058] Specifically, according to the device exception identifier, the number of abnormal devices is determined, and then the ratio of the number of abnormal devices to the total number of devices in the network security system is determined as the second risk value corresponding to the abnormal device identifier.

[0059] Step S2022, a first difference value is obtained by calculating the difference between the CPU occupancy rate and the preset CPU occupancy rate, and the second risk value corresponding to the CPU occupancy rate is determined according to the interval to which the first difference value belongs;

[0060] Specifically, the higher the current CPU occupancy, the worse the network security system's ability to respond to attacks, so the application sets the preset CPU occupancy, which is the maximum CPU occupancy allowed without affecting the security devices in the network security system to respond to attacks. Then calculate the difference between the CPU occupancy rate and the preset CPU occupancy rate, and in the case that the CPU occupancy rate is greater than the preset CPU occupancy rate, determine the corresponding risk value according to the interval to which the absolute value of the difference belongs, to obtain the second risk value corresponding to the CPU occupancy rate.

[0061] Step S2023, a second difference value is obtained by calculating the difference between the memory occupancy rate and the preset memory occupancy rate, and the second risk value corresponding to the memory occupancy rate is determined according to the interval to which the second difference value belongs;

[0062] Specifically, the higher the current memory occupancy, the worse the network security system's ability to respond to attacks, so the application sets the preset memory occupancy, which is the maximum memory occupancy allowed without affecting the security devices in the network security system to respond to attacks. Then calculate the difference between the memory occupancy rate and the preset memory occupancy rate, and in the case that the memory occupancy rate is greater than the preset memory occupancy rate, determine the corresponding risk value according to the interval to which the absolute value of the difference belongs, to obtain the second risk value corresponding to the memory occupancy rate.

[0063] Step S2024, a third difference value is obtained by calculating the difference between the disk occupancy rate and the preset disk occupancy rate, and the second risk value corresponding to the disk occupancy rate is determined according to the interval to which the third difference value belongs;

[0064] Specifically, the higher the current occupancy of the disk, the worse the network security system can cope with attacks, so the application sets the above-mentioned preset disk occupancy rate, that is, the maximum disk occupancy rate allowed without affecting the security equipment in the network security system to cope with attacks. Further, the difference between the above-mentioned disk occupancy rate and the preset disk occupancy rate is calculated, and in the case that the disk occupancy rate is greater than the preset disk occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned disk occupancy rate is obtained.

[0065] Step S2025, the difference between the above-mentioned interface flow and the preset flow is calculated to obtain a fourth difference value, and the above-mentioned second risk value corresponding to the above-mentioned interface flow is determined according to the interval to which the above-mentioned fourth difference value belongs;

[0066] Specifically, the greater the interface flow, the greater the impact on the network security system when attacked, so the application sets the above-mentioned preset flow, that is, the maximum interface flow allowed without affecting the security equipment in the network security system to cope with attacks. Further, the difference between the above-mentioned interface flow and the preset flow occupancy rate is calculated, and in the case that the interface flow is greater than the preset flow, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned interface flow is obtained.

[0067] Step S2026, the difference between the above-mentioned interface data packet quantity and the preset data packet quantity is calculated to obtain a fifth difference value, and the above-mentioned second risk value corresponding to the above-mentioned interface data packet quantity is determined according to the interval to which the above-mentioned fifth difference value belongs;

[0068] Specifically, the greater the interface data packet quantity, the greater the impact on the network security system when attacked, so the application sets the above-mentioned preset data packet quantity, that is, the maximum interface data packet quantity allowed without affecting the security equipment in the network security system to cope with attacks. Further, the difference between the above-mentioned interface data packet quantity and the preset data packet quantity occupancy rate is calculated, and in the case that the interface data packet quantity is greater than the preset data packet quantity, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned interface data packet quantity is obtained.

[0069] Step S2027, according to the above-mentioned monitoring parameter corresponding to each of the above-mentioned second risk values, the second weight corresponding to the above-mentioned second risk value is determined, and the above-mentioned second weight corresponds to the above-mentioned second risk value one by one.

[0070] Specifically, according to each of the above-mentioned monitoring parameters, the corresponding preset weight is determined, that is, the above-mentioned second weight is obtained, and the sum of the above-mentioned second weights is 1.

[0071] Step S2028, the product of each of the above-mentioned second risk values and the corresponding above-mentioned second weight is calculated and summed to obtain the above-mentioned second risk coefficient.

[0072] Specifically, the second risk coefficient is calculated by weighting the second risk values and the corresponding second weights.

[0073] To obtain the third risk coefficient, in an optional embodiment, the step S203 includes:

[0074] In step S2031, a first training set is divided according to the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient.

[0075] Specifically, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are determined as the first training set.

[0076] In step S2032, the first training set is divided into a plurality of training subsets, any one of the training subsets is determined as a validation set, and the training subsets other than the validation set are determined as a second training set.

[0077] Specifically, the first training set is divided into k subsets of equal size to obtain the training subsets, and then one of the training subsets is determined as the validation set, and the other training subsets are determined as the second training set.

[0078] In step S2033, an analysis model is trained according to the second training set and verified according to the validation set to obtain a fourth risk value.

[0079] Specifically, the analysis model is trained based on the second training set, and the performance of the analysis model is evaluated according to the validation set. The validation results, including the accuracy, precision and recall rate of the model, are recorded, and the corresponding risk value is determined according to the validation results to obtain the fourth risk value.

[0080] In step S2034, the division step and the verification step are repeated at least once in sequence until the fourth risk values corresponding to all the validation sets are obtained, and the average of the fourth risk values is calculated to obtain the third risk coefficient.

[0081] Specifically, the division step and the verification step are repeated, the training subsets are respectively taken as the validation sets, the corresponding fourth risk values are obtained, and then the average of the k fourth risk values is calculated to obtain the third risk coefficient.

[0082] To obtain the third risk value, in an optional embodiment, the step S204 includes:

[0083] Step S2041, determining a first target code according to the first risk information in the vulnerability risk list, and determining a second target code according to the first vulnerability information in the vulnerability risk list;

[0084] Specifically, the first target code is determined according to the application program and system source code or binary code corresponding to the risk information in the vulnerability risk list, and the second target code is determined according to the application program and system source code or binary code corresponding to the vulnerability information in the vulnerability risk list.

[0085] Step S2042, determining a sixth risk value according to the matching between the first target code and a preset code template, and determining a seventh risk value according to the matching between the second target code and the preset code template;

[0086] Specifically, the standard risk model is introduced, and the sixth risk value and the seventh risk value are calculated based on the existing database and the third-party database.

[0087] Step S2043, calculating the mean value of the sixth risk value and the seventh risk value to obtain the third risk value.

[0088] Specifically, the mean value of the sixth risk value and the seventh risk value is calculated to obtain the third risk value.

[0089] In order to obtain the fourth risk value, in an optional embodiment, the step S204 further includes:

[0090] Step S2044, constructing a simulation environment according to the first risk information and / or the first vulnerability information in the vulnerability risk list, the simulation environment being a network environment under an attack situation;

[0091] Specifically, the first risk information and the first vulnerability information are combined according to the first risk information and the first vulnerability information, and the simulation environment corresponding to the simulated real attack scene is constructed.

[0092] Step S2045, verifying the first risk information and the first vulnerability information according to the simulation environment, determining a first target risk and a first target vulnerability, the first target risk being the first risk information triggered in the simulation environment, and the first target vulnerability being the first vulnerability information triggered in the simulation environment;

[0093] Specifically, the system is attacked through a series of simulated attacks in the simulation environment, and the first risk information and the first vulnerability information that can be utilized in the first risk information and the first vulnerability information are determined as the first target risk and the first target vulnerability.

[0094] Step S2046, determining an eighth risk value according to a ratio of the first target risk and the first risk information, determining a ninth risk value according to a ratio of the first target vulnerability and the first vulnerability information, and calculating a mean value of the eighth risk value and the ninth risk value to obtain the fourth risk value.

[0095] Specifically, the eighth risk value is determined according to a ratio of a number of risk information utilized in the verification process and a total number of risk information, and the ninth risk value is determined according to a ratio of a number of vulnerability information utilized in the verification process and a total number of vulnerability information. Further, the fourth risk value is determined according to a mean value of the eighth risk value and the ninth risk value.

[0096] To obtain the fourth risk coefficient, in an optional embodiment, the step S204 further includes:

[0097] Step S2047, obtaining a third weight and a fourth weight, the third weight being a weight corresponding to the third risk value, and the fourth weight being a weight corresponding to the fourth risk value.

[0098] Specifically, the results of the static analysis and the dynamic analysis, i.e., the third risk value and the fourth risk value, are obtained respectively, and the corresponding emphasis ratios, i.e., the third weight and the fourth weight, are read.

[0099] Step S2048, calculating a product of the third risk value and the third weight and a product of the fourth risk value and the fourth weight, and summing the products to obtain the fourth risk coefficient.

[0100] Specifically, the fourth risk coefficient is calculated by weighted average according to the third risk value, the fourth risk value, the third weight and the fourth weight.

[0101] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0102] The embodiment of the present application further provides a network security risk assessment device. It should be noted that the network security risk assessment device of the embodiment of the present application can be used to execute the network security risk assessment method provided by the embodiment of the present application. The device is used to realize the above-mentioned embodiment and preferred embodiment, and details are not repeated. As used below, the term "module" can be a combination of software and / or hardware that realizes a predetermined function. Although the device described in the following embodiment is preferably realized in software, realization of hardware, or a combination of software and hardware, is also possible and contemplated.

[0103] The network security risk assessment device provided by the embodiment of the present application is introduced below.

[0104] Figure 3 is a structural block diagram of the network security risk assessment device according to the embodiment of the present application. As shown in Figure 3 , the device comprises:

[0105] The first acquisition unit 10 is configured to acquire target log information, determine a corresponding first risk value according to different types of the target log information, and perform weighted calculation to obtain a first risk coefficient. The target log information comprises access logs, security logs, version application logs and database logs.

[0106] Specifically, the running logs of the security device in the platform of the target security system are comprehensively collected, including access logs, security logs, version application logs and database logs, to obtain the target log information. These running log information covers various running details of the system, including but not limited to kernel messages, user login events and program errors. Then, the proportion of abnormal information in each type of log is determined to obtain the first risk value, and the first risk value corresponding to each type of log is weighted to obtain the first risk coefficient.

[0107] The second acquisition unit 20 is configured to acquire a monitoring parameter group, determine a corresponding second risk value according to each monitoring parameter in the monitoring parameter group, and perform weighted calculation to obtain a second risk coefficient. The monitoring parameter group comprises device abnormality identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic and interface data packet quantity.

[0108] Specifically, in order to further ensure the accuracy of risk assessment, in addition to analyzing the log information, the present application sets to monitor the running state parameters of the security device to obtain the monitoring parameter group, which comprises device abnormality identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic and interface data packet quantity. Each running state parameter is evaluated to obtain the corresponding second risk value, and the second risk value is weighted to obtain the second risk coefficient.

[0109] The first computing unit 30 is configured to cross-verify the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list includes the first risk information and the first vulnerability information existing in the network.

[0110] Specifically, in order to avoid inaccurate analysis results, the present application cross-verifies the analysis results based on logs and device operation parameters, fuses the analysis results, determines the possible vulnerabilities and risks in the network security system to obtain the vulnerability risk list, and then scores the security system according to the vulnerability risk list to obtain the third risk coefficient.

[0111] The second computing unit 40 is configured to perform static analysis according to the vulnerability risk list to obtain a third risk value, perform dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and perform weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient.

[0112] Specifically, the third risk value is obtained by performing static analysis on the code field corresponding to the risks and vulnerabilities in the vulnerability risk list, and then the fourth risk coefficient is obtained by constructing a corresponding simulation environment according to the code field, simulating running, and evaluating the running results.

[0113] The third computing unit 50 is configured to input the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, wherein the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list.

[0114] Specifically, the audit tool is used to check and supplement the risks and vulnerabilities in the vulnerability risk list, and then the fifth risk coefficient is obtained by evaluation.

[0115] The fourth computing unit 60 is configured to perform weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient, and the fifth risk coefficient to obtain a risk evaluation value.

[0116] Specifically, the risk evaluation value is obtained by weighting the risk coefficients evaluated by different methods, which is used to represent the potential risk of the current security system.

[0117] By the embodiment, the first acquisition unit acquires target log information, determines corresponding first risk values according to different types of the target log information and performs weighted calculation to obtain a first risk coefficient, the target log information includes access log, security log, version application log and database log; the second acquisition unit acquires a monitoring parameter group, determines corresponding second risk values according to each monitoring parameter in the monitoring parameter group and performs weighted calculation to obtain a second risk coefficient, the monitoring parameter group includes device exception identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic and interface data packet quantity; the first calculation unit cross- verifies the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list, the vulnerability risk list includes first risk information and first vulnerability information existing in the network; the second calculation unit performs static analysis according to the vulnerability risk list to obtain a third risk value, performs dynamic analysis according to the vulnerability risk list to obtain a fourth risk value, and performs weighted calculation according to the third risk value and the fourth risk value to obtain a fourth risk coefficient; the third calculation unit inputs the vulnerability risk list into an audit tool to obtain a fifth risk coefficient, the fifth risk coefficient is a risk coefficient of configuration information corresponding to the vulnerability risk list; the fourth calculation unit performs weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain a risk evaluation value. The application quantifies all threats faced in the network security scene, determines corresponding risk values, and calculates the final risk value by comprehensively considering the risk values from multiple aspects, which is used to represent the risk situation of the network security of the information system. The application solves the problem that in the prior art, a staff needs to reach the evaluation site for network security evaluation, which consumes a lot of manpower and time.

[0118] To obtain the first risk coefficient, in an optional implementation, the first acquisition unit includes:

[0119] The first determination module is configured to determine abnormal behavior of a user according to the access log, and determine the first risk value corresponding to the access log as a ratio of a number of times of the abnormal behavior to a total number of behaviors.

[0120] Specifically, the access behavior of the user to the security device in the security system is determined according to the access log, and then the risk behavior is analyzed to obtain the abnormal behavior, and then the ratio of the number of times of the abnormal operation of the user to the total number of times of the user access is determined as the first risk value corresponding to the access log.

[0121] The second determination module is configured to determine attack information according to the security log, determine the number of times of network attacks according to the attack information, and determine the first risk value corresponding to the security log as a ratio of the number of times of network attacks to the number of times of access.

[0122] Specifically, by reading the security log of the security device, it can be determined that the security system is attacked, that is, the attack information is obtained, and then according to the ratio of the number of attacks to the total number of accesses of the security system, the first risk value corresponding to the security log is determined.

[0123] The third determining module is configured to determine second vulnerability information and second risk information existing in the current version according to the version application log, and determine the first risk value corresponding to the version application log according to the number of the second vulnerability information and the second risk information.

[0124] Specifically, based on the version application log, the version information of the current security system can be determined, and then according to the analysis of the configuration information of the security system, the vulnerability information and risk information that the current security system fails to solve in the development process can be determined, that is, the second risk information and the second vulnerability information are obtained, and then the first risk value corresponding to the version application log is determined according to the number of vulnerabilities and risks existing in the version system.

[0125] The fourth determining module is configured to determine abnormal data according to the database log, and determine the first risk value corresponding to the database log according to the ratio of the number of the abnormal data to the total number of all data.

[0126] Specifically, according to the database log corresponding to the database, the abnormal data in the database can be determined, and then the first risk value corresponding to the database log is determined according to the ratio of the number of abnormal data to the number of data included in the database.

[0127] The fifth determining module is configured to determine a plurality of first weights by determining the type of the target log information corresponding to each of the first risk values, wherein the first weights correspond to the first risk values one by one.

[0128] Specifically, the first weights are determined according to the types of the log information corresponding to each of the target log information, and the sum of the first weights is 1.

[0129] The first calculating module is configured to calculate the product of each of the first risk values and the first weight corresponding thereto and sum the products to obtain the first risk coefficient.

[0130] Specifically, the first risk coefficient is obtained by weighted calculation according to each of the first risk values and the first weight.

[0131] In order to obtain the second risk coefficient, in an optional implementation, the second obtaining unit comprises:

[0132] a sixth determining module configured to determine the number of abnormal devices according to the device abnormality identifier, and determine the second risk value corresponding to the device abnormality identifier as the ratio of the number of abnormal devices to the total number of devices in the network security system;

[0133] Specifically, the number of abnormal devices is determined according to the device abnormality identifier, and then the second risk value corresponding to the abnormal device identifier is determined as the ratio of the number of abnormal devices to the total number of devices in the network security system.

[0134] A seventh determining module is configured to calculate a first difference value between the CPU occupancy rate and a preset CPU occupancy rate, and determine the second risk value corresponding to the CPU occupancy rate according to the interval to which the first difference value belongs.

[0135] Specifically, the higher the current CPU occupancy, the worse the ability of the network security system to respond to attacks, and therefore the application sets the preset CPU occupancy rate, which is the maximum CPU occupancy rate allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the CPU occupancy rate and the preset CPU occupancy rate is calculated, and in the case where the CPU occupancy rate is greater than the preset CPU occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, to obtain the second risk value corresponding to the CPU occupancy rate.

[0136] An eighth determining module is configured to calculate a second difference value between the memory occupancy rate and a preset memory occupancy rate, and determine the second risk value corresponding to the memory occupancy rate according to the interval to which the second difference value belongs.

[0137] Specifically, the higher the current memory occupancy, the worse the ability of the network security system to respond to attacks, and therefore the application sets the preset memory occupancy rate, which is the maximum memory occupancy rate allowed without affecting the ability of the security devices in the network security system to respond to attacks. Then, the difference between the memory occupancy rate and the preset memory occupancy rate is calculated, and in the case where the memory occupancy rate is greater than the preset memory occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, to obtain the second risk value corresponding to the memory occupancy rate.

[0138] A ninth determining module is configured to calculate a third difference value between the disk occupancy rate and a preset disk occupancy rate, and determine the second risk value corresponding to the disk occupancy rate according to the interval to which the third difference value belongs.

[0139] Specifically, the higher the current occupancy of the disk, the worse the network security system can cope with attacks, and therefore the application is provided with the above-mentioned preset disk occupancy rate, that is, the maximum disk occupancy rate allowed without affecting the security equipment in the network security system to cope with attacks. Further, the difference between the above-mentioned disk occupancy rate and the preset disk occupancy rate is calculated, and in the case that the disk occupancy rate is greater than the preset disk occupancy rate, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned disk occupancy rate is obtained.

[0140] The tenth determining module is configured to calculate a fourth difference value between the interface flow and a preset flow, and determine the second risk value corresponding to the interface flow according to an interval to which the fourth difference value belongs.

[0141] Specifically, the greater the interface flow, the greater the impact on the network security system when attacked, and therefore the application is provided with the above-mentioned preset flow, that is, the maximum interface flow allowed without affecting the security equipment in the network security system to cope with attacks. Further, the difference between the above-mentioned interface flow and the preset flow is calculated, and in the case that the interface flow is greater than the preset flow, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned interface flow is obtained.

[0142] The eleventh determining module is configured to calculate a fifth difference value between the interface data packet quantity and a preset data packet quantity, and determine the second risk value corresponding to the interface data packet quantity according to an interval to which the fifth difference value belongs.

[0143] Specifically, the greater the interface data packet quantity, the greater the impact on the network security system when attacked, and therefore the application is provided with the above-mentioned preset data packet quantity, that is, the maximum interface data packet quantity allowed without affecting the security equipment in the network security system to cope with attacks. Further, the difference between the above-mentioned interface data packet quantity and the preset data packet quantity is calculated, and in the case that the interface data packet quantity is greater than the preset data packet quantity, the corresponding risk value is determined according to the interval to which the absolute value of the difference belongs, and the above-mentioned second risk value corresponding to the above-mentioned interface data packet quantity is obtained.

[0144] The twelfth determining module is configured to determine a second weight corresponding to the second risk value according to the monitoring parameter corresponding to the second risk value, and the second weight and the second risk value correspond one-to-one.

[0145] Specifically, the corresponding preset weight is determined according to each of the above-mentioned monitoring parameters, that is, the above-mentioned second weight is obtained, and the sum of the second weights is 1.

[0146] The second calculating module is configured to calculate the product of each of the second risk values and the corresponding second weight and sum them up to obtain the second risk coefficient.

[0147] Specifically, the second risk coefficient is calculated by weighting the second risk value and the corresponding second weight.

[0148] To obtain the third risk coefficient, in an optional embodiment, the first calculation unit comprises:

[0149] The first division module is configured to divide a first training set according to the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient.

[0150] Specifically, the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient are determined as the first training set.

[0151] The second division module is configured to perform the division step, divide the first training set into a plurality of training subsets, determine any one of the training subsets as a validation set, and determine the training subsets other than the validation set as a second training set.

[0152] Specifically, the first training set is divided into k subsets of equal size to obtain the training subsets, and then one of the training subsets is determined as the validation set, and the other training subsets are determined as the second training set.

[0153] The first verification module is configured to perform the verification step, train an analysis model according to the second training set, and verify the analysis model according to the validation set to obtain a fourth risk value.

[0154] Specifically, the analysis model is trained based on the second training set, and the performance of the analysis model is evaluated according to the validation set. The verification results, including the accuracy, precision, and recall rate of the model, are recorded, and the corresponding risk value is determined according to the verification results to obtain the fourth risk value.

[0155] The repeating module is configured to repeat the division step and the verification step at least once in turn until the fourth risk values corresponding to all the validation sets are obtained, and calculate the average of the fourth risk values to obtain the third risk coefficient.

[0156] Specifically, the division step and the verification step are repeated, the training subsets are respectively taken as the validation sets, the corresponding fourth risk values are obtained, and then the average of the k fourth risk values is calculated to obtain the third risk coefficient.

[0157] To obtain the third risk value, in an optional embodiment, the second calculation unit comprises:

[0158] The thirteenth determining module is configured to determine a first target code according to a first risk information in the vulnerability risk list and a second target code according to a first vulnerability information.

[0159] Specifically, the first target code is determined according to the application program and the system source code or the binary code corresponding to the first risk information in the vulnerability risk list, and the second target code is determined according to the application program and the system source code or the binary code corresponding to the first vulnerability information in the vulnerability risk list.

[0160] The fourteenth determining module is configured to determine a sixth risk value according to a matching between the first target code and a preset code template and determine a seventh risk value according to a matching between the second target code and the preset code template.

[0161] Specifically, the standard risk model is introduced, and the sixth risk value and the seventh risk value are calculated based on the existing database and the third-party database.

[0162] The third calculating module is configured to calculate a mean value of the sixth risk value and the seventh risk value to obtain the third risk value.

[0163] Specifically, the third risk value is calculated according to the mean value of the sixth risk value and the seventh risk value.

[0164] In order to obtain the fourth risk value, in an optional implementation, the second calculating unit further includes:

[0165] The constructing module is configured to construct a simulation environment according to the first risk information and / or the first vulnerability information in the vulnerability risk list, and the simulation environment is a network environment under an attack situation.

[0166] Specifically, the first risk information and the first vulnerability information are combined, and a corresponding simulation scene of a real attack is constructed to obtain the simulation environment.

[0167] The second verifying module is configured to verify the first risk information and the first vulnerability information according to the simulation environment, determine a first target risk and a first target vulnerability, the first target risk is the first risk information triggered in the simulation environment, and the first target vulnerability is the first vulnerability information triggered in the simulation environment.

[0168] Specifically, in the simulation environment, the system is attacked by a series of simulated attacks, the first risk information and the first vulnerability information that can be exploited are determined from the first risk information and the first vulnerability information, and the first target risk and the first target vulnerability are determined.

[0169] The fourth calculation module is configured to determine an eighth risk value according to a ratio of the first target risk to the first risk information, determine a ninth risk value according to a ratio of the first target vulnerability to the first vulnerability information, and calculate a mean value of the eighth risk value and the ninth risk value to obtain the fourth risk value.

[0170] Specifically, the ratio of the number of risk information exploited in the verification process to the total number of risk information is determined as the eighth risk value, and the ratio of the number of vulnerability information exploited in the verification process to the total number of vulnerability information is determined as the ninth risk value. Further, the fourth risk value is determined according to the mean value of the eighth risk value and the ninth risk value.

[0171] In order to obtain the fourth risk coefficient, in an optional embodiment, the second calculation unit further comprises:

[0172] The acquisition module is configured to acquire a third weight and a fourth weight, the third weight being a weight corresponding to the third risk value, and the fourth weight being a weight corresponding to the fourth risk value.

[0173] Specifically, the results of the static analysis and the dynamic analysis, i.e., the third risk value and the fourth risk value, are acquired respectively, and the corresponding emphasis ratios, i.e., the third weight and the fourth weight, are read.

[0174] The fifth calculation module is configured to calculate a product of the third risk value and the third weight and a product of the fourth risk value and the fourth weight, and sum the products to obtain the fourth risk coefficient.

[0175] Specifically, the fourth risk coefficient is calculated by weighted average according to the third risk value, the fourth risk value, the third weight, and the fourth weight.

[0176] The network security risk assessment device comprises a processor and a memory, and the first acquisition unit, the second acquisition unit, the first calculation unit, the second calculation unit, the third calculation unit, and the fourth calculation unit are all stored in the memory as program units, and the corresponding functions are realized by the processor executing the program units stored in the memory. The modules are located in the same processor; or, the modules are located in different processors in any combination.

[0177] The processor comprises a core, and the core retrieves corresponding program units in the memory.

[0178] The memory can comprise a non-permanent memory in a computer readable medium, random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash memory (flash RAM), and the memory comprises at least one memory chip.

[0179] The embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium comprises a stored program, wherein the program controls a device where the computer readable storage medium is located to perform the network security risk assessment method when the program is running.

[0180] Specifically, the network security risk assessment method comprises:

[0181] In step S201, target log information is acquired, corresponding first risk values are determined according to different types of the target log information, and a first risk coefficient is obtained through weighted calculation, the target log information comprises access logs, security logs, version application logs and database logs;

[0182] In step S202, a monitoring parameter group is acquired, corresponding second risk values are determined according to each monitoring parameter in the monitoring parameter group, and a second risk coefficient is obtained through weighted calculation, the monitoring parameter group comprises device exception identifiers, CPU occupancy, memory occupancy, disk occupancy, interface traffic and interface data packet quantity;

[0183] In step S203, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are cross-verified to obtain a third risk coefficient and a vulnerability risk list, the vulnerability risk list comprises first risk information and first vulnerability information existing in the network;

[0184] In step S204, a third risk value is obtained through static analysis according to the vulnerability risk list, a fourth risk value is obtained through dynamic analysis according to the vulnerability risk list, and a fourth risk coefficient is obtained through weighted calculation according to the third risk value and the fourth risk value;

[0185] In step S205, the vulnerability risk list is input into an audit tool to obtain a fifth risk coefficient, the fifth risk coefficient is a risk coefficient of configuration information corresponding to the vulnerability risk list;

[0186] In step S206, a risk assessment value is obtained through weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient.

[0187] The embodiment of the present application provides a processor for running a program, wherein the processor performs the network security risk assessment method when running the program.

[0188] Specifically, the network security risk assessment method comprises the following steps:

[0189] In step S201, target log information is acquired, a corresponding first risk value is determined according to different types of the target log information, and a first risk coefficient is obtained through weighted calculation, wherein the target log information comprises access logs, security logs, version application logs and database logs;

[0190] In step S202, a monitoring parameter group is acquired, a corresponding second risk value is determined according to each monitoring parameter in the monitoring parameter group, and a second risk coefficient is obtained through weighted calculation, wherein the monitoring parameter group comprises device exception identifiers, CPU occupancy, memory occupancy, disk occupancy, interface traffic and interface data packet quantity;

[0191] In step S203, the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are cross-verified to obtain a third risk coefficient and a vulnerability risk list, wherein the vulnerability risk list comprises first risk information and first vulnerability information existing in the network;

[0192] In step S204, a third risk value is obtained through static analysis according to the vulnerability risk list, a fourth risk value is obtained through dynamic analysis according to the vulnerability risk list, and a fourth risk coefficient is obtained through weighted calculation according to the third risk value and the fourth risk value;

[0193] In step S205, the vulnerability risk list is input into an audit tool to obtain a fifth risk coefficient, wherein the fifth risk coefficient is a risk coefficient of configuration information corresponding to the vulnerability risk list;

[0194] In step S206, a risk assessment value is obtained through weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient.

[0195] The embodiment of the present application provides a network security system, which comprises a processor, a memory and a program stored in the memory and capable of running on the processor, and the processor performs the following steps when running the program:

[0196] In step S201, target log information is acquired, a corresponding first risk value is determined according to different types of the target log information, and a first risk coefficient is obtained through weighted calculation, wherein the target log information comprises access logs, security logs, version application logs and database logs;

[0197] Step S202, a monitoring parameter group is acquired, a second risk value corresponding to each monitoring parameter in the monitoring parameter group is determined, and a second risk coefficient is obtained by weighted calculation; the monitoring parameter group includes device anomaly identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic, and interface data packet quantity;

[0198] Step S203, cross verification is performed on the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list; the vulnerability risk list includes first risk information and first vulnerability information existing in the network;

[0199] Step S204, a third risk value is obtained by static analysis according to the vulnerability risk list, a fourth risk value is obtained by dynamic analysis according to the vulnerability risk list, and a fourth risk coefficient is obtained by weighted calculation according to the third risk value and the fourth risk value;

[0200] Step S205, the fifth risk coefficient is obtained by inputting the vulnerability risk list into an audit tool; the fifth risk coefficient is a risk coefficient of configuration information corresponding to the vulnerability risk list;

[0201] Step S206, a risk assessment value is obtained by weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient, and the fifth risk coefficient.

[0202] The application also provides a computer program product adapted to execute the program of at least the following method steps when executed on a data processing device:

[0203] Step S201, target log information is acquired, a first risk value corresponding to different types of the target log information is determined, and a first risk coefficient is obtained by weighted calculation; the target log information includes access log, security log, version application log, and database log;

[0204] Step S202, a monitoring parameter group is acquired, a second risk value corresponding to each monitoring parameter in the monitoring parameter group is determined, and a second risk coefficient is obtained by weighted calculation; the monitoring parameter group includes device anomaly identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic, and interface data packet quantity;

[0205] Step S203, cross verification is performed on the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list; the vulnerability risk list includes first risk information and first vulnerability information existing in the network;

[0206] Step S204, a third risk value is obtained by static analysis according to the vulnerability risk list, a fourth risk value is obtained by dynamic analysis according to the vulnerability risk list, and a fourth risk coefficient is obtained by weighted calculation according to the third risk value and the fourth risk value;

[0207] Step S205, the fifth risk coefficient is obtained by inputting the vulnerability risk list into the audit tool, and the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list.

[0208] Step S206, a risk assessment value is obtained by weighted calculation according to the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient and the fifth risk coefficient.

[0209] Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be realized by general computing devices, which can be concentrated on a single computing device or distributed on a network composed of multiple computing devices, and they can be realized by program codes executable by computing devices, so that they can be stored in storage devices and executed by computing devices, and in some cases, the steps shown or described can be executed in different order, or they can be manufactured into individual integrated circuit modules, or multiple modules or steps can be manufactured into a single integrated circuit module. Therefore, the present application is not limited to any specific hardware and software combination.

[0210] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can be in the form of complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

[0211] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The device that realizes the functions specified in one block or multiple blocks.

[0212] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the multiple flows or multiple blocks.

[0213] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the multiple flows or multiple blocks.

[0214] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0215] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory. The memory is an example of computer-readable media.

[0216] Computer-readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0217] It is also to be noted that the terms "comprising", "comprises" or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0218] From the above description, it can be seen that the above-mentioned embodiments of the present application achieve the following technical effects:

[0219] 1) The network security risk assessment method of the present application, first, obtains target log information, determines the corresponding first risk value according to different types of the above-mentioned target log information and performs weighted calculation to obtain the first risk coefficient, the above-mentioned target log information includes access log, security log, version application log and database log; then, obtains a monitoring parameter group, determines the corresponding second risk value according to each monitoring parameter in the above-mentioned monitoring parameter group and performs weighted calculation to obtain the second risk coefficient, the above-mentioned monitoring parameter group includes device exception identifier, CPU occupancy rate, memory occupancy rate, disk occupancy rate, interface traffic and interface data packet quantity; thereafter, cross-verify the above-mentioned target log information, the above-mentioned first risk coefficient, the above-mentioned monitoring parameter group and the above-mentioned second risk coefficient to obtain the third risk coefficient and the vulnerability risk list, the above-mentioned vulnerability risk list includes the first risk information and the first vulnerability information existing in the network; thereafter, perform static analysis according to the above-mentioned vulnerability risk list to obtain the third risk value, perform dynamic analysis according to the above-mentioned vulnerability risk list to obtain the fourth risk value, and perform weighted calculation according to the above-mentioned third risk value and the above-mentioned fourth risk value to obtain the fourth risk coefficient; thereafter, input the above-mentioned vulnerability risk list into an audit tool to obtain the fifth risk coefficient, the above-mentioned fifth risk coefficient is the risk coefficient of the configuration information corresponding to the above-mentioned vulnerability risk list; finally, perform weighted calculation according to the above-mentioned first risk coefficient, the above-mentioned second risk coefficient, the above-mentioned third risk coefficient, the fourth risk coefficient and the fifth risk coefficient to obtain the risk assessment value. The present application quantifies all threats faced in the network security scene, determines the corresponding risk value, and comprehensively calculates the final risk value from multiple risk values, which is used to represent the risk situation of the network security of the information system. The present application solves the problem of large consumption of manpower and time in the prior art network security evaluation which requires staff to reach the evaluation site.

[0220] 2) The network security risk assessment device of this application comprises: a first acquisition unit acquiring target log information, determining a corresponding first risk value based on different types of the target log information, and performing a weighted calculation to obtain a first risk coefficient; the target log information including access logs, security logs, version application logs, and database logs; a second acquisition unit acquiring a monitoring parameter group, determining a corresponding second risk value based on each monitoring parameter in the monitoring parameter group, and performing a weighted calculation to obtain a second risk coefficient; the monitoring parameter group including device anomaly identifier, CPU utilization, memory utilization, disk utilization, interface traffic, and the number of interface data packets; and a first calculation unit cross-calculating the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient. The verification process yields a third risk coefficient and a vulnerability risk list, which includes first risk information and first vulnerability information existing in the network. A second calculation unit performs static analysis based on the vulnerability risk list to obtain a third risk value, and dynamic analysis to obtain a fourth risk value. A weighted calculation is then performed on the third and fourth risk values ​​to obtain a fourth risk coefficient. A third calculation unit inputs the vulnerability risk list into an auditing tool to obtain a fifth risk coefficient, which is the risk coefficient of the configuration information corresponding to the vulnerability risk list. A fourth calculation unit performs a weighted calculation based on the first, second, third, fourth, and fifth risk coefficients to obtain a risk assessment value. This application quantifies all threats faced in network security scenarios, determines the corresponding risk values, and calculates a final risk value by integrating multiple risk values ​​to characterize the network security risk status of the information system. This application solves the problem in existing technologies where network security assessments require personnel to be physically present at the assessment site, resulting in significant manpower and time consumption.

[0221] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for risk assessment of cybersecurity, characterized in that, include: Obtain target log information, determine the corresponding first risk value based on the different types of target log information, and perform weighted calculation to obtain the first risk coefficient. The target log information includes access logs, security logs, version application logs, and database logs. A monitoring parameter group is obtained, and a second risk coefficient is obtained by weighting the corresponding second risk value based on each monitoring parameter in the monitoring parameter group. The monitoring parameter group includes device anomaly identifier, CPU utilization rate, memory utilization rate, disk utilization rate, interface traffic, and number of interface data packets. The target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient are cross-validated to obtain a third risk coefficient and a vulnerability risk list. The vulnerability risk list includes the first risk information and the first vulnerability information existing in the network. A third risk value is obtained by static analysis based on the vulnerability risk list, a fourth risk value is obtained by dynamic analysis based on the vulnerability risk list, and a fourth risk coefficient is obtained by weighted calculation based on the third risk value and the fourth risk value. The vulnerability risk list is input into the auditing tool to obtain the fifth risk coefficient, which is the risk coefficient of the configuration information corresponding to the vulnerability risk list. The risk assessment value is obtained by weighting the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient, and the fifth risk coefficient. A third risk coefficient is obtained by cross-validating the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient, including: The first training set is divided according to the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient; The partitioning step involves dividing the first training set into multiple training subsets, determining any one of the training subsets as the validation set, and determining the training subsets other than the validation set as the second training set. The verification step involves training an analysis model based on the second training set and verifying it based on the verification set to obtain a fourth risk value. The partitioning step and the verification step are repeated at least once until the fourth risk value corresponding to all the verification sets is obtained, and the average value of the fourth risk value is calculated to obtain the third risk coefficient. A fourth risk value is obtained through dynamic analysis based on the aforementioned vulnerability risk list, including: A simulation environment is constructed based on the first risk information and / or the first vulnerability information in the vulnerability risk list, wherein the simulation environment is a network environment under attack conditions. The first risk information and the first vulnerability information are verified based on the simulation environment to determine the first target risk and the first target vulnerability. The first target risk is the first risk information triggered in the simulation environment, and the first target vulnerability is the first vulnerability information obtained by triggering in the simulation environment. The eighth risk value is determined based on the ratio of the first target risk to the first risk information, the ninth risk value is determined based on the ratio of the first target vulnerability to the first vulnerability information, and the average of the eighth risk value and the ninth risk value is calculated to obtain the fourth risk value.

2. The method according to claim 1, characterized in that, Based on the different types of target log information, a corresponding first risk value is determined and a first risk coefficient is obtained through weighted calculation, including: Based on the access logs, abnormal user behavior is determined, and the ratio of the number of abnormal behaviors to the total number of behaviors is determined as the first risk value corresponding to the access logs. The attack information is determined based on the security log, the number of times the network was attacked is determined based on the attack information, and the ratio of the number of times the network was attacked to the number of times it was accessed is determined as the first risk value corresponding to the security log. Based on the application logs of the version, determine the second vulnerability information and the second risk information existing in the current version, and determine the first risk value corresponding to the application logs of the version based on the number of the second vulnerability information and the second risk information. Based on the database logs, abnormal data is identified, and the ratio of the number of abnormal data to the total number of all data is determined as the first risk value corresponding to the database logs. Multiple first weights are obtained by determining the corresponding weights based on the type of target log information corresponding to each first risk value, and each first weight corresponds to a first risk value. The first risk coefficient is obtained by multiplying each of the first risk values ​​and the corresponding first weights and summing the products.

3. The method according to claim 1, characterized in that, The second risk coefficient is obtained by weighting the corresponding second risk values ​​determined based on each monitoring parameter in the monitoring parameter group, including: The number of abnormal devices is determined based on the device anomaly identifier, and the ratio of the number of abnormal devices to the total number of devices is determined as the second risk value corresponding to the device anomaly identifier. The difference between the CPU utilization rate and the preset CPU utilization rate is calculated to obtain a first difference value, and the second risk value corresponding to the CPU utilization rate is determined based on the interval to which the first difference value belongs. The difference between the memory occupancy rate and the preset memory occupancy rate is calculated to obtain a second difference value, and the second risk value corresponding to the memory occupancy rate is determined based on the interval to which the second difference value belongs; The difference between the disk utilization rate and the preset disk utilization rate is calculated to obtain a third difference value, and the second risk value corresponding to the disk utilization rate is determined based on the interval to which the third difference value belongs; The difference between the interface traffic and the preset traffic is calculated to obtain a fourth difference value, and the second risk value corresponding to the interface traffic is determined according to the interval to which the fourth difference value belongs; The difference between the number of interface data packets and the preset number of data packets is calculated to obtain a fifth difference value. The second risk value corresponding to the number of interface data packets is determined based on the interval to which the fifth difference value belongs. The second weight corresponding to each second risk value is determined based on the monitoring parameters corresponding to each second risk value, and the second weight corresponds one-to-one with the second risk value. The second risk coefficient is obtained by multiplying each of the second risk values ​​and the corresponding second weights and summing the products.

4. The method according to claim 1, characterized in that, A third risk value is obtained through static analysis based on the aforementioned vulnerability risk list, including: Based on the first risk information in the vulnerability risk list, the corresponding code field is determined to obtain the first target code, and based on the first vulnerability information, the corresponding code field is determined to obtain the second target code. A sixth risk value is determined by matching the first target code with a preset code template, and a seventh risk value is determined by matching the second target code with the preset code template. The third risk value is obtained by calculating the average of the sixth and seventh risk values.

5. The method according to claim 1, characterized in that, The fourth risk coefficient is obtained by weighting the third risk value and the fourth risk value, including: Obtain the third weight and the fourth weight, wherein the third weight is the weight corresponding to the third risk value, and the fourth weight is the weight corresponding to the fourth risk value; The fourth risk coefficient is obtained by calculating the product of the third risk value and the third weight, and the product of the fourth risk value and the fourth weight.

6. A network security risk assessment device, characterized in that, The device includes: The first acquisition unit is used to acquire target log information, determine the corresponding first risk value according to the different types of target log information, and perform weighted calculation to obtain the first risk coefficient. The target log information includes access logs, security logs, version application logs, and database logs. The second acquisition unit is used to acquire a monitoring parameter group, determine the corresponding second risk value based on each monitoring parameter in the monitoring parameter group, and perform weighted calculation to obtain a second risk coefficient. The monitoring parameter group includes device anomaly identifier, CPU utilization rate, memory utilization rate, disk utilization rate, interface traffic, and number of interface data packets. The first calculation unit is used to cross-validate the target log information, the first risk coefficient, the monitoring parameter group and the second risk coefficient to obtain a third risk coefficient and a vulnerability risk list. The vulnerability risk list includes first risk information and first vulnerability information existing in the network. The second calculation unit is used to perform static analysis based on the vulnerability risk list to obtain a third risk value, perform dynamic analysis based on the vulnerability risk list to obtain a fourth risk value, and perform weighted calculation based on the third risk value and the fourth risk value to obtain a fourth risk coefficient. The third calculation unit is used to input the vulnerability risk list into the auditing tool to obtain the fifth risk coefficient, wherein the fifth risk coefficient is the risk coefficient of the configuration information corresponding to the vulnerability risk list; The fourth calculation unit is used to perform a weighted calculation based on the first risk coefficient, the second risk coefficient, the third risk coefficient, the fourth risk coefficient, and the fifth risk coefficient to obtain a risk assessment value; A third risk coefficient is obtained by cross-validating the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient, including: The first training set is divided according to the target log information, the first risk coefficient, the monitoring parameter group, and the second risk coefficient; The partitioning step involves dividing the first training set into multiple training subsets, determining any one of the training subsets as the validation set, and determining the training subsets other than the validation set as the second training set. The verification step involves training an analysis model based on the second training set and verifying it based on the verification set to obtain a fourth risk value. The partitioning step and the verification step are repeated at least once until the fourth risk value corresponding to all the verification sets is obtained, and the average value of the fourth risk value is calculated to obtain the third risk coefficient. A fourth risk value is obtained through dynamic analysis based on the aforementioned vulnerability risk list, including: A simulation environment is constructed based on the first risk information and / or the first vulnerability information in the vulnerability risk list, wherein the simulation environment is a network environment under attack conditions. The first risk information and the first vulnerability information are verified based on the simulation environment to determine the first target risk and the first target vulnerability. The first target risk is the first risk information triggered in the simulation environment, and the first target vulnerability is the first vulnerability information obtained by triggering in the simulation environment. The eighth risk value is determined based on the ratio of the first target risk to the first risk information, the ninth risk value is determined based on the ratio of the first target vulnerability to the first vulnerability information, and the average of the eighth risk value and the ninth risk value is calculated to obtain the fourth risk value.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 5.

8. A network security system, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors as described in any one of claims 1 to 5.

Images