A network security assessment information processing method and system

Abstract

The present invention relates to the field of network security technology, specifically to a network security assessment information processing method and system, comprising the following steps: based on the network security assessment information, collecting the configuration information and operation log of the target computer system, sorting the data according to the time information, and performing formatting and standardization processing to generate the operation data processing result. In the present invention, by sorting and formatting the data by time, optimizing the data quality, classifying the security events according to the time information and the severity, combining the event frequency analysis, improving the accuracy of threat identification, and by analyzing the damage risk level of various security threat types and adjusting the weight of the security assessment index, enhancing the response sensitivity and prediction ability of the assessment model, reducing the risk of misjudgment, and improving the adaptability and foresight of the security measures, ensuring that the security level assessment accurately reflects the actual security situation.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security assessment information processing method and system. Background Art

[0002] The field of network security technology focuses on protecting computer networks and systems from unauthorized access, data leakage, and network attacks, including multiple defense mechanisms such as firewalls, encryption protocols, intrusion detection systems, and secure operating systems, aiming to ensure data integrity, confidentiality, and availability. Through continuous monitoring and real-time analysis of network activities, it ensures real-time response to risky behaviors. In combination with technological advances and the evolution of network threats, it uses behavioral analysis technology, cloud security, and artificial intelligence to adapt to changing security needs.

[0003] Among them, the network security assessment information processing method focuses on the technical methods for security assessment and management of network systems, aiming to identify and repair security vulnerabilities in the network, ensure that the network environment can resist external and internal security threats, and conduct comprehensive security inspections and risk assessments on network equipment, services, and applications. It helps to improve the security protection level of the network and protect the data assets of enterprises or organizations from damage. It combines automated tools and expert analysis to ensure the effectiveness and timely updating of security measures.

[0004] Traditional network security assessment information processing methods are insufficient in dynamic assessment and real-time data analysis. They often rely on fixed rules and configurations when handling security incidents, lack real-time analysis of continuous data streams and changing trends, resulting in an untimely response to environmental changes. When integrating different data sources, they often cannot effectively perform data consistency and integrity verification, resulting in assessment results based on incomplete or erroneous information, affecting the accuracy of the assessment results, and failing to provide accurate grading and adjustment suggestions for actual security protection, increasing the risk of network system damage. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a network security assessment information processing method and system.

[0006] In order to achieve the above object, the present invention adopts the following technical solution, a method for processing network security assessment information, comprising the following steps:

[0007] S1: Based on the network security assessment information, collect the configuration information and operation log of the target computer system, sort the data according to the time information, and perform formatting and standardization processing to generate the operation data processing results;

[0008] S2: Based on the processing results of the operation data, multiple security incidents are classified according to time and severity, the occurrence frequency of multiple security incidents is analyzed, the damage risk level of multiple security threat types is predicted, and risk assessment information is generated;

[0009] S3: According to the risk assessment information, according to the damage levels and occurrence frequencies of various threat types, the weights of multiple security assessment indicators are adjusted, the assessment model parameters are optimized, and model parameter adjustment information is obtained;

[0010] S4: Based on the model parameter adjustment information, multiple evaluations are performed on the target computer system, the impact of multiple configuration items on the security level is analyzed, key configuration parameters are identified, and key configuration analysis results are generated;

[0011] S5: Evaluate the impact of various security configurations on threat protection through the key configuration analysis results, classify configuration items, identify risky configurations and security vulnerabilities, and generate security vulnerability identification information;

[0012] S6: Utilize the security vulnerability identification information to analyze the security performance of multiple components, evaluate the security level of the target computer system, and generate evaluation information processing results.

[0013] As a further scheme of the present invention, the operating data processing results include data integrity verification information, format consistency analysis results, and data anomaly marking results; the risk assessment information includes security incident classification statistics, event frequency data, and predicted security threat damage levels; the model parameter adjustment information includes adjusted security assessment indicator weights, optimized assessment model parameters, and weight distribution information of key risk factors; the key configuration analysis results include key security configuration item identification data, configuration item contribution analysis results to the security level, and risk point identification information; the security vulnerability identification information includes simulated attack test results, a risk configuration list, and identified security vulnerability information; the evaluation information processing results include security performance analysis data of multiple components, security level assessment scores, and key security risk points.

[0014] As a further solution of the present invention, based on the network security assessment information, the configuration information and operation log of the target computer system are collected, the data is sorted according to the time information, and formatted and standardized to generate the operation data processing results. Specifically, the steps are as follows:

[0015] S101: Based on the network security assessment information, collect the configuration information and operation logs of the target computer system, including the hardware configuration, operating system version and installed application list, sort them according to time, and generate configuration and log sorting results;

[0016] S102: Based on the configuration and the log sorting result, format the data, identify and eliminate non-standard characters and redundant data, and perform integrity check on the data to generate a formatting processing result;

[0017] S103: Based on the formatting processing result, the data is standardized, including adjusting the time format and the unified identifier, optimizing the integrity and consistency of the data, and generating an operation data processing result.

[0018] As a further solution of the present invention, according to the processing results of the operation data, multiple security events are classified according to time and severity, the occurrence frequency of multiple security events is analyzed, and the damage risk level of multiple security threat types is predicted. The steps of generating risk assessment information are specifically as follows:

[0019] S201: Based on the operation data processing result, classify the recorded security events according to the occurrence time and severity, and generate an event classification result;

[0020] S202: Based on the event classification result, according to the time series data of event occurrence, the occurrence frequency of various types of events is calculated to generate an event frequency analysis result;

[0021] S203: Using the event frequency analysis results, predict the damage risk levels of various security threat types, including evaluating the risk levels of external intrusion and internal leakage, and generate risk assessment information.

[0022] As a further solution of the present invention, according to the risk assessment information, according to the damage levels and occurrence frequencies of various threat types, the weights of multiple security assessment indicators are adjusted, and the assessment model parameters are optimized. The steps of obtaining the model parameter adjustment information are specifically as follows:

[0023] S301: Based on the risk assessment information, analyze the damage levels and occurrence frequencies of multiple security threats, assess the damage risks of multiple threat types, and generate key threat analysis results;

[0024] S302: Based on the key threat analysis results, evaluate the correlation between existing security assessment indicators and key threats, adjust the weights of multiple indicators to match the actual impact of threats on the system, and generate an indicator weight adjustment record;

[0025] S303: Using the indicator weight adjustment record, adjust the evaluation model parameters to optimize the response capability, including adjusting the threshold and sensitivity parameters, and generate model parameter adjustment information.

[0026] As a further solution of the present invention, based on the model parameter adjustment information, the target computer system is evaluated multiple times, the impact of multiple configuration items on the security level is analyzed, and key configuration parameters are identified. The steps of generating key configuration analysis results are specifically as follows:

[0027] S401: Based on the model parameter adjustment information, evaluate the target computer system, analyze the security performance of the operating system, application program and network configuration, and generate a security evaluation result;

[0028] S402: Based on the security assessment result, analyzing the security level impact of multiple configuration items, including checking the rationality of the operating system patch level and network firewall rules, and generating a configuration item impact analysis result;

[0029] S403: Utilizing the configuration item impact analysis result, analyzing the correlation between multiple key configuration parameters and security levels, including data access rights and sensitive operation response parameters, and generating a key configuration analysis result.

[0030] As a further solution of the present invention, the impact of various security configurations on threat protection is evaluated through the key configuration analysis results, and the configuration items are classified to identify risky configurations and security vulnerabilities. The steps of generating security vulnerability identification information are specifically as follows:

[0031] S501: Based on the key configuration analysis results, a simulated attack test is set to perform a stress test on the operating system, application program, and network configuration in the system, detect the ability of the configuration items to resist attacks, and generate a simulated attack test result;

[0032] S502: Based on the simulated attack test result, analyze the security vulnerabilities recorded in the test, classify multiple configuration items according to security levels, identify risk levels of multiple configuration items, and generate a configuration risk classification result;

[0033] S503: Using the configuration risk classification result, taking into account the risk level of the target configuration item and the impact on system security, identify key security vulnerabilities and generate security vulnerability identification information.

[0034] As a further solution of the present invention, the security vulnerability identification information is used to analyze the security performance of multiple components, and the security level of the target computer system is evaluated. The steps of generating the evaluation information processing result are specifically as follows:

[0035] S601: Based on the security vulnerability identification information, assess the physical security and software applications of the target system, including checking physical access control and software security settings, and generating a security assessment result;

[0036] S602: Based on the security assessment results, analyze the security performance of multiple components, evaluate the effectiveness of firewalls, encryption measures and access rights management, and generate security performance analysis results;

[0037] S603: Using the security performance analysis results, adopting the weighted average method, considering the security architecture of the system and the protection effects of multiple parts, evaluate the security level of the target computer system and generate an evaluation information processing result.

[0038] As a further solution of the present invention, the weighted average method is according to the formula:

[0039] ;

[0040] Calculate the comprehensive safety level;

[0041] in, Represents the overall security level of the system. It represents the weight determined according to the importance and risk exposure of the component, reflecting the contribution of different components to the overall system security. Used to represent the sequence number of multiple components in the system. Represents the current risk score of the component, measuring the maximum potential loss that the component may suffer. The total number of components evaluated within the system is calculated by balancing the risk impact of each component through a weighted average approach.

[0042] Based on the same inventive concept, the present invention also provides a network security assessment information processing system, which is used to execute the above-mentioned network security assessment information processing method, including:

[0043] The data collection module collects configuration information and operation logs from the target computer system based on the network security assessment information, sorts them according to timestamps, and performs formatting and standardization processing to optimize the consistency and integrity of the data, classifies multiple security incidents by time and severity, analyzes the frequency of incidents, and predicts the damage risk level of multiple types of security threats to generate risk analysis data;

[0044] The risk assessment module adjusts the weights of security assessment indicators based on the risk analysis data, according to the damage levels and occurrence frequencies of various threat types, optimizes the assessment model parameters, and generates model optimization results;

[0045] The configuration assessment module uses the model optimization results to assess the target computer system, analyze the impact of various configuration items on the security level, identify key configuration parameters, and generate configuration impact analysis information;

[0046] The vulnerability analysis module evaluates the impact of various security configurations on threat protection based on the configuration impact analysis information, and classifies configuration items according to security levels, identifies risky configurations and security vulnerabilities, and generates vulnerability record information;

[0047] The level assessment module uses the vulnerability record information to analyze the security performance of multiple components of the target computer system, conducts system security level assessment, and generates assessment information processing results.

[0048] Compared with the prior art, the advantages and positive effects of the present invention are:

[0049] In the present invention, data quality is optimized by sorting and formatting data in time, and security events are classified according to time information and severity. The accuracy of threat identification is improved by combining event frequency analysis. By analyzing the damage risk levels of various security threat types and adjusting the weights of security assessment indicators, the responsiveness and predictive ability of the assessment model are enhanced, the risk of misjudgment is reduced, and the adaptability and foresight of security measures are improved, ensuring that the security level assessment accurately reflects the actual security situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 The following is a flowchart of the network security assessment information processing method.

[0051] Figure 2 The flowchart of step S1 of the network security assessment information processing method is detailed.

[0052] Figure 3 The flowchart of step S2 of the network security assessment information processing method is detailed.

[0053] Figure 4 The flowchart of step S3 of the network security assessment information processing method is detailed.

[0054] Figure 5 The flowchart of step S4 of the network security assessment information processing method is detailed.

[0055] Figure 6 The flowchart is detailed for step S5 of the network security assessment information processing method.

[0056] Figure 7 The flowchart is detailed for step S6 of the network security assessment information processing method.

[0057] Figure 8 This is the flow chart of the network security assessment information processing system. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0059] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0060] See also Figure 1 The present invention provides a method for processing network security assessment information, comprising the following steps:

[0061] S1: Based on the network security assessment information, collect the configuration information and operation log of the target computer system, sort the data according to the time information, and perform formatting and standardization processing to generate the operation data processing results;

[0062] S2: Based on the results of operation data processing, multiple security incidents are classified according to time and severity, the frequency of occurrence of various security incidents is analyzed, the damage risk level of various security threat types is predicted, and risk assessment information is generated;

[0063] S3: Based on the risk assessment information, according to the damage levels and occurrence frequencies of various threat types, the weights of multiple security assessment indicators are adjusted, the assessment model parameters are optimized, and the model parameter adjustment information is obtained;

[0064] S4: Based on the model parameter adjustment information, the target computer system is evaluated multiple times, the impact of various configuration items on the security level is analyzed, and key configuration parameters are identified to generate key configuration analysis results;

[0065] S5: Evaluate the impact of various security configurations on threat protection through key configuration analysis results, classify configuration items, identify risky configurations and security vulnerabilities, and generate security vulnerability identification information;

[0066] S6: Utilize security vulnerability identification information to analyze the security performance of multiple components, evaluate the security level of the target computer system, and generate evaluation information processing results.

[0067] The operating data processing results include data integrity verification information, format consistency analysis results, and data anomaly marking results. The risk assessment information includes security incident classification statistics, incident frequency data, and predicted security threat damage levels. The model parameter adjustment information includes the adjusted security assessment indicator weights, optimized assessment model parameters, and weight distribution information of key risk factors. The key configuration analysis results include key security configuration item identification data, configuration item contribution to security level analysis results, and risk point identification information. The security vulnerability identification information includes simulated attack test results, risk configuration lists, and identified security vulnerability information. The evaluation information processing results include security performance analysis data of multiple components, security level assessment scores, and key security risk points.

[0068] See also Figure 2 Based on the network security assessment information, the configuration information and operation log of the target computer system are collected, the data is sorted according to the time information, and formatted and standardized. The specific steps for generating the operation data processing results are as follows:

[0069] S101: Based on the network security assessment information, collect the configuration information and operation logs of the target computer system, including the hardware configuration, operating system version and installed application list, sort them according to time, and generate configuration and log sorting results;

[0070] In sub-step S101, the network security assessment information is systematically processed through collection and sorting algorithms to obtain the configuration information and operation logs of the target computer system. The hardware configuration, operating system version and list of installed applications of the computer system are collected through network monitoring tools. The target data points are obtained through software agents and directly from the management interface of the operating system to ensure the originality and integrity of the data. The collected data is sorted by a timestamp-based sorting algorithm to organize the information in the actual time sequence of log generation, providing a timeline-organized data view for analysis and locating the time point when the problem occurred. The generated configuration and log sorting results provide a data basis for subsequent data formatting and standardization processing, ensuring the logic and traceability of data processing.

[0071] S102: Based on the configuration and the log sorting result, the data is formatted, non-standard characters and redundant data are identified and eliminated, and integrity check is performed on the data to generate a formatting processing result;

[0072] In sub-step S102, through data cleaning and integrity verification methods, configuration and log data are optimized, and data formatting processing is implemented, including identifying and eliminating non-standard characters and redundant data in the data. This uses regular expressions and customized data cleaning rules to correct special characters and format errors in the logs, reducing errors and anomalies in the data parsing process. The data integrity check includes verifying the integrity of data fields to ensure that necessary information is correctly recorded and not omitted. The hash verification method is used to mine inconsistencies in data during transmission or storage to ensure data accuracy and availability, laying a solid foundation for standardized processing. The generated formatting processing results improve the quality of data and the efficiency of subsequent processing.

[0073] S103: Based on the formatting processing result, standardize the data, including adjusting the time format and unified identifier, optimizing the integrity and consistency of the data, and generating the operation data processing result;

[0074] In sub-step S103, the consistency and overall integrity of the data are optimized through time format unification and identifier standardization. The time format unification algorithm is used to convert the timestamps in all log entries into a unified format. Identifier standardization unifies the user and device identifiers in multiple log sources into a common naming convention, and ensures the consistency of identifiers in the entire data set through mapping tables and replacement rules. By adjusting the data fields to meet the requirements of subsequent analysis and storage, the versatility and operability of the data are enhanced, and the operation data processing results are generated.

[0075] See also Figure 3 ,According to the results of operation data processing, multiple security incidents are classified according to time and severity, the frequency of occurrence of various security incidents is analyzed, and the damage risk level of various security threat types is predicted. The specific steps for generating risk assessment information are as follows:

[0076] S201: Based on the operation data processing result, classify the recorded security events according to the occurrence time and severity, and generate event classification results;

[0077] In sub-step S201, through the event classification algorithm, the system will carry out fine classification of security events based on the results of operation data processing, according to the time of occurrence and severity of the events, and use data analysis tools to arrange the collected security events in chronological order of occurrence. The target events are divided into multiple categories according to the severity level of the events, including warnings, errors, and serious errors. The severity of the events is defined by setting thresholds, and each event is classified and marked using logical judgment to identify key security threats. It is also convenient for trend analysis of historical data. The event classification results generated after the classification is completed will serve as the basic data for frequency analysis, recording the frequency and severity of multiple types of events, and providing data support for risk assessment and security policy formulation.

[0078] S202: Based on the event classification results, according to the time series data of the event occurrence, the occurrence frequencies of various types of events are calculated to generate event frequency analysis results;

[0079] In sub-step S202, based on the event classification result, wherein based on the time series data of the event occurrence, according to the formula:

[0080] ;

[0081] Calculate the occurrence frequency of various categories of events and generate event frequency analysis results.

[0082] In the formula, represents the event frequency, represents the total time length considered, Representative Class events in The number of occurrences within a time period, Represents the total number of categories of events.

[0083] Detailed explanation of the formula and the process of formula calculation and derivation:

[0084] Assume that in a year, there are three types of security incident records, and the number of incidents is:

[0085] sky;

[0086] Type 1 Event Second-rate;

[0087] Type 2 Event Second-rate;

[0088] Type 3 Event Second-rate;

[0089] Substitute the parameters into the formula for calculation:

[0090] ;

[0091] ;

[0092] ;

[0093] Calculation results The data shows that the average total number of incidents per day is 0.411, which can help security teams evaluate and monitor the frequency of incidents in order to adjust and optimize security response strategies.

[0094] S203: using the event frequency analysis results, predicting the damage risk levels of various security threat types, including assessing the risk levels of external intrusion and internal leakage, and generating risk assessment information;

[0095] In sub-step S203, the risk prediction model is used to use the event frequency analysis results to predict the damage risk level of various security threat types. A prediction algorithm based on historical data is used to combine the frequency of events and the degree of damage caused in the past to evaluate the risk level of future security threats. Early warnings are given to potential high-risk threats, and response measures are prepared in advance. Combined with the different risk factors of external intrusion and internal leakage, a categorized risk level assessment is provided. The generated risk assessment information includes the possibility of multiple types of security threats and the expected degree of damage, and predicts security incidents.

[0096] See also Figure 4 ,According to the risk assessment information, according to the damage level and occurrence frequency of various threat types, the weights of multiple security assessment indicators are adjusted, and the assessment model parameters are optimized. The specific steps for obtaining the model parameter adjustment information are as follows:

[0097] S301: Based on the risk assessment information, analyze the damage levels and occurrence frequencies of various security threats, assess the damage risks of various threat types, and generate key threat analysis results;

[0098] In sub-step S301, based on the risk assessment information, according to the formula:

[0099] ;

[0100] Calculates and assesses the risk of damage from multiple threat types to generate critical threat analysis results.

[0101] In the formula, represents the weighted average damage risk level, Representative The frequency of occurrence of this type of threat, Representative The damage level of the threat class, Represents the total number of threat types.

[0102] Detailed explanation of the formula and the process of formula calculation and derivation:

[0103] Assume that there are three types of threats, and the frequency and damage level of each threat are:

[0104] Threat 1: Frequency , damage level ;

[0105] Threat 2: Frequency , damage level ;

[0106] Threat 3: Frequency , damage level ;

[0107] Substitute the parameters into the formula for calculation:

[0108] ;

[0109] ;

[0110] ;

[0111] Calculation results The weighted average damage risk level faced by the system is 55.3. This indicator provides a quantitative damage risk assessment for the security team, helping to determine which threats need to be given priority attention and strengthened protection measures, thereby more accurately guiding resource allocation and security strategy formulation.

[0112] S302: Based on the key threat analysis results, evaluate the correlation between existing security assessment indicators and key threats, adjust the weights of multiple indicators to match the actual impact of threats on the system, and generate indicator weight adjustment records;

[0113] In sub-step S302, the correlation between existing security assessment indicators and threats is adjusted according to the key threat analysis results through correlation analysis method and weight adjustment strategy. The correlation between multiple security indicators and key threats is evaluated using correlation analysis method. The sensitivity and prediction accuracy of the indicators are determined by analyzing historical data on the actual impact of indicators and threats. The weights of the indicators are adjusted according to the analysis results to ensure that the assessment model can accurately reflect the actual impact of threats on the system. The weight adjustment is based on the performance and importance of each indicator in predicting key threats. By increasing the weight of indicators that accurately predict threats and reducing the weight of indicators with low correlation with key threats, the generated indicator weight adjustment record explains the adjustment status and reasons for each security assessment indicator.

[0114] S303: Using the indicator weight adjustment record, adjusting the evaluation model parameters to optimize the response capability, including adjusting the threshold and sensitivity parameters, and generating model parameter adjustment information;

[0115] In sub-step S303, the parameters of the evaluation model are adjusted according to the indicator weight adjustment records through the parameter optimization algorithm to optimize the model's responsiveness. The threshold and sensitivity parameters of the model are adjusted according to the data in the weight adjustment records to make the model more sensitive to changes in high-risk threats while avoiding excessive response to low-risk events. The parameter optimization algorithm adjusts parameters to achieve the optimal risk prediction balance by minimizing model errors and maximizing prediction accuracy. The model parameter adjustment information generated after the adjustment includes threshold settings and sensitivity parameters, so that the evaluation model can respond to actual security threats more quickly, improve the speed and accuracy of security incident processing, and enhance the efficiency and effectiveness of security operations.

[0116] See also Figure 5 ,Based on the model parameter adjustment information, the target computer system is evaluated multiple times, the impact of various configuration items on the security level is analyzed, and key configuration parameters are identified. The specific steps for generating key configuration analysis results are as follows:

[0117] S401: Based on the model parameter adjustment information, the target computer system is evaluated, the security performance of the operating system, application program and network configuration is analyzed, and a security evaluation result is generated;

[0118] In sub-step S401, a system security assessment tool is used to perform a security assessment on the operating system, application programs, and network configuration of the target computer system based on the model parameter adjustment information. Data is collected from multiple aspects, including the security settings of the operating system, security vulnerability information of installed applications, and security protection measures of the network configuration. The security status of the computer system is assessed based on the adjusted assessment model parameters, including the identification of potential security threats and vulnerabilities. After the security assessment tool processes the target information, the generated security assessment results describe the security performance of multiple parts, including the vulnerability density of the operating system, the security compliance of the application, and the protection effect of the network configuration, providing data support for security reinforcement and policy adjustment.

[0119] S402: Based on the security assessment results, analyze the security level impact of multiple configuration items, including checking the rationality of the operating system patch level and network firewall rules, and generate configuration item impact analysis results;

[0120] In sub-step S402, by configuring the security analysis tool, the impact of each configuration item on the system security level is analyzed based on the security assessment results. By automatically checking the patch level of the operating system and the rules of the network firewall, multiple key security configuration items are set to evaluate the rationality and security of multiple configuration items. The analysis tool uses the security database and compliance standards to compare the differences between the current configuration and the recommended configuration. Through detailed comparative analysis, the configuration item impact analysis results are generated. The results include the security score of each configuration, suggestions for updates and improvements, and the security risks caused by the target configuration defects.

[0121] S403: Analyze the correlation between multiple key configuration parameters and security levels, including data access rights and sensitive operation response parameters, using the configuration item impact analysis results, and generate key configuration analysis results;

[0122] In sub-step S403, the configuration relationship analysis method is used to analyze the correlation between multiple key configuration parameters and the system security level based on the configuration item impact analysis results, including data access permission settings, sensitive operation response parameters and multiple key security configurations. By analyzing the relationship between the settings of multiple parameters and the actual security incidents encountered by the system, the key factors affecting the system security level are identified. The generated key configuration analysis results provide the impact weight and optimization suggestions for each parameter, which are used to adjust security policies and enhance the system's ability to respond to complex threats, helping the security team to strengthen system protection measures in a targeted manner to ensure the security of sensitive operations and strict control of data access.

[0123] See also Figure 6 , through the key configuration analysis results, evaluate the impact of various security configurations on threat protection, classify configuration items, identify risky configurations and security vulnerabilities, and generate security vulnerability identification information in the following steps:

[0124] S501: Based on the key configuration analysis results, set up a simulated attack test, perform stress tests on the operating system, application programs, and network configurations in the system, detect the ability of configuration items to resist attacks, and generate simulated attack test results;

[0125] In sub-step S501, a simulated attack test is organized through penetration testing tools based on the key configuration analysis results to verify the attack resistance capabilities of the operating system, application programs, and network configurations in the system. By setting a variety of attack scenarios, the scenarios are designed according to the potential weaknesses identified in the key configuration analysis results to simulate security threats encountered in the real world, and stress tests are performed on a variety of configurations to monitor the performance and reaction of the system under a variety of attack pressures. The test process generates simulated attack test results by recording the system's response mechanism and vulnerability performance. The results show the performance of a variety of configuration items in the face of actual attacks, as well as the effectiveness of the defense mechanism and potential weaknesses.

[0126] S502: Based on the simulated attack test results, analyze the security vulnerabilities recorded in the test, classify multiple configuration items according to security levels, identify risk levels of multiple configuration items, and generate configuration risk classification results;

[0127] In sub-step S502, data analysis tools are used to analyze the security vulnerabilities recorded in the test based on the simulated attack test results. The system classifies multiple configuration items according to security levels based on the severity of the vulnerabilities and the degree of impact on the system. The analysis process includes evaluating the difficulty of exploiting the vulnerabilities, the potential scope of damage, and the urgency of repair. The generated configuration risk classification results list the risk levels of multiple types of configuration items, and provide a list of multi-level risk configurations and priority repair suggestions.

[0128] In sub-step S502, based on the simulated attack test result, according to the formula:

[0129] ;

[0130] Classify the security levels of multiple configuration items, identify the risk levels of multiple configuration items, and generate configuration risk classification results.

[0131] In the formula, Represents the comprehensive risk level of the configuration item. Representative The frequency with which a configuration item is exploited in a simulated attack. Represents the potential damage that can be caused by exploiting this configuration item. Represents the total number of configuration items tested.

[0132] Detailed explanation of the formula and the process of formula calculation and derivation:

[0133] Assume that three security vulnerabilities of configuration items are identified in the simulated attack test. The exploitation frequency and potential damage degree of each configuration item are:

[0134] Configuration item 1: Exploitation frequency , potential damage ;

[0135] Configuration item 2: Exploitation frequency , potential damage ;

[0136] Configuration item 3: Frequency of use , potential damage ;

[0137] Substitute the parameters into the formula for calculation:

[0138] ;

[0139] ;

[0140] ;

[0141] Calculation results It shows that according to the results of the simulated attack test, the comprehensive risk level of the system configuration items is 135. This score helps the security team quantify the security threat level of each configuration item and guide how to prioritize security enhancements to reduce the impact of the highest risk configuration items on the overall system security.

[0142] S503: Using the configuration risk classification result, considering the risk level of the target configuration item and the impact on system security, identifying key security vulnerabilities, and generating security vulnerability identification information;

[0143] In sub-step S503, through the risk assessment model, using the configuration risk classification results, considering the risk level of the target configuration item and the overall impact on system security, key security vulnerabilities are identified, and a quantitative analysis method is used to evaluate the risk contribution and emergency processing requirements of each configuration item. The identification process includes the setting of data access rights, the effectiveness of network protection measures, and the security policy of sensitive operations. The generated security vulnerability identification information provides the security team with clear repair goals and action guidelines.

[0144] See also Figure 7 , using security vulnerability identification information, analyzing the security performance of multiple components, evaluating the security level of the target computer system, and generating evaluation information processing results in the following steps:

[0145] S601: Based on the security vulnerability identification information, evaluate the physical security and software applications of the target system, including checking physical access control and software security settings, and generate security assessment results;

[0146] In sub-step S601, a comprehensive assessment of the physical security and software applications of the target system is conducted through comprehensive security management tools based on security vulnerability identification information. Physical access control measures, including entrance security detection systems, configuration of monitoring equipment, and effectiveness of emergency response procedures, are checked. Software security settings are reviewed, including security configuration of the operating system, permission management of applications, and data protection measures. Based on security standards and compliance requirements, combined with historical security incidents and security vulnerability information, the timeliness and accuracy of the assessment results are ensured. The generated security assessment results describe the current status of physical security measures and software settings, including existing defects, potential risk points, and recommended improvement measures.

[0147] S602: Based on the security assessment results, analyze the security performance of multiple components, evaluate the effectiveness of firewalls, encryption measures and access rights management, and generate security performance analysis results;

[0148] In sub-step S602, the security performance analysis module is used to analyze various components of the system based on the security assessment results. By evaluating key security measures such as the effectiveness of firewall configuration, the implementation quality of encryption measures, and the strictness of access permission management, dynamic testing and historical data comparison are used to evaluate the performance of various security measures in actual operations and their contribution to system security. The generated security performance analysis results provide performance scores and optimization suggestions for each security measure, and point out the strengths and weaknesses of each security component.

[0149] S603: Using the security performance analysis results, adopting the weighted average method, considering the security architecture of the system and the protection effects of multiple parts, evaluating the security level of the target computer system, and generating evaluation information processing results;

[0150] Weighted average method, according to the formula:

[0151] ;

[0152] Calculate the comprehensive safety level;

[0153] in, Represents the overall security level of the system. It represents the weight determined according to the importance and risk exposure of the component, reflecting the contribution of different components to the overall system security. Used to represent the sequence number of multiple components in the system. Represents the current risk score of the component, measuring the maximum potential loss that the component may suffer. The total number of components evaluated within the system is calculated by balancing the risk impact of each component through a weighted average approach.

[0154] formula:

[0155] ;

[0156] Detailed explanation of the formula and the process of formula calculation and derivation:

[0157] is the safety level after weighted average;

[0158] is the total number of components evaluated in the system;

[0159] A serial number used to represent multiple components in a system;

[0160] The weight of each component is set according to its importance in the system and its risk exposure;

[0161] For risk scoring, the risk score of each component is obtained through a security vulnerability scanning tool. The risk score reflects the possibility of each component being attacked and the severity of the potential damage.

[0162] Assume a system has three components, and the weights and risk scores of each component are as follows:

[0163] Database Server ;

[0164] Application Server ;

[0165] Web Server .

[0166] Substitute the parameters into the formula for calculation:

[0167] ;

[0168] ;

[0169] ;

[0170] ;

[0171] ;

[0172] The results show that the overall security level is 69, which is a calculation result obtained by considering the importance and security risks of each component. It is used to help security managers evaluate the overall security status of the system and guide necessary security reinforcement measures to ensure that key components are adequately protected.

[0173] See also Figure 8 , a network security assessment information processing system, used to execute the above-mentioned network security assessment information processing method, comprising:

[0174] The data collection module collects configuration information and operation logs from the target computer system based on the network security assessment information, sorts them according to timestamps, and performs formatting and standardization processing to optimize the consistency and integrity of the data, classifies multiple security incidents by time and severity, analyzes the frequency of incidents, and predicts the damage risk level of multiple types of security threats to generate risk analysis data;

[0175] The risk assessment module adjusts the weights of security assessment indicators, optimizes the assessment model parameters, and generates model optimization results based on risk analysis data and the damage levels and occurrence frequencies of various threat types;

[0176] The configuration assessment module uses the model optimization results to evaluate the target computer system, analyze the impact of various configuration items on the security level, identify key configuration parameters, and generate configuration impact analysis information;

[0177] The vulnerability analysis module evaluates the impact of various security configurations on threat protection based on configuration impact analysis information, and classifies configuration items according to security levels, identifies risky configurations and security vulnerabilities, and generates vulnerability record information;

[0178] The level assessment module uses vulnerability record information to analyze the security performance of multiple components of the target computer system, conducts system security level assessment, and generates assessment information processing results.

[0179] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A method for processing network security assessment information, characterized in that: The following steps are involved: Based on the network security assessment information, collect the configuration information and operation logs of the target computer system, sort the data according to the time information, and perform formatting and standardization processing to generate the operation data processing results; Based on the processing results of the operation data, multiple security incidents are classified according to time and severity, the occurrence frequency of multiple security incidents is analyzed, the damage risk level of multiple security threat types is predicted, and risk assessment information is generated; Based on the risk assessment information, according to the damage levels and occurrence frequencies of multiple threat types, weights of multiple security assessment indicators are adjusted, assessment model parameters are optimized, and model parameter adjustment information is obtained; According to the risk assessment information, according to the damage levels and occurrence frequencies of various threat types, the weights of multiple security assessment indicators are adjusted, and the assessment model parameters are optimized. The steps of obtaining the model parameter adjustment information are specifically as follows: Based on the risk assessment information, analyzing the damage levels and occurrence frequencies of various security threats, assessing the damage risks of various threat types, and generating key threat analysis results; Based on the key threat analysis results, evaluate the correlation between existing security assessment indicators and key threats, adjust the weights of multiple indicators to match the actual impact of threats on the system, and generate indicator weight adjustment records; Using the indicator weight adjustment record, adjusting the evaluation model parameters to optimize the response capability, including adjusting the threshold and sensitivity parameters, and generating model parameter adjustment information; Based on the model parameter adjustment information, multiple evaluations are performed on the target computer system, the impact of multiple configuration items on the security level is analyzed, and key configuration parameters are identified to generate key configuration analysis results; Based on the model parameter adjustment information, the target computer system is evaluated multiple times, the impact of multiple configuration items on the security level is analyzed, and key configuration parameters are identified. The steps of generating key configuration analysis results are specifically as follows: Based on the model parameter adjustment information, the target computer system is evaluated, the security performance of the operating system, application program and network configuration is analyzed, and a security evaluation result is generated; Based on the security assessment results, analyze the security level impact of multiple configuration items, including checking the rationality of operating system patch levels and network firewall rules, and generate configuration item impact analysis results; Utilizing the configuration item impact analysis results, analyzing the correlation between multiple key configuration parameters and security levels, including data access rights and sensitive operation response parameters, and generating key configuration analysis results; Through the key configuration analysis results, the impact of various security configurations on threat protection is evaluated, and configuration items are classified to identify risky configurations and security vulnerabilities, and generate security vulnerability identification information; Through the key configuration analysis results, the impact of various security configurations on threat protection is evaluated, and the configuration items are classified to identify risky configurations and security vulnerabilities. The specific steps for generating security vulnerability identification information are as follows: Based on the key configuration analysis results, a simulated attack test is set up to perform stress tests on the operating system, application programs, and network configurations in the system, detect the ability of configuration items to resist attacks, and generate simulated attack test results; Based on the simulated attack test results, the security vulnerabilities recorded in the test are analyzed, multiple configuration items are classified according to security levels, risk levels of multiple configuration items are identified, and configuration risk classification results are generated; Using the configuration risk classification results, considering the risk level of the target configuration item and the impact on system security, identifying key security vulnerabilities and generating security vulnerability identification information; Utilizing the security vulnerability identification information, analyzing the security performance of multiple components, evaluating the security level of the target computer system, and generating evaluation information processing results; The steps of using the security vulnerability identification information to analyze the security performance of multiple components, evaluate the security level of the target computer system, and generate the evaluation information processing results are as follows: Based on the security vulnerability identification information, assess the physical security and software applications of the target system, including checking physical access control and software security settings, and generating security assessment results; Based on the security assessment results, analyze the security performance of multiple components, evaluate the effectiveness of firewalls, encryption measures and access rights management, and generate security performance analysis results; Utilizing the security performance analysis results, a weighted average method is adopted to consider the security architecture of the system and the protection effects of multiple components, including database servers, application servers, and Web servers, to evaluate the security level of the target computer system and generate evaluation information processing results.

2. A method for processing network security assessment information according to claim 1, characterized in that: The operation data processing results include data integrity verification information, format consistency analysis results, and data anomaly marking results. The risk assessment information includes security incident classification statistics, event frequency data, and predicted security threat damage levels. The model parameter adjustment information includes adjusted security assessment indicator weights, optimized assessment model parameters, and weight distribution information of key risk factors. The key configuration analysis results include key security configuration item identification data, configuration item contribution analysis results to the security level, and risk point identification information. The security vulnerability identification information includes simulated attack test results, risk configuration lists, and identified security vulnerability information. The evaluation information processing results include security performance analysis data of multiple components, security level assessment scores, and key security risk points.

3. A method for processing network security assessment information according to claim 1, characterized in that: Based on the network security assessment information, collect the configuration information and operation log of the target computer system, sort the data according to the time information, and perform formatting and standardization processing to generate the operation data processing results. The specific steps are as follows: Based on the network security assessment information, collect the configuration information and operation logs of the target computer system, including hardware configuration, operating system version and installed application list, and sort them by time to generate configuration and log sorting results; Based on the configuration and the log sorting result, the data is formatted, non-standard characters and redundant data are identified and eliminated, and the data is checked for integrity to generate a formatting processing result; Based on the formatting processing result, the data is standardized, including adjusting the time format and unified identifier, optimizing the integrity and consistency of the data, and generating an operation data processing result.

4. A method for processing network security assessment information according to claim 1, characterized in that: According to the processing results of the operation data, multiple security incidents are classified according to time and severity, the occurrence frequency of multiple security incidents is analyzed, and the damage risk level of multiple security threat types is predicted. The steps of generating risk assessment information are specifically as follows: Based on the operation data processing results, classify the recorded security events according to the occurrence time and severity, and generate event classification results; Based on the event classification results, according to the time series data of event occurrence, the occurrence frequencies of various types of events are calculated to generate event frequency analysis results; The event frequency analysis results are used to predict the damage risk levels of various security threat types, including evaluating the risk levels of external intrusion and internal leakage, and generate risk assessment information.

5. A method for processing network security assessment information according to claim 1, characterized in that: The weighted average method is based on the formula: ； Calculate the comprehensive safety level; in, Represents the overall security level of the system. It represents the weight determined according to the importance and risk exposure of the components, reflecting the contribution of different components to the overall system security. Used to indicate the serial number of multiple components in the system. Represents the current risk score of the component, measuring the maximum potential loss that the component may suffer. The total number of components assessed within the system is calculated by balancing the risk impact of each component through a weighted average approach.

6. A network security assessment information processing system, characterized in that: The method for processing network security assessment information according to any one of claims 1 to 5 comprises: The data collection module collects configuration information and operation logs from the target computer system based on the network security assessment information, sorts them according to timestamps, and performs formatting and standardization processing to optimize the consistency and integrity of the data, classifies multiple security incidents by time and severity, analyzes the frequency of incidents, and predicts the damage risk level of multiple types of security threats to generate risk assessment information; The risk assessment module adjusts the weights of security assessment indicators, optimizes assessment model parameters, and generates model parameter adjustment information based on the risk assessment information and the damage levels and occurrence frequencies of various threat types; The configuration assessment module uses the model parameter adjustment information to assess the target computer system, analyze the impact of various configuration items on the security level, identify key configuration parameters, and generate key configuration analysis results; The vulnerability analysis module evaluates the impact of various security configurations on threat protection based on the key configuration analysis results, and classifies configuration items according to security levels, identifies risky configurations and security vulnerabilities, and generates security vulnerability identification information; The level assessment module uses the security vulnerability identification information to analyze the security performance of multiple components of the target computer system, conducts system security level assessment, and generates assessment information processing results.

Images