Asset security threat intelligent identification method, system and device based on K-means algorithm

Abstract

The invention discloses an asset security threat intelligent identification method, system and device based on a K-means algorithm. The method comprises the steps of determining a classification target parameter of an asset security threat of a target network security system; correspondingly associating the preprocessed various data with preset influence factors and weights to obtain a plurality of security threat level factors of each data; the security threat level factors comprise threat susceptibility factors and threat risk factors; generating a plurality of asset identification units; determining a security threat susceptibility index and security threat susceptibility data of each asset identification unit; determining security threat risk data of each asset identification unit; the asset security threat classification model is constructed based on a K-means algorithm; according to the security threat susceptibility data, the security threat risk data and the target classification parameters of each asset identification unit, outputting a corresponding security threat identification evaluation result; according to the invention, the capability of identifying asset security threat behaviors by a network security system is improved.

Description

Technical Field

[0001] The present application relates to the field of asset security technology, and in particular to a method, system and device for intelligently identifying asset security threats based on a K-means algorithm. Background Art

[0002] With the rapid advancement of information technology, security threats in network environments are becoming more diverse and complex, which makes asset security threat identification technology a key link in ensuring the security of information systems.

[0003] Currently, mainstream asset security threat identification systems on the market mostly rely on preset rule bases for threat detection. This method shows certain effectiveness when dealing with known and common types of threats; however, when faced with slow attacks, highly concealed unknown threats or multi-step compound attacks, the detection capabilities of these systems are severely challenged. There are significant deficiencies in the intelligent identification of asset security threats, and there is a defect in the ability to identify asset security threat behaviors in network security systems. There is room for improvement. Summary of the invention

[0004] In order to improve the network security system's ability to identify asset security threat behaviors, the present application provides an asset security threat intelligent identification method, system and device based on the K-means algorithm.

[0005] In the first aspect, the invention objective of the present application is achieved by adopting the following technical solutions: The intelligent identification method of asset security threats based on the K-means algorithm includes: Determine the classification target parameters of the asset security threats of the target network security system; Collect various data related to asset security, perform data preprocessing on the various data, and associate the preprocessed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors; Based on the preprocessed data and the classified target parameters, a number of asset identification units are generated in the asset area of ​​the target network security system; Taking each asset identification unit as a basic unit, preliminary identification and classification of asset security threats are performed according to the threat susceptibility factor and the preset asset security threat classification model, and the security threat susceptibility index of each asset identification unit is obtained, and the security threat susceptibility data of each asset identification unit is calculated according to the security threat susceptibility index; taking each asset identification unit as a basic unit, the security threat hazard data of each asset identification unit is determined according to the threat hazard factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm; According to the security threat susceptibility data, security threat risk data and the target classification parameters of each asset identification unit, a corresponding security threat identification evaluation result is output.

[0006] By adopting the above technical scheme, according to the clarification of classification target parameters, it is helpful to improve the recognition efficiency of various types of data of asset security threats to the target network security system; through data preprocessing, it is helpful to extract key features from the massive data of the network security system and improve the accuracy of intelligent recognition of asset security threats. Through the analysis method of preset influencing factors and weight associations, combined with the asset security threat classification model built based on the K-means algorithm, intelligent recognition and data classification are performed, so that the target network security system can dynamically adapt to the ever-changing asset security threat environment and timely identify new threat types, which is conducive to improving the target network security system's ability to identify asset security threat behaviors. Furthermore, the present application also provides a method for the target network security The threat susceptibility (possibility of threat occurrence) and threat dangerousness (potential consequences and impact) of the entire system are calculated to identify a multi-faceted assessment of asset security threats and quantify threat intelligent identification indicators, which is helpful in helping users or decision makers implement targeted security response strategies. At the same time, this application supports custom classification target parameters and influencing factor weights, so that the target network security system can be flexibly customized according to the asset security threat identification needs of different industries, with high flexibility. Then, by outputting the security threat identification assessment results in real time, it is helpful for users to quickly respond to asset security incidents, reduce losses and impacts, and improve the response capability of the target network security system. Therefore, this application achieves the effect of improving the network security system's ability to identify asset security threat behaviors.

[0007] In a preferred example of the present application: the preset asset security threat classification model is constructed based on the K-means algorithm, including: Extract data features from various types of pre-processed data to obtain feature data associated with asset security threats and corresponding associated feature tag labels, wherein the feature tag labels include data threat types and threat levels; identify entities related to various types of pre-processed data and asset security threats, and the relationships between entities to obtain entity information; Based on the feature data, feature marker labels and corresponding entity information, a deep learning encoder is used to reduce the dimension and encode the feature data, and an initial asset security threat classification model is constructed in combination with a K-means algorithm; The initial asset security threat classification model is trained based on a pre-labeled model training data set to obtain an asset security threat classification model; the asset security threat classification model is evaluated based on the test data to obtain a model evaluation result; The asset security threat classification model is optimized and updated based on the model evaluation result until the corresponding model evaluation result reaches a preset model evaluation index, and the model evaluation index includes but is not limited to accuracy, precision and recall.

[0008] By adopting the above-mentioned technical scheme, by combining the deep learning encoder and the K-means algorithm, the robustness and accuracy of the asset security threat classification model can be optimized, and the data processing efficiency can be improved, so that the asset security threat classification model can accurately and reliably classify asset security threats; and the asset security threat intelligent identification method of the present application realizes automation and intelligence from data preprocessing, feature extraction, model construction to model optimization training, effectively ensuring that the asset security threat classification model can adapt to the target network security system to the ever-changing threat environment of the outside world, and maintain a high level of asset security threat intelligent identification performance.

[0009] In a preferred example of the present application, the classification target parameters for determining the asset security threats of the target network security system include: Determine the type of asset security threat based on the asset security threat source and security threat data characteristics of the target network security system; The threat severity of asset security threats is divided into different levels to obtain threat levels; Analyze the asset scope affected by asset security threats and obtain the security impact scope; Determine classification target parameters based on asset security threat type, threat level, and security impact scope.

[0010] By adopting the above technical solution, through detailed classification and evaluation of the asset security threats of the target network security system, it is beneficial to analyze in detail the source of the asset security threats of the target network security system, data characteristics, threat severity and the scope of assets affected, which is beneficial to the subsequent accurate identification of the data characteristics and status of the asset security threats, and facilitates network security management personnel to quickly formulate targeted security protection strategies.

[0011] In a preferred example of the present application, each asset identification unit is used as a basic unit, and preliminary identification and classification of asset security threats are performed according to the threat susceptibility factor and a preset asset security threat classification model to obtain a security threat susceptibility index of each asset identification unit, and security threat susceptibility data of each asset identification unit is calculated according to the security threat susceptibility index, including: The threat susceptibility factors include but are not limited to asset value, system vulnerabilities and network topology; In the preset asset security threat classification model, each asset identification unit is taken as the basic unit, and preliminary identification and classification are performed according to the threat susceptibility factor. Based on the similarity and difference of the data in each asset identification unit, the data cluster and the corresponding data points in each asset identification unit are determined; According to the data cluster of each asset identification unit and the corresponding threat susceptibility factor, each data in each asset identification unit is assigned a value and a weighted average is calculated to obtain a corresponding security threat susceptibility index; The security threat susceptibility indexes of all data clusters involved in a single asset identification unit are weightedly calculated to obtain security threat susceptibility data of each asset identification unit.

[0012] By adopting the above technical solution, each asset identification unit is combined with different threat susceptibility factors to carry out fine-grained identification and classification of asset security threats. The refined identification method at the unit level can more accurately reflect the threat situation faced by different assets. By utilizing the intrinsic characteristics of the data such as the similarity and difference of the data in each asset identification unit, and by assigning values ​​and weighted average calculations to each data in each asset identification unit, not only the mutual influence between different data clusters is taken into account, but also a comprehensive assessment of asset security threats is achieved.

[0013] In a preferred example of the present application, each asset identification unit is used as a basic unit, and the security threat risk data of each asset identification unit is determined according to the threat risk factor and the security threat susceptibility data, including: The threat risk factors include data sensitivity, business impact, attack intensity, damage recovery difficulty and recovery cost; Corresponding threat risk factors are associated with all data clusters involved in each asset identification unit, and weighted calculation is performed based on the corresponding threat risk factors and the corresponding security threat susceptibility data to determine the security threat risk data of each asset identification unit.

[0014] By adopting the above technical solution, a multi-dimensional comprehensive assessment of asset security threats is conducted based on threat risk factors. By weighted calculation of threat risk factors and corresponding security threat susceptibility data, the security threat risk data of each asset identification unit can be accurately quantified, so as to facilitate intuitive understanding and analysis of the potential consequences of asset security threats (referring to the difficulty and cost of damage recovery) and the severity of the threat. This will facilitate network security management personnel to reasonably allocate security protection resources and take corresponding levels of processing measures for asset identification units with higher risks, improve the utilization efficiency of asset security protection resources, and facilitate the construction of a more comprehensive intelligent identification method for asset security threats.

[0015] In the second aspect, the invention objective of the present application is achieved by adopting the following technical solutions: An asset security threat intelligent identification system based on a K-means algorithm, the system comprising: A classification parameter determination module, used to determine classification target parameters of asset security threats of a target network security system; The data collection and preprocessing module is used to collect various data related to asset security, perform data preprocessing on the various data, and associate the preprocessed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors; An asset identification unit generation module, for generating a number of asset identification units in an asset region of a target network security system based on various types of preprocessed data and classification target parameters; A threat identification and classification module is used to take each asset identification unit as a basic unit, perform preliminary identification and classification of asset security threats according to the threat susceptibility factor and a preset asset security threat classification model, obtain a security threat susceptibility index of each asset identification unit, and calculate security threat susceptibility data of each asset identification unit according to the security threat susceptibility index; take each asset identification unit as a basic unit, determine the security threat hazard data of each asset identification unit according to the threat hazard factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm; The assessment result output module is used to output the corresponding security threat identification assessment result according to the security threat susceptibility data, security threat risk data and the target classification parameters of each asset identification unit.

[0016] By adopting the above technical scheme, based on the clarification of classification target parameters, it is helpful to improve the recognition efficiency of various types of data on asset security threats to the target network security system; through data preprocessing, it is helpful to extract key features from the massive data of the network security system and improve the accuracy of intelligent recognition of asset security threats. Through the analysis method of preset influencing factors and weight associations, combined with the asset security threat classification model constructed based on the K-means algorithm, intelligent recognition and data classification are performed, so that the target network security system can dynamically adapt to the ever-changing asset security threat environment and timely identify new threat types, which is conducive to improving the target network security system's ability to identify asset security threat behaviors.

[0017] In a preferred example of the present application: the threat susceptibility factors include but are not limited to asset value, system vulnerabilities and network topology; the threat identification and classification module includes: The preliminary identification and classification unit is used to perform preliminary identification and classification based on threat susceptibility factors in a preset asset security threat classification model, taking each asset identification unit as a basic unit, and determining the data clusters and corresponding data points in each asset identification unit based on the similarities and differences of the data in each asset identification unit; The susceptibility data calculation unit is used to assign values ​​and perform weighted average calculation on each data in each asset identification unit according to the data cluster and the corresponding threat susceptibility factor of each asset identification unit to obtain the corresponding security threat susceptibility index; and to perform weighted calculation on the security threat susceptibility index of all data clusters involved in a single asset identification unit to obtain the security threat susceptibility data of each asset identification unit.

[0018] By adopting the above technical solution, each asset identification unit is combined with different threat susceptibility factors to carry out fine-grained identification and classification of asset security threats. The refined identification method at the unit level can more accurately reflect the threat situation faced by different assets. By utilizing the intrinsic characteristics of the data such as the similarity and difference of the data in each asset identification unit, and by assigning values ​​and weighted average calculations to each data in each asset identification unit, not only the mutual influence between different data clusters is taken into account, but also a comprehensive assessment of asset security threats is achieved.

[0019] In the third aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned method for intelligent identification of asset security threats based on the K-means algorithm are implemented.

[0020] In a fourth aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for intelligently identifying asset security threats based on a K-means algorithm.

[0021] In summary, the present application includes at least one of the following beneficial technical effects: 1. By clarifying the classification target parameters, it is helpful to improve the recognition efficiency of various types of data of asset security threats to the target network security system; through data preprocessing, it is helpful to extract key features from the massive data of the network security system, improve the accuracy of intelligent recognition of asset security threats, and through the analysis method of preset influencing factors and weight associations, combined with the asset security threat classification model built based on the K-means algorithm, intelligent recognition and data classification are performed, so that the target network security system can dynamically adapt to the ever-changing asset security threat environment and timely identify new threat types, thereby helping to improve the target network security system's ability to identify asset security threat behaviors. Furthermore, this application also provides a threat classification model for the target network security system. The threat susceptibility (threat possibility) and threat danger (potential consequences) are calculated to identify the multi-faceted assessment of asset security threats and the quantification of threat intelligent identification indicators, which is helpful to help users or decision makers implement targeted security response strategies. At the same time, this application supports custom classification target parameters and influencing factor weights, so that the target network security system can be flexibly customized according to the asset security threat identification needs of different industries, with high flexibility. Then, by outputting the security threat identification and evaluation results in real time, it is helpful for users to quickly respond to asset security incidents, reduce losses and impacts, and improve the response capability of the target network security system. Therefore, this application achieves the effect of improving the network security system's ability to identify asset security threat behaviors; 2. Each asset identification unit is combined with different threat susceptibility factors to carry out refined identification and classification of asset security threats. The refined identification method at the unit level can more accurately reflect the threat situation faced by different assets. By utilizing the intrinsic characteristics of the similarity and difference of the data in each asset identification unit, and by assigning values ​​and weighted average calculations to each data in each asset identification unit, it not only considers the mutual influence between different data clusters, but also realizes a comprehensive assessment of asset security threats; 3. Based on the threat risk factor, a multi-dimensional comprehensive assessment of asset security threats is conducted. By weighted calculation of the threat risk factor and the corresponding security threat susceptibility data, the security threat risk data of each asset identification unit can be accurately quantified, so as to intuitively understand and analyze the potential consequences of asset security threats (referring to the difficulty and cost of damage recovery) and the severity of the threat. This will facilitate network security management personnel to reasonably allocate security protection resources and take corresponding levels of processing measures for asset identification units with higher risks, improve the utilization efficiency of asset security protection resources, and help build a more comprehensive intelligent identification method for asset security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flow chart of an intelligent identification method of asset security threats based on a K-means algorithm in one embodiment of the present application; Figure 2 It is a flowchart of step S4 in the method for intelligent identification of asset security threats based on the K-means algorithm in one embodiment of the present application; Figure 3 It is a schematic diagram of a device in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The present application is further described in detail below in conjunction with the accompanying drawings.

[0024] In one embodiment, if Figure 1 As shown, the present application discloses an intelligent identification method for asset security threats based on the K-means algorithm, which specifically includes the following steps: S1: Determine the classification target parameters of the asset security threats of the target network security system.

[0025] In this embodiment, the focus of specific asset security threats of the target network security system is determined by classification target parameters, such as the protection level of key assets, the priority of threat types, etc.; the classification target parameters include but are not limited to threat types (such as internal threats, external threats, malware, etc.), threat levels (such as low, medium, high), and asset categories that require special attention (such as databases, servers, network equipment, etc.).

[0026] S2: Collect various data related to asset security, pre-process the data, and associate the pre-processed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors.

[0027] In this embodiment, various types of data include but are not limited to system logs, network traffic, user behavior records, security equipment alarms, etc.; data preprocessing includes data cleaning, denoising, and normalization operations.

[0028] Specifically, according to the preset influencing factors (such as asset value, system vulnerabilities, network topology, security configuration, user behavior, etc.) and weights, the preprocessed data is associated with these factors to generate several security threat level factors; and the several security threat level factors are divided into threat susceptibility factors and threat danger factors.

[0029] S3: Based on the preprocessed data and classification target parameters, several asset identification units are generated in the asset area of ​​the target network security system.

[0030] In this embodiment, a number of asset identification units are generated by using methods such as space division and cluster analysis; each asset identification unit represents a relatively independent asset set or area, which facilitates subsequent security threat identification and classification.

[0031] S4: Taking each asset identification unit as the basic unit, perform preliminary identification and classification of asset security threats according to the threat susceptibility factor and the preset asset security threat classification model, obtain the security threat susceptibility index of each asset identification unit, and calculate the security threat susceptibility data of each asset identification unit according to the security threat susceptibility index; taking each asset identification unit as the basic unit, determine the security threat hazard data of each asset identification unit according to the threat hazard factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm.

[0032] In this embodiment, each asset identification unit is taken as a basic unit, and preliminary identification and classification are performed according to threat susceptibility factors (such as asset value, system vulnerabilities, network topology, etc.) and a preset asset security threat classification model based on the K-means algorithm; similar data points are clustered into clusters by calculating the similarities and differences of the data in each unit, and each cluster represents one or more similar security threat types; based on the clustering results, the security threat susceptibility index of each asset identification unit is calculated, and security threat susceptibility data is generated accordingly; further, on the basis of obtaining the security threat susceptibility data, the security threat hazard data of each asset identification unit is further determined in combination with threat hazard factors (such as data sensitivity, business impact, attack means and intensity, recovery difficulty and cost, etc.). In actual calculation, it is necessary to weight the threat susceptibility data and consider the specific impact of different threat types on assets.

[0033] Specifically, in the database of the target network security system, different security threat susceptibility indexes corresponding to all threat susceptibility factors are associated with security threat susceptibility probabilities one by one, and the security threat susceptibility probability is calculated based on the operating condition data of historical asset security threat times; each threat susceptibility factor and threat risk factor is pre-divided into severity intervals, and each different severity is assigned and weighted one by one. The assignment and weight values ​​of different severity intervals of the same threat susceptibility factor are not the same. It is stipulated that the total score value of several threat susceptibility factors of the same asset identification unit is consistent, and the total weight value is 1. The specific assignment data can be pre-customized according to the actual application scenarios and usage requirements of the target network security system.

[0034] After assigning values ​​to all threat susceptibility factors of each asset identification unit, a weighted calculation is performed to obtain a security threat susceptibility index; based on the security threat susceptibility index of each threat susceptibility factor, the corresponding security threat susceptibility probability data in the historical operating condition data are associated and weighted calculation is performed to obtain the corresponding security threat susceptibility data; a weighted calculation is performed on all threat hazard factors of each asset identification unit to obtain security threat hazard data; the security threat hazard data of an asset identification unit is equal to the ratio of the security threat hazard data of the asset identification unit to the security threat susceptibility data.

[0035] S5: Output the corresponding security threat identification and assessment results according to the security threat susceptibility data, security threat risk data and target classification parameters of each asset identification unit.

[0036] Specifically, based on the security threat susceptibility data, security threat danger data and target classification parameters (security threat type, threat level, security impact scope) of each asset identification unit, the asset security status of the entire target network security system is comprehensively evaluated; a detailed security threat identification and assessment report is generated, including a list of threatened assets, threat type, threat level, impact scope and recommended defense measures, etc., to provide decision support for network security management.

[0037] In one embodiment, if Figure 2 As shown, in step S4, the preset asset security threat classification model is constructed based on the K-means algorithm, including: S401: Extract data features from various types of pre-processed data to obtain feature data associated with asset security threats and corresponding associated feature marking labels, which include data threat types and threat levels; identify entities related to various types of pre-processed data and asset security threats, and the relationships between each entity to obtain entity information.

[0038] In this embodiment, feature data closely related to asset security threats are extracted from various types of pre-processed data; these features include network traffic features, such as IP address, port number, transmission protocol, etc.; system log features, such as number of login failures, abnormal access mode; user behavior features, such as login time, operation frequency, access path, etc.; data threat types include different threat sources such as DDoS attacks, SQL injections, malware, etc.; threat levels are divided into high, medium, and low. Entity information includes attackers, victims, and attack tools.

[0039] S402: Based on the feature data, feature marker labels and corresponding entity information, a deep learning encoder is used to reduce the dimension and encode the feature data, and an initial asset security threat classification model is constructed in combination with the K-means algorithm.

[0040] In this embodiment, the feature vector is first divided into different clusters according to a preset number of clusters (i.e., the number of threat types), and each cluster represents a type of asset security threat; then, based on the clustering results of the K-means algorithm, an initial asset security threat classification model is constructed, and the initial asset security threat classification model maps the feature vector to the corresponding threat type and threat level.

[0041] S403: Train the initial asset security threat classification model based on the pre-labeled model training data set to obtain the asset security threat classification model; perform model evaluation on the asset security threat classification model based on the test data to obtain a model evaluation result.

[0042] In this embodiment, during the training process, by adjusting the parameters of the model (such as the encoder structure, the number of K-means clusters, etc.), the model can more accurately identify asset security threats; the training process may involve multiple iterations, and each iteration adjusts the model based on the feedback of the training data.

[0043] S404: Optimize and update the asset security threat classification model based on the model evaluation result until the corresponding model evaluation result reaches a preset model evaluation index, where the model evaluation index includes but is not limited to accuracy, precision, and recall.

[0044] Specifically, the asset security threat classification model is optimized based on the model evaluation results; the optimization methods may include adjusting model parameters, improving feature extraction methods, introducing new features or entity information, etc.; if the evaluation results of the model do not meet the preset model evaluation indicators, the model training, evaluation and optimization process is repeated until the requirements of the model evaluation indicators are met.

[0045] Furthermore, as new security threat types and data continue to emerge, the asset security threat classification model is updated regularly; the model update optimization process may include retraining the model, adjusting the number of clusters, or introducing new features, etc.; ensuring that the model can continue to adapt to the ever-changing security threat environment.

[0046] In one embodiment, in step S1, determining a classification target parameter of an asset security threat of a target network security system includes: S11: Determine the type of asset security threat based on the asset security threat source and security threat data characteristics of the target network security system.

[0047] Specifically, sources of asset security threats include external attacks, internal threats, supply chain risks, and physical threats. Asset security threat data includes, but is not limited to, network traffic logs, system logs, user behavior data, and security incident reports. Asset security threat types include phishing, malware, ransomware, data leakage, and unauthorized access.

[0048] S12: The asset security threats are classified into different levels according to their severity to obtain threat levels.

[0049] Specifically, different levels of thresholds are set, such as low threat, medium threat, high threat, etc., and each level corresponds to a different range of evaluation criteria.

[0050] S13: Analyze the asset scope affected by the asset security threat to obtain the security impact scope.

[0051] Specifically, first, an asset inventory is compiled, that is, a detailed asset inventory of the target network security system is compiled, including hardware equipment, software applications and data resources; then the threat propagation path is analyzed, that is, the propagation path and potential impact range of each asset security threat in the system are analyzed. This includes determining the type, quantity, location of assets that the threat may affect, and the dependencies between them; then the security impact range is determined. Based on the analysis results of the threat propagation path, the security impact range of each asset security threat is determined, which includes directly affected assets and assets that may be indirectly affected due to dependencies, and the impact range is quantitatively evaluated, such as the number of affected assets, importance scores, potential losses, etc.

[0052] S14: Determine classification target parameters based on asset security threat type, threat level, and security impact scope.

[0053] In one embodiment, in step S4, each asset identification unit is used as a basic unit, and preliminary identification and classification of asset security threats are performed according to the threat susceptibility factor and the preset asset security threat classification model to obtain the security threat susceptibility index of each asset identification unit, and the security threat susceptibility data of each asset identification unit is calculated according to the security threat susceptibility index, including: S401: In the preset asset security threat classification model, each asset identification unit is taken as a basic unit, and preliminary identification and classification are performed according to the threat susceptibility factor. Based on the similarities and differences of the data in each asset identification unit, the data clusters and corresponding data points in each asset identification unit are determined.

[0054] In this embodiment, the threat susceptibility factor includes but is not limited to asset value, system vulnerabilities and network topology; the asset value is quantified using quantitative or qualitative methods, such as expert scoring, cost estimation, etc., and is used as a component of the threat susceptibility factor; the system vulnerabilities are quantified by vulnerability scanning, and the number, type and severity of the discovered system vulnerabilities are quantified; the location, connection relationship and traffic pattern of each asset identification unit in the network topology of the target network security system are analyzed in the network, and its exposure level and potential attack path are evaluated, and the analysis results are used as quantitative indicators and as threat susceptibility factors.

[0055] S402: According to the data cluster of each asset identification unit and the corresponding threat susceptibility factor, each data in each asset identification unit is assigned a value and a weighted average is calculated to obtain a corresponding security threat susceptibility index.

[0056] Specifically, for each data cluster in each asset identification unit, a value is assigned according to the characteristics of the data in the cluster and the threat susceptibility factor; the assignment can be based on expert judgment, historical data or statistical models and other methods; the assigned values ​​of all data in the cluster are weighted averaged to obtain the security threat susceptibility index of the data cluster.

[0057] S403: Perform weighted calculation on the security threat susceptibility indexes of all data clusters involved in a single asset identification unit to obtain security threat susceptibility data of each asset identification unit.

[0058] Specifically, a weighted calculation is performed on the security threat susceptibility index of all data clusters involved in a single asset identification unit; the weighting coefficient can be determined according to the importance of the data cluster, the threat level or other relevant factors; and finally the security threat susceptibility data of each asset identification unit is obtained, and the security threat susceptibility data reflects the security threat level and risk level faced by the corresponding asset identification unit.

[0059] In one embodiment, in step S4, each asset identification unit is used as a basic unit, and security threat risk data of each asset identification unit is determined according to the threat risk factor and the security threat susceptibility data, including: S411: Threat risk factors include data sensitivity, business impact, attack intensity, difficulty of damage recovery and recovery cost.

[0060] In this embodiment, data sensitivity is assigned a corresponding data sensitivity score value based on the sensitivity of sensitive data such as personal identity information, trade secrets, intellectual property rights, etc. The business impact is determined by the size and scope of business impacts such as service terminals, data loss, and obstructed business processes; the attack intensity is determined based on the attack frequency, attack means, and attack source; the difficulty of recovery from damage is determined by evaluating the availability of backups, the complexity of the recovery process, the time required, and the technical resources required; the recovery cost is determined based on labor costs, equipment costs, and third-party service fees.

[0061] S412: Corresponding threat risk factors are associated with all data clusters involved in each asset identification unit, and weighted calculation is performed based on the corresponding threat risk factors and the corresponding security threat susceptibility data to determine the security threat risk data of each asset identification unit.

[0062] Specifically, for each data cluster, the corresponding threat risk factor value is determined according to its associated data characteristics and threat risk factors; a weighted calculation is performed based on the threat risk factor value and security threat susceptibility data of the data cluster in each asset identification unit; the weighting coefficient can be determined according to the importance of different factors and the contribution to the overall threat risk; for example, data sensitivity and business impact may have higher weights, while recovery cost and difficulty of damaged recovery may adjust the weights according to specific circumstances.

[0063] It should be understood that the serial numbers of the steps in the above embodiments do not imply a sequence of execution. The execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0064] In one embodiment, a system for intelligently identifying asset security threats based on a K-means algorithm is provided. The system for intelligently identifying asset security threats based on a K-means algorithm corresponds to the method for intelligently identifying asset security threats based on a K-means algorithm in the above-mentioned embodiment.

[0065] The asset security threat intelligent identification system based on the K-means algorithm includes a classification parameter determination module, a data acquisition and preprocessing module, an asset identification unit generation module, a threat identification and classification module, and an evaluation result output module. The detailed description of each functional module is as follows: A classification parameter determination module, used to determine classification target parameters of asset security threats of a target network security system; The data collection and preprocessing module is used to collect various data related to asset security, preprocess various data, and associate the preprocessed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors; An asset identification unit generation module, for generating a number of asset identification units in an asset region of a target network security system based on various types of preprocessed data and classification target parameters; The threat identification and classification module is used to take each asset identification unit as the basic unit, perform preliminary identification and classification of asset security threats according to the threat susceptibility factor and the preset asset security threat classification model, obtain the security threat susceptibility index of each asset identification unit, and calculate the security threat susceptibility data of each asset identification unit according to the security threat susceptibility index; take each asset identification unit as the basic unit, determine the security threat hazard data of each asset identification unit according to the threat hazard factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm; The assessment result output module is used to output the corresponding security threat identification assessment result according to the security threat susceptibility data, security threat danger data and target classification parameters of each asset identification unit.

[0066] Optional Threat Identification and Classification modules include: The preliminary identification and classification unit is used to perform preliminary identification and classification based on threat susceptibility factors in a preset asset security threat classification model, taking each asset identification unit as a basic unit, and determining the data clusters and corresponding data points in each asset identification unit based on the similarities and differences of the data in each asset identification unit; The susceptibility data calculation unit is used to assign values ​​and perform weighted average calculation on each data in each asset identification unit according to the data cluster and the corresponding threat susceptibility factor of each asset identification unit to obtain the corresponding security threat susceptibility index; and to perform weighted calculation on the security threat susceptibility index of all data clusters involved in a single asset identification unit to obtain the security threat susceptibility data of each asset identification unit.

[0067] For the specific limitations of the asset security threat intelligent identification system based on the K-means algorithm, please refer to the limitations of the asset security threat intelligent identification method based on the K-means algorithm above, which will not be repeated here; the various modules in the above-mentioned asset security threat intelligent identification system based on the K-means algorithm can be implemented in whole or in part through software, hardware and a combination thereof; the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0068] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store classification target parameters, various types of data related to asset security, and asset security threat classification models. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an intelligent identification method for asset security threats based on the K-means algorithm is implemented.

[0069] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: S1: Determine the classification target parameters of the asset security threats of the target network security system; S2: Collect various data related to asset security, pre-process the data, and associate the pre-processed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors; S3: Based on the preprocessed data and classification target parameters, a number of asset identification units are generated in the asset area of ​​the target network security system; S4: Taking each asset identification unit as a basic unit, perform preliminary identification and classification of asset security threats according to the threat susceptibility factor and the preset asset security threat classification model, obtain the security threat susceptibility index of each asset identification unit, and calculate the security threat susceptibility data of each asset identification unit according to the security threat susceptibility index; taking each asset identification unit as a basic unit, determine the security threat hazard data of each asset identification unit according to the threat hazard factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm; S5: Output the corresponding security threat identification and assessment results according to the security threat susceptibility data, security threat risk data and target classification parameters of each asset identification unit.

[0070] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: S1: Determine the classification target parameters of the asset security threats of the target network security system; S2: Collect various data related to asset security, pre-process the data, and associate the pre-processed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors; S3: Based on the preprocessed data and classification target parameters, a number of asset identification units are generated in the asset area of ​​the target network security system; S4: Taking each asset identification unit as a basic unit, perform preliminary identification and classification of asset security threats according to the threat susceptibility factor and the preset asset security threat classification model, obtain the security threat susceptibility index of each asset identification unit, and calculate the security threat susceptibility data of each asset identification unit according to the security threat susceptibility index; taking each asset identification unit as a basic unit, determine the security threat hazard data of each asset identification unit according to the threat hazard factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm; S5: Output the corresponding security threat identification and assessment results according to the security threat susceptibility data, security threat risk data and target classification parameters of each asset identification unit.

[0071] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0072] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0073] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments may still be modified, or some of the features thereof may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An intelligent identification method for asset security threats based on K-means algorithm, characterized in that: include: Determine the classification target parameters of the asset security threats of the target network security system; Collect various data related to asset security, perform data preprocessing on the various data, and associate the preprocessed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors; Based on the preprocessed data and the classified target parameters, a number of asset identification units are generated in the asset area of ​​the target network security system; Each asset identification unit is a basic unit, and preliminary identification and classification of asset security threats are performed according to the threat susceptibility factor and a preset asset security threat classification model to obtain a security threat susceptibility index for each asset identification unit, and security threat susceptibility data for each asset identification unit is calculated according to the security threat susceptibility index; Taking each asset identification unit as a basic unit, determining the security threat risk data of each asset identification unit according to the threat risk factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm; According to the security threat susceptibility data, security threat risk data and the target classification parameters of each asset identification unit, a corresponding security threat identification evaluation result is output.

2. The method for intelligent identification of asset security threats based on the K-means algorithm according to claim 1 is characterized in that: The preset asset security threat classification model is constructed based on the K-means algorithm and includes: Extract data features from various types of pre-processed data to obtain feature data associated with asset security threats and corresponding associated feature tag labels, wherein the feature tag labels include data threat types and threat levels; identify entities related to various types of pre-processed data and asset security threats, and the relationships between entities to obtain entity information; Based on the feature data, feature marker labels and corresponding entity information, a deep learning encoder is used to reduce the dimension and encode the feature data, and an initial asset security threat classification model is constructed in combination with a K-means algorithm; The initial asset security threat classification model is trained based on a pre-labeled model training data set to obtain an asset security threat classification model; the asset security threat classification model is evaluated based on the test data to obtain a model evaluation result; The asset security threat classification model is optimized and updated based on the model evaluation result until the corresponding model evaluation result reaches a preset model evaluation index, and the model evaluation index includes but is not limited to accuracy, precision and recall.

3. The method for intelligently identifying asset security threats based on the K-means algorithm according to claim 1 is characterized in that: The step of determining the classification target parameters of the asset security threats of the target network security system includes: Determine the type of asset security threat based on the asset security threat source and security threat data characteristics of the target network security system; The threat severity of asset security threats is divided into different levels to obtain threat levels; Analyze the asset scope affected by asset security threats and obtain the security impact scope; Determine classification target parameters based on asset security threat type, threat level, and security impact scope.

4. The method for intelligently identifying asset security threats based on the K-means algorithm according to claim 1 is characterized in that: The method of taking each asset identification unit as a basic unit, performing preliminary identification and classification of asset security threats according to the threat susceptibility factor and a preset asset security threat classification model, obtaining a security threat susceptibility index of each asset identification unit, and calculating security threat susceptibility data of each asset identification unit according to the security threat susceptibility index includes: The threat susceptibility factors include but are not limited to asset value, system vulnerabilities and network topology; In the preset asset security threat classification model, each asset identification unit is taken as the basic unit, and preliminary identification and classification are performed according to the threat susceptibility factor. Based on the similarity and difference of the data in each asset identification unit, the data cluster and the corresponding data points in each asset identification unit are determined; According to the data cluster of each asset identification unit and the corresponding threat susceptibility factor, each data in each asset identification unit is assigned a value and a weighted average is calculated to obtain a corresponding security threat susceptibility index; The security threat susceptibility indexes of all data clusters involved in a single asset identification unit are weightedly calculated to obtain security threat susceptibility data of each asset identification unit.

5. The method for intelligently identifying asset security threats based on the K-means algorithm according to claim 4 is characterized in that: The method of taking each asset identification unit as a basic unit and determining the security threat risk data of each asset identification unit according to the threat risk factor and the security threat susceptibility data includes: The threat risk factors include data sensitivity, business impact, attack intensity, damage recovery difficulty and recovery cost; Corresponding threat risk factors are associated with all data clusters involved in each asset identification unit, and weighted calculation is performed based on the corresponding threat risk factors and the corresponding security threat susceptibility data to determine the security threat risk data of each asset identification unit.

6. The asset security threat intelligent identification system based on K-means algorithm is characterized by: The system comprises: A classification parameter determination module, used to determine classification target parameters of asset security threats of a target network security system; The data collection and preprocessing module is used to collect various data related to asset security, perform data preprocessing on the various data, and associate the preprocessed data with preset influencing factors and weights to obtain several security threat level factors for each data; the security threat level factors include threat susceptibility factors and threat risk factors; An asset identification unit generation module, for generating a number of asset identification units in an asset region of a target network security system based on various types of preprocessed data and classification target parameters; A threat identification and classification module is used to take each asset identification unit as a basic unit, perform preliminary identification and classification of asset security threats according to the threat susceptibility factor and a preset asset security threat classification model, obtain a security threat susceptibility index of each asset identification unit, and calculate security threat susceptibility data of each asset identification unit according to the security threat susceptibility index; take each asset identification unit as a basic unit, determine the security threat hazard data of each asset identification unit according to the threat hazard factor and the security threat susceptibility data; the preset asset security threat classification model is constructed based on the K-means algorithm; The assessment result output module is used to output the corresponding security threat identification assessment result according to the security threat susceptibility data, security threat risk data and the target classification parameters of each asset identification unit.

7. The asset security threat intelligent identification system based on K-means algorithm according to claim 6 is characterized in that: The threat susceptibility factors include but are not limited to asset value, system vulnerabilities and network topology; the threat identification and classification module includes: The preliminary identification and classification unit is used to perform preliminary identification and classification based on threat susceptibility factors in a preset asset security threat classification model, taking each asset identification unit as a basic unit, and determining the data clusters and corresponding data points in each asset identification unit based on the similarities and differences of the data in each asset identification unit; The susceptibility data calculation unit is used to assign values ​​and perform weighted average calculation on each data in each asset identification unit according to the data cluster and the corresponding threat susceptibility factor of each asset identification unit to obtain the corresponding security threat susceptibility index; and to perform weighted calculation on the security threat susceptibility index of all data clusters involved in a single asset identification unit to obtain the security threat susceptibility data of each asset identification unit.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for intelligently identifying asset security threats based on the K-means algorithm as described in any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for intelligently identifying asset security threats based on the K-means algorithm as claimed in any one of claims 1 to 5 are implemented.

Images