Network security intelligent evaluation method and system

Abstract

The invention provides a network security intelligent assessment method and system, and relates to the technical field of computer network security, and the method comprises the steps: obtaining an initial network system, carrying out the standard description of the initial network system, generating a target network system, solving the target network system, obtaining a corresponding information security risk, and constructing a planning penetration graph model; constructing a corresponding information security risk probability calculation model according to the planning penetration graph model, and calculating the risk probability of the information security risk; determining a risk quantitative evaluation index, performing risk quantitative evaluation on each security target in the target network system according to the risk probability, and establishing a network security quantitative evaluation model; the network security quantitative evaluation model is applied to a real-time network system, and the network security quantitative evaluation model is verified and optimized, so that accurate, comprehensive and dynamic evaluation of network system information security risks can be realized, corresponding decision support is provided, and the reliability and effectiveness of network security management are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to a network security intelligent evaluation method and system. Background Art

[0002] In the current field of computer network security technology, with the rapid development of network technology and the continuous expansion of network scale, network security issues are becoming increasingly prominent. The existing network system is relatively complex, involving many elements and links, which makes the identification and assessment of network security risks particularly difficult.

[0003] In the prior art, traditional network security assessment methods are often based on static, known risk factors for analysis, which cannot reflect the dynamic changes of risks in the network system in real time, resulting in the evaluation results lagging behind the actual security situation, making it difficult to provide timely and effective support for security improvement measures. At the same time, since this method ignores the dynamic evolution of risks in the network system, it often fails to fully consider the vulnerability and attack path of the network system, resulting in the evaluation results may miss some important risk factors, thereby reducing the comprehensiveness and accuracy of the evaluation. In addition, traditional assessment methods often rely on manual analysis and lack automation and intelligent means, which leads to a cumbersome and time-consuming assessment process, and is easily affected by human factors, reducing the efficiency and reliability of the assessment.

[0004] Therefore, it is necessary to provide a network security intelligent assessment method and system to solve the above technical problems. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a network security intelligent assessment method and system for solving the problem that traditional assessment methods often focus on analyzing static, known risk factors, but ignore the dynamic evolution of risks in the network system, and separate risk analysis from the specific system environment and business background, resulting in the assessment results being unable to fully and accurately reflect the system information security status.

[0006] The present invention provides a network security intelligent assessment method, the assessment method comprising:

[0007] Obtaining an initial network system and generating a target network system by describing it in a standardized manner, solving the target network system to obtain corresponding information security risks, and constructing a planning penetration map model;

[0008] Constructing a corresponding information security risk probability calculation model according to the planned penetration map model to calculate the risk probability of the information security risk;

[0009] Determine risk quantitative assessment indicators, conduct risk quantitative assessment on each security target in the target network system according to the risk probability, and establish a network security quantitative assessment model;

[0010] The network security quantitative evaluation model is applied to a real-time network system to verify and optimize the network security quantitative evaluation model.

[0011] Preferably, the obtaining of the initial network system and generating a target network system by performing a specification description, solving the target network system to obtain the corresponding information security risk, and constructing a planning penetration map model specifically includes:

[0012] Acquire the initial network system, and describe the state and action of the initial network system in a standardized manner based on a planning domain definition language to generate the target network system;

[0013] Solving the target network system based on heuristic search to obtain the information security risk, and the information security risk includes potential attack paths, steps and resources;

[0014] The planning penetration map model is constructed according to the information security risk.

[0015] Preferably, the planned penetration map model is constructed by the following formula:

[0016] Obtain the initial network system, and describe the state and action of the initial network system in a standardized manner based on the planning domain definition language to generate a corresponding state space S = {s1, s2, ..., s n}、Action space A={a1,a2,...,a n} and target state set The target state set G represents the set to which all secure network states belong;

[0017] In the heuristic search, the evaluation function is set to f(s), and the calculation formula of the evaluation function f(s) is:

[0018] f(s)=g(s)+h(s)

[0019] In the formula, f(s) represents the evaluation function; g(s) represents the actual cost of the target network system from the starting state to the current state s; h(s) represents the heuristic function, that is, the minimum cost of the target network system from the current state s to the target state set G;

[0020] The heuristic search process is guided by the evaluation function f(s), and the target network system is solved to obtain the information security risk, and the planning penetration map model is constructed according to the information security risk.

[0021] Preferably, the constructing a corresponding information security risk probability calculation model according to the planned penetration map model to calculate the risk probability of the information security risk specifically includes:

[0022] Introducing a risk probability factor into the planning penetration graph model, constructing the information security risk probability calculation model according to the planning penetration graph model based on a Bayesian network, and determining the structure of the information security risk probability calculation model, wherein the structure includes nodes, edges, and dependencies between nodes;

[0023] Assume that the node set is N, the edge set is E, and the node N i The prior probability of occurrence is P(N i ), at node N j The condition that occurs is node N i The conditional probability of occurrence is P(N i |N j );

[0024] Determine a priori distribution of model parameters corresponding to each of the nodes;

[0025] Based on the Bayesian theorem, the model parameters are updated in real time according to the operation status of the target network system:

[0026]

[0027] In the formula, P(N i |Pa(N i )) indicates that in the parent node set Pa(N i ) under the condition that node N i The posterior probability of occurrence; P(Pa(N i )|N i ) indicates that at node N i Under the condition that occurs, the parent node set Pa(N i ) appears; P(N i ) represents node N i Prior probability of occurrence; P(Pa(N i )) represents the node Pa(N i ) occurs;

[0028] Based on the joint probability distribution and according to the updated model parameters, the risk probability of the information security risk is calculated by the information security risk probability calculation model:

[0029] P(N1,N2,...,N m )

[0030] =P(N1)×P(N2|N1)×P(N3|N1,N2)...P(N m|N1,N2,...,N m-1 )

[0031] Where N1, N2, ..., N m Represents a node; P(N1,N2,...,N m ) represents the risk probability of information security risk; P(N1) represents the prior probability of node N1 occurring; P(N2|N1) represents the conditional probability of node N2 occurring under the condition that node N1 occurs; P(N3|N1,N2) represents the conditional probability of node N3 occurring under the condition that nodes N1 and N2 occur; P(N m |N1,N2,...,N m-1 ) indicates that at nodes N1, N2, ..., N m-1 Under the condition that the node N m The conditional probability of occurrence.

[0032] Preferably, the step of determining the risk quantitative assessment index, performing risk quantitative assessment on each security target in the target network system according to the risk probability, and establishing a network security quantitative assessment model specifically includes:

[0033] Determining the risk quantification evaluation index according to the security requirements of the target network system, and the risk quantification evaluation index includes a risk value R, a loss value L and a security level Q;

[0034] Based on the risk quantification assessment indicator, according to the risk probability, combined with the risk loss corresponding to the information security risk, a risk quantification assessment is performed on each security target in the target network system to generate a corresponding risk quantification assessment result;

[0035] Establishing the network security quantitative assessment model according to the risk quantitative assessment result;

[0036] The calculation formula of the risk value index in the network security quantitative assessment model is:

[0037] R k =P(D k )×L(D k )

[0038] Where D k represents the kth risk event; R k represents the risk value indicator corresponding to the k-th risk event; P(D k ) represents the risk probability of the kth risk event; L(D k ) represents the risk loss caused by the occurrence of the kth risk event;

[0039] The corresponding average risk value indicator calculation formula is:

[0040]

[0041] In the formula, represents the average risk value indicator; T represents the total number of risk events; R k Represents the risk value indicator corresponding to the k-th risk event;

[0042] Determine the security level Q according to the average risk value indicator:

[0043]

[0044] In the formula, Q represents the safety level; Represents the average risk value indicator; R high Indicates the highest risk threshold; R low Indicates the lowest risk threshold.

[0045] Preferably, based on the network security quantitative assessment model, early warning information and defense decisions corresponding to the information security risks are generated and displayed to the management end.

[0046] Preferably, the applying the network security quantitative assessment model to a real-time network system to verify and optimize the network security quantitative assessment model specifically includes:

[0047] Applying the network security quantitative assessment model to a real-time network system to perform risk assessment, verifying the effectiveness of the network security quantitative assessment model, and generating corresponding verification results;

[0048] According to the verification result and in combination with the operation status of the real-time network system, the network security quantitative assessment model is continuously updated and optimized.

[0049] A network security intelligent evaluation system, the evaluation system comprising:

[0050] A construction module is used to obtain an initial network system and generate a target network system by describing the target network system in a standardized manner, solve the target network system to obtain the corresponding information security risks, and construct a planning penetration map model;

[0051] A calculation module, used to construct a corresponding information security risk probability calculation model according to the planned penetration map model, and calculate the risk probability of the information security risk;

[0052] An evaluation module is used to determine a risk quantitative evaluation index, perform a risk quantitative evaluation on each security target in the target network system according to the risk probability, and establish a network security quantitative evaluation model;

[0053] The optimization module is used to apply the network security quantitative evaluation model to a real-time network system to verify and optimize the network security quantitative evaluation model.

[0054] Compared with the related art, the network security intelligent assessment method and system provided by the present invention have the following beneficial effects:

[0055] The present invention obtains an initial network system and generates a target network system by performing a specification description, solves the target network system to obtain the corresponding information security risk, and constructs a planning penetration map model; constructs a corresponding information security risk probability calculation model according to the planning penetration map model, and calculates the risk probability of the information security risk; determines a risk quantification assessment index, performs a risk quantification assessment on each security target in the target network system according to the risk probability, and establishes a network security quantitative assessment model; applies the network security quantitative assessment model to a real-time network system, verifies and optimizes the network security quantitative assessment model. The present invention can achieve accurate modeling and probability calculation of information security risks by introducing a Bayesian network model, thereby improving the accuracy of intelligent network security assessment; and can comprehensively consider the vulnerability and attack path of the network system, thereby enhancing the comprehensiveness of network security assessment; at the same time, the present invention can update model parameters in real time, reflect the actual risk status of the network system, and realize dynamic assessment of information security risks; by establishing a network security quantitative assessment model, the present invention can provide network security managers with comprehensive and accurate security defense decisions and early warnings, thereby improving the effectiveness and reliability of network security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A flowchart of a network security intelligent assessment method of the present invention;

[0057] Figure 2 A schematic diagram showing early warning information and defense decisions corresponding to information security risks of the present invention;

[0058] Figure 3 The system block diagram of a network security intelligent assessment system of the present invention is shown in FIG. DETAILED DESCRIPTION

[0059] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.

[0060] Embodiment 1

[0061] like Figure 1 As shown, a network security intelligent assessment method, the assessment method comprising:

[0062] S1, obtaining an initial network system and generating a target network system by describing the system in a standardized manner, solving the target network system to obtain the corresponding information security risks, and constructing a planning penetration map model;

[0063] Among them, when conducting a network security assessment, the initial network system can be first obtained and a corresponding specification description can be made for it, so that the required target network system can be accurately constructed. This process includes a comprehensive analysis of the initial network system, involving various aspects such as the architecture, configuration, data flow, and security policy of the initial network system, thereby ensuring the accuracy and comprehensiveness of the generated target network system. After obtaining the target network system, based on network security analysis technology, the information security risks faced by the target network system can be solved, potential security vulnerabilities, threat vectors, and attack paths can be identified, and support for subsequent security protection work can be provided.

[0064] S2, constructing a corresponding information security risk probability calculation model according to the planned penetration map model, and calculating the risk probability of the information security risk;

[0065] It is understandable that in order to effectively deal with these information security risks, a planning penetration map model can be constructed. This model graphically displays possible attack penetration paths, as well as key nodes and vulnerable links on these paths, which helps managers intuitively grasp the security situation of the network system and facilitate the subsequent formulation of targeted defense strategies.

[0066] Based on the planning penetration map model, the corresponding information security risk probability calculation model can be further constructed to quantitatively assess the risk. The information security risk probability calculation model is based on probability theory and statistical principles, and can comprehensively consider factors such as the defense level of the target network system to calculate the probability of each security risk, which is convenient for the subsequent formulation of risk mitigation measures and allocation of security resources.

[0067] S3, determining a risk quantitative assessment index, performing a risk quantitative assessment on each security target in the target network system according to the risk probability, and establishing a network security quantitative assessment model;

[0068] In practical applications, by formulating scientific and reasonable risk quantification assessment indicators, we can comprehensively reflect key information such as the vulnerability, potential losses, and recovery difficulty of each security target in the target network system. We can then conduct risk quantification assessment of each security target based on risk probability and establish a complete network security quantitative assessment model.

[0069] The network security quantitative assessment model can provide quantitative decision-making basis for network security management, which helps to achieve effective control of network security risks.

[0070] S4, applying the network security quantitative evaluation model to a real-time network system to verify and optimize the network security quantitative evaluation model.

[0071] Finally, the constructed network security quantitative assessment model can be applied to real-time network systems, and the accuracy and effectiveness of the network security quantitative assessment model can be verified through continuous monitoring and data analysis.

[0072] At the same time, based on real-time feedback information, the network security quantitative assessment model can be continuously optimized to ensure that it can adapt to the dynamic changes in the network environment and provide strong support for network security protection.

[0073] In the specific implementation process, the initial network system is obtained and a target network system is generated by a specification description, the target network system is solved to obtain the corresponding information security risk, and a planning penetration map model is constructed, which specifically includes:

[0074] Acquire the initial network system, and describe the state and action of the initial network system in a standardized manner based on a planning domain definition language to generate the target network system;

[0075] Solving the target network system based on heuristic search to obtain the information security risk, and the information security risk includes potential attack paths, steps and resources;

[0076] The planning penetration map model is constructed according to the information security risk.

[0077] Among them, in the initial stage of evaluating the information security protection capabilities of the network system, the acquired initial network system can be deeply analyzed to generate a target network system with standardized definitions.

[0078] Specifically, the initial network system can be fully collected first, including information on the network architecture, device configuration, communication protocol, security policy, and other dimensions of the initial network system. Subsequently, the planning domain definition language (PDDL) can be used to accurately and formally describe the state space and executable actions of the initial network system, thereby ensuring that all key elements of the network system are accurately captured, generating a target network system with a clear structure and strict logic, and providing support for subsequent analysis and modeling.

[0079] It should be noted that heuristic search, as an intelligent optimization method, can efficiently explore the state space of the target network system and discover potential attack paths, attack steps, and required attack resources. After obtaining the target network system, the heuristic search algorithm can be used to solve it to identify and quantify potential information security risks. These information security risks not only cover direct network intrusions, but also include indirect attack methods such as intrusions by exploiting system vulnerabilities, improper configurations, or user behavior weaknesses. Through heuristic search, the possible weak links in the network system can be systematically revealed, providing a scientific basis for the formulation of targeted security protection measures.

[0080] Based on the information security risks obtained, a planning penetration graph model can be further constructed. The planning penetration graph model is a graphical representation method that can intuitively display the key path of attacks from the outside of the network to the inside, the specific operations of each attack step, and the required resource conditions in the form of nodes and edges. The planning penetration graph model helps managers intuitively understand the security situation of the network system and provides strong support for formulating defense strategies and optimizing security configurations.

[0081] Through the above methods, we can comprehensively use technical means such as planning domain definition language and heuristic search algorithms to comprehensively and deeply evaluate the information security risks of network systems and provide a scientific basis for improving network protection capabilities.

[0082] The planning penetration map model is constructed by the following formula:

[0083] Obtain the initial network system, and describe the state and action of the initial network system in a standardized manner based on the planning domain definition language to generate a corresponding state space S = {s1, s2, ..., s n}、Action space A={a1,a2,...,a n} and target state set The target state set G represents the set to which all secure network states belong;

[0084] In the heuristic search, the evaluation function is set to f(s), and the calculation formula of the evaluation function f(s) is:

[0085] f(s)=g(s)+h(s)

[0086] In the formula, f(s) represents the evaluation function; g(s) represents the actual cost of the target network system from the starting state to the current state s; h(s) represents the heuristic function, that is, the minimum cost of the target network system from the current state s to the target state set G;

[0087] The heuristic search process is guided by the evaluation function f(s), and the target network system is solved to obtain the information security risk, and the planning penetration map model is constructed according to the information security risk.

[0088] It can be understood that the initial network system can be obtained first, which covers all relevant network components, connection relationships and their potential security attributes. And the planning domain definition language (PDDL) can be used to standardize the state and action of the initial network system, converting complex network behaviors into a series of parseable state transitions and action executions, generating corresponding state spaces, action spaces and target state sets.

[0089] It should be noted that the target state set is a specific subset that includes all network states that meet security standards, that is, it represents an ideal security network configuration.

[0090] In the process of constructing the planning permeation graph model, heuristic search strategies are widely used to determine the optimal path from the initial state to the target state set. In order to efficiently guide the heuristic search process, the evaluation function can be set: f(s) = g(s) + h(s), where f(s) represents the value of the evaluation function at the current state s; g(s) represents the actual cost of the target network system from the initial state to the current state s, which usually includes factors such as resource consumption and time cost of the executed actions; h(s) represents the heuristic function, which estimates the minimum cost of the target network system from the current state s to the target state set G, so that the optimal solution can be quickly found under limited computing resources.

[0091] Through the evaluation function, the heuristic search algorithm can intelligently and efficiently traverse the state space until the path to the target state set is determined. By planning the penetration graph model, a scientific basis can be provided for the formulation of network security strategies, which is convenient for subsequent penetration testing, security reinforcement, etc.

[0092] The step of constructing a corresponding information security risk probability calculation model according to the planned penetration map model to calculate the risk probability of the information security risk specifically includes:

[0093] Introducing a risk probability factor into the planning penetration graph model, constructing the information security risk probability calculation model according to the planning penetration graph model based on a Bayesian network, and determining the structure of the information security risk probability calculation model, wherein the structure includes nodes, edges, and dependencies between nodes;

[0094] Assume that the node set is N, the edge set is E, and the node N i The prior probability of occurrence is P(N i ), at node N jThe condition that occurs is node N i The conditional probability of occurrence is P(N i |N j );

[0095] Determine a priori distribution of model parameters corresponding to each of the nodes;

[0096] Based on the Bayesian theorem, the model parameters are updated in real time according to the operation status of the target network system:

[0097]

[0098] In the formula, P(N i |Pa(N i )) indicates that in the parent node set Pa(N i ) under the condition that node N i The posterior probability of occurrence; P(Pa(N i )|N i ) indicates that at node N i Under the condition that occurs, the parent node set Pa(N i ) appears; P(N i ) represents node N i Prior probability of occurrence; P(Pa(N i )) represents the node Pa(N i ) occurs;

[0099] Based on the joint probability distribution and according to the updated model parameters, the risk probability of the information security risk is calculated by the information security risk probability calculation model:

[0100] P(N1,N2,...,N m )

[0101] =P(N1)×P(N2|N1)×P(N3|N1,N2)...P(N m |N1,N2,...,N m-1 )

[0102] Where N1, N2, ..., N m Represents a node; P(N1,N2,...,N m ) represents the risk probability of information security risk; P(N1) represents the prior probability of node N1 occurring; P(N2|N1) represents the conditional probability of node N2 occurring under the condition that node N1 occurs; P(N3|N1,N2) represents the conditional probability of node N3 occurring under the condition that nodes N1 and N2 occur; P(N m |N1,N2,...,N m-1 ) indicates that at nodes N1, N2, ..., Nm-1 Under the condition that the node N m The conditional probability of occurrence.

[0103] In practical applications, we can first integrate risk probability factors into the planning penetration graph model, use the Bayesian network framework, and build an information security risk probability calculation model based on the structural characteristics of the planning penetration graph model, and clarify its structural composition, including nodes, edges, and dependencies between nodes.

[0104] Specifically, the nodes of the information security risk probability calculation model represent different information security elements or events; the edges describe the potential impact paths between nodes; and the dependencies between nodes reveal the impact of a node state change on other nodes.

[0105] Assume that the node set is N, the edge set is E, and the node N i The prior probability of occurrence is P(N i ), at node N j The condition that occurs is node N i The conditional probability of occurrence is P(N i |N j ), and determine the prior distribution of the corresponding model parameters for each node, and then based on Bayesian theorem and combined with the real-time operation of the target network system, the model parameters can be dynamically updated.

[0106] Through the above methods, we can systematically build and optimize the information security risk probability calculation model to provide a scientific basis for the security protection of network systems.

[0107] The step of determining the risk quantitative assessment index, performing risk quantitative assessment on each security target in the target network system according to the risk probability, and establishing a network security quantitative assessment model specifically includes:

[0108] Determining the risk quantification evaluation index according to the security requirements of the target network system, and the risk quantification evaluation index includes a risk value R, a loss value L and a security level Q;

[0109] Based on the risk quantification assessment indicator, according to the risk probability, combined with the risk loss corresponding to the information security risk, a risk quantification assessment is performed on each security target in the target network system to generate a corresponding risk quantification assessment result;

[0110] Establishing the network security quantitative assessment model according to the risk quantitative assessment result;

[0111] The calculation formula of the risk value index in the network security quantitative assessment model is:

[0112] R k =P(Dk )×L(D k )

[0113] Where D k represents the kth risk event; R k represents the risk value indicator corresponding to the k-th risk event; P(D k ) represents the risk probability of the kth risk event; L(D k ) represents the risk loss caused by the occurrence of the kth risk event;

[0114] The corresponding average risk value indicator calculation formula is:

[0115]

[0116] In the formula, represents the average risk value indicator; T represents the total number of risk events; R k Represents the risk value indicator corresponding to the k-th risk event;

[0117] Determine the security level Q according to the average risk value indicator:

[0118]

[0119] In the formula, Q represents the safety level; Represents the average risk value indicator; R high Indicates the highest risk threshold; R low Indicates the lowest risk threshold.

[0120] like Figure 2 As shown, based on the network security quantitative assessment model, early warning information and defense decisions corresponding to the information security risks are generated and displayed to the management end through the terminal device.

[0121] In order to systematically identify and quantify potential threats, we can first determine the risk quantification assessment indicators based on the specific security requirements of the target network system to ensure the pertinence and effectiveness of the assessment results. Risk quantification assessment indicators usually include three core elements: risk value, loss value, and security level. These indicators together constitute the basic framework for measuring network security situation.

[0122] Specifically, the calculation of risk value is based on the probability of risk events and the losses they may cause. In order to accurately quantify the risks of each security target in the target network system, we can first analyze the risk probability of each risk event and its potential risk losses based on the risk quantification assessment indicators and the specific scenarios of information security risks. By comprehensively applying statistics, probability theory and loss assessment techniques, we can generate corresponding risk quantification assessment results and provide data support for subsequent model construction.

[0123] Based on the results of risk quantitative assessment, a network security quantitative assessment model can be further constructed. This model can intuitively display the security status of the network system in a mathematical way, providing a scientific basis for the formulation and optimization of security strategies.

[0124] In the network security quantitative assessment model, the risk value index is usually calculated using the following formula: R k =P(D k )×L(D k ), where R k represents the risk value indicator corresponding to the k-th risk event; P(D k ) represents the risk probability of the kth risk event; L(D k ) represents the risk loss caused by the occurrence of the kth risk event. Through the above formula, the impact of each risk event on the overall security situation can be quantified.

[0125] In order to obtain a comprehensive network security status, the corresponding average risk value index can be further calculated. The calculation formula is as follows: in, represents the average risk value indicator; T represents the total number of risk events; R k It represents the risk value indicator corresponding to the k-th risk event. The average risk value indicator can fully reflect the overall risk level faced by the network system.

[0126] Finally, the safety level judgment standard can be set based on the average risk value indicator. This standard is usually based on the preset highest risk threshold R high and the minimum risk threshold R low , determined by the following formula: Among them, Q represents the security level, which divides the network system into different security levels according to the position of the average risk value indicator relative to the risk threshold, thereby providing managers with an intuitive display of security situation and decision-making basis.

[0127] The applying the network security quantitative evaluation model to a real-time network system to verify and optimize the network security quantitative evaluation model specifically includes:

[0128] Applying the network security quantitative assessment model to a real-time network system to perform risk assessment, verifying the effectiveness of the network security quantitative assessment model, and generating corresponding verification results;

[0129] According to the verification result and in combination with the operation status of the real-time network system, the network security quantitative assessment model is continuously updated and optimized.

[0130] In practical applications, the constructed network security quantitative assessment model can be applied to real-time network systems to verify its applicability and accuracy, which helps to confirm whether the model can effectively capture and quantify potential threats in real-time network environments and provide feedback for subsequent model optimization.

[0131] Specifically, the network security quantitative assessment model can be embedded in the real-time network system, and then the model can be used to dynamically assess various security risks that are occurring or may occur in the system. Through the input and analysis of real-time data, instant feedback on network security performance, i.e., verification results, can be generated. These verification results include quantitative indicators such as risk value and loss value of risk events, as well as a comprehensive evaluation of the overall security situation of the network.

[0132] Furthermore, the verification results can be combined with the actual operation of the real-time network system. By comprehensively analyzing multi-source information such as network logs, event records, and traffic data, the degree of match between the model prediction results and the actual security events can be verified. In this way, the limitations and error sources of the network security quantitative assessment model in specific scenarios can be determined, such as some risk factors not being fully considered and the risk probability calculation being inaccurate.

[0133] Based on the verification results, the network security quantitative assessment model can be continuously updated and optimized by adjusting the risk quantitative assessment indicators, improving the risk probability calculation method, and updating the risk loss assessment standard. For example, if it is found that the network security quantitative assessment model performs poorly in the face of certain types of attacks, the risk identification features for such attacks can be added or their risk weights can be adjusted to improve the sensitivity and accuracy of the model. In addition, with the development of network technology and the continuous emergence of new threats, the update of the network security quantitative assessment model needs to fully consider new security risks to ensure that it can continue to adapt to the dynamic changes in the network security environment.

[0134] By applying the network security quantitative assessment model to the real-time network system and continuously updating and optimizing the network security quantitative assessment model based on the verification results, the practicality and accuracy of the network security quantitative assessment model can be improved, and a responsive and accurate network security protection system can be built.

[0135] Embodiment 2

[0136] like Figure 3 As shown, a network security intelligent evaluation system, the evaluation system comprises:

[0137] A construction module is used to obtain an initial network system and generate a target network system by describing the target network system in a standardized manner, solve the target network system to obtain the corresponding information security risks, and construct a planning penetration map model;

[0138] A calculation module, used to construct a corresponding information security risk probability calculation model according to the planned penetration map model, and calculate the risk probability of the information security risk;

[0139] An evaluation module is used to determine a risk quantitative evaluation index, perform a risk quantitative evaluation on each security target in the target network system according to the risk probability, and establish a network security quantitative evaluation model;

[0140] The optimization module is used to apply the network security quantitative evaluation model to a real-time network system to verify and optimize the network security quantitative evaluation model.

[0141] Through the introduction of the above embodiments, the present invention uses a network security intelligent assessment method and system, obtains an initial network system and generates a target network system by performing a standardized description, solves the target network system to obtain the corresponding information security risk, and constructs a planning penetration map model; constructs a corresponding information security risk probability calculation model according to the planning penetration map model, calculates the risk probability of the information security risk; determines the risk quantification assessment index, performs risk quantification assessment on each security target in the target network system according to the risk probability, and establishes a network security quantitative assessment model; applies the network security quantitative assessment model to a real-time network system, verifies and optimizes the network security quantitative assessment model. The present invention can achieve accurate modeling and probability calculation of information security risks by introducing a Bayesian network model, thereby improving the accuracy of network security intelligent assessment; and comprehensively considers the vulnerability and attack path of the network system, thereby enhancing the comprehensiveness of network security assessment; at the same time, the present invention can update model parameters in real time, reflect the actual risk status of the network system, and realize dynamic assessment of information security risks; the present invention can provide comprehensive and accurate security defense decisions and early warnings for network security managers by establishing a network security quantitative assessment model, thereby improving the effectiveness and reliability of network security management.

[0142] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0143] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0144] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

Claims

1. A network security intelligent assessment method, characterized in that: The evaluation methods include: Obtaining an initial network system and generating a target network system by describing it in a standardized manner, solving the target network system to obtain corresponding information security risks, and constructing a planning penetration map model; Constructing a corresponding information security risk probability calculation model according to the planned penetration map model to calculate the risk probability of the information security risk; Determine risk quantitative assessment indicators, conduct risk quantitative assessment on each security target in the target network system according to the risk probability, and establish a network security quantitative assessment model; The network security quantitative evaluation model is applied to a real-time network system to verify and optimize the network security quantitative evaluation model.

2. A network security intelligent assessment method according to claim 1, characterized in that: The initial network system is obtained and described in a specification to generate a target network system, the target network system is solved to obtain the corresponding information security risk, and a planning penetration map model is constructed, specifically including: Acquire the initial network system, and describe the state and action of the initial network system in a standardized manner based on a planning domain definition language to generate the target network system; Solving the target network system based on heuristic search to obtain the information security risk, and the information security risk includes potential attack paths, steps and resources; The planning penetration map model is constructed according to the information security risk.

3. A network security intelligent assessment method according to claim 2, characterized in that: The planning penetration map model is constructed by the following formula: Obtain the initial network system, and describe the state and action of the initial network system in a standardized manner based on the planning domain definition language to generate a corresponding state space S = {s1, s2, ..., s n }、Action space A={a1,a2,...,a n } and target state set The target state set G represents the set to which all secure network states belong; In the heuristic search, the evaluation function is set to f(s), and the calculation formula of the evaluation function f(s) is: f(s)=g(s)+h(s) In the formula, f(s) represents the evaluation function; g(s) represents the actual cost of the target network system from the starting state to the current state s; h(s) represents the heuristic function, that is, the minimum cost of the target network system from the current state s to the target state set G; The heuristic search process is guided by the evaluation function f(s), and the target network system is solved to obtain the information security risk, and the planning penetration map model is constructed according to the information security risk.

4. A network security intelligent assessment method according to claim 1, characterized in that: The step of constructing a corresponding information security risk probability calculation model according to the planned penetration map model to calculate the risk probability of the information security risk specifically includes: Introducing a risk probability factor into the planning penetration graph model, constructing the information security risk probability calculation model according to the planning penetration graph model based on a Bayesian network, and determining the structure of the information security risk probability calculation model, wherein the structure includes nodes, edges, and dependencies between nodes; Assume that the node set is N, the edge set is E, and the node N i The prior probability of occurrence is P(N i ), at node N j The condition that occurs is node N i The conditional probability of occurrence is P(N i |N j ); Determine a priori distribution of model parameters corresponding to each of the nodes; Based on the Bayesian theorem, the model parameters are updated in real time according to the operation status of the target network system: In the formula, P(N i |Pa(N i )) indicates that in the parent node set Pa(N i ) under the condition that node N i The posterior probability of occurrence; P(Pa(N i )|N i ) indicates that at node N i Under the condition that occurs, the parent node set Pa(N i ) appears; P(N i ) represents node N i Prior probability of occurrence; P(Pa(N i )) represents the node Pa(N i ) occurs; Based on the joint probability distribution and according to the updated model parameters, the risk probability of the information security risk is calculated by the information security risk probability calculation model: P(N1,N2,...,N m ) =P(N1)×P(N2|N1)×P(N3|N1,N2)...P(N m |N1,N2,...,N m-1 ) where N1, N2, ..., N m Represents a node; P(N1,N2,...,N m ) represents the risk probability of information security risk; P(N1) represents the prior probability of node N1 occurring; P(N2|N1) represents the conditional probability of node N2 occurring under the condition that node N1 occurs; P(N3|N1,N2) represents the conditional probability of node N3 occurring under the condition that nodes N1 and N2 occur; P(N m |N1,N2,...,N m-1 ) indicates that at nodes N1, N2, ..., N m-1 Under the condition that the node N m The conditional probability of occurrence.

5. A network security intelligent assessment method according to claim 1, characterized in that: The step of determining the risk quantitative assessment index, performing risk quantitative assessment on each security target in the target network system according to the risk probability, and establishing a network security quantitative assessment model specifically includes: Determining the risk quantification evaluation index according to the security requirements of the target network system, and the risk quantification evaluation index includes a risk value R, a loss value L and a security level Q; Based on the risk quantification assessment indicator, according to the risk probability, combined with the risk loss corresponding to the information security risk, a risk quantification assessment is performed on each security target in the target network system to generate a corresponding risk quantification assessment result; Establishing the network security quantitative assessment model according to the risk quantitative assessment result; The calculation formula of the risk value index in the network security quantitative assessment model is: R k =P(D k )×L(D k ) Where D k represents the kth risk event; R k represents the risk value indicator corresponding to the k-th risk event; P(D k ) represents the risk probability of the kth risk event; L(D k ) represents the risk loss caused by the occurrence of the kth risk event; The corresponding average risk value indicator calculation formula is: In the formula, represents the average risk value indicator; T represents the total number of risk events; R k Represents the risk value indicator corresponding to the k-th risk event; Determine the security level Q according to the average risk value indicator: In the formula, Q represents the safety level; It represents the average risk value indicator; Represents the highest risk threshold; R low Indicates the lowest risk threshold.

6. A network security intelligent assessment method according to claim 5, characterized in that: Based on the network security quantitative assessment model, early warning information and defense decisions corresponding to the information security risks are generated and displayed to the management end.

7. A network security intelligent assessment method according to claim 1, characterized in that: The applying the network security quantitative evaluation model to a real-time network system to verify and optimize the network security quantitative evaluation model specifically includes: Applying the network security quantitative assessment model to a real-time network system to perform risk assessment, verifying the effectiveness of the network security quantitative assessment model, and generating corresponding verification results; According to the verification result and in combination with the operation status of the real-time network system, the network security quantitative assessment model is continuously updated and optimized.

8. A network security intelligent assessment system, applied to a network security intelligent assessment method according to any one of claims 1 to 7, the assessment system comprising: A construction module is used to obtain an initial network system and generate a target network system by describing the system in a standardized manner, solve the target network system to obtain the corresponding information security risks, and construct a planning penetration map model; A calculation module, used to construct a corresponding information security risk probability calculation model according to the planned penetration map model, and calculate the risk probability of the information security risk; An evaluation module is used to determine a risk quantitative evaluation index, perform a risk quantitative evaluation on each security target in the target network system according to the risk probability, and establish a network security quantitative evaluation model; The optimization module is used to apply the network security quantitative evaluation model to a real-time network system to verify and optimize the network security quantitative evaluation model.

Images