Network risk assessment model construction method and device, equipment and storage medium

Abstract

The invention discloses a network risk assessment model construction method and device, equipment and a storage medium, and the method comprises the steps: collecting information data, and carrying out the preprocessing of the information data; setting a topological weight strategy, a service weight strategy, a vulnerability weight strategy and a risk value calculation strategy according to the information data; and constructing a risk assessment mechanism according to the topological weight strategy, the service weight strategy, the vulnerability weight strategy and the risk value calculation strategy, and finally forming a network risk assessment model. The network risk assessment model construction method can solve the problems that an information network platform has security vulnerabilities and threats, a network security assessment mechanism is imperfect and the information network platform is difficult to adapt to a rapidly changing network security environment, and has the characteristics of convenience in implementation, high accuracy, high usability and relatively high migration and generalization capabilities.

Description

Technical Field

[0001] The present application belongs to the technical field of network risk assessment, and in particular, relates to a method, device, equipment and storage medium for constructing a network risk assessment model. Background Art

[0002] With the improvement and maturity of various information networks, the method of achieving comprehensive information interconnection based on computer networks and information systems through network communication technology, intelligent equipment and automated command and control processes has played an important role in various command operations.

[0003] However, at the same time, the network security of information interconnected devices still has weak links, such as: security vulnerabilities and threats in information network platforms, imperfect network security assessment mechanisms, and difficulty in adapting to the rapid changes in the network security environment. Therefore, how to solve the above technical problems is the focus of current research. Summary of the invention

[0004] The main technical problem solved by the present invention is to provide a network risk assessment model construction method, device, equipment and storage medium to solve the problems of security vulnerabilities and threats in information network platforms, imperfect network security assessment mechanism, and difficulty in adapting to rapid changes in the network security environment.

[0005] In order to solve the above technical problems, a technical solution adopted by the present invention is to provide a network risk assessment model construction method, device, equipment and storage medium, wherein the method comprises:

[0006] Collect information data and pre-process the information data.

[0007] Set topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy based on information data.

[0008] A risk assessment mechanism is constructed based on topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy, and finally a network risk assessment model is formed.

[0009] In some embodiments, the topology weight strategy is: draw the current network topology structure based on the topology information in the information data; identify the network nodes and network relationships in the current network topology structure; assign different weights to different types of network nodes to obtain a node importance set; and calculate the topology risk weight based on the node importance set.

[0010] In some embodiments, the topological risk weight is calculated as follows:

[0011] top_risk_w(k)=node_w(k)+rw(k)*rela_w(r);

[0012] Among them, top_risk_w(k) represents the topological risk weight of the k-th network node, node_w(k) represents the weight of the k-th network node, rw(k) represents the link relationship importance ratio of the k-th network node, and rela_w(r) represents the weight of the link relationship r.

[0013] In some embodiments, the business weight strategy is: identify business systems in the network system; set different business weights and importance indicators for the identified business systems; set relative importance according to different importance indicators, and score the importance indicators to obtain scoring results; calculate the business risk weight based on the relative importance and the scoring results.

[0014] In some embodiments, the vulnerability weight strategy is: setting the weight of vulnerability vulnerability, the weight of complexity vulnerability and the weight of own vulnerability of each business system; collecting the vulnerability level, number of vulnerabilities and difficulty of exploitation in the business system, and calculating the vulnerability vulnerability of each business system; calculating the complexity vulnerability and own vulnerability of each business system; calculating the vulnerability risk weight according to the weight of vulnerability vulnerability, the weight of complexity vulnerability, the weight of own vulnerability, vulnerability vulnerability, complexity vulnerability and own vulnerability of each business system.

[0015] In some embodiments, the risk value calculation strategy is: collect traffic data of the current network; label and encode the traffic data; build a basic classification model, and set the weight of the basic classification model according to the topology weight strategy, business weight strategy, and vulnerability weight strategy; input the labeled and encoded traffic data into the basic classification model for training, and use the verification set to verify the effect.

[0016] In some embodiments, a risk assessment mechanism is constructed according to a topology weight strategy, a service weight strategy, a vulnerability weight strategy, and a risk value calculation strategy, and the method includes:

[0017] The relative importance of the topology weight strategy, the business weight strategy, and the vulnerability weight strategy are set respectively, and normalized to obtain the topology weight value, the business weight value, and the vulnerability weight value respectively.

[0018] The global weights of the topology weight value, the business weight value, and the vulnerability weight value are calculated to obtain the topology global weight, the business global weight, and the vulnerability global weight, respectively.

[0019] According to the global weight of topology, global weight of business and global weight of vulnerability, the weight setting of risk value calculation strategy is set to build a risk assessment mechanism.

[0020] In order to solve the above technical problems, the present application also provides a network risk assessment model construction device, including: a collection module, used to collect information data and pre-process the information data; a policy setting module, used to set topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy according to the information data; a construction module, used to construct a risk assessment mechanism according to the topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy, and finally form a network risk assessment model.

[0021] In order to solve the above technical problems, the present application also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, any one of the above network risk assessment model construction methods is implemented.

[0022] In order to solve the above technical problems, the present application also provides a computer-readable storage medium on which a computer program is stored, and the computer program is used to implement any of the above-mentioned network risk assessment model construction methods.

[0023] Beneficial effects: The present application discloses a method, device, equipment and storage medium for constructing a network risk assessment model, wherein the method includes: collecting information data and preprocessing the information data; setting a topology weight strategy, a business weight strategy, a vulnerability weight strategy and a risk value calculation strategy according to the information data; constructing a risk assessment mechanism according to the topology weight strategy, the business weight strategy, the vulnerability weight strategy and the risk value calculation strategy, and finally forming a network risk assessment model. The network risk assessment model construction method of the present application can solve the problems of security vulnerabilities and threats in the information network platform, the imperfect network security assessment mechanism, and the difficulty in adapting to the rapidly changing network security environment. It also has the characteristics of convenient implementation, high accuracy, strong ease of use, and strong migration and generalization capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of an embodiment of a method for constructing a network risk assessment model of the present application is given;

[0025] Figure 2 A schematic diagram of the structure of an embodiment of a network risk assessment model building device of the present application is given;

[0026] Figure 3 A schematic diagram of the framework of an electronic device of the present application is provided;

[0027] Figure 4 A schematic diagram of a framework of an embodiment of a computer-readable storage medium of the present application is provided. DETAILED DESCRIPTION

[0028] In order to facilitate the understanding of the present invention, the present invention is described in more detail below in conjunction with the accompanying drawings and specific embodiments. Preferred embodiments of the present invention are provided in the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described in this specification. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present invention more thorough and comprehensive.

[0029] It should be noted that, unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used in this specification includes any and all combinations of one or more related listed items.

[0030] It should be noted that the "network risk assessment" referred to in this application means using scientific methods and means from the perspective of risk management to systematically analyze the threats faced by information systems and their existing vulnerabilities, assess the degree of harm that may be caused once a security incident occurs, and propose targeted protection countermeasures and rectification measures to prevent and resolve information security risks, control risks at an acceptable level, and provide a scientific basis for maximizing information security.

[0031] Figure 1 A flowchart of an embodiment of a method for constructing a network risk assessment model of the present application is shown, including the steps of:

[0032] Step S11, collecting information data and preprocessing the information data.

[0033] Step S12, setting a topology weight strategy, a service weight strategy, a vulnerability weight strategy and a risk value calculation strategy according to the information data.

[0034] Step S13, constructing a risk assessment mechanism according to the topology weight strategy, the service weight strategy, the vulnerability weight strategy and the risk value calculation strategy, and finally forming a network risk assessment model.

[0035] In the method of the present application, the weight of the model is set by the topology weight strategy, the business weight strategy and the vulnerability weight strategy, and the above weights are combined and set to the risk value calculation strategy to calculate the traffic risk value, and finally the risk assessment mechanism is constructed to test and fine-tune the weights to obtain a network risk assessment model that meets the requirements. The construction method of the present application can also be migrated to other application scenarios to obtain a network risk assessment model that adapts to new application scenarios, thereby completing the network risk assessment, and the process is simple and efficient. And because the method of the present application designs the topology weight strategy, the business weight strategy and the vulnerability weight strategy separately, it has the characteristics of high cohesion and low coupling. If it is expected to optimize and modify the model during the later use process, the strategy design can be modified separately, which does not affect the use of the overall model and has strong expansion capabilities. Therefore, the method of the present application can solve the problems of security vulnerabilities and threats in the information network platform, the imperfect network security assessment mechanism, and the difficulty in adapting to the rapidly changing network security environment. It also has the characteristics of convenient implementation, high accuracy, strong ease of use, and strong migration and generalization capabilities.

[0036] In some embodiments, in step S11, information data is collected and preprocessed, and the preprocessing includes normalizing, de-dimensionalizing, denoising, and completing the information data.

[0037] Specifically, information data includes all information data such as networks, devices, services, systems, service hardware and software, hardware and software vulnerabilities, network traffic, etc. The collected information data is pre-processed to facilitate effective data alignment when participating in calculations later.

[0038] Specifically, normalization is a common data preprocessing technique used to convert data into a uniform scale range to eliminate the dimensional differences between different variables. Descaling refers to removing the influence of data units on numerical values ​​so that all variables are at the same level so that they can participate in subsequent processing fairly; its main purpose is to convert data of different magnitudes into the same magnitude so that the data obeys the standard normal distribution. Denoising refers to the process of screening and deleting data that is not related to the retrieval target subject from the deduplicated data records by certain means or methods; data records that are not related to the retrieval target subject are data noise; the data set of the retrieval target that has undergone the denoising process will lay a solid foundation for subsequent data analysis and provide a reliable basis for obtaining objective, true and accurate analysis conclusions. Completion refers to the method of handling missing values ​​in a data set, which provides reasonable estimates for missing values ​​by utilizing the correlation and structure in the data.

[0039] In some embodiments, the topology weight strategy is: draw the current network topology structure based on the topology information in the information data; identify the network nodes and network relationships in the current network topology structure; assign different weights to different types of network nodes to obtain a node importance set; and calculate the topology risk weight based on the node importance set.

[0040] Specifically, topological information refers to the number, type and mutual relationship information of the topological elements (vertices, edges and surfaces) of an object. The network topology structure refers to the physical layout of various devices interconnected by transmission media. The network relationship is the relationship between a network node and other network nodes in a network system. The types of network nodes include but are not limited to routers, firewalls, gateways, workstations, terminals, network cards, bridges, load balancers, network storage devices, network security devices, business services, auxiliary services, etc. For the type of network node, each type is assigned a different weight, and the set of these weights is called the node importance set.

[0041] In some embodiments, the topological risk weight is calculated based on the node importance set by calculating the number of input relations and the number of output relations of each network node in the current network topology structure, for example, the number of input relations and the number of output relations of the kth network node are node_in(k) and node_out(k) respectively. Further, the weight of each network node is calculated by:

[0042]

[0043] Among them, node_w(k) represents the weight of the kth network node, nin_w represents the weight value of the network node input, nout_w represents the weight value of the network node output, node_out(k) represents the number of output relations of the kth network node, node_in(k) represents the number of input relations of the kth network node, nin_w and nout_w can be set to different values ​​according to different network environments, node_in(i) represents the number of input relations of the ith network node, node_out(i) represents the number of output relations of the ith network node, ∑node_in(i) represents the total number of input relations of all network nodes, and ∑node_out(i) represents the total number of output relations of all network nodes.

[0044] Furthermore, the weight of the link relationship is calculated. Two directly connected network nodes are called a link relationship; the percentage set of a link relationship indicates the percentage of the link relationship in all the longest links in which it participates; the weight of a link relationship is the maximum percentage value in the link relationship set.

[0045] In some embodiments, the weight of the link relationship is calculated as follows:

[0046]

[0047] Wherein, s represents the serial number of a link among all the links involved in link relationship r; count(s,r) represents the number of network nodes involved in the current link relationship in the s-th link of link relationship r, which accounts for the total number of all link relationships.

[0048] In some embodiments, the topological risk weight is calculated as follows:

[0049] top_risk_w(k)=node_w(k)+rw(k)*rela_w(r);

[0050] Among them, top_risk_w(k) represents the topological risk weight of the k-th network node, node_w(k) represents the weight of the k-th network node, rela_w(r) represents the weight of the link relationship r, and rw(k) represents the link relationship importance ratio of the k-th network node. The link relationship importance ratio varies depending on the network node, environment, and even time.

[0051] In some embodiments, the business weight strategy is: identifying business systems in the network system, including: identifying all business systems, auxiliary business systems, related terminals and other service contents in the network system; setting different business weights bus_weig(m) and importance indicators bus_metric for the identified business systems, where bus_weig(m) represents the mth business system, and the importance indicators include but are not limited to performance, stability, security, maximum allowable interruption time, etc.; setting relative importance according to different importance indicators, and scoring the importance indicators to obtain a scoring result bus_score(m). For example, a tomographic analysis method can be used to score the importance indicators; calculating the business risk weight bus_risk_w(m) based on the relative importance and the scoring result.

[0052] In some embodiments, the business risk weight is calculated as follows:

[0053] bus_risk_w(m)=bus_weig(m)*bus_score(m);

[0054] Among them, bus_risk_w(m) represents the business risk weight of the m-th business system, bus_weig(m) represents the business weight of the m-th business system, and bus_score(m) represents the scoring result of the m-th business system.

[0055] In some embodiments, the vulnerability weight strategy is: setting the weight of the vulnerability of each business system, the weight of the complexity vulnerability and the weight of its own vulnerability, which are leak_w1, leak_w2 and leak_w3 respectively.

[0056] Furthermore, the vulnerability level v1_lev, the number of vulnerabilities v1_con, and the degree of difficulty of exploitation v1_im in the business system are collected, and the vulnerability of each business system is calculated. The calculation method of the vulnerability is:

[0057] vul_leak(n)=∑v1_lev*v1_w1+v1_con*v1_w2+v1_im*v1_w3;

[0058] Among them, vul_leak(n) represents the vulnerability of the nth business system, v1_lev represents the vulnerability level, v1_con represents the number of vulnerabilities, v1_im represents the difficulty of exploitation, and v1_w1, v1_w2 and v1_w3 represent the weights of the vulnerability level, the number of vulnerabilities and the difficulty of exploitation respectively.

[0059] Furthermore, the complexity vulnerability and the self-vulnerability of each business system are calculated, wherein the calculation method of the complexity vulnerability is:

[0060] dis_leak(n)=∑dis_open*dis_w1+dis_c*dis_w2+dis_dis*dis_w3;

[0061] Among them, dis_leak(n) represents the complexity vulnerability of the nth business system, dis_open represents the openness of the network system, dis_c represents the network density of the network system, dis_dis represents the heterogeneity of the network system, dis_w1 represents the weight of the openness of the network system, dis_w2 represents the weight of the network density of the network system, and dis_w3 represents the weight of the heterogeneity of the network system.

[0062] Furthermore, the inherent vulnerability index of the network system includes but is not limited to the number of application programming interfaces provided, deployment methods, password complexity restrictions, expiration time, etc. The calculation method of inherent vulnerability is similar to the calculation method of complexity vulnerability.

[0063] Furthermore, the vulnerability risk weight is calculated based on the weight of the vulnerability of each business system, the weight of the complexity vulnerability, the weight of its own vulnerability, the vulnerability vulnerability, the complexity vulnerability and its own vulnerability.

[0064] In some embodiments, the vulnerability risk weight is calculated as follows:

[0065] vul_risk_w=vul_leak(n)*leak_w1+dis_leak(n)*leak_w2+self_leak(n)*leak_w3;

[0066] Among them, vul_leak(n) represents the vulnerability of the nth business system, leak_w1 represents the weight of the vulnerability, dis_leak(n) represents the complexity vulnerability of the nth business system, leak_w2 represents the weight of the complexity vulnerability, self_leak(n) represents the vulnerability of the nth business system itself, and leak_w3 represents the weight of its own vulnerability.

[0067] Specifically, vulnerability can also be called weakness or loophole, which is a weak link in an asset or asset group that may be exploited by threats to cause damage. Vulnerability mainly targets various business systems, including but not limited to network software and hardware vulnerability, complexity vulnerability of various business systems, and vulnerability of the business system itself.

[0068] In some embodiments, the risk value calculation strategy is: collect traffic data of the current network; label and encode the traffic data; build a basic classification model, and set the weight of the basic classification model according to the topology weight strategy, business weight strategy, and vulnerability weight strategy; input the labeled and encoded traffic data into the basic classification model for training, and use the verification set to verify the effect.

[0069] Specifically, the flow data of the current network includes normal flow data and abnormal flow data of the current network. After the step of collecting the flow data of the current network, it also includes: preprocessing the flow data, and the preprocessing includes removing invalid, erroneous, inconsistent and other data in the flow data. The flow data is marked and encoded, including marking the normal flow data and the abnormal flow data and encoding them respectively.

[0070] In this application, the basic classification model can be used to verify the rationality of the weights set in the aforementioned steps according to different weight strategies, and further guide and modify the topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy until a network risk assessment model that meets the requirements is obtained.

[0071] In some embodiments, in step S13, a risk assessment mechanism is constructed according to the topology weight strategy, the business weight strategy, the vulnerability weight strategy and the risk value calculation strategy, and the method includes: respectively setting the relative importance of the topology weight strategy, the business weight strategy and the vulnerability weight strategy, and normalizing them to obtain the topology weight value top_w, the business weight value bus_w and the vulnerability weight value vul_w respectively, and the above relative importance can be set according to the advice of network security experts; for the topology weight strategy, the business weight strategy and the vulnerability weight strategy, the topology global weight, the business global weight and the vulnerability global weight are calculated respectively according to their respective relative importance.

[0072] In some embodiments, the topological global weight w_top is calculated as follows:

[0073] w_top = top_risk_w*top_w;

[0074] Among them, top_risk_w represents the topological risk weight, and top_w represents the topological weight value.

[0075] In some embodiments, the calculation method of the service global weight w_bus is:

[0076] w_bus = bus_risk_w*bus_w;

[0077] Among them, bus_risk_w represents the business risk weight, and bus_w represents the business weight value.

[0078] In some embodiments, the vulnerability global weight w_vul is calculated as follows:

[0079] w_vul=vul_risk_w*vul_w;

[0080] Among them, vul_risk_w represents the vulnerability risk weight, and vul_w represents the vulnerability weight value.

[0081] Furthermore, the topology global weight, business global weight, and vulnerability global weight calculated above are set to the weight setting of the risk value calculation strategy to construct a risk assessment mechanism. The above setting method is: set the topology global weight of each network node to the same node in the risk value calculation strategy data set (such as the topology global weight of network node j is w_top(j). When not set, the topology global weights of all network nodes are default values, such as: 1.); similarly, set each business global weight in the business global weight w_bus to the same business system in the risk value calculation strategy data set (such as the same request IP or interface, etc.); similarly, set each vulnerability global weight in the vulnerability global weight w_vul to the same business system in the risk value calculation strategy data set.

[0082] Furthermore, after the above-mentioned global topology weight, global business weight and global vulnerability weight are set respectively, the validation set is used to verify the effect on the basic classification model. If the requirements are met, the topology weight value top_w, the business weight value bus_w and the vulnerability weight value vul_w and other parameters are retained. Otherwise, the relevant parameters are modified and re-verified until the requirements are met to form the final network risk assessment model. It should be noted that in the risk value calculation strategy, the data set with the original weights set to the default value (generally 1) has been trained and verified by the validation set. Then it can be considered that the trained network risk assessment model preliminarily meets the requirements, but the network risk assessment model itself cannot adapt to the specific network topology structure, business weight, and vulnerability requirements, so it is necessary to set the weights for it. After setting, it can be directly verified using the validation set without further training.

[0083] Combination Figure 2 The present application also provides a network risk assessment model construction device, including:

[0084] The acquisition module 21 is used to acquire information data and pre-process the information data;

[0085] A strategy setting module 22, used to set a topology weight strategy, a business weight strategy, a vulnerability weight strategy and a risk value calculation strategy according to information data;

[0086] Construction module 23 is used to construct a risk assessment mechanism based on topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy, and finally form a network risk assessment model.

[0087] The other technical features of the above-mentioned network risk assessment model construction device are the same as the features disclosed in the above-mentioned embodiment method, and will not be repeated here.

[0088] Combination Figure 3The present application also provides an electronic device, including a processor 32 and a memory 31, wherein the memory 31 stores a computer program that can be executed by the processor, and when the computer program is executed by the processor 32, any one of the above-mentioned network risk assessment model construction methods is implemented.

[0089] Specifically, the memory 31 is used to store computer programs or data. The memory 31 can be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0090] The processor 32 is used to read / write data or computer programs stored in the memory 31 and execute corresponding functions. For example, when the computer program stored in the memory 31 is executed by the processor 32, the network risk assessment model construction method provided in the embodiment of the present application can be implemented.

[0091] Combination Figure 4 The present application also provides a computer-readable storage medium 40 on which program instructions 401 are stored. The program instructions 401 are used to implement any of the above-mentioned network risk assessment model construction methods.

[0092] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0093] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0094] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0095] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0096] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0097] In summary, the present application discloses a network risk assessment model construction method, device, equipment and storage medium, wherein the method includes: collecting information data and preprocessing the information data; setting a topology weight strategy, a business weight strategy, a vulnerability weight strategy and a risk value calculation strategy according to the information data; constructing a risk assessment mechanism according to the topology weight strategy, the business weight strategy, the vulnerability weight strategy and the risk value calculation strategy, and finally forming a network risk assessment model. The network risk assessment model construction method of the present application can solve the problems of security vulnerabilities and threats in the information network platform, the imperfect network security assessment mechanism, and the difficulty in adapting to the rapidly changing network security environment. It also has the characteristics of convenient implementation, high accuracy, strong ease of use, and strong migration and generalization capabilities.

[0098] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structural transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for constructing a network risk assessment model, characterized in that: include: Collecting information data and preprocessing the information data; Setting a topology weight strategy, a business weight strategy, a vulnerability weight strategy, and a risk value calculation strategy according to the information data; A risk assessment mechanism is constructed according to the topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy, and finally a network risk assessment model is formed.

2. The network risk assessment model construction method according to claim 1, characterized in that: The topology weight strategy is: Draw the current network topology structure according to the topology information in the information data; Identify network nodes and network relationships in the current network topology; Assigning different weights to different types of the network nodes to obtain a node importance set; A topological risk weight is calculated based on the node importance set.

3. The method for constructing a network risk assessment model according to claim 2, characterized in that: The calculation method of the topological risk weight is: top_risk_w(k)=node_w(k)+rw(k)*rela_w(r); Among them, top_risk_w(k) represents the topological risk weight of the k-th network node, node_w(k) represents the weight of the k-th network node, rw(k) represents the link relationship importance ratio of the k-th network node, and rela_w(r) represents the weight of the link relationship r.

4. The method for constructing a network risk assessment model according to claim 1, characterized in that: The business weight strategy is: Identify business systems in the network system; Set different business weights and importance indicators for the identified business systems; Setting relative importance according to different importance indicators, and scoring the importance indicators to obtain scoring results; The business risk weight is calculated based on the relative importance and the scoring results.

5. The method for constructing a network risk assessment model according to claim 1, characterized in that: The vulnerability weight strategy is: Set the weight of vulnerability of each business system, the weight of complexity vulnerability and the weight of its own vulnerability; Collect the vulnerability level, number of vulnerabilities and the ease of exploitation in business systems, and calculate the vulnerability of each business system; Calculate the complexity and vulnerability of each business system as well as its own vulnerability; The vulnerability risk weight is calculated based on the weight of the vulnerability of each business system, the weight of the complexity vulnerability, the weight of the own vulnerability, the vulnerability vulnerability, the complexity vulnerability and the own vulnerability.

6. The method for constructing a network risk assessment model according to claim 1, characterized in that: The risk value calculation strategy is: Collect current network traffic data; marking and encoding the flow data; Constructing a basic classification model, and setting the weight of the basic classification model according to the topology weight strategy, the business weight strategy, and the vulnerability weight strategy; The labeled and encoded traffic data is input into the basic classification model for training, and the effect is verified using a validation set.

7. The method for constructing a network risk assessment model according to claim 1, characterized in that: The risk assessment mechanism is constructed according to the topology weight strategy, the business weight strategy, the vulnerability weight strategy and the risk value calculation strategy, and the method includes: The relative importance of the topology weight strategy, the business weight strategy and the vulnerability weight strategy are set respectively, and normalized to obtain the topology weight value, the business weight value and the vulnerability weight value respectively; Calculating the global weights of the topology weight value, the service weight value, and the vulnerability weight value to obtain the topology global weight, the service global weight, and the vulnerability global weight, respectively; The weight setting of the risk value calculation strategy is set according to the topology global weight, the business global weight and the vulnerability global weight, so as to construct a risk assessment mechanism.

8. A network risk assessment model construction device, characterized in that: include: A collection module, used for collecting information data and preprocessing the information data; A strategy setting module, used to set a topology weight strategy, a business weight strategy, a vulnerability weight strategy and a risk value calculation strategy according to the information data; The construction module is used to construct a risk assessment mechanism according to the topology weight strategy, business weight strategy, vulnerability weight strategy and risk value calculation strategy, and finally form a network risk assessment model.

9. An electronic device, characterized in that: It includes a processor and a memory, wherein the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, the network risk assessment model construction method described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program is used to implement the network risk assessment model construction method described in any one of claims 1 to 7.

Images