Exposed surface quantitative evaluation method and system based on fuzzy evaluation

Abstract

The invention relates to the technical field of Internet security detection, and discloses an exposed surface quantitative evaluation method and system based on fuzzy evaluation. Wherein the evaluation dimensions at least comprise high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, lost assets and data leakage risks; obtaining basic data related to each evaluation dimension in a network security exposure surface of the organization; determining a corresponding scoring standard for the evaluation dimension of the network security exposure surface of each organization, and performing quantitative scoring according to the collected basic data; evaluating the safety of the exposed surface by adopting a fuzzy comprehensive evaluation method in combination with the quantitative scoring result of each evaluation dimension to obtain an overall score of the exposed surface; according to the invention, the safety of the key information assets is guaranteed, and the overall safety management efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet security detection, and in particular to a method and system for quantitatively evaluating exposure surfaces based on fuzzy evaluation. Background Art

[0002] In the wave of digital transformation, the exposure of organizational networks is rapidly expanding and becoming increasingly complex, which makes the network security situation more severe than ever before. The diversity, frequency and destructiveness of network attacks continue to rise, posing new challenges to traditional security measures based on threat detection and response. These measures appear passive and insufficient in the face of dynamically changing attack methods. Organizations urgently need to shift to more proactive and forward-looking security protection strategies.

[0003] Exposure surface management is the key to proactive security protection. It involves identifying and addressing all potential entry points that attackers may exploit. Gartner's "Top Ten Strategic Technology Trends for 2024" emphasizes that "continuous exposure surface management" as a continuous, closed-loop risk management framework plays an increasingly important role in security operations. Exposure surface management integrates a set of effective security technologies and management processes, enabling enterprises to continuously and consistently evaluate visibility and verify the accessibility and vulnerability of enterprise digital assets.

[0004] The exposure surface includes various digital assets that attackers may exploit, such as hardware devices, cloud services, operating systems, network configurations, applications, etc. These asset collections constitute the front line of organizational network security. Although most organizations realize the importance of managing exposure surfaces, in actual operations, many potential risk points are not easy to find. With the development of technologies such as cloud computing, the Internet of Things, and SaaS, the network exposure surface of organizations has further expanded, which requires traditional risk-based vulnerability management methods to be updated to fully cover emerging threats.

[0005] In order to effectively manage and reduce security risks, organizations must comprehensively identify and converge on exposure surfaces. In this process, quantitative evaluation methods play a fundamental role. They not only help organizations understand the current security situation, but also guide how to prioritize resources to manage and mitigate the most important risk points.

[0006] Prior art 1: A network security assessment method and system based on risk exposure is disclosed (application number CN202410057885.2). Based on the sample data obtained by penetration scanning, the single indicator score of each core indicator of the organization to be assessed is calculated, and the total network security assessment score of the organization to be assessed is obtained by weighted calculation. This technology focuses too much on the existing vulnerabilities and attacks suffered by the system as factors for assessment, ignoring emerging threats (such as data leakage, counterfeit assets, content security, etc.), resulting in the lack of foresight and pertinence in the assessment results, and cannot fully reflect the real-time status of the organization's network security.

[0007] Prior art 2: A system and method for detecting assets on an organization's Internet exposure surface (application number CN202311562250.X) is disclosed, which has the advantages of more efficient and reliable asset detection and clearer and more intuitive display. This technology focuses on efficient methods and automated analysis capabilities for asset detection, but does not involve quantitative evaluation of detection results, which may make it difficult for organizations to formulate accurate security policies and priority rankings based on the evaluation results, affecting the accuracy of risk management and the effectiveness of resource allocation. Summary of the invention

[0008] The purpose of the present invention is to solve the above problems and to design a method and system for quantitative evaluation of exposure surface based on fuzzy evaluation.

[0009] A first aspect of the present invention provides a method for quantitatively evaluating an exposed surface based on fuzzy evaluation, the method comprising the following steps:

[0010] Step 1: Determine the evaluation dimensions of the organization's network security exposure, where the evaluation dimensions at least include high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, compromised assets, and data leakage risks;

[0011] Step 2: Use silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity to obtain basic data related to each evaluation dimension in the organization's network security exposure surface;

[0012] Step 3: Determine the corresponding scoring criteria for the evaluation dimensions of each organization's cybersecurity exposure, and make quantitative scores based on the collected basic data;

[0013] Step 4: Combine the quantitative scoring results of each evaluation dimension and use the fuzzy comprehensive evaluation method to evaluate the safety of the exposed surface and obtain the overall score of the exposed surface.

[0014] Optionally, in a first implementation of the first aspect of the present invention, the use of silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity to obtain basic data related to each evaluation dimension in the network security exposure of the organization includes:

[0015] Silent detection technology: Distributed scanning of exposed traffic through distributed nodes, segmentation of data packets, construction of MAC addresses to hide the detection source, and randomization of data packet header information;

[0016] Crawler technology: Use crawler technology to perform page fingerprint recognition, technical architecture analysis, API interface extraction and sensitive information identification, identify and classify web page content and website structure through natural language processing technology, and implement anomaly detection mechanisms to counter anti-crawler strategies;

[0017] Vulnerability identification technology based on intelligent matching: Combined with existing asset fingerprints and vulnerability databases, using automated scanning tools, web crawlers, and machine learning algorithms, it automatically identifies the running service software and its version information, compares it with the existing asset fingerprints and vulnerability databases, and finds out possible security vulnerabilities;

[0018] Vulnerability verification technology based on deep learning: According to the target fingerprint characteristics, vulnerability detection strategies and vulnerability exploitation scripts are dynamically scheduled in real time to imitate the behavior patterns of real attackers, automatically execute the penetration testing process, and verify and confirm the actual security vulnerabilities in the target system;

[0019] Asset discovery based on threat intelligence association: Collect and analyze threat intelligence data in public and anonymous networks, and discover unknown assets and lost assets by combining asset fingerprints, vulnerability exploitation data, intrusion and attack situation multi-dimensional association analysis. The unknown assets include at least illegal assets and shadow assets.

[0020] Sensitive data leakage discovery based on content similarity: From the attacker's perspective, search for potentially leaked sensitive information in web searches, document libraries, cloud storage, sharing services, and code hosting platforms, and use the Google Simhash algorithm to perform similarity detection on documents and codes. The code hosting platforms include at least Github, Gitee, and Gitlab.

[0021] Optionally, in a second implementation of the first aspect of the present invention, determining a corresponding scoring standard for the evaluation dimension of the network security exposure of each organization, and performing a quantitative scoring based on the collected basic data, includes:

[0022] Define six evaluation dimensions R a , Rs , R d , R L , R c , R p , representing high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, lost assets and data leakage risks, respectively. Each indicator uses a 100-point scoring system to quantify the risk level;

[0023] The high-risk port exposure risk faced by an organization can be calculated using the following formula:

[0024] R a =(1-M / P)*100

[0025] In the formula, R a is the high-risk port exposure risk score, M is the number of high-risk ports exposed by the organization, and P is the total number of ports exposed by the organization;

[0026] The security vulnerability faced by an organization can be calculated using the following formula:

[0027] R s =(1-V / A)*100

[0028] In the formula, R s is the security vulnerability score, V is the score of the vulnerability exposed by the organization, and A is the asset value;

[0029] The content security risk faced by an organization can be calculated using the following formula:

[0030] R d =(1-B / A)*100

[0031] In the formula, R d Content security risk score, B is the number of content security risks of the organization, and A is the total number of assets of the organization;

[0032] The counterfeit assets that an organization faces can be calculated using the following formula:

[0033] R L =(1-B / A)*100

[0034] In the formula, R L is the counterfeit asset risk score, B is the total number of counterfeit assets, and A is the total number of organizational assets;

[0035] The amount of lost assets faced by an organization can be calculated using the following formula:

[0036] R c =(1-(AC1+AC2 / A a )*100

[0037] In the formula, R cis the risk score of the lost assets, AC1 and AC2 are the values ​​of the lost assets C1 and C2 respectively, and A a is the total value of the organization’s assets;

[0038] The data breach risk faced by an organization can be calculated using the following formula:

[0039] R p =(1-L / A)*100

[0040] In the formula, R p The data leakage risk score, L is the number of leaked codes or documents in the organization, and A is the total number of assets in the organization.

[0041] Optionally, in a third implementation of the first aspect of the present invention, the quantified scoring results of each evaluation dimension are combined to evaluate the safety of the exposed surface using a fuzzy comprehensive evaluation method to obtain an overall score of the exposed surface, including:

[0042] Obtain the quantitative scoring results of each evaluation dimension, obtain the safety score corresponding to each evaluation dimension according to the quantitative scoring results of each evaluation dimension, divide the safety scores corresponding to each evaluation dimension into three levels, and judge the safety according to the corresponding levels;

[0043] According to the level classification, the safety scores corresponding to each evaluation dimension are calculated through linear interpolation to obtain the membership of different levels, and finally the fuzzy matrix R is obtained:

[0044]

[0045] where r ij represents the membership of the i-th factor at the j-th level;

[0046] Multiply the fuzzy matrix R and the weight W corresponding to each evaluation dimension to obtain the comprehensive evaluation vector B:

[0047] B = W × R, and the overall score of the exposed surface is calculated by the weighted average method.

[0048] Optionally, in a fourth implementation of the first aspect of the present invention, a security score of 0-60 points corresponding to each evaluation dimension indicates low security, a security score of 60-80 points corresponding to each evaluation dimension indicates medium security, and a security score of 80-100 points corresponding to each evaluation dimension indicates high security.

[0049] Optionally, in a fifth implementation of the first aspect of the present invention, the membership calculation formula includes:

[0050] The low security membership is as follows:

[0051]

[0052] The security membership is as follows:

[0053]

[0054] The high security membership is as follows:

[0055]

[0056] In the formula, x represents the safety score corresponding to each evaluation dimension.

[0057] The second aspect of the present invention provides an exposure surface quantitative assessment system based on fuzzy evaluation, the exposure surface quantitative assessment system based on fuzzy evaluation includes an evaluation dimension determination module, an automatic basic data acquisition module, a single indicator quantitative assessment module and a fuzzy comprehensive evaluation module, wherein:

[0058] An evaluation dimension determination module is used to determine the evaluation dimensions of the network security exposure of the organization, wherein the evaluation dimensions at least include high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, lost assets and data leakage risks;

[0059] The module for automatically acquiring basic data is used to acquire basic data related to each evaluation dimension in the network security exposure of an organization by using silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity;

[0060] The single indicator quantitative evaluation module is used to determine the corresponding scoring criteria for the evaluation dimension of each organization's network security exposure and to perform quantitative scoring based on the collected basic data;

[0061] The fuzzy comprehensive evaluation module is used to combine the quantitative scoring results of each evaluation dimension, use the fuzzy comprehensive evaluation method to evaluate the safety of the exposure surface, and obtain the overall score of the exposure surface.

[0062] Optionally, in a first implementation of the second aspect of the present invention, the automatic basic data acquisition module includes a silent detection submodule, a crawler submodule, a vulnerability identification submodule, a vulnerability verification submodule, an asset discovery submodule and a leakage discovery submodule, wherein:

[0063] The silent detection submodule is used to disperse the traffic of the exposed surface through distributed nodes, segment the data packets, construct MAC addresses to hide the detection source, and randomize the packet header information;

[0064] The crawler submodule is used to use crawler technology to perform page fingerprint recognition, technical architecture analysis, API interface extraction and sensitive information identification, identify and classify web page content and website structure through natural language processing technology, and implement anomaly detection mechanisms to counter anti-crawler strategies;

[0065] The vulnerability identification submodule is used to combine the existing asset fingerprints and vulnerability databases, use automated scanning tools, web crawlers, and machine learning algorithms to automatically identify the running service software and its version information, and compare it with the existing asset fingerprints and vulnerability databases to find possible security vulnerabilities;

[0066] The vulnerability verification submodule is used to dynamically schedule vulnerability detection strategies and vulnerability exploitation scripts in real time according to the target fingerprint characteristics, imitate the behavior patterns of real attackers, automatically execute the penetration testing process, and verify and confirm the actual security vulnerabilities in the target system;

[0067] The asset discovery submodule is used to collect and analyze threat intelligence data in public and anonymous networks, and discover unknown assets and lost assets by combining asset fingerprints, vulnerability exploitation data, intrusion and attack situation multi-dimensional correlation analysis, where the unknown assets include at least illegal assets and shadow assets;

[0068] The leakage detection submodule is used to search for potentially leaked sensitive information in network searches, document libraries, cloud storage, sharing services and code hosting platforms from the attacker's perspective, and use the Google Simhash algorithm to perform similarity detection on documents and codes, where the code hosting platforms include at least Github, Gitee, and Gitlab.

[0069] Optionally, in a second implementation of the second aspect of the present invention, the fuzzy comprehensive evaluation module includes a level division submodule, a first calculation submodule and a second calculation submodule, wherein:

[0070] The level classification submodule is used to obtain the quantitative scoring results of each evaluation dimension, obtain the safety score corresponding to each evaluation dimension according to the quantitative scoring results of each evaluation dimension, classify the safety scores corresponding to each evaluation dimension into three levels, and judge the safety according to the corresponding levels;

[0071] The first calculation submodule is used to calculate the membership of different levels by linear interpolation of the safety scores corresponding to each evaluation dimension according to the level classification, and finally obtain the fuzzy matrix R:

[0072]

[0073] where r ij represents the membership of the i-th factor at the j-th level;

[0074] The second calculation submodule is used to multiply the fuzzy matrix R and the weight W corresponding to each evaluation dimension to obtain a comprehensive evaluation vector B: B = W × R, and calculate the overall score of the exposure surface by weighted average method.

[0075] In the technical solution provided by the present invention, by determining the evaluation dimensions of the network security exposure of an organization, wherein the evaluation dimensions include at least high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, compromised assets and data leakage risks; obtaining basic data related to each evaluation dimension in the network security exposure of the organization; determining corresponding scoring standards for the evaluation dimensions of the network security exposure of each organization, and performing quantitative scoring based on the collected basic data; combining the quantitative scoring results of each evaluation dimension, using a fuzzy comprehensive evaluation method to evaluate the security of the exposure surface, and obtaining an overall score for the exposure surface; the present invention not only provides a comprehensive exposure view, but also enhances the adaptability and practicality of the evaluation through the application of fuzzy comprehensive evaluation technology, so that organizations can more conveniently integrate exposure assessment into their risk management system, thereby more effectively identifying, prioritizing and allocating resources to address the most critical risk points, ensuring the security of key information assets, and improving the overall security management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the following detailed description of the preferred embodiment.The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting the invention.

[0077] Figure 1 A schematic diagram of an embodiment of a method for quantitatively evaluating an exposed surface based on fuzzy evaluation provided by an embodiment of the present invention;

[0078] Figure 2 A schematic diagram of step 2 of the method for quantitatively evaluating the exposure surface based on fuzzy evaluation provided by an embodiment of the present invention;

[0079] Figure 3 A schematic diagram of the structure of an exposure surface quantitative assessment system based on fuzzy evaluation provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0081] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 An embodiment of the present invention provides a schematic diagram of an embodiment of a method for quantitatively evaluating an exposure surface based on fuzzy evaluation, wherein the method specifically comprises the following steps:

[0082] Step 1: Determine the evaluation dimensions of the organization's network security exposure, where the evaluation dimensions at least include high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, compromised assets, and data leakage risks;

[0083] In this embodiment, 1. High-risk port exposure refers to the ports with potential risks that are opened to the outside by the organization, such as the FTP service on port 21, the SSH service on port 22, the MySQL service on port 3306, and the RDP service on port 3389. These ports can easily become a way for attackers to invade the system, causing losses;

[0084] 2. Security vulnerabilities: refers to the vulnerabilities that are caused by improper design or implementation during the code development process of an organization. If these vulnerabilities are not fixed in time, they may be exploited by attackers;

[0085] 3. Content security risks: mainly include the organization's external windows such as websites, WeChat public accounts, Weibo, etc., which may contain sensitive content or typos that violate regulations; or service anomalies on external websites, etc. Although this type of risk is not easy to be directly exploited, it may cause damage to the organization's reputation and compliance;

[0086] 4. Counterfeit assets: Counterfeit resources that may cause damage to the organization's brand, such as counterfeit websites, domain names, applications, social media accounts, etc. These counterfeit assets are particularly dangerous when they involve financial transactions;

[0087] 5. Lost assets: assets that have been confirmed to have been hacked. These assets may have been implanted with malware such as backdoors, dark links, or Trojans. Such assets require prompt remedial measures to prevent further security threats;

[0088] 6. Data leakage risk: Pay attention to the protection of the organization's sensitive data, including the potential leakage risk of codes, documents, employee information, personal emails and social media accounts on the Internet or dark web. Data leakage not only damages the reputation of the organization, but also may expose system vulnerabilities and provide attackers with attack guides.

[0089] Step 2: Use silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity to obtain basic data related to each evaluation dimension in the organization's network security exposure surface;

[0090] In this embodiment, Figure 2 As shown in the figure, the exposure surface automated data acquisition technology mainly includes silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity;

[0091] Silent detection technology: Through distributed nodes, it disperses and scans the traffic on the exposed surface, segments the data packets, constructs MAC addresses to hide the detection source, and randomizes the packet header information. Silent detection technology reduces the risk of detection behavior being blocked by security devices and enhances the ability to deeply discover and analyze network assets.

[0092] Crawler technology: Use crawler technology to perform page fingerprint recognition, technical architecture analysis, API interface extraction and sensitive information identification. Use natural language processing technology to identify and classify web page content and website structure, and implement anomaly detection mechanisms to combat anti-crawler strategies. Intelligent crawler technology also integrates anomaly detection mechanisms to identify and respond to anti-crawler strategies to ensure the continuity and stability of the data collection process.

[0093] Vulnerability identification technology based on intelligent matching: Combined with existing asset fingerprints and vulnerability databases, using automated scanning tools, web crawlers, and machine learning algorithms, it automatically identifies the running service software and its version information, compares it with the existing asset fingerprints and vulnerability databases, and finds out possible security vulnerabilities;

[0094] Vulnerability verification technology based on deep learning: According to the target fingerprint characteristics, vulnerability detection strategies and vulnerability exploitation scripts are dynamically scheduled in real time to imitate the behavior patterns of real attackers, automatically execute the penetration testing process, and verify and confirm the actual security vulnerabilities in the target system;

[0095] Asset discovery based on threat intelligence association: Collect and analyze threat intelligence data in public and anonymous networks, and discover unknown assets and lost assets by combining asset fingerprints, vulnerability exploitation data, intrusion and attack situation multi-dimensional association analysis. Unknown assets include at least illegal assets and shadow assets.

[0096] Sensitive data leakage discovery based on content similarity: From the attacker's perspective, search for potentially leaked sensitive information in web searches, document libraries, cloud storage, sharing services, and code hosting platforms, and use the Google Simhash algorithm to perform similarity detection on documents and codes. The code hosting platforms include at least Github, Gitee, and Gitlab.

[0097] Step 3: Determine the corresponding scoring criteria for the evaluation dimensions of each organization's cybersecurity exposure, and make quantitative scores based on the collected basic data;

[0098] In this embodiment, six evaluation dimensions R are defined: a , R s , R d , R L , R c , R p , representing high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, compromised assets and data leakage risks, respectively. Each indicator uses a 100-point scoring system to quantify the risk level, taking into account the following factors: the number and severity level of risk items, the total amount of organizational assets and asset value. By comparing these factors with the risk items, a single score reflecting the actual risk situation can be obtained. In order to ensure the scientificity and standardization of the evaluation method, the following national standards are specially referred to:

[0099] GB / T 30279-2020 Information Security Technology - Guidelines for Classification and Grading of Cybersecurity Vulnerabilities, which is used to guide the systematic classification and grading of cybersecurity vulnerabilities;

[0100] GB / T 20984-2022 Information Security Technology Information Security Risk Assessment Method provides a standardized risk assessment process;

[0101] 1. High-risk port exposure:

[0102] The high-risk port exposure risk faced by an organization can be calculated using the following formula:

[0103] R a =(1-M / P)*100

[0104] In the formula, R ais the high-risk port exposure risk score, M is the number of high-risk ports exposed by the organization, and P is the total number of ports exposed by the organization;

[0105] This score reflects the proportion of high-risk ports among all exposed ports of an organization, thus quantifying the risk of port security;

[0106] 2. Security vulnerabilities:

[0107] Asset value assessment: Based on the national standard "GB / T20984-2022 Information Security Technology Information Security Risk Assessment Method", this method quantitatively scores the confidentiality, integrity, and availability of assets from the perspective of business systems and asset characteristics (1 to 5 points), and uses multiplication to calculate the comprehensive asset value (expressed as A). The value range of A is from 1 to 125, which fully reflects the importance of the asset;

[0108] Vulnerability severity assessment: According to the "GB / T30279-2020 Information Security Technology Network Security Vulnerability Classification and Grading Guide", this method comprehensively considers the exploitability of the vulnerability (such as access path, trigger conditions, permission requirements), environmental factors (such as exploitation cost, repair difficulty, impact scope) and impact, and carefully scores the severity of the vulnerability (expressed as V). The value range of V is 1 to 9, which accurately maps the potential threat of the vulnerability;

[0109] Evaluation Example:

[0110] For a certain asset, the asset value A1 = 25, and the asset has 3 vulnerabilities, and the corresponding scores of the vulnerabilities are V h =8, V m =5, V L =2, then the vulnerability score of A1 is RA1 = (1-(V h +V m +V L ) / A1)*100=40;

[0111] For an asset A2=50, the asset has 2 vulnerabilities, and the corresponding scores of the vulnerabilities are V h 9. V L =2, then the vulnerability score of A2 is RA2 = (1-(V h +V L ) / A2)*100=78;

[0112] By analogy, the vulnerability scores of all assets are aggregated and averaged to obtain a comprehensive security vulnerability score for the entire organization.

[0113] 3. Content security risks:

[0114] The number of content security risks in an organization is B, the total number of organizational assets is A, and the content security risk is R. d =(1-B / A)*100;

[0115] Content security risk can impact an organization’s reputation and compliance and can be assessed using the following formula:

[0116] R d =(1-B / A)*100

[0117] Where R d Content security risk score, B is the number of content security risks of the organization, and A is the total number of assets of the organization;

[0118] This score quantifies the proportion of assets with content security risks in the total assets of an organization, providing a reference for organizations to strengthen content security management;

[0119] 4. Counterfeit assets:

[0120] Counterfeit assets pose a threat to an organization’s brand and customer trust, and the risk can be assessed using the following formula:

[0121] R L =(1-B / A)*100

[0122] In the formula, R L is the counterfeit asset risk score, B is the total number of counterfeit assets, and A is the total number of organizational assets;

[0123] This score reveals the proportion of counterfeit assets relative to the organization's total assets, providing organizations with a basis for identifying and responding to counterfeit threats.

[0124] 5. Lost assets:

[0125] Based on the asset value, calculate the impact of the lost assets on the overall security risk of the organization. The specific calculation formula is as follows:

[0126] R c =(1-(AC1+AC2 / A a )*100

[0127] Where R c is the risk score of the lost assets, AC1 and AC2 are the values ​​of the lost assets C1 and C2 respectively, and A a The total value of the organization's assets.

[0128] Evaluation Example:

[0129] Assume that the organization has four assets, of which C1 and C2 are lost assets, and their corresponding asset values ​​are AC1=15 and AC2=10. The values ​​of the other two assets are AC3=10 and AC4=10. According to the formula, the risk score of the organization's lost assets is:

[0130] R c =(1-(AC1+AC2) / ((AC1+AC2+AC3+AC4))*100=44

[0131] With this approach, organizations can quickly identify the impact of compromised assets on the overall security posture and take appropriate risk mitigation measures accordingly;

[0132] 6. Data leakage risk:

[0133] Data breaches can severely damage an organization’s information security, and the risk can be quantified by the following formula:

[0134] R p =(1-L / A)*100

[0135] Where R p Data leakage risk score, L is the number of leaked codes or documents in the organization, and A is the total number of assets in the organization;

[0136] This score reflects the proportion of an organization's assets that have been compromised, helping organizations understand the urgency of data protection.

[0137] Step 4: Combine the quantitative scoring results of each evaluation dimension and use the fuzzy comprehensive evaluation method to evaluate the safety of the exposed surface and obtain the overall score of the exposed surface.

[0138] In this embodiment, the scores are divided into three levels, and the security is judged according to these levels: 0-60 points represent low security, 60-80 points represent medium security, and 80-100 points represent high security. Then, according to the above-mentioned level division, a fuzzy relationship matrix is ​​constructed, and then according to the level division, the scores of each evaluation factor are calculated by linear interpolation method to obtain the membership of different levels, and finally the fuzzy matrix R is obtained;

[0139]

[0140] where r ij It represents the membership of the i-th factor at the i-th factor at the j-th level, where the membership is calculated as follows:

[0141] Low security membership:

[0142]

[0143] Medium security membership:

[0144]

[0145] High security membership:

[0146]

[0147] Then the weight vector W is multiplied by the evaluation matrix R to obtain the comprehensive evaluation vector B.

[0148] B=W×R

[0149] Finally, the final evaluation result is obtained through the upper limit weighted average method;

[0150] Taking an organization as an example, we show how to apply the above formula to calculate the final evaluation result. Assume that the organization's high-risk port exposure, security vulnerability, content security risk, counterfeit assets, lost assets and data leakage risk scores are 88.24, 68.82, 100.00, 93.04, 82.35 and 23.53 respectively. The high-risk port exposure membership calculation is as follows:

[0151] Low security: 0

[0152] Medium security: (100-88.24) / (80-60)=0.58

[0153] High security: (88.24-80) / (80-60)=0.412

[0154] The fuzzy matrix R results are as follows:

[0155]

[0156] After expert analysis, the weights W of high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, lost assets and data leakage risks are expressed as 0.05, 0.35, 0.10, 0.15, 0.30 and 0.05 respectively.

[0157] B=W×R=[0.246, 0.4995, 0.2545]

[0158] Finally, the final score is calculated by upper limit weighted average method;

[0159] S=60×0.246+80×0.4995+100×0.2545=80.17

[0160] The organization's final safety score was 80.17.

[0161] See also Figure 3, a schematic diagram of the structure of the exposure surface quantitative evaluation system based on fuzzy evaluation provided by an embodiment of the present invention, the system includes an evaluation dimension determination module, an automatic basic data acquisition module, a single indicator quantitative evaluation module and a fuzzy comprehensive evaluation module, wherein,

[0162] An evaluation dimension determination module is used to determine the evaluation dimensions of the network security exposure of the organization, where the evaluation dimensions at least include high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, lost assets and data leakage risks;

[0163] The module for automatically acquiring basic data is used to acquire basic data related to each evaluation dimension in the network security exposure of an organization by using silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity;

[0164] The single indicator quantitative evaluation module is used to determine the corresponding scoring criteria for the evaluation dimension of each organization's network security exposure and to perform quantitative scoring based on the collected basic data;

[0165] The fuzzy comprehensive evaluation module is used to combine the quantitative scoring results of each evaluation dimension, use the fuzzy comprehensive evaluation method to evaluate the safety of the exposure surface, and obtain the overall score of the exposure surface.

[0166] In this embodiment, the automatic basic data acquisition module includes a silent detection submodule, a crawler submodule, a vulnerability identification submodule, a vulnerability verification submodule, an asset discovery submodule and a leakage discovery submodule, wherein:

[0167] The silent detection submodule is used to disperse the traffic of the exposed surface through distributed nodes, segment the data packets, construct MAC addresses to hide the detection source, and randomize the packet header information;

[0168] The crawler submodule is used to use crawler technology to perform page fingerprint recognition, technical architecture analysis, API interface extraction and sensitive information identification, identify and classify web page content and website structure through natural language processing technology, and implement anomaly detection mechanisms to counter anti-crawler strategies;

[0169] The vulnerability identification submodule is used to combine the existing asset fingerprints and vulnerability databases, use automated scanning tools, web crawlers, and machine learning algorithms to automatically identify the running service software and its version information, and compare it with the existing asset fingerprints and vulnerability databases to find possible security vulnerabilities;

[0170] The vulnerability verification submodule is used to dynamically schedule vulnerability detection strategies and vulnerability exploitation scripts in real time according to the target fingerprint characteristics, imitate the behavior patterns of real attackers, automatically execute the penetration testing process, and verify and confirm the actual security vulnerabilities in the target system;

[0171] The asset discovery submodule is used to collect and analyze threat intelligence data in public and anonymous networks, and discover unknown assets and lost assets by combining asset fingerprints, vulnerability exploitation data, intrusion and attack situation multi-dimensional correlation analysis. Unknown assets include at least illegal assets and shadow assets.

[0172] The leakage detection submodule is used to search for potentially leaked sensitive information in network searches, document libraries, cloud storage, sharing services, and code hosting platforms from the attacker's perspective, and uses the Google Simhash algorithm to perform similarity detection on documents and codes. The code hosting platforms include at least Github, Gitee, and Gitlab.

[0173] In this embodiment, the fuzzy comprehensive evaluation module includes a level division submodule, a first calculation submodule and a second calculation submodule, wherein:

[0174] The level classification submodule is used to obtain the quantitative scoring results of each evaluation dimension, obtain the safety score corresponding to each evaluation dimension according to the quantitative scoring results of each evaluation dimension, classify the safety scores corresponding to each evaluation dimension into three levels, and judge the safety according to the corresponding levels;

[0175] The first calculation submodule is used to calculate the membership of different levels by linear interpolation of the safety scores corresponding to each evaluation dimension according to the level classification, and finally obtain the fuzzy matrix R:

[0176]

[0177] where r ij represents the membership of the i-th factor at the j-th level;

[0178] The second calculation submodule is used to multiply the fuzzy matrix R and the weight W corresponding to each evaluation dimension to obtain a comprehensive evaluation vector B: B = W × R, and calculate the overall score of the exposure surface by weighted average method.

[0179] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for quantitatively evaluating exposure surface based on fuzzy evaluation, characterized in that: The exposure surface quantitative assessment method based on fuzzy evaluation comprises the following steps: Step 1: Determine the evaluation dimensions of the organization's network security exposure, where the evaluation dimensions at least include high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, compromised assets, and data leakage risks; Step 2: Use silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity to obtain basic data related to each evaluation dimension in the organization's network security exposure surface; Step 3: Determine the corresponding scoring criteria for the evaluation dimensions of each organization's cybersecurity exposure, and make quantitative scores based on the collected basic data; Step 4: Combine the quantitative scoring results of each evaluation dimension and use the fuzzy comprehensive evaluation method to evaluate the safety of the exposed surface and obtain the overall score of the exposed surface.

2. The method for quantitatively evaluating exposure surface based on fuzzy evaluation according to claim 1, characterized in that: The above mentioned silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity are used to obtain basic data related to each evaluation dimension in the network security exposure of the organization, including: Silent detection technology: Distributed scanning of exposed traffic through distributed nodes, segmentation of data packets, construction of MAC addresses to hide the detection source, and randomization of data packet header information; Crawler technology: Use crawler technology to perform page fingerprint recognition, technical architecture analysis, API interface extraction and sensitive information identification, identify and classify web page content and website structure through natural language processing technology, and implement anomaly detection mechanisms to counter anti-crawler strategies; Vulnerability identification technology based on intelligent matching: Combined with existing asset fingerprints and vulnerability databases, using automated scanning tools, web crawlers, and machine learning algorithms, it automatically identifies the running service software and its version information, compares it with the existing asset fingerprints and vulnerability databases, and finds out possible security vulnerabilities; Vulnerability verification technology based on deep learning: According to the target fingerprint characteristics, vulnerability detection strategies and vulnerability exploitation scripts are dynamically scheduled in real time to imitate the behavior patterns of real attackers, automatically execute the penetration testing process, and verify and confirm the actual security vulnerabilities in the target system; Asset discovery based on threat intelligence association: Collect and analyze threat intelligence data in public and anonymous networks, and discover unknown assets and lost assets by combining asset fingerprints, vulnerability exploitation data, intrusion and attack situation multi-dimensional association analysis. The unknown assets include at least illegal assets and shadow assets. Sensitive data leakage discovery based on content similarity: From the attacker's perspective, search for potentially leaked sensitive information in web searches, document libraries, cloud storage, sharing services, and code hosting platforms, and use the Google Simhash algorithm to perform similarity detection on documents and codes. The code hosting platforms include at least Github, Gitee, and Gitlab.

3. The method for quantitatively evaluating exposure surface based on fuzzy evaluation according to claim 1, characterized in that: The evaluation dimension of the network security exposure of each organization determines the corresponding scoring criteria, and performs quantitative scoring based on the collected basic data, including: Define six evaluation dimensions R a , R s , R d , R L , R c , R p , representing high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, lost assets and data leakage risks, respectively. Each indicator uses a 100-point scoring system to quantify the risk level; The high-risk port exposure risk faced by an organization can be calculated using the following formula: R a =(1-M / P)*100 In the formula, R a is the high-risk port exposure risk score, M is the number of high-risk ports exposed by the organization, and P is the total number of ports exposed by the organization; The security vulnerability faced by an organization can be calculated using the following formula: R s =(1-V / A)*100 In the formula, R s is the security vulnerability score, V is the score of the vulnerability exposed by the organization, and A is the asset value; The content security risk faced by an organization can be calculated using the following formula: R d =(1-B / A)*100 In the formula, R d Content security risk score, B is the number of content security risks of the organization, and A is the total number of assets of the organization; The counterfeit assets that an organization faces can be calculated using the following formula: R L =(1-B / A)*100 In the formula, R L is the counterfeit asset risk score, B is the total number of counterfeit assets, and A is the total number of organizational assets; The amount of lost assets faced by an organization can be calculated using the following formula: R c =(1-(AC1+AC2 / A a )*100 In the formula, R c is the risk score of the lost assets, AC1 and AC2 are the values ​​of the lost assets C1 and C2 respectively, and A a is the total value of the organization’s assets; The data breach risk faced by an organization can be calculated using the following formula: R p =(1-L / A)*100 In the formula, R p The data leakage risk score, L is the number of leaked codes or documents in the organization, and A is the total number of assets in the organization.

4. The method for quantitatively evaluating exposure surface based on fuzzy evaluation according to claim 1, characterized in that: The fuzzy comprehensive evaluation method is used to evaluate the safety of the exposure surface by combining the quantitative scoring results of each evaluation dimension to obtain the overall score of the exposure surface, including: Obtain the quantitative scoring results of each evaluation dimension, obtain the safety score corresponding to each evaluation dimension according to the quantitative scoring results of each evaluation dimension, divide the safety scores corresponding to each evaluation dimension into three levels, and judge the safety according to the corresponding levels; According to the level classification, the safety scores corresponding to each evaluation dimension are calculated through linear interpolation to obtain the membership of different levels, and finally the fuzzy matrix R is obtained: where r ij represents the membership of the i-th factor at the j-th level; The fuzzy matrix R is multiplied by the weight W corresponding to each evaluation dimension to obtain the comprehensive evaluation vector B: B = W × R, and the overall score of the exposure surface is calculated by the weighted average method.

5. The method for quantitatively evaluating exposure surface based on fuzzy evaluation according to claim 4, characterized in that: A security score of 0-60 points corresponding to each evaluation dimension indicates low security, a security score of 60-80 points corresponding to each evaluation dimension indicates medium security, and a security score of 80-100 points corresponding to each evaluation dimension indicates high security.

6. The method for quantitatively evaluating exposure surface based on fuzzy evaluation according to claim 4, characterized in that: The membership degree calculation formula includes: The low security membership is as follows: The security membership is as follows: The high security membership is as follows: In the formula, x represents the safety score corresponding to each evaluation dimension.

7. A fuzzy evaluation-based exposure surface quantitative assessment system, characterized in that: The exposure surface quantitative assessment system based on fuzzy evaluation includes an evaluation dimension determination module, an automatic basic data acquisition module, a single indicator quantitative evaluation module and a fuzzy comprehensive evaluation module, wherein: An evaluation dimension determination module is used to determine the evaluation dimensions of the network security exposure of the organization, wherein the evaluation dimensions at least include high-risk port exposure, security vulnerabilities, content security risks, counterfeit assets, lost assets and data leakage risks; The module for automatically acquiring basic data is used to acquire basic data related to each evaluation dimension in the network security exposure of an organization by using silent detection technology, crawler technology, vulnerability identification technology based on intelligent matching, vulnerability verification technology based on deep learning, asset discovery based on threat intelligence association, and sensitive data leakage discovery based on content similarity; The single indicator quantitative evaluation module is used to determine the corresponding scoring criteria for the evaluation dimension of each organization's network security exposure and to perform quantitative scoring based on the collected basic data; The fuzzy comprehensive evaluation module is used to combine the quantitative scoring results of each evaluation dimension, use the fuzzy comprehensive evaluation method to evaluate the safety of the exposure surface, and obtain the overall score of the exposure surface.

8. The exposure surface quantitative assessment system based on fuzzy evaluation as claimed in claim 7, characterized in that: The automatic basic data acquisition module includes a silent detection submodule, a crawler submodule, a vulnerability identification submodule, a vulnerability verification submodule, an asset discovery submodule and a leakage discovery submodule, wherein: The silent detection submodule is used to disperse the traffic of the exposed surface through distributed nodes, segment the data packets, construct MAC addresses to hide the detection source, and randomize the packet header information; The crawler submodule is used to use crawler technology to perform page fingerprint recognition, technical architecture analysis, API interface extraction and sensitive information identification, identify and classify web page content and website structure through natural language processing technology, and implement anomaly detection mechanisms to counter anti-crawler strategies; The vulnerability identification submodule is used to combine the existing asset fingerprints and vulnerability databases, use automated scanning tools, web crawlers, and machine learning algorithms to automatically identify the running service software and its version information, and compare it with the existing asset fingerprints and vulnerability databases to find possible security vulnerabilities; The vulnerability verification submodule is used to dynamically schedule vulnerability detection strategies and vulnerability exploitation scripts in real time according to the target fingerprint characteristics, imitate the behavior patterns of real attackers, automatically execute the penetration testing process, and verify and confirm the actual security vulnerabilities in the target system; The asset discovery submodule is used to collect and analyze threat intelligence data in public and anonymous networks, and discover unknown assets and lost assets by combining asset fingerprints, vulnerability exploitation data, intrusion and attack situation multi-dimensional correlation analysis, where the unknown assets include at least illegal assets and shadow assets; The leakage detection submodule is used to search for potentially leaked sensitive information in network searches, document libraries, cloud storage, sharing services and code hosting platforms from the attacker's perspective, and use the Google Simhash algorithm to perform similarity detection on documents and codes, where the code hosting platforms include at least Github, Gitee, and Gitlab.

9. The exposure surface quantitative assessment system based on fuzzy evaluation as claimed in claim 7, characterized in that: The fuzzy comprehensive evaluation module includes a level division submodule, a first calculation submodule and a second calculation submodule, wherein: The level classification submodule is used to obtain the quantitative scoring results of each evaluation dimension, obtain the safety score corresponding to each evaluation dimension according to the quantitative scoring results of each evaluation dimension, classify the safety scores corresponding to each evaluation dimension into three levels, and judge the safety according to the corresponding levels; The first calculation submodule is used to calculate the membership of different levels by linear interpolation of the safety scores corresponding to each evaluation dimension according to the level classification, and finally obtain the fuzzy matrix R: where r ij represents the membership of the i-th factor at the j-th level; The second calculation submodule is used to multiply the fuzzy matrix R and the weight W corresponding to each evaluation dimension to obtain a comprehensive evaluation vector B: B = W × R, and calculate the overall score of the exposure surface by weighted average method.

Images