Network risk quantification method and device, computer equipment and storage medium

Abstract

The invention provides a network risk quantification method and apparatus, a computer device and a storage medium, and belongs to the technical field of network security, and the method specifically comprises the steps of obtaining information of a plurality of risk data items of a service party; evaluating the risk data items, and determining corresponding risk values; respectively substituting the risk values into a risk rate function to obtain a single-factor risk model corresponding to each risk data item; adjusting the single-factor risk model based on the information of the industry where the customer is located and the attack type, and constructing a double-factor evaluation model for the customer; and inputting the evaluation time node into the two-factor evaluation model to obtain a risk quantification result for the customer. Through the processing scheme provided by the invention, the consequence caused by the security event is comprehensively evaluated and analyzed in combination with the influence of personnel management / consciousness on the network security event from the perspective of insurance, intelligent analysis and processing of data are realized, and the reliability and comprehensiveness of network security analysis are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network risk quantification method, device, computer equipment and storage medium. Background Art

[0002] Cyber ​​risk refers to the risk of malicious acts affecting or paralyzing an organization's information technology system, causing it to suffer property loss, economic loss, business interruption or loss of goodwill. Once a company suffers a cyber attack, it will suffer quantifiable economic losses and unquantifiable reputation losses, and even a worrying development prospect. Cybersecurity insurance can help companies deal with serious data leakage risks.

[0003] However, cyber risk is an emerging risk, and cyber security insurance is also an innovative insurance product that combines cyber security with finance. Cyber ​​security insurance is a new thing in China, and overseas experience is less than 20 years. At present, the security risk quantification adopted by the insurance industry is mainly provided by security technology companies. Based on the evaluation logic of cyber security, it is a quantitative assessment of the defensive vulnerability of enterprises to external threats. The risk points considered are mainly external threats and the security protection of the enterprise itself. The result of the quantitative output is just to grade the security protection capabilities of the enterprise according to "excellent, good, medium, and poor".

[0004] However, there are differences between the insurance perspective and the security perspective. The security perspective focuses on the game between threat and defense, while the insurance perspective focuses on the consequences of security incidents (loss intensity and probability). Existing security assessment methods cannot reflect the quantitative results required by insurance, so they cannot effectively provide corresponding protection for enterprises; and from the perspective of the causes of the consequences, threats and defense are not the only risk factors.

[0005] Therefore, there is an urgent need for a risk quantification assessment method for cybersecurity insurance, which can reduce the company's financial losses and smoothly deal with various network risks. Summary of the invention

[0006] Therefore, in order to overcome the shortcomings of the above-mentioned prior art, the present invention provides a network risk quantification method, device, computer equipment and storage medium, which can conduct a comprehensive assessment and analysis of the consequences of security incidents from an insurance perspective combined with the impact of personnel management / awareness on network security incidents, realize intelligent analysis and processing of data, and improve the reliability and comprehensiveness of network security analysis.

[0007] In order to achieve the above-mentioned purpose, the present invention provides a network risk quantification method, comprising: obtaining information of multiple risk data items of a business party, wherein the risk data items are at least one of enterprise status, information gap assessment, prevention level and entity revenue; evaluating the risk data items to determine corresponding risk values; substituting the risk values ​​into a hazard rate function respectively to obtain a single-factor risk model corresponding to each of the risk data items; adjusting the single-factor risk model based on the industry information of the customer and the type of attack, and constructing a two-factor assessment model for the customer; inputting the assessment time node into the two-factor assessment model to obtain a risk quantification result for the customer.

[0008] In one of the embodiments, the risk data items are evaluated to determine the corresponding risk values, including: normalizing the risk data items to unify the measurement units of risk characteristics to obtain a first intrusion feature; setting an attack type label to identify the attack type based on the log information obtained from the test data, and labeling the corresponding attack behavior with an attack type label; calculating the average attack time of a certain attack behavior, that is, the time required for a successful attack: setting different correlation coefficients according to the severity that different attack types may cause to the target network, and calculating the total average implementation time of the attack behavior within the evaluation period; determining the external security risk level based on the total average implementation time to obtain a corresponding risk value.

[0009] In one embodiment, the step of substituting the risk values ​​into the hazard rate function to obtain a single factor risk model corresponding to each of the risk data items includes: obtaining the hazard rate function Substituting the risk value into the hazard rate function, we get Among them, t 1 represents the start time, t 2 represents the end time, h(s) represents the instantaneous network attack or network fraud loss intensity, P[t 1 ,t 2 ] represents the time period (t 1 , t 2 ) is the probability of a network attack or network fraud being breached, h(t) represents the risk rate function of the insured person’s network attack or network fraud being breached, h 0 (t) represents the baseline risk rate function of the same type of cyber attack or cyber fraud being compromised, and φ represents the insured’s understanding of and awareness of cyber attack methods.

[0010] In one embodiment, the single-factor risk model is adjusted based on the industry information and attack type of the customer to construct a two-factor assessment model for the customer, including: obtaining an adjustment coefficient corresponding to the industry information and the attack type; adjusting the single-factor risk model according to the adjustment coefficient to construct a two-factor assessment model for the customer Among them, θ and γ represent two factors. This formula is used to calculate the instantaneous network attack or network fraud loss intensity at time t, h 0 (t) represents the baseline risk rate function of the same type of cyber attack or cyber fraud being compromised, θ is the proportion of personnel and process factors, 1-θ is the proportion of technology and tools, and θ is between 0 and 1; φ represents the insured's understanding of and awareness of cyber attack methods; γ represents the insured's technical defense capabilities against cyber attacks.

[0011] In one embodiment, the obtaining of information of multiple risk data items of the business party includes: collecting original network security risk assessment data, preprocessing the original data, and obtaining a basic network security data set; wherein the preprocessing includes: cleaning, converting and standardizing multi-source heterogeneous data in the original data to efficiently merge the multi-source heterogeneous data; based on the basic network security data set and the network security risk assessment data label library, performing feature selection, feature extraction, feature conversion and feature dimensionality reduction of network security risk assessment elements, extracting a variety of network security risk information including source network IP, target network IP, protocol type, and network port, and forming risk data items.

[0012] In one of the embodiments, the original data includes historical log information, models of each node device and its components, running operating system and patch installation status, configuration status, running services and service program versions.

[0013] In one embodiment, the attack type labels include industrial control worm attack, logic bomb attack, ransomware attack, replay attack, DDoS attack, and IO hijacking attack.

[0014] A network risk quantification device, the device comprising:

[0015] An acquisition module, used to acquire information of a plurality of risk data items of a business party, wherein the risk data item is at least one of enterprise status, information gap assessment, prevention level, and entity revenue;

[0016] A risk value assessment module, used to assess the risk data item and determine the corresponding risk value;

[0017] A single factor model building module, used for substituting the risk values ​​into the hazard rate function respectively to obtain a single factor risk model corresponding to each of the risk data items;

[0018] A two-factor model building module, used to adjust the single-factor risk model based on the industry information of the customer and the attack type, and build a two-factor assessment model for the customer;

[0019] The quantitative assessment module is used to input the assessment time node into the two-factor assessment model to obtain the risk quantification result for the customer.

[0020] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0021] A computer-readable storage medium stores a computer program, which implements the steps of the above method when executed by a processor.

[0022] Compared with the prior art, the advantages of the present invention are: based on the industry information of the customer and the type of attack, it additionally considers and quantifies the impact of personnel management / awareness on network security incidents, conducts comprehensive evaluation and analysis from the two aspects of internal management and external attacks of network communication security, objectively and comprehensively evaluates network risk security, realizes intelligent analysis and processing of data, improves the reliability of network security analysis, and presents the risk quantification results of network security insurance through the deformation results output by the dual-factor evaluation model, making the results clearer. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A schematic diagram of a process of a network risk quantification method in one embodiment of the present invention;

[0025] Figure 2 A schematic diagram of a single factor risk model in one embodiment of the present invention;

[0026] Figure 3 A schematic diagram of a single factor risk model in another embodiment of the present invention;

[0027] Figure 4 A schematic diagram of a two-factor risk model in one embodiment of the present invention;

[0028] Figure 5 It is a structural block diagram of a network risk quantification device in one embodiment of the present invention;

[0029] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0030] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0031] The following describes the implementation methods of the present application through specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The present application can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that, in the absence of conflict, the following embodiments and the features in the embodiments can be combined with each other. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work belong to the scope of protection of the present application.

[0032] It should be noted that various aspects of the embodiments within the scope of protection of the present invention are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present application, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number and aspect described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0033] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application. The drawings only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0034] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0035] In one embodiment, Figure 1As shown, the embodiment of the present application provides a network risk quantification method, which can be applied in a terminal or a server, wherein the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable smart devices, and the server 104 can be implemented by an independent server or a server cluster composed of multiple servers. Taking the application of the method to a server as an example, the method includes the following steps:

[0036] Step 101, obtaining information of multiple risk data items of the business party, where the risk data item is at least one of enterprise status, information gap assessment, prevention level, and entity revenue.

[0037] The business parties are various banks, financial enterprises, etc. that need to process insurance data. Correspondingly, the information includes but is not limited to personal asset subject matter, social activities, movable / immovable property value, product selection preferences, etc. of different insurance products. The risk data item is at least one of the enterprise status, information gap assessment, prevention level, and entity revenue. When the risk data item is the enterprise status, the information of the risk data item may include the current business status of the enterprise, the registered capital of the enterprise, the corporate legal person, and other information. When the risk data item is the information gap assessment, the information of the risk data item may be the difference between the internal information of the enterprise and the external information of the enterprise. When the risk data item is the prevention level, the information of the risk data item may be network attack data, etc. When the risk data item is the entity revenue, the information of the risk data item may be the gross profit of the enterprise, the net profit of the enterprise, the dividend of the enterprise, etc.

[0038] Network attack data can be analyzed through the enterprise's network communication data. Network communication data includes data features such as IP address, port number, Modbus length, function code, etc. The network communication data is processed to obtain the first intrusion feature of the external attack behavior. The first intrusion feature includes 12 data features: source IP address, target IP address, length of IP packet header, source port number, target port number, function code, protocol identifier, message length, data address, data volume, transaction processing identifier, and unit identifier.

[0039] Step 102: Evaluate the risk data item and determine the corresponding risk value.

[0040] The server can evaluate the risk data items and determine the corresponding risk values. In one embodiment, a semantic analysis method can also be used to analyze the information of each risk data item, determine the negative information, neutral information and positive information in the information, and then determine the corresponding risk value. Each risk data item can be represented by a function of the two dimensions of loss severity and probability, where the H function reflects the severity and the F function corresponds to the probability.

[0041] Step 103: Substitute the risk values ​​into the hazard rate function to obtain a single factor risk model corresponding to each risk data item.

[0042] The hazard rate function is a special function that describes the law of death. It is used to describe the probability of an individual who lives to time t dying in a unit time after that moment, where T is the life span. The server substitutes the risk values ​​into the hazard rate function to obtain a single factor risk model corresponding to each risk data item. Specifically, the risk values ​​are substituted into the hazard rate function Get the single factor risk model h(t) represents the instantaneous hazard rate, t represents time, and (t, t+Δt) represents the event interval. At this time, for different risk data items, there may be different expressions of the single factor risk model, so the curves showing the expression may also be different, such as Figure 2 and Figure 3 As shown, the dotted line is the curve represented by the H function, and the solid line is the curve represented by the F function.

[0043] Step 104, based on the industry information of the customer and the attack type, the single-factor risk model is adjusted to construct a two-factor assessment model for the customer.

[0044] The server adjusts the single-factor risk model based on the customer's industry information and attack type, and builds a dual-factor assessment model for the customer. Specifically, it adjusts multiple single-factor risk models and integrates them into a dual-factor assessment model. Figure 4 The two-factor evaluation model for customers is shown in the figure. The specific method can be: first, use historical data to estimate the parameters of each single-factor model and optimize the error explained by the model; second, use historical data to simultaneously estimate the parameters of the two-factor evaluation model and optimize the error explained by the model; if the two-factor evaluation model can give a significantly better model prediction (or reduce the error), then the two-factor evaluation model is used. Figure 4 The values ​​presented on the three-digit axis in the equation represent the probability distribution (the output is probability, the single-factor model can be presented in the two-dimensional axis of the x-axis and the y-axis, and the two-factor model is the three-dimensional axis of the x, y, and z axes).

[0045] Step 105, input the evaluation time node into the two-factor evaluation model to obtain the risk quantification result for the customer.

[0046] The server inputs the evaluation time node into the two-factor evaluation model to obtain the risk quantification result for the customer.

[0047] The above method, based on the industry information of the client and the type of attack, additionally considers and quantifies the impact of personnel management / awareness on network security incidents, conducts a comprehensive assessment and analysis from the two aspects of internal management and external attacks on network communication security, objectively and comprehensively assesses network risk security, realizes intelligent analysis and processing of data, improves the reliability of network security analysis, and presents the risk quantification results of network security insurance through the deformation results output by the two-factor assessment model, making the results clearer.

[0048] In one embodiment, evaluating the risk data item to determine the corresponding risk value includes:

[0049] Normalize the risk data items, unify the measurement units of risk features, and obtain the first intrusion feature;

[0050] Set attack type labels, identify attack types based on the log information obtained from the test data, and label the corresponding attack behaviors with attack type labels;

[0051] Calculate the average attack time of a certain attack behavior, that is, the time required for a successful attack:

[0052] Different correlation coefficients are set according to the severity of different attack types on the target network, and the total average implementation time of the attack behavior during the evaluation period is calculated;

[0053] Determine the external security risk level based on the total average implementation time and obtain the corresponding risk value.

[0054] In one embodiment, the risk values ​​are substituted into the hazard rate function to obtain a single factor risk model corresponding to each risk data item, including:

[0055] Get the hazard rate function

[0056] Substituting the risk value into the hazard rate function, we get

[0057]

[0058] Among them, t 1 represents the start time, t 2 represents the end time, h(s) represents the instantaneous network attack or network fraud loss intensity, P[t 1 ,t 2 ] represents the time period (t 1 , t 2 ) is the probability of a network attack or network fraud being breached, h(t) represents the risk rate function of the insured person’s network attack or network fraud being breached, h 0(t) represents the baseline risk rate function of the same type of cyber attack or cyber fraud being compromised, and φ represents the insured’s understanding of and awareness of cyber attack methods.

[0059] In one embodiment, based on the industry information of the customer and the attack type, the single-factor risk model is adjusted to build a two-factor assessment model for the customer, including:

[0060] Obtaining an adjustment coefficient corresponding to the industry information and the attack type;

[0061] The single-factor risk model is adjusted according to the adjustment coefficient to construct a dual-factor assessment model for the customer.

[0062] Among them, θ and γ represent two factors. This formula is used to calculate the instantaneous network attack or network fraud loss intensity at time t, h 0 (t) represents the baseline risk rate function of the same type of cyber attack or cyber fraud being compromised, θ is the proportion of personnel and process factors, 1-θ is the proportion of technology and tools, and θ is between 0 and 1; φ represents the insured's understanding of and awareness of cyber attack methods; γ represents the insured's technical defense capabilities against cyber attacks.

[0063] θ is the insured's defense against cyber attacks (fraud), which is a game of defense and offense that determines the outcome of the game. θ is the proportion of personnel and process factors, and 1-θ is the proportion of technology and tools. θ is between 0 and 1.

[0064] φ represents the insured’s understanding (information) and awareness of cyber-attack (fraud) methods (φ=0.5 represents neutrality, where neither party has an absolute advantage over the other; φ<0.5 indicates that the attacker has an information advantage over the attacked party).

[0065] γ represents the insured's technical defense capability against cyber attacks (fraud) (γ = 0.5 represents neutrality, where neither party has an absolute advantage over the other; γ < 0.5 represents the attacker having a technical advantage).

[0066] The relative weight of “people and process” versus “technology and tools”

[0067] People and Process (θ) Techniques and Tools (1-θ) Ransomware ≤10％ ≥90％ DDOS attacks 20％-30％ 70％-80％ APT via phishing 40％-60％ 40％-60％ Wire fraud 70％-80％ 20％-30％ Insider Threat ≥70％ ≤30％ Romance Scams ≥90％ ≤10％

[0068] In one embodiment, obtaining information of multiple risk data items of a business party includes:

[0069] Collect the original data of network security risk assessment, pre-process the original data, and obtain the basic network security data set; the pre-processing includes: cleaning, converting and standardizing the multi-source heterogeneous data in the original data to efficiently integrate the multi-source heterogeneous data;

[0070] Based on the basic network security data set and the network security risk assessment data label library, feature selection, feature extraction, feature conversion and feature dimensionality reduction of network security risk assessment elements are performed to extract a variety of network security risk information including source network IP, target network IP, protocol type and network port, and constitute risk data items.

[0071] In the above S101, the original data of network security risk assessment is collected to obtain the basic network security data set. The original data of network security risk assessment is collected, and this data is the data source for model training and evaluation. The original data can be collected from the traditional network security protection system to obtain the network security risk assessment data set in the historical process and the historical evaluation results. At the same time, the collected data also includes data sets such as personnel, management mechanism, security measures, enterprise information, etc. in the enterprise dimension, as well as threat intelligence data sets in a wide range of dimensions. Specifically, the above original data includes: collecting network security data and global dynamic network security situation, through multiple channels, using multiple protocols, and collecting various network security data from multiple devices, involving data information required by each element in the risk assessment process, including network security data inside and outside the enterprise. The network security element data within the enterprise includes multiple risk assessment element dimensions such as assets, business, vulnerability, threat (attack), network architecture, protocol, traffic, server, terminal, operating system, application system, database, personnel, management mechanism, security measures, enterprise information, etc.; the network security data outside the enterprise includes global network security situation, dynamic summary data of attack data, vulnerability statistics, threat intelligence data, and other global dynamic data involving network security.

[0072] In one embodiment, since the data collected above have different sources, formats, attributes, and data frames, it is necessary to construct a data preprocessing sub-model to perform data preprocessing on the collected raw data, efficiently fuse multi-source heterogeneous data, and obtain strongly correlated risk assessment data information.

[0073] In the specific implementation, the collected multi-source heterogeneous data is cleaned, converted and standardized, and the security data from different channels, sources and formats are converted, garbage filtered, data deduplication, format cleansed and other operations are performed to remove "dirty" data, and the multi-source heterogeneous data is efficiently integrated, which includes data screening, data conversion, data merging and data completion. The original network security data is processed uniformly. The above preprocessing method improves the data quality.

[0074] By collecting the data sources of all elements of network security risk assessment through the above data collection, we can ensure the complete data support for the establishment of the risk assessment model. Among them, by conducting a preliminary assessment of the dimensions covered by the collected network security risk assessment data set, it covers multiple data dimensions related to risk assessment, such as business, assets, attacks, vulnerabilities, and attack results. Therefore, based on the basic network security data set and the network security risk assessment data label library, we can perform feature selection, feature extraction, feature conversion, and feature dimensionality reduction of network security risk assessment elements, extract a variety of network security risk information including source network IP, target network IP, protocol type, and network port, and constitute risk data items.

[0075] In one of the embodiments, the original data includes historical log information, the model of each node device and its components, the running operating system and patch installation status, configuration status, running services and service program versions.

[0076] In one embodiment, the attack type labels include industrial control worm attack, logic bomb attack, ransomware attack, replay attack, DDoS attack, and IO hijacking attack.

[0077] In one embodiment, Figure 5 As shown, a network risk quantification device is provided, which includes an acquisition module 501, a risk value assessment module 502, a single factor model construction module 503, a double factor model construction module 504 and a quantitative assessment module 505.

[0078] The acquisition module 501 is used to obtain information of multiple risk data items of the business party, where the risk data item is at least one of enterprise status, information gap assessment, prevention level and entity revenue.

[0079] The risk value evaluation module 502 is used to evaluate the risk data items and determine the corresponding risk values.

[0080] The single factor model building module 503 is used to substitute the risk values ​​into the hazard rate function respectively to obtain the single factor risk model corresponding to each risk data item.

[0081] The dual-factor model building module 504 is used to adjust the single-factor risk model based on the industry information of the customer and the attack type, and build a dual-factor assessment model for the customer.

[0082] The quantitative assessment module 505 is used to input the assessment time node into the dual-factor assessment model to obtain the risk quantification result for the customer.

[0083] In one embodiment, the risk value assessment module 502 includes:

[0084] The normalization unit is used to normalize the risk data items, unify the measurement units of the risk features, and obtain the first intrusion feature.

[0085] The label setting unit is used to set the attack type label, identify the attack type according to the log information obtained from the test data, and mark the attack type label for the corresponding attack behavior.

[0086] The attack time calculation unit is used to calculate the average attack time of a certain attack behavior, that is, the time required for a successful attack.

[0087] The implementation time unit is used to set different correlation coefficients according to the severity that different attack types may cause to the target network, and calculate the total average implementation time of the attack behavior within the evaluation period.

[0088] The evaluation unit is used to determine the external security risk level according to the total average implementation time and obtain the corresponding risk value.

[0089] In one embodiment, the single factor model building module 503 includes:

[0090] Function acquisition unit, used to obtain the hazard rate function

[0091] A single factor model building unit is used to substitute the risk value into the hazard rate function to obtain

[0092]

[0093] In one embodiment, the two-factor model building module 504 includes:

[0094] The coefficient acquisition unit is used to obtain the adjustment coefficient corresponding to the industry information and the attack type.

[0095] A dual-factor model construction unit is used to adjust the single-factor risk model according to the adjustment coefficient to construct a dual-factor assessment model for the customer.

[0096] In one embodiment, the acquisition module 501 includes:

[0097] The preprocessing unit is used to collect the original data of network security risk assessment, preprocess the original data, and obtain the basic network security data set; wherein the preprocessing includes: cleaning, converting and standardizing the multi-source heterogeneous data in the original data to efficiently integrate the multi-source heterogeneous data.

[0098] The data item extraction unit is used to perform feature selection, feature extraction, feature conversion and feature dimension reduction of network security risk assessment elements based on the basic network security data set and the network security risk assessment data label library, extract a variety of network security risk information including source network IP, target network IP, protocol type, network port, and constitute risk data items.

[0099] For the specific definition of the network risk quantification device, please refer to the definition of the network risk quantification method above, which will not be repeated here. Each module in the above network risk quantification device can be implemented in whole or in part by software, hardware and their combination. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0100] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as raw data, basic network security data sets, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network risk quantification method is implemented.

[0101] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0102] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the following steps when executing the computer program: obtaining information of multiple risk data items of a business party, the risk data items being at least one of enterprise status, information gap assessment, prevention level, and entity revenue; evaluating the risk data items to determine corresponding risk values; substituting the risk values ​​into a hazard rate function to obtain a single-factor risk model corresponding to each risk data item; adjusting the single-factor risk model based on the industry information of the customer and the type of attack, and constructing a two-factor assessment model for the customer; inputting the assessment time node into the two-factor assessment model to obtain a risk quantification result for the customer.

[0103] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: obtaining information of multiple risk data items of a business party, the risk data items being at least one of enterprise status, information gap assessment, prevention level, and entity revenue; evaluating the risk data items to determine corresponding risk values; substituting the risk values ​​into a hazard rate function to obtain a single-factor risk model corresponding to each risk data item; adjusting the single-factor risk model based on the industry information of the customer and the type of attack, and constructing a two-factor assessment model for the customer; inputting the assessment time node into the two-factor assessment model to obtain a risk quantification result for the customer.

[0104] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed in the present application should be included in the protection scope of the present application.

Claims

1. A network risk quantification method, characterized in that: include: Acquire information of a plurality of risk data items of the business party, wherein the risk data item is at least one of enterprise status, information gap assessment, prevention level, and entity revenue; Evaluate the risk data item to determine the corresponding risk value; Substituting the risk values ​​into the hazard rate function respectively to obtain a single factor risk model corresponding to each risk data item; Based on the industry information and attack type of the customer, the single-factor risk model is adjusted to construct a two-factor assessment model for the customer; The evaluation time node is input into the two-factor evaluation model to obtain a risk quantification result for the customer.

2. The method according to claim 1, characterized in that The step of evaluating the risk data item to determine a corresponding risk value includes: Normalizing the risk data items to unify the measurement units of risk features to obtain a first intrusion feature; Set attack type labels, identify attack types based on the log information obtained from the test data, and label the corresponding attack behaviors with attack type labels; Calculate the average attack time of a certain attack behavior, that is, the time required for a successful attack: Different correlation coefficients are set according to the severity of different attack types on the target network, and the total average implementation time of the attack behavior during the evaluation period is calculated; Determine the external security risk level based on the total average implementation time and obtain the corresponding risk value.

3. The method according to claim 1, characterized in that: Substituting the risk values ​​into the hazard rate function respectively to obtain a single factor risk model corresponding to each risk data item includes: Get the hazard rate function Substituting the risk value into the hazard rate function, we get Where t1 represents the start time, t2 represents the end time, h(s) represents the instantaneous intensity of the loss from cyber attack or cyber fraud, P[t1, t2] represents the probability of a cyber attack or cyber fraud being compromised in the time period (t1, t2), h(t) represents the hazard rate function of the insured’s cyber attack or cyber fraud being compromised, h0(t) represents the benchmark hazard rate function of the same type of cyber attack or cyber fraud being compromised, and φ represents the insured’s understanding of and awareness of cyber attack methods.

4. The method according to claim 1, characterized in that: The single-factor risk model is adjusted based on the industry information of the customer and the attack type to construct a two-factor assessment model for the customer, including: Obtaining an adjustment coefficient corresponding to the industry information and the attack type; The single-factor risk model is adjusted according to the adjustment coefficient to construct a dual-factor assessment model for the customer. Among them, θ and γ represent two factors. The formula is used to calculate the instantaneous loss intensity of cyber attack or cyber fraud at time t. h0(t) represents the baseline hazard rate function of the same type of cyber attack or cyber fraud being compromised. θ is the proportion of personnel and process factors, 1-θ is the proportion of technology and tools, and θ is between 0 and 1; φ represents the insured's understanding of cyber attack methods and awareness of prevention; γ represents the insured's technical defense capabilities against cyber attacks.

5. The method according to claim 1, characterized in that The obtaining of information of multiple risk data items of the business party includes: Collecting original data of network security risk assessment, preprocessing the original data, and obtaining a basic network security data set; wherein the preprocessing includes: cleaning, converting and standardizing multi-source heterogeneous data in the original data to efficiently integrate the multi-source heterogeneous data; Based on the basic network security data set and the network security risk assessment data label library, feature selection, feature extraction, feature conversion and feature dimension reduction of network security risk assessment elements are performed to extract a variety of network security risk information including source network IP, target network IP, protocol type, and network port, and constitute risk data items.

6. The method according to claim 5, characterized in that The original data includes historical log information, the model of each node device and its components, the running operating system and patch installation status, configuration status, running services and service program versions.

7. The method according to claim 1, characterized in that The attack type labels include industrial control worm attack, logic bomb attack, ransomware attack, replay attack, DDoS attack, and IO hijacking attack.

8. A network risk quantification device, characterized in that: The device comprises: An acquisition module, used to acquire information of a plurality of risk data items of a business party, wherein the risk data item is at least one of enterprise status, information gap assessment, prevention level, and entity revenue; A risk value assessment module, used to assess the risk data item and determine the corresponding risk value; A single factor model building module, used for substituting the risk values ​​into the hazard rate function respectively to obtain a single factor risk model corresponding to each of the risk data items; A two-factor model building module, used to adjust the single-factor risk model based on the industry information of the customer and the attack type, and build a two-factor assessment model for the customer; The quantitative assessment module is used to input the assessment time node into the two-factor assessment model to obtain the risk quantification result for the customer.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images