A network security level protection intelligent evaluation method and system

Abstract

The present invention relates to the field of information security technology, specifically to a network security level protection intelligent evaluation method and system, comprising the following steps: based on the network device connection relationship, router configuration file and firewall rule list, hierarchical analysis of security policy rule dependencies is performed, the interactive protocol and priority of the dependencies are extracted, the existing inconsistencies are identified and corrected, and an optimized security policy model is generated in combination with the network security level protection requirements. In the present invention, through the optimized security policy model, the comprehensiveness and accuracy of the analysis are improved, the policy loopholes are reduced, the access control rule path is parsed and combined with the database interface, the systematic risk identification capability is enhanced, the risk prevention and control capability matrix is ​​optimized in combination with the vulnerability patch priority and coverage, the prevention and control blank area is compared, the security policy coverage depth is improved, the accurate evaluation and path optimization of network security capabilities are achieved, and the coverage efficiency and evaluation applicability are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a network security level protection intelligent evaluation method and system. Background Art

[0002] The field of information security technology is mainly committed to protecting the confidentiality, integrity, availability and reliability of information systems, preventing data leakage, tampering or loss. The core task of this field is to protect information from external and internal threats during storage, transmission and processing through various technical means and methods. Information security covers a variety of technologies, including network security, data encryption, identity authentication, access control, firewalls, intrusion detection systems, vulnerability scanning, security auditing, and security policy formulation and implementation. With the continuous development of information technology, information security technology is also constantly improving, especially in emerging technology fields such as cloud computing, the Internet of Things and artificial intelligence. The needs and challenges of information security are becoming more complex, driving the continuous innovation and optimization of information security technology.

[0003] Among them, the network security level protection intelligent assessment method is a technical means to evaluate and improve the security of network systems. Its main purpose is to help users systematically identify, analyze and solve network security risks, and provide scientific and effective security assessments and improvement suggestions. Users can evaluate the weaknesses of the network system, analyze the implemented security measures, and formulate optimization strategies to improve the overall security of the network. This method is widely used in information system level protection work, especially in security assessment, risk analysis and report generation. It can effectively simplify the process, speed up work efficiency, and ensure that the system meets the relevant national network security level protection standards.

[0004] The existing technology has the problem of fragmented analysis steps in network security assessment. For example, the dependencies of security policy rules cannot be effectively analyzed in layers, resulting in inflexible adjustment of rule priorities, which in turn leads to the hidden danger of security configuration conflicts. The matching of access control rules by the existing technology remains at the verification stage of static rules, and lacks the ability to interactively analyze dynamic security risk points, thereby limiting the comprehensive coverage of potential security issues. In terms of risk prevention and control capability assessment, the existing technology lacks detailed comprehensive analysis of vulnerability patch priorities and coverage, and relies on manual adjustment, which leads to subjective bias in the assessment results and makes it difficult to efficiently identify blank areas of prevention and control. For the correlation analysis of key instruction operation paths and protection areas in the network, the existing technology lacks clear logical combing and in-depth correlation analysis capabilities, resulting in the lack of sufficient pertinence and comprehensiveness in the assessment conclusions, making it difficult for network security assessment work to quickly adapt to the needs of complex scenarios, thereby affecting assessment efficiency and protection quality. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a network security level protection intelligent evaluation method and system.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a network security level protection intelligent evaluation method, comprising the following steps:

[0007] S1: Based on the network device connection relationship, router configuration files and firewall rule lists, perform hierarchical analysis of security policy rule dependencies, extract the interaction protocols and priorities of dependencies, identify and correct inconsistencies in the rules, and generate an optimized security policy model in combination with network security level protection requirements;

[0008] S2: Based on the optimized security policy model, parse and match the rule path in the access control list, extract the database interface and the associated security configuration file content, generate a control path security risk set, analyze each risk point and summarize the impact range, and generate a security risk list;

[0009] S3: Based on the security risk list, combined with the vulnerability patch priority and coverage, unauthorized access is deduced and verified, and the authorized access control requirements in the network security level protection assessment are compared to generate a risk prevention and control capability matrix, and the gaps in prevention and control are compared to analyze the risk prevention and control coverage level and optimize the path, and obtain prevention and control strategy optimization data;

[0010] S4: Based on the optimization data of the prevention and control strategy, a matching analysis is performed on the secure coverage areas and uncovered areas in the network. Combined with the evaluation requirements for security area protection, access control, and monitoring audit, the operation paths associated with key instructions are extracted, and the network security protection evaluation data is summarized and output.

[0011] As a further solution of the present invention, the step of obtaining the optimized security policy model is specifically as follows:

[0012] S111: extracting communication protocols and data transmission priorities between devices based on the network device connection relationship, router configuration files, and firewall rule lists, and generating a dependency protocol priority matrix by performing weighted analysis on the connection relationship;

[0013] S112: According to the dependency protocol priority matrix, combined with the router configuration file, the access control list parameters associated with the configuration items are analyzed, and the corresponding rules are extracted through intersection operation, using the formula:

[0014] ;

[0015] Calculate the rule weight values ​​of the router configuration items to obtain the configuration rule dependency weight set;

[0016] in, Indicates the rule weight value, is the protocol weight coefficient, is the configuration and protocol interaction matrix item, is the priority factor, Indicates the number of protocols associated with a router configuration item;

[0017] S113: combining the firewall rule list and the configuration rule dependency weight set, matching inconsistent items in the rules, identifying interaction protocols and priority conflicts, eliminating conflicts and reordering, and generating an optimized security policy model.

[0018] As a further solution of the present invention, the step of obtaining the control path security risk set is specifically:

[0019] S211: parsing the optimized security policy model, extracting the rule path in the access control list, extracting the path information associated with the database interface, extracting and analyzing the associated security configuration file, and obtaining the risk coefficient of each path;

[0020] S212: Compare the risk coefficient of each path with a set risk threshold, screen the paths whose risks exceed the threshold, and perform weighted scoring on the paths to obtain path risk assessment data;

[0021] S213: Based on the path risk assessment data, combined with the safety factor and risk value of the path, the formula is adopted:

[0022] ;

[0023] Calculate the security risk value of the control path to obtain the control path security risk set;

[0024] in, represents the security risk value of the control path, is the weight coefficient of the path, is the risk factor of the path, is the safety factor of the path, is the safety threshold of the path, is the total number of paths.

[0025] As a further solution of the present invention, the steps of obtaining the security risk list are specifically as follows:

[0026] S221: Based on the control path safety risk set, identify the risk points one by one, mark the real-time location of the risk points and screen the suspicious areas by gradually checking the geographic location data and the associated operation records, analyze the surrounding environmental conditions and potential danger sources, and classify the risk points according to categories and attributes to obtain a risk point classification list;

[0027] S222: Based on the risk point classification list, perform range analysis on each category of risk points, analyze the impact range and interaction intensity by comparing the risk points with the facility distribution and operation process parameters item by item, integrate the spatial correlation information between the risk points and the associated facilities, and obtain a risk impact range distribution data set;

[0028] S223: Based on the risk impact range distribution data set, priority risk points are extracted, and by analyzing the core influencing parameters, the correlation between risk points in space, time and process paths is sorted out, the level range of risk points is summarized and multiple key parameter data are integrated to generate a safety risk list.

[0029] As a further solution of the present invention, the steps for obtaining the risk prevention and control capability matrix are specifically as follows:

[0030] S311: Based on the security risk list, matching risk points with vulnerability patch priority data is performed, extracting patch priority parameters and coverage by parsing risk point attributes and vulnerability patch information, checking patch coverage risk points, integrating risk points and patch coverage, and generating a patch coverage list;

[0031] S312: Based on the patch coverage list, the unauthorized access path is deduced, and the coverage patch bypass situation of the risk point is verified by the differentiated path, the key interaction points of the path are analyzed, the access parameters and coverage verification results are extracted, and the impact range is recorded in combination with the verification data to obtain the unauthorized access verification data;

[0032] S313: Based on the unauthorized access verification data, compare the authorized access control requirements in the network security level protection assessment, check the correspondence between the assessment requirements for risk point prevention and control and coverage, analyze the coverage defects and risk point distribution characteristics, extract the difference content, and generate a risk prevention and control capability matrix.

[0033] As a further solution of the present invention, the steps for obtaining the control strategy optimization data are specifically as follows:

[0034] S321: calling the coverage level parameters, risk factor characteristic values ​​and control blank item difference weight factors in the risk control capability matrix, performing matrix mapping in combination with the blank item distribution characteristic parameters, and screening to obtain the correlation between the blank items and the risk factors within the coverage range;

[0035] S322: Based on the correlation between the blank items and the risk factors within the coverage, the weighted proportion of the factor eigenvalues ​​in the blank item difference comparison matrix is ​​calculated using the formula:

[0036] ;

[0037] Calculate the control difference value of the blank item and obtain the difference analysis result of the control blank item;

[0038] in, Indicates the control difference value of the blank item, represents the coverage level parameter of the risk prevention and control capability matrix, represents the characteristic value of risk factor, represents the difference weight factor of the blank items in prevention and control, represents the characteristic parameter of blank item distribution, is the total number of blank items in the matrix;

[0039] S323: According to the difference analysis results of the prevention and control blank items, combined with the adjustment factors of the preset optimization path and the distribution characteristic adjustment factors, the adjustment criticality of the optimization path is determined, and the optimization path is gradually adjusted to obtain the prevention and control strategy optimization data.

[0040] As a further solution of the present invention, the steps for obtaining the network security protection evaluation data are specifically as follows:

[0041] S411: Based on the control strategy optimization data, by matching the security coverage area and the uncovered area in the network, extracting the security protection factor of the coverage area and the access control factor of the uncovered area, performing preliminary parameter division on the evaluation requirements of the two types of areas, and generating a coverage protection and uncovered access parameter set;

[0042] S412: calling the security protection factors and access control factors in the coverage protection and uncovered access parameter set, combining the associated requirements of monitoring and auditing in the evaluation, extracting the key instruction path, using the formula:

[0043] ;

[0044] Calculate key instruction path associated parameters to obtain a key path associated parameter set;

[0045] in, Indicates the key instruction path associated parameters, is the safety protection factor, is the corresponding factor weight, is the access control factor, is the corresponding factor weight, Adjustment factors for monitoring audits;

[0046] S413: Based on the critical path associated parameter set, threshold matching analysis is performed on the path associated parameters, and a judgment condition is whether the associated parameters meet a threshold range, and network security protection evaluation data is output through step-by-step optimization.

[0047] A network security level protection intelligent evaluation system, the network security level protection intelligent evaluation system is used to execute the network security level protection intelligent evaluation method, the system comprises:

[0048] The network configuration parsing module extracts the interface allocation parameters and routing table items in the router configuration file based on the network device connection relationship, router configuration file and firewall rule list, parses static and dynamic routing matching rules, compares firewall rule conditions and interface parameters item by item, analyzes protocol dependency paths and rule priorities, filters conflicting rules and redundant configurations, and establishes a parsed configuration relationship table;

[0049] The security rule optimization module verifies the priority parameters of conflicting rules one by one based on the parsed configuration relationship table, adjusts the coverage of the rule path, merges the matching conditions and access control policies of redundant rules, screens the path dependency parameters and priority conflicting items, reorders the operation paths of the rule items, parses the access scope and dependency strength covered by the rules, and generates an optimized rule path set;

[0050] The risk path analysis module parses the interface parameters of the rule path in the access control list based on the optimized rule path set, extracts the associated database rules and access scope in the security configuration file, compares the authorized access points in the path with the protocol matching conditions, extracts the protocol parameters and impact scope of the path risk points, summarizes the associated risk information of the rule matching items, and obtains the path risk point set;

[0051] The difference prevention and control comparison module analyzes the matching relationship between the authorized access control requirements and the vulnerability patch priority range based on the path risk point set, derives the unauthorized access points in the risk coverage path, extracts the coverage path and rule parameters of the prevention and control blank area, screens the prevention and control capability deficiencies and range parameters in the path configuration, and establishes a prevention and control capability difference matrix;

[0052] Based on the prevention and control capability difference matrix, the regional protection assessment module analyzes the address parameters of the covered and uncovered areas of the network, extracts the protection rules and access control paths in the assessment requirements, matches the monitoring and auditing rules and associated configurations, summarizes the operation paths and monitoring configurations of key protection areas of the network, and obtains network security protection assessment data.

[0053] Compared with the prior art, the advantages and positive effects of the present invention are:

[0054] In the present invention, an optimized security policy model is formed by parsing the network device connection relationship, router configuration file and firewall rule list, and the comprehensiveness and accuracy of the analysis are improved in risk identification and rule optimization, thereby reducing the loopholes in security policy configuration. Through the optimized security policy model, the access control rule path is further parsed and matched, and the coverage risk set is generated and the impact range is summarized in combination with the database interface and the associated configuration file content, which significantly enhances the systematic identification ability of potential risks. On the basis of the security risk list, the risk point prevention and control capability matrix is ​​improved through the deduction and verification of vulnerability patch priority and coverage, and the prevention and control blank area is accurately compared to improve the coverage depth of the security policy. Combined with the coverage of the network's security area, the key instruction operation path is fully extracted and the evaluation conclusion data is generated, so as to realize the all-round evaluation and path optimization of network security capabilities. Through specific technical actions and logic optimization, the accuracy of security policy generation and evaluation is improved, the coverage blind spots are reduced, and the optimization efficiency is improved, and the applicability and operability in the network security level protection evaluation are significantly enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0056] Figure 2 This is a flow chart of the optimized security policy model in the present invention;

[0057] Figure 3 It is a flow chart of the control path security risk set in the present invention;

[0058] Figure 4 A flowchart of the safety risk list in the present invention;

[0059] Figure 5 It is a flow chart of the risk prevention and control capability matrix in the present invention;

[0060] Figure 6 A flow chart for optimizing data for the prevention and control strategy of the present invention;

[0061] Figure 7 This is a flow chart of network security protection evaluation data in the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0063] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0064] Example 1: Please refer to Figure 1 The present invention provides a technical solution: a network security level protection intelligent evaluation method, comprising the following steps:

[0065] S1: Based on the network device connection relationship, router configuration files and firewall rule lists, perform hierarchical analysis of security policy rule dependencies, extract the interaction protocols and priorities of dependencies, identify and correct inconsistencies in the rules, and generate an optimized security policy model in combination with network security level protection requirements;

[0066] S2: Based on the optimized security policy model, parse and match the rule path in the access control list, extract the database interface and the associated security configuration file content, generate a control path security risk set, analyze each risk point and summarize the impact range, and generate a security risk list;

[0067] S3: Based on the security risk list, combined with the vulnerability patch priority and coverage, unauthorized access is deduced and verified, and the authorized access control requirements in the network security level protection assessment are compared to generate a risk prevention and control capability matrix, and the gaps in prevention and control are compared to analyze the risk prevention and control coverage level and optimize the path, and obtain prevention and control strategy optimization data;

[0068] S4: Based on the prevention and control strategy optimization data, match and analyze the security coverage areas and uncovered areas in the network. Combined with the assessment requirements for security area protection, access control and monitoring audit, extract the operation paths associated with key instructions, summarize and output network security protection assessment data.

[0069] The optimized security policy model includes the results of network device connection relationship analysis, router configuration dependency hierarchy, and firewall rule priority analysis. The control path security risk set includes the risk rule path set, database interface risk mapping table, and security configuration file association items. The security risk list includes the risk point classification list, impact range coverage table, and risk type grouping results. The risk prevention and control capability matrix includes the unauthorized access analysis matrix, authorized access control comparison table, and prevention and control blank item identification data. The prevention and control strategy optimization data includes the optimized prevention and control path list, security coverage area data, and difference comparison analysis results. The network security protection evaluation data includes the security area protection conclusion, access control assessment conclusion, and monitoring audit evaluation results.

[0070] See also Figure 2 ,The specific steps for obtaining the optimized security policy model are:

[0071] S111: extracting communication protocols and data transmission priorities between devices based on the network device connection relationship, router configuration files, and firewall rule lists, and generating a dependency protocol priority matrix by performing weighted analysis on the connection relationship;

[0072] Parse the connection relationship of network devices, analyze the actual physical connection and logical connection path between devices in turn, obtain the communication port and transmission protocol type between devices, extract the main data interaction mode and protocol type between devices by gradually scanning and detecting the interface status of the device and the activation status of the protocol, further parse the source address and destination address of the data transmission, cross-validate in combination with the network topology diagram, identify the existing redundant paths and invalid connections, mark the directionality of the communication path one by one, perform statistical analysis on the data flow between devices based on the extraction, extract the statistical characteristics of the communication frequency and data flow between devices, use frequency and data volume as weight factors, and obtain the final priority through weighted calculation based on the importance of the communication protocol, and construct a dependent protocol priority matrix based on the device connection relationship to describe the distribution of communication dependencies and protocol priorities between devices.

[0073] S112: According to the dependency protocol priority matrix, combined with the router configuration file, the access control list parameters associated with the configuration items are analyzed, and the corresponding rules are extracted through the intersection operation, using the formula:

[0074] ;

[0075] Calculate the rule weight values ​​of the router configuration items to obtain the configuration rule dependency weight set;

[0076] in, Indicates the rule weight value, is the protocol weight coefficient, is the configuration and protocol interaction matrix item, is the priority factor, Indicates the number of protocols associated with a router configuration item;

[0077] The formula is beneficial in that it provides a refined measurement method for analyzing the dependencies of router configuration rules by comprehensively considering the weight of the protocol, the interaction between the configuration and the protocol, and the priority setting in the rule, thereby improving the accuracy of rule optimization;

[0078] : Protocol weight coefficient, by parsing the protocol entries in the router configuration file, extracting the priority weight of each protocol one by one, quantifying it based on the function and scope importance of the protocol, and the actual collected data is used to set the weight value of each protocol;

[0079] : Configuration and protocol interaction matrix items, gradually build the interactive mapping relationship between router configuration rules and protocols, and generate an interaction matrix based on the actual call and adaptation of configuration rules and protocol items;

[0080] : Priority factor, according to the priority value specified in the router configuration rule, obtains its definition range and specific value by parsing the configuration file;

[0081] Set the value: , , ;

[0082] Derivation process:

[0083] ;

[0084] ;

[0085] The result shows that the dependency weight of the current router configuration rule is 1.8, which means that the importance of this rule in network optimization analysis has reached a medium level and can provide an effective reference for further analysis and optimization.

[0086] S113: Combine the firewall rule list and the configuration rule dependency weight set, match the inconsistent items in the rules, identify the interaction protocol and priority conflicts, remove the conflicts and re-order, and generate an optimized security policy model;

[0087] Combined with the content of the firewall rule list, the source address, destination address and port number settings in the firewall rules are compared, and the conflicting items in the matching configuration rule dependency weight set are matched. By comparing the action types of the firewall rules one by one, such as allow or deny rules, and comparing whether they are consistent with the behaviors in the configuration rules, the main causes of the conflict are analyzed. For the rules with action conflicts, the associated interaction protocols are refined and extracted, and the priority of the protocols is analyzed to see whether they are within the priority range of the dependency weight set. By determining the weight factors of the conflicting protocols, the conflicting items are screened in combination with the priority rules. Duplicate or invalid rules are directly eliminated, and the priorities of the rules that need to be adjusted are reset. The firewall list is integrated with the adjusted configuration rules to form an optimized security policy model. The model is used to describe the logical optimization of network security rules and the priority order after conflict resolution.

[0088] See also Figure 3 ,The specific steps for obtaining the control path security risk set are:

[0089] S211: parsing the optimized security policy model, extracting the rule path in the access control list, extracting the path information associated with the database interface, extracting and analyzing the associated security configuration file, and obtaining the risk coefficient of each path;

[0090] When parsing the security policy model, first extract all rule paths from the access control list, and analyze the security parameters of each path one by one, including the source of the path, terminal equipment, protocol type, etc. By querying the information of the database interface, extract the interface data related to the path, and combine the openness of the interface, data transmission method, encryption level and other parameters to conduct a preliminary risk assessment on each path. By extracting and analyzing the settings in the security configuration file, such as firewall policies, intrusion detection rules, access permission configuration, etc., compare the configuration parameters with the path data to identify potential security vulnerabilities. Based on the information, use a specific scoring system to calculate the risk coefficient of each path as the basis for subsequent protection measures and provide a basis for further path optimization.

[0091] S212: Compare the risk coefficient of each path with the set risk threshold, screen the paths whose risks exceed the threshold, perform weighted scoring on the paths, and obtain path risk assessment data;

[0092] Compare each path in the path risk set with the set risk threshold according to its risk coefficient, screen the paths with risk coefficient greater than the set threshold, and define them as high-risk paths. Perform weighted scoring on the screened paths, with the weight based on the correlation between the path's safety factor and its risk value. The safety factor is calculated based on factors such as the security of the network where the path is located, the access frequency, and the correlation with key data. The risk threshold is determined by the security requirements in the policy configuration. After weighting the path's risk coefficient and safety factor, the path's risk size and security protection capability are combined to obtain the path risk assessment data, which will serve as the basis for further optimizing the control strategy.

[0093] S213: Based on the path risk assessment data, combined with the path safety factor and risk value, the formula is used:

[0094] ;

[0095] Calculate the security risk value of the control path to obtain the control path security risk set;

[0096] in, represents the security risk value of the control path, is the weight coefficient of the path, is the risk factor of the path, is the safety factor of the path, is the safety threshold of the path, is the total number of paths;

[0097] The benefit of the formula is that, by introducing the combination of weight coefficient, risk coefficient, safety factor and risk threshold, the final safety risk value of the path can more accurately reflect the comprehensive safety risk of the path, providing a basis for subsequent protection strategies. By considering the weighted risk coefficient and safety factor of the path and judging the risk threshold, the safety of each path can be dynamically adjusted to improve the overall safety of the system.

[0098] When calculating the comprehensive risk value of the path, the risk coefficient of each path is extracted from the path risk assessment data , the coefficient comes from the previous risk assessment of the path, and the safety factor of each path is obtained and the corresponding risk threshold , the safety factor represents the safety of the path, the risk threshold is the maximum allowable risk set, and the weighted risk of each path is calculated. The weight coefficient According to the safety and criticality settings of the paths, paths with higher weight values ​​account for a larger proportion in the overall safety risk value calculation;

[0099] Setting: There are three paths, and their risk coefficients are , , ;

[0100] The safety factor is , , ;

[0101] The risk threshold is , , ;

[0102] The weight coefficient is , , ;

[0103] The calculation process is as follows:

[0104] ;

[0105] ;

[0106] ;

[0107] The result shows that the comprehensive security risk value of the control path is 0.683, which means that the comprehensive risk is low in the security assessment of these paths, and this value will be used in subsequent security protection configuration.

[0108] See also Figure 4 , the specific steps for obtaining the security risk list are:

[0109] S221: Based on the control path safety risk set, identify the risk points one by one, mark the real-time location of the risk points and screen the suspicious areas by gradually checking the geographic location data and related operation records, analyze the surrounding environmental conditions and potential danger sources, and classify the risk points according to categories and attributes to obtain a risk point classification list;

[0110] By checking the geographic location data one by one, combined with the timeline sequence of the operation records, the triggering conditions of the risk points are compared and screened point by point, and the real-time spatial coordinates of each risk point are marked. Combined with dynamic path information, the potential danger area is divided and demarcated, and the risk factors of the environment in the area are analyzed using facility operation logs and historical event records. For the marked risk points, core indicators are extracted from the three dimensions of geological conditions, facility types, and environmental factors. By analyzing the characteristic attributes of the marked points one by one, they are preliminarily classified into three levels: high, medium, and low according to the degree of risk. Risk points with interactive characteristics are further summarized, and multi-dimensional data are recorded in a classification list. The generated risk point classification list details the identification code, location information, risk trigger conditions, and attribution category of each risk point.

[0111] S222: Based on the risk point classification list, perform range analysis for each category of risk points, analyze the impact range and interaction intensity by comparing the risk points with the facility distribution and operation process parameters item by item, integrate the spatial correlation information between the risk points and the associated facilities, and obtain the risk impact range distribution data set;

[0112] By comprehensively extracting the distribution coordinates of facilities, operating parameters and historical event records, a spatial distribution model of risk points is established, and their radiation range and potential interaction effects are analyzed item by item. For key categories of risk points, the interaction intensity between each risk point and surrounding facilities is sorted out by measuring the impact radius, the minimum interval between facilities and the operation frequency, and the interaction weights are further divided to form a spatial association matrix. Based on this matrix, the high-risk areas of facility distribution are derived and marked in the distribution map. After integrated analysis, a risk impact range distribution data set is formed, covering the distribution density, interaction level and risk impact boundary of specific areas, providing layered support for subsequent data use.

[0113] S223: Based on the risk impact range distribution data set, priority risk points are extracted, and by analyzing the core influencing parameters, the correlation of risk points in space, time and process paths is sorted out, the level range of risk points is summarized and multiple key parameter data are integrated to generate a safety risk list;

[0114] Through the item-by-item calculation of core parameters such as impact radius, hazard level and operation frequency, points with high-risk characteristics are screened and the priority processing order is marked. By analyzing the overlapping range of spatial positions and key nodes in the time series item by item, the association paths between risk points are summarized and classified into direct association and indirect association. Combined with the analysis of process paths, the dynamic level range of risk points is gradually improved to ensure that in the comprehensive sorting of multiple parameters, the priority reflects the actual hazard of the degree of impact and spatial location. In the process of sorting, multiple key parameter data are obtained based on classification, calculation and integration, and finally a safety risk list is generated, which fully describes the distribution range, level classification and processing priority of various risk points, and supports the precise positioning and efficient management of risk control.

[0115] See also Figure 5 , the specific steps for obtaining the risk prevention and control capability matrix are:

[0116] S311: Based on the security risk list, match the risk points with the vulnerability patch priority data, extract the patch priority parameters and coverage by parsing the risk point attributes and vulnerability patch information, check the patch coverage risk points, integrate the risk points and patch coverage, and generate a patch coverage list;

[0117] By analyzing the attributes of each risk point, the characteristics and impact range of its potential threats are listed one by one. Combined with the vulnerability patch information, the priority and coverage capability of the patches are extracted one by one. For each patch record, the correlation with the risk point is matched through cross-comparison, and high-priority patches are screened and the corresponding applicable scope is marked. For risk points that cannot be directly covered, the functional description and applicable scope characteristics of the patch are used to analyze the potential coverage boundaries and record the extended adaptability of the patch. Combined with the matching results of the patch and the risk point, a coverage matrix is ​​gradually established to verify the patch coverage effect of each risk point, and the insufficient coverage areas are noted in the records. Finally, a patch coverage list is generated, including the priority sequence of the patch, the list of covered risk points and the coverage capability description.

[0118] S312: Based on the patch coverage list, the unauthorized access path is deduced, and the coverage patch bypass situation of the risk point is verified by the differentiated path, the key interaction points of the path are analyzed, the access parameters and coverage verification results are extracted, and the impact scope is recorded in combination with the verification data to obtain the unauthorized access verification data;

[0119] By checking all access paths within the patch coverage, potential bypass situations are verified step by step. For each path, key interaction nodes are extracted based on path characteristics. Combined with the access path verification rules, key locations that may lead to patch bypass are screened out. The interaction logic of the access path is further analyzed, and the risk points in the path are compared with the patch coverage. The path segments with risk points but not protected by the patch are checked. For the key interaction points in the differentiated paths, access rules are extracted and the actual verified coverage data is recorded. The impact scope of the bypass behavior and the potential risk points of the extended path are analyzed one by one. Finally, the unauthorized access verification data is sorted out, and the path risks, bypass logic and coverage defects are detailed.

[0120] S313: Based on the unauthorized access verification data, compare the authorized access control requirements in the network security level protection assessment, check the control correspondence between the assessment requirements and the risk points and coverage, analyze the coverage defects and risk point distribution characteristics, extract the difference content, and generate a risk control capability matrix;

[0121] By checking the fit between the prevention and control measures for risk points in the assessment requirements and the patch coverage, the content that has not been met is identified. For uncovered risk points, by analyzing the distribution characteristics, recording the location and scope of unprotected areas and patch coverage defects, combined with the unauthorized paths and bypass logic extracted from the verification data, the main defects that affect network security prevention and control capabilities are gradually summarized. Risk points with insufficient coverage, unmet assessment requirements, and potential bypass logic are classified and archived, and integrated and analyzed to generate a risk prevention and control capability matrix. The matrix covers the distribution location of risk points, patch defect types, and specific descriptions of unauthorized paths, providing clear guidance for subsequent improvements.

[0122] See also Figure 6 ,The specific steps for obtaining prevention and control strategy optimization data are as follows:

[0123] S321: Call the coverage level parameters, risk factor characteristic values ​​and control blank item difference weight factors in the risk control capability matrix, perform matrix mapping in combination with the blank item distribution characteristic parameters, and screen to obtain the correlation between the blank items and the risk factors within the coverage range;

[0124] First, the matching relationship between blank items in prevention and control and risk factors is screened through preliminary mapping of the matrix, and the distribution characteristic parameters corresponding to the blank items are extracted one by one. The association model is established based on the parameters, and the matching degree between risk factors and blank items is verified multiple times to ensure that each matching degree can reflect the actual coverage level. At the same time, possible redundant parameters are eliminated during the screening process. Through multiple rounds of cross-comparison and mapping verification, the correlation between blank items and risk factors within the coverage range is finally generated, providing reliable input data for subsequent difference analysis.

[0125] S322: Based on the correlation between the blank items and the risk factors within the coverage, the weighted proportion of the factor eigenvalues ​​in the blank item difference comparison matrix is ​​calculated using the formula:

[0126] ;

[0127] Calculate the control difference value of the blank item and obtain the difference analysis result of the control blank item;

[0128] in, Indicates the control difference value of the blank item, represents the coverage level parameter of the risk prevention and control capability matrix, represents the characteristic value of risk factor, represents the difference weight factor of the blank items in prevention and control, represents the characteristic parameter of blank item distribution, is the total number of blank items in the matrix;

[0129] The benefit of the formula is that by introducing the distribution characteristic parameter The square sum of the parameters is normalized to enhance the comparability of the differences of each blank item. At the same time, the contribution ratio of each parameter to the result is effectively adjusted by combining the weighting factor, making the difference evaluation more in line with the actual situation.

[0130] Coverage Level Parameters Set to 0.7, the risk factor eigenvalue is 0.6, blank item difference weight factor is 0.5, the distribution characteristic parameter is 0.8, the total number of matrix entries ;

[0131] Calculate the numerator: ;

[0132] Calculate the denominator: ;

[0133] Difference value: ;

[0134] The results show that there are significant differences in the current risk prevention and control coverage, and the prevention and control paths need to be further optimized and adjusted to improve the overall coverage level.

[0135] S323: According to the difference analysis results of the prevention and control blank items, combined with the adjustment factors of the preset optimization path and the distribution characteristic adjustment factors, the adjustment criticality of the optimization path is determined, and the optimization path is gradually adjusted to obtain the prevention and control strategy optimization data;

[0136] By combining the adjustment factors of the preset optimization path with the distribution characteristic adjustment factors, the mapping relationship between difference analysis and path adjustment is gradually established. First, based on the changing trend of the difference, the influence of each path on the overall prevention and control level is quantified. Then, with the distribution characteristic adjustment factor as the core, the weight and priority of the optimization path are reallocated. At the same time, the difference analysis results are compared and verified with the changes after the current path adjustment. Multiple adjustment tests are performed on the paths with large differences, and the change data of each adjustment is recorded. Through the analysis of the cumulative change data, the necessity and priority of adjusting the prevention and control strategy optimization path are finally determined, and the prevention and control strategy optimization data is generated.

[0137] See also Figure 7 ,The specific steps for obtaining network security protection evaluation data are as follows:

[0138] S411: Based on the prevention and control strategy optimization data, by matching the security coverage area and the uncovered area in the network, extracting the security protection factor of the coverage area and the access control factor of the uncovered area, making a preliminary parameter division for the evaluation requirements of the two types of areas, and generating a coverage protection and uncovered access parameter set;

[0139] When analyzing the security coverage and uncovered areas in the network, through comprehensive analysis of data sets, key resources that require special protection and weak links that are vulnerable to attacks are identified. For the security coverage areas, security protection factors including firewall settings, encryption strength and intrusion detection systems are extracted. The factors are obtained from continuous network traffic monitoring and historical security event analysis. Each factor is accurately weighted through advanced data analysis technology. For example, the weight of the intrusion detection system's impact factor is adjusted based on its past attack detection success rate. For the uncovered areas, attention is paid to access control factors such as access frequency, authorization level and access time window. Factors are extracted through access logs and user behavior analysis, and each access control factor is dynamically adjusted to match the current network security needs, so as to formulate more accurate access control strategies. The extraction and weight setting of factors are completed through complex algorithm models, ensuring the real-time update and high personalization of security strategies, thereby effectively improving the security protection level of the entire network.

[0140] S412: Call the security protection factors and access control factors in the coverage protection and uncovered access parameter sets, combine the associated requirements of monitoring and auditing in the assessment, extract the key instruction path, and use the formula:

[0141] ;

[0142] Calculate key instruction path associated parameters to obtain a key path associated parameter set;

[0143] in, Indicates the key instruction path associated parameters, is the safety protection factor, is the corresponding factor weight, is the access control factor, is the corresponding factor weight, Adjustment factors for monitoring audits;

[0144] By integrating multiple dimensions of security protection and access control factors, this formula can comprehensively evaluate the security status of key instruction paths in the network and strengthen data-driven decision-making for monitoring and auditing, which helps to achieve accurate security level determination and resource allocation optimization;

[0145] Set the security factor for encryption strength is 1.5, and its weight The weight is 0.7, which is set based on the importance of encryption technology in security protection;

[0146] Access control factor for access frequency is 1.0, weight The weight is 0.5, which reflects the direct impact of access frequency on network security;

[0147] Monitoring and audit adjustment factor 0.3, which is the result of adjusting the monitoring strategy based on past security incidents;

[0148] Substitute the values ​​into the formula to calculate:

[0149] ;

[0150] ;

[0151] ;

[0152] ;

[0153] The security assessment parameter of the critical path is 1.2855, which indicates the comprehensive risk level of the path under the current security configuration, and thus provides data support for the security team to adjust the protection strategy to strengthen the security protection of high-risk paths in a targeted manner.

[0154] S413: Based on the key path association parameter set, threshold matching analysis is performed on the path association parameters, and the determination condition is whether the association parameters meet the threshold range, and network security protection evaluation data is output through step-by-step optimization;

[0155] Threshold matching analysis based on key path associated parameter sets is a key network security operation. It conducts a comprehensive risk assessment by comparing the security parameters of each path with the preset security threshold. The preset threshold is determined based on network security industry standards and the organization's past security audit history. The key parameters involved in this process include encryption level, access frequency and response time. The threshold of each parameter is adjusted based on a comprehensive analysis of recent security incidents and protection effects. By regularly updating the threshold, the network security team can dynamically adjust security policies to cope with the ever-changing security threat environment. In this way, high-risk paths are identified and marked in a timely manner. The security team adjusts monitoring and protection measures accordingly, strengthens security protection in key areas, and finally obtains network security protection evaluation data, which provides a basis for the implementation of specific protection measures and ensures the comprehensiveness and foresight of network security protection.

[0156] The network security level protection intelligent evaluation system is used to execute the above network security level protection intelligent evaluation method, and the system includes:

[0157] The network configuration parsing module extracts the interface allocation parameters and routing table items in the router configuration file based on the network device connection relationship, router configuration file and firewall rule list, parses static and dynamic routing matching rules, compares firewall rule conditions and interface parameters item by item, analyzes protocol dependency paths and rule priorities, filters conflicting rules and redundant configurations, and establishes a parsed configuration relationship table;

[0158] The security rule optimization module verifies the priority parameters of conflicting rules one by one based on the parsed configuration relationship table, adjusts the coverage of the rule path, merges the matching conditions and access control policies of redundant rules, filters the path dependency parameters and priority conflict items, reorders the operation paths of the rule items, parses the access scope and dependency strength covered by the rules, and generates an optimized rule path set;

[0159] The risk path analysis module is based on the optimization rule path set, parsing the interface parameters of the rule path in the access control list, extracting the associated database rules and access scope in the security configuration file, comparing the authorized access points in the path with the protocol matching conditions, extracting the protocol parameters and impact scope of the path risk points, summarizing the associated risk information of the rule matching items, and obtaining the path risk point set;

[0160] The difference prevention and control comparison module analyzes the matching relationship between the authorized access control requirements and the vulnerability patch priority range based on the path risk point set, derives the unauthorized access points in the risk coverage path, extracts the coverage path and rule parameters of the prevention and control blank area, screens the prevention and control capability deficiencies and range parameters in the path configuration, and establishes a prevention and control capability difference matrix;

[0161] The regional protection assessment module is based on the prevention and control capability difference matrix, analyzes the address parameters of the covered and uncovered areas of the network, extracts the protection rules and access control paths in the assessment requirements, matches the monitoring and auditing rules with the associated configurations, summarizes the operation paths and monitoring configurations of the key protection areas of the network, and obtains network security protection assessment data.

[0162] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A network security level protection intelligent evaluation method, characterized in that: The following steps are involved: Based on the network device connection relationship, router configuration files and firewall rule lists, perform hierarchical analysis of security policy rule dependencies, extract the interaction protocols and priorities of dependencies, identify and correct inconsistencies in the rules, and generate an optimized security policy model in combination with network security level protection requirements; Based on the optimized security policy model, the rule path in the access control list is parsed and matched, the database interface and the associated security configuration file content are extracted, a control path security risk set is generated, and each risk point is analyzed and the impact scope is summarized to generate a security risk list; Based on the security risk list, combined with the vulnerability patch priority and coverage, unauthorized access is deduced and verified, and the authorized access control requirements in the network security level protection assessment are compared to generate a risk prevention and control capability matrix, and the gaps in prevention and control are compared to analyze the risk prevention and control coverage level and optimize the path, and obtain prevention and control strategy optimization data; Based on the prevention and control strategy optimization data, a matching analysis is performed on the secure coverage areas and uncovered areas in the network. Combined with the evaluation requirements for security area protection, access control and monitoring auditing, the operation paths associated with key instructions are extracted, and the network security protection evaluation data is summarized and output.

2. The network security level protection intelligent evaluation method according to claim 1 is characterized in that: The steps for obtaining the optimized security policy model are specifically as follows: Based on the network device connection relationship, router configuration files and firewall rule lists, the communication protocols and data transmission priorities between devices are extracted, and the dependency protocol priority matrix is ​​generated by weighted analysis of the connection relationship; According to the dependency protocol priority matrix, combined with the router configuration file, the access control list parameters associated with the configuration items are analyzed, and the corresponding rules are extracted through intersection operations, using the formula: ； Calculate the rule weight values ​​of the router configuration items to obtain the configuration rule dependency weight set; in, Indicates the rule weight value, is the protocol weight coefficient, is the configuration and protocol interaction matrix item, is the priority factor, Indicates the number of protocols associated with a router configuration item; Combine the firewall rule list and the configuration rule dependency weight set, match the inconsistencies in the rules, identify the interaction protocols and priority conflicts, eliminate the conflicts and reorder them, and generate an optimized security policy model.

3. The network security level protection intelligent evaluation method according to claim 2 is characterized in that: The steps for obtaining the control path security risk set are specifically as follows: Parsing the optimized security policy model, extracting the rule path in the access control list, extracting the path information associated with the database interface, extracting and analyzing the associated security configuration files, and obtaining the risk coefficient of each path; Compare the risk coefficient of each path with a set risk threshold, screen the paths whose risks exceed the threshold, and perform weighted scoring on the paths to obtain path risk assessment data; Based on the path risk assessment data, combined with the path safety factor and risk value, the formula is adopted: ； Calculate the security risk value of the control path to obtain the control path security risk set; in, represents the security risk value of the control path, is the weight coefficient of the path, is the risk factor of the path, is the safety factor of the path, is the safety threshold of the path, is the total number of paths.

4. The network security level protection intelligent evaluation method according to claim 3 is characterized in that: The steps for obtaining the security risk list are specifically as follows: Based on the control path safety risk set, risk points are identified item by item, and the real-time location of risk points is marked and suspicious areas are screened by gradually checking the geographic location data and associated operation records, analyzing the surrounding environmental conditions and potential sources of danger, and classifying risk points according to categories and attributes to obtain a risk point classification list; Based on the risk point classification list, a range analysis of each category of risk points is performed, and the impact range and interaction intensity are analyzed by comparing the risk points with the facility distribution and operation process parameters item by item, integrating the spatial correlation information between the risk points and the associated facilities, and obtaining a risk impact range distribution data set; Based on the risk impact range distribution data set, priority risk points are extracted, and by analyzing the influencing core parameters, the correlation between risk points in space, time and process paths is sorted out, the level range of risk points is summarized and multiple key parameter data are integrated to generate a safety risk list.

5. The network security level protection intelligent evaluation method according to claim 4 is characterized in that: The steps for obtaining the risk prevention and control capability matrix are specifically as follows: Based on the security risk list, matching risk points with vulnerability patch priority data is performed, extracting patch priority parameters and coverage by parsing risk point attributes and vulnerability patch information, checking patch coverage risk points, integrating risk points and patch coverage, and generating a patch coverage list; Based on the patch coverage list, unauthorized access paths are deduced, and the coverage patch bypass situation of risk points by differentiated paths is verified, key interaction points of the paths are analyzed, access parameters and coverage verification results are extracted, and the impact scope is recorded in combination with verification data to obtain unauthorized access verification data; Based on the unauthorized access verification data, a comparison is made with the authorized access control requirements in the network security level protection assessment, the correspondence between the assessment requirements for the prevention and control of risk points and coverage is checked, the coverage defects and risk point distribution characteristics are analyzed, the differences are extracted, and a risk prevention and control capability matrix is ​​generated.

6. The network security level protection intelligent evaluation method according to claim 5 is characterized in that: The steps for obtaining the prevention and control strategy optimization data are specifically as follows: Calling the coverage level parameters, risk factor characteristic values ​​and control blank item difference weight factors in the risk control capability matrix, combining the blank item distribution characteristic parameters for matrix mapping, and screening out the correlation between the blank items and the risk factors within the coverage range; Based on the correlation between the blank items and the risk factors within the coverage, the weighted proportion of the factor eigenvalues ​​in the blank item difference comparison matrix is ​​calculated using the formula: ； Calculate the control difference value of the blank item and obtain the difference analysis result of the control blank item; in, Indicates the control difference value of the blank item, represents the coverage level parameter of the risk prevention and control capability matrix, represents the characteristic value of risk factor, represents the difference weight factor of the blank items in prevention and control, represents the characteristic parameter of blank item distribution, is the total number of blank items in the matrix; According to the difference analysis results of the prevention and control gap items, combined with the adjustment factors of the preset optimization path and the distribution characteristic adjustment factors, the criticality of adjustment of the optimization path is judged, the optimization path is gradually adjusted, and the prevention and control strategy optimization data is obtained.

7. The network security level protection intelligent evaluation method according to claim 6 is characterized in that: The steps for obtaining the network security protection evaluation data are specifically as follows: Based on the control strategy optimization data, by matching the security coverage area and the uncovered area in the network, extracting the security protection factor of the coverage area and the access control factor of the uncovered area, making a preliminary parameter division for the evaluation requirements of the two types of areas, and generating a coverage protection and uncovered access parameter set; The security protection factors and access control factors in the coverage protection and uncovered access parameter set are called, and the key instruction paths are extracted in combination with the associated requirements of monitoring and auditing in the evaluation, using the formula: ； Calculate key instruction path associated parameters to obtain a key path associated parameter set; in, Indicates the key instruction path associated parameters, is the safety protection factor, is the corresponding factor weight, is the access control factor, is the corresponding factor weight, Adjustment factors for monitoring audits; Based on the critical path associated parameter set, a threshold matching analysis is performed on the path associated parameters, and the judgment condition is whether the associated parameters meet the threshold range. Through step-by-step optimization, network security protection evaluation data is output.

8. A network security level protection intelligent evaluation system, characterized in that: The system includes a network device, and the system is used to execute the network security level protection intelligent assessment method according to any one of claims 1-7.

Images