Information system security risk continuous assessment method based on evaluation form content analysis

Abstract

The invention relates to an evaluation form content analysis-based information system security risk continuous evaluation method, which comprises the following steps of: analyzing and standardizing evaluation form content, analyzing the evaluation form content through a word frequency-inverse form frequency method, calculating the word frequency and the inverse form frequency of each keyword, and calculating the word frequency and the inverse form frequency of each keyword; calculating feature vectors of the keywords through the two indexes, namely risk occurrence probability and risk hazard degree; defining a risk assessment matrix, mapping feature vectors in the risk assessment matrix, and performing risk grade division and quantification on the feature vectors; according to the context of a service scene, the network position and the security policy change of the same evaluation object in a historical evaluation form are sensed in real time by using deep reinforcement learning, and a risk weight dictionary is adjusted, so that a risk score is dynamically calculated. Compared with the prior art, the problems of low labor efficiency and poor evaluation precision of information system safety evaluation are solved through the word frequency-inverse form frequency, the risk evaluation matrix and deep reinforcement learning.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace information security management, and in particular to a method for continuously evaluating information system security risks based on evaluation form content analysis. Background Art

[0002] Information system security risk refers to the potential threat that may lead to security incidents such as information leakage, tampering, loss or service interruption during the operation of the information system. In order to protect the security of the information system and reduce risks, it is necessary to effectively manage the information system security risks. In the existing technology, multi-level protection is to divide the security level of the information system and take corresponding security protection measures according to the divided level to ensure the security of the information system. Multi-level protection assessment is used to evaluate whether the information system meets the corresponding security protection level requirements, and is one of the important links in multi-level protection work. With the rapid development of information technology and the increasingly severe network security situation, the research and practice of multi-level protection assessment technology has become an important topic in the field of information security.

[0003] At present, policies and regulations related to security assessment are gradually being improved, such as the current GB / T 22239-2019 "Information Security Technology·Basic Requirements for Cybersecurity Level Protection", which clarifies the security management measures and security technical requirements that information systems of different security levels should adopt, and provides clear technical specifications and evaluation standards for security assessment. The formulation of these standards not only helps to unify the technical requirements for assessment and improve the standardization level of assessment, but also provides clear security guidance for the construction and operation and maintenance of information systems, and improves the level of cybersecurity protection for the entire society.

[0004] However, the existing multi-level protection assessment methods mainly focus on compliance review, that is, by checking whether the information system complies with relevant security standards and requirements to assess its security level. Although such methods can ensure that the information system meets certain security standards, they often ignore the actual security risks faced by the system, resulting in poor defense effectiveness. In addition, the existing multi-level protection assessment methods are usually based on on-site inspections and manual experience analysis, which have the defects of strong subjectivity and low efficiency. Summary of the invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a method for continuous assessment of information system security risks based on analysis of assessment form content, which can effectively determine the risk level of the information system and solve the problems of low manual efficiency and poor assessment accuracy in current information system security assessment.

[0006] The purpose of the present invention can be achieved by the following technical solution: A method for continuous assessment of information system security risks based on evaluation form content analysis, comprising the following steps:

[0007] S1. Parse and standardize the evaluation form content. Analyze the evaluation form content using the term frequency-inverse table frequency method (TF-ITF), calculate the term frequency and inverse table frequency of each keyword, and use these two indicators to calculate the keyword's feature vector, i.e., the risk probability and risk hazard level.

[0008] S2. Define a risk assessment matrix, map the eigenvectors in the risk assessment matrix, and classify and quantify the risk levels;

[0009] S3. Based on the business scenario context, deep reinforcement learning is used to perceive the network location and security policy changes of the same assessment object in the historical assessment form in real time, adjust the risk weight dictionary, and dynamically calculate the risk score.

[0010] Furthermore, the step S1 includes the following steps:

[0011] S11. Extract the evaluation form content for analysis and generate a list of evaluation result items 1 , Evaluation weight item list 2 Two word lists;

[0012] S12. Calculate the list of evaluation results 1 , Evaluation weight item list 2 The term frequency (TF) of the keywords in the two word lists in each evaluation category form;

[0013] S13, calculating the inverse table frequency (ITF) of the keyword;

[0014] S14. Calculate the importance of the keyword by combining the keyword frequency and inverse form frequency of the keyword;

[0015] S15. By normalizing the TF-ITF value, the risk assessment feature vector of each form is calculated, including the probability of risk occurrence and the degree of risk hazard.

[0016] Furthermore, the calculation formula of the word frequency in step S12 is:

[0017]

[0018] The calculation formula of the reverse table frequency in step S13 is:

[0019]

[0020] Among them, TFword ITF is the frequency of the word in the same category. word is the inverse form frequency of the term word, N is the number of all documents, DF word It is the document frequency, which indicates the number of all documents in which the term word appears.

[0021] Furthermore, the importance of the keyword in step S14 is specifically the product of the keyword's word frequency and the inverse form frequency:

[0022] TF-ITF n,word =TF word ×ITF word

[0023] Among them, TF-ITF n,word The importance of the entry word.

[0024] Furthermore, the specific process of step S15 is: characterizing the possibility of security risk and the degree of security risk through normalization of TF-ITF value, defining the possibility normalization coefficient p 1 ,p 2 ,…,p x , the normalization coefficient of the degree of harm is t 1 ,t 2 ,…,t y , the normalized result P n ,T n The mathematical representations are as follows:

[0025]

[0026] Among them, Pn and Tn are the risk occurrence probability and risk hazard degree index respectively.

[0027] Furthermore, the risk assessment matrix in step S2 divides and quantifies the risk levels according to the two dimensions of the possibility of risk occurrence and the degree of harm, wherein the degree of harm of risk occurrence is subdivided into five levels: major, high, medium, low, and slight, and the possibility of risk occurrence is divided into three levels: high, medium, and low;

[0028] Based on this, the risk assessment matrix divides security risks into five clear levels: major security risk, high security risk, medium security risk, low security risk and minor security risk.

[0029] Furthermore, the possibility and degree of risk in step S2 are specifically divided according to the risk assessment matrix parameters, which use a normalized interval of 0-1. For specific safety assessment scenarios, the x-direction and y-direction matrix division parameters para are set. xwith para y , according to para x with para y Divide the risk assessment matrix to obtain dynamically adjustable risk matrix blocks. The x-direction ranges from 0 to 1, representing the five safety risk hazard levels: slight, low, medium, high, and major; the y-direction ranges from 0 to 1, representing the three safety risk possibility levels: low, medium, and high.

[0030] Furthermore, in step S3, the risk assessment weight dictionary is denoted as D, where λ 1 To 5 is the weight parameter corresponding to each risk level, major safety risk corresponds to λ1, high safety risk corresponds to λ2, medium safety risk corresponds to λ3, low safety risk corresponds to λ4, and slight safety risk corresponds to λ5.

[0031] Furthermore, in step S3, the risk score is calculated by weighted summation based on given evaluation items, risk matrix parameters, and risk assessment weights.

[0032] Furthermore, the risk score is calculated as follows:

[0033]

[0034] Among them, w(k) is the evaluation item and THR is the risk score of the system.

[0035] Compared with the prior art, the present invention has the following advantages:

[0036] 1. The present invention uses TF-ITF technology to extract keywords, characterize the probability of occurrence of security risks in the information system of the evaluation object and its degree of harm, so as to help determine the risk level of the information system. In this way, the risk level of each evaluation category can be effectively distinguished, so as to pay more attention to higher-risk security risks. This method allows evaluators to manually intervene in the keyword selection process, supports smart error correction and dynamic configuration; and also improves the risk assessment efficiency of evaluators by automatically mapping the probability of risk occurrence and the degree of harm.

[0037] 2. The risk assessment matrix designed by the present invention combines the probability of security risk occurrence and the potential degree of harm, defines the security risk level faced by the evaluation object in different evaluation items, and can provide fine-grained risk quantification for each evaluation form of the information system. Through the mapping of risk matrix and risk level, the evaluation personnel can quickly perceive the risk source and infer the risk evolution trend.

[0038] 3. When calculating the risk score, the risk assessment weights involved are dynamically and real-time generated by a deep reinforcement learning algorithm based on factors such as changes in the network location of the object to be tested and updates to security policies. This makes the evaluation result independent of a single evaluation record, but rather a fusion of multiple historical evaluation records. This is an in-depth exploration of the contents of a large number of historical evaluation forms, which can fully ensure the accuracy of the risk scoring results. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of the method flow of the present invention;

[0040] Figure 2 It is a schematic diagram of the application process of the embodiment;

[0041] Figure 3 Schematic diagram of the visualization effect of the risk assessment matrix in the embodiment. DETAILED DESCRIPTION

[0042] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0043] Example

[0044] like Figure 1 As shown, a method for continuous assessment of information system security risks based on evaluation form content parsing includes the following steps:

[0045] S1. Parse and standardize the evaluation form content. Analyze the evaluation form content using the word frequency-inverse form frequency method TF-ITF, calculate the word frequency and inverse form frequency of each keyword, and use these two indicators to calculate the keyword's feature vector, i.e., the risk probability and risk hazard level.

[0046] S2. Define a risk assessment matrix, map the eigenvectors in the risk assessment matrix, and classify and quantify the risk levels;

[0047] S3. Based on the business scenario context, deep reinforcement learning is used to perceive the network location and security policy changes of the same assessment object in the historical assessment form in real time, adjust the risk weight dictionary, and dynamically calculate the risk score.

[0048] This embodiment applies the above solution, such as Figure 2 As shown, the main process is:

[0049] Step 1: Parse and standardize the evaluation form content. Use the word frequency-inverse form frequency TF-ITF method to parse the evaluation form, calculate the word frequency and inverse form frequency of each keyword, and use these two indicators to calculate the feature vector of the feature word.

[0050] In step 1, the method of parsing the evaluation form through word frequency-inverse form frequency first needs to extract the evaluation form content and parse it to generate a list of evaluation result items. 1 , Evaluation weight item list 2 Two word lists.

[0051] list 1 =[word 11 ,word 12 ,…,word 1x ] (1)

[0052] list 2 =[word 21 ,word 22 ,…,word 2y ] (2)

[0053] After that, the word frequency TF of the characteristic words in the two word lists of evaluation result item and evaluation weight item in each evaluation category form needs to be calculated. Since only characteristic words of the same type are related to the characteristic words that need to be evaluated, the word frequency of other words has no practical meaning for the word, so only the word frequency of the word in the same type of words needs to be calculated.

[0054]

[0055] After calculating the word frequency, the importance (harm level) of the word in the evaluation form needs to be measured through the inverse form frequency (ITF). The principle of ITF is that for a certain keyword, the more evaluation forms contain the keyword, the stronger the form category characteristics of the keyword.

[0056]

[0057] ITF word is the inverse form frequency of the term Word, N is the number of all documents, DF word It is the document frequency, which indicates the number of all documents in which the term Word appears.

[0058] The importance of the feature word is calculated by comprehensively considering the word frequency and the inverse form frequency of the feature word. The calculation method is the product of the word frequency and the inverse form frequency of the feature word.

[0059] TF-ITF n,word =TF word ×ITF word (5)

[0060] In order to evaluate the possibility of the occurrence of the risk of the evaluation object and the degree of risk damage, the present invention characterizes the possibility of the occurrence of the security risk and the degree of security risk damage by normalizing the TF-ITF value. Define the possibility normalization coefficient p1 ,p 2 ,…,p x , the normalization coefficient of the degree of harm is t 1 ,t 2 ,…,t y , the normalized result P n ,T n The mathematical representations are shown below.

[0061]

[0062] In practical applications, for each form W in the heterogeneous evaluation form set S of a certain evaluation object, a risk assessment feature vector generation algorithm based on word frequency is used to traverse each word in the form. If the word belongs to the evaluation result list list1 or the evaluation weight list list2, the word frequency TFword of the word in the form is calculated. Then the inverse form frequency ITFword of each word is calculated, and the possibility of risk occurrence and the degree of harm index of risk occurrence are marked as Pn and Tn respectively. According to formulas (6) and (7), the risk assessment feature vector V of each form can be calculated.

[0063] Step 2: Define the risk assessment matrix, map the eigenvectors in the risk assessment matrix, and classify them;

[0064] The risk assessment matrix defined in step 2 combines the risk hazard level and its probability of occurrence, and defines the security risk level faced by the assessment object in different assessment items. Specifically, the risk assessment matrix conducts risk assessment based on the two dimensions of risk probability and hazard level.

[0065] Table 1

[0066]

[0067] Table 2

[0068]

[0069] In this matrix, the risk hazard level is divided into five levels: major, high, medium, low, and minor, and the probability of risk occurrence is divided into three levels: high, medium, and low (as shown in Table 1). Based on this, the risk assessment matrix divides security risks into five clear levels: major security risk, high security risk, medium security risk, low security risk, and minor security risk. The characteristics of each risk level are shown in Table 2.

[0070] The present invention classifies and normalizes the risk assessment matrix. The risk assessment matrix is ​​projected into a 1×1 two-dimensional interval in the first quadrant to divide each security level block. Specifically, for a specific risk assessment scenario, the x-direction and y-direction matrix division parameters para are set. x with para y .

[0071] para x =(0,x 1 ,x 2 ,x 3 ,x 4 ,1) (8)

[0072] para y =(0,y 1 ,y 2 ,1) (9)

[0073] According to para x with para y Divide the risk assessment matrix to obtain dynamically adjustable risk matrix blocks. The x-direction ranges from 0 to 1, representing the five safety risk hazard levels of slight, low, medium, high, and major, and the y-direction ranges from 0 to 1, representing the three safety risk possibility levels of low, medium, and high.

[0074] This embodiment also visualizes the risk assessment matrix, using different colors to represent different risk levels: green represents a slight safety risk; blue represents a low safety risk; yellow represents a medium safety risk; orange represents a high safety risk; and red represents a major safety risk. The normalized eigenvector calculated in step 1 is mapped to the two-dimensional plane of the risk assessment matrix, and the comprehensive safety risk faced by all evaluation items in the evaluation category form corresponding to the eigenvector can be obtained.

[0075] Step 3: Define the risk weight dictionary, conduct a quantitative assessment of the security risk of the information system under assessment, and calculate the security risk score of the information system.

[0076] In step 3, risk assessment weights need to be defined and dynamically configured by deep reinforcement learning based on environmental factors such as the location change of the system to be tested, security policies, and the risk level obtained in step 2. The security risk score calculation formula is obtained by weighted summation based on given evaluation items, risk level corresponding parameters, and risk assessment weights.

[0077] Specifically, the risk assessment weight dictionary is denoted as D, where λ 1 …λ 5 The weight parameters correspond to each risk level, and the following corresponding relationship is established.

[0078] D={(major,λ1 ),(high,λ 2 ),(middle,λ 3 ),(low,λ 4 ),(slight,λ 5 )} (10) Next, different risk score calculation weights are assigned to each risk level, and a weighted sum calculation is performed.

[0079]

[0080] Among them, the evaluation item is w(k), and the risk level corresponds to the parameter λ 1 …λ 5 , the risk score of the system is THR.

[0081] In summary, the present invention uses TF-ITF technology for the first time to extract feature vectors to characterize the probability of occurrence and degree of risk of the information system security risk of the evaluation object, thereby helping to determine the security of the information system. In this way, the risk level of each evaluation category can be effectively distinguished, so that more attention can be paid to more critical security risks. This method not only retains the flexibility and dynamic adjustment capabilities of manual data processing, but also provides an automated risk assessment method for third-party evaluation agencies.

[0082] At the same time, the present invention has designed for the first time a risk assessment matrix that integrates the degree of security risk and the probability of risk occurrence, defines the security risk level faced by the assessment object in different assessment items, and can provide a specific risk quantitative assessment and display for the information system assessment form. The risk assessment matrix enables assessors to quickly identify and assess various risks, laying the foundation for the targeted deployment of security protection strategies.

[0083] The above describes the basic embodiments of the present invention. It should be understood that the present invention is not limited to the above specific implementations, and deep reinforcement learning can also be used to perform fusion analysis on evaluation records, system logs, etc. obtained multiple times over a long period of time. Among them, the functions of each module in deep reinforcement learning are as follows:

[0084] 1) Net module, which defines the structure, input and output of the Q network. The input is a five-dimensional environmental state variable. The first two dimensions are the previous evaluation record and the current evaluation record, and the last three dimensions are the migration of the information system business entity after the previous evaluation, the adopted security strategy, and the security event record triggered between the two evaluations. The output is a one-dimensional action integer variable. The neural network structure is three convolutional layers plus two fully connected layers.

[0085] 2) DQN model, including the initialization function __init__(), the action selection function choose_action(), the data storage function store_transition, and the learn function that uses historical data to train the DQN model.

[0086] 3) The training process loops. Initially, only the dqn.choose_action function is used to select an action. The action is input into the environment to obtain the next environment data, reward, and whether the environment has ended. The environment data, reward, whether the environment has ended, and other information are stored in the historical database. When the historical database is full of data, the dqn.learn function is called for training. Since DQN is embedded in the risk scoring calculation process and is used to determine the weight parameters, its training goal is to calculate the weights of various risks in the scoring calculation based on the current business context of the system, the attacks it has suffered, the existing security policies, the current evaluation form, etc. For example, if a risk point is found in the current evaluation form, and the risk point has also appeared in the previous evaluation form, and has suffered related attacks between the two evaluations, and the corresponding security policy has not yet been configured, then the weight of the risk point will increase, otherwise it will be reduced.

[0087] Applying the scheme proposed by the present invention to practice can perform keyword traversal and statistical analysis on the contents of multivariate heterogeneous evaluation forms, wherein the evaluation form is a complete record of the evaluators after the evaluation of the target information system, and each entry in each form contains the evaluation items required by the security evaluation specification; the keywords are specific words involving security risks in the description language required by the security evaluation specification. The present invention solves the problems of low manual efficiency and poor evaluation accuracy of information system security evaluation through word frequency-inverse form frequency, risk assessment matrix, and deep reinforcement learning, and can provide strong support for national public security governance and cyberspace governance. The present invention comprehensively utilizes word frequency-inverse form frequency and deep reinforcement learning to achieve continuous evaluation of the security risks of the target information system, which not only supports the automated parsing of the contents of large-scale heterogeneous evaluation forms, but also can perceive the business context status of the object to be tested, providing a more efficient and reliable evaluation tool for third-party evaluation, which can strongly support the security supervision of important information systems.

Claims

1. A method for continuous assessment of information system security risks based on evaluation form content analysis, characterized in that: The following steps are involved: S1. Parse and standardize the evaluation form content. Use the word frequency-inverse form frequency method to parse the evaluation form content, calculate the word frequency and inverse form frequency of each keyword, and use these two indicators to calculate the keyword's feature vector, i.e., the risk probability and risk hazard degree; S2. Define a risk assessment matrix, map the eigenvectors in the risk assessment matrix, and classify and quantify the risk levels; S3. Based on the business scenario context, deep reinforcement learning is used to perceive the network location and security policy changes of the same assessment object in the historical assessment form in real time, adjust the risk weight dictionary, and dynamically calculate the risk score.

2. According to claim 1, a method for continuous assessment of information system security risks based on evaluation form content analysis is characterized in that: The step S1 comprises the following steps: S11, extract the evaluation form content for parsing, and generate two word lists, evaluation result item list1 and evaluation weight item list2; S12, calculating the word frequency of the keywords in the two word lists of evaluation result item list1 and evaluation weight item list2 in each evaluation category form; S13, calculating the reverse form frequency of the keyword; S14. Calculate the importance of the keyword by combining the keyword frequency and inverse form frequency of the keyword; S15. By normalizing the TF-ITF value, the risk assessment feature vector of each form is calculated, including the probability of risk occurrence and the degree of risk hazard.

3. The method for continuous assessment of information system security risks based on evaluation form content analysis according to claim 2 is characterized in that: The calculation formula of word frequency in step S12 is: The calculation formula of the reverse table frequency in step S13 is: Among them, TF word ITF is the frequency of the word in the same category. word is the inverse form frequency of the term word, N is the number of all documents, DF word It is the document frequency, which indicates the number of all documents in which the term word appears.

4. The method for continuously assessing information system security risks based on evaluation form content analysis according to claim 3 is characterized in that: The importance of the keyword in step S14 is specifically the product of the keyword's word frequency and the inverse form frequency: TF-ITF n，word =TF word ×ITF word Among them, TF-ITF n，word The importance of the entry word.

5. The method for continuously assessing information system security risks based on evaluation form content analysis according to claim 4 is characterized in that: The specific process of step S15 is: characterize the possibility of security risk and the degree of security risk through normalization processing of TF-ITF value, define the possibility normalization coefficients p1, p2, ..., p x , the normalization coefficient of the degree of harm is t1, t2, ..., t y , the normalized result P n , T n The mathematical representations are as follows: Among them, Pn and Tn are the risk occurrence probability and risk hazard degree index respectively.

6. The method for continuous assessment of information system security risks based on evaluation form content analysis according to claim 1 is characterized in that: In step S2, the risk assessment matrix divides and quantifies the risk level according to the two dimensions of the possibility of risk occurrence and the degree of harm, wherein the degree of harm of risk occurrence is subdivided into five levels: major, high, medium, low, and slight, and the possibility of risk occurrence is divided into three levels: high, medium, and low; Based on this, the risk assessment matrix divides security risks into five clear levels: major security risk, high security risk, medium security risk, low security risk and minor security risk.

7. The method for continuous assessment of information system security risks based on evaluation form content analysis according to claim 6 is characterized in that: The possibility and degree of risk in step S2 are specifically divided according to the risk assessment matrix parameters, which use a normalized interval of 0-1. For a specific safety assessment scenario, the x-direction and y-direction matrix division parameters para are set. x with para y , according to para x with para y Divide the risk assessment matrix to obtain dynamically adjustable risk matrix blocks. The x-direction ranges from 0 to 1, representing the five safety risk hazard levels: slight, low, medium, high, and major; the y-direction ranges from 0 to 1, representing the three safety risk possibility levels: low, medium, and high.

8. The method for continuous assessment of information system security risks based on evaluation form content analysis according to claim 6 is characterized in that: In step S3, the risk assessment weight dictionary is recorded as D, where λ1 to λ5 are weight parameters corresponding to each risk level, major security risk corresponds to λ1, high security risk corresponds to λ2, medium security risk corresponds to λ3, low security risk corresponds to λ4, and slight security risk corresponds to λ5.

9. The method for continuous assessment of information system security risks based on evaluation form content analysis according to claim 8 is characterized in that: In step S3, the risk score is calculated by weighted summation based on given evaluation items, risk matrix parameters, and risk assessment weights.

10. The method for continuously assessing information system security risks based on evaluation form content analysis according to claim 9, characterized in that: The risk score is calculated as follows: Among them, w(k) is the evaluation item and THR is the risk score of the system.

Images