Information system security vulnerability assessment method and system

Abstract

The invention discloses an information system security vulnerability assessment method and system, and the method comprises the steps: obtaining security association data of an information system, carrying out the standardization processing of module test information in the security association data, and obtaining corresponding standardized vulnerability test data; establishing an expert weight threshold, and performing fusion evaluation on vulnerability scanning data, standardized vulnerability test data, security expert opinions and associated system information in the security associated data to obtain preliminary vulnerability distribution information; performing cooperative calculation on the preliminary vulnerability distribution information and system penetration test information in the security association data to obtain final vulnerability distribution information; compared with the prior art, the method has the advantages that the vulnerability detection and repair accuracy can be remarkably improved, the repair time is shortened, and the safety and stability of the system after repair are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security processing, and in particular to an information system security vulnerability assessment method and system. Background Art

[0002] In recent years, the rapid development of information technology has promoted the widespread application of information systems in various organizations. From governments, enterprises to financial institutions, information systems have become the core support for business operations. However, with the in-depth advancement of informatization, the security risks faced by information systems are increasing day by day. The complexity and diversity of network security threats are showing explosive growth, especially the exposure and exploitation of system vulnerabilities, which have become an important breakthrough for hacker attacks. In order to cope with these security threats, information system vulnerability detection technology has gradually developed, forming a comprehensive defense system based on vulnerability scanning, penetration testing, dynamic monitoring and other means. Early vulnerability detection tools mainly relied on rule matching and feature extraction, and identified known vulnerability patterns through static analysis. However, with the evolution of attack technology and the complexity of network environment, relying solely on traditional detection methods can no longer meet the security needs of information systems. With the introduction of artificial intelligence technology, vulnerability detection based on machine learning has gradually become a research hotspot. Through learning and training with a large amount of historical data, it has a certain degree of unknown vulnerability prediction ability.

[0003] Although the existing vulnerability detection technology has made significant progress, there are still many limitations in the field of vulnerability repair effect evaluation. First, the existing vulnerability repair effect evaluation methods mostly rely on static detection results, ignoring the dynamic changes in the information system operating environment. The existing evaluation methods are often difficult to accurately reflect the actual security improvement effect after the vulnerability is repaired, resulting in the inability to fully quantify the effect of vulnerability repair. Secondly, traditional vulnerability assessment methods often lack multi-dimensional data fusion capabilities, and are unable to organically combine multiple information such as vulnerability scanning, module testing, and security expert opinions, making it difficult to form a comprehensive security assessment perspective. In addition, with the complexity of information system architecture, existing technologies cannot effectively evaluate the security risk transmission between related systems when facing multi-system and multi-module collaborative operations, which can easily lead to potential security risks being ignored. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above existing problems, the present invention is proposed. Therefore, the present invention provides an information system security vulnerability assessment method to solve the problems mentioned in the background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides an information system security vulnerability assessment method, comprising:

[0008] Acquire security-related data of the information system, perform standardization on module test information in the security-related data, and obtain corresponding standardized vulnerability test data;

[0009] Establish expert weight thresholds, integrate and evaluate vulnerability scanning data, standardized vulnerability testing data, security expert opinions, and related system information in security-related data to obtain preliminary vulnerability distribution information;

[0010] Co-calculating the preliminary vulnerability distribution information and the system penetration test information in the security association data to obtain final vulnerability distribution information;

[0011] Based on the final vulnerability distribution information, a security vulnerability assessment result of the information system is determined.

[0012] As a preferred solution of the information system security vulnerability assessment method of the present invention, the security-related data includes:

[0013] Vulnerability scanning data, module testing information, security expert opinions, associated system information and system penetration testing information;

[0014] Among them, the vulnerability scanning data is the percentage rate of the number of vulnerabilities found in the vulnerability scan to the total number of scans, the module testing information is the percentage rate of the number of problems found in the module test to the total number of module test times, the security expert opinion is the normalized value from zero to one of the security expert's score, the associated system information is the percentage rate of the number of problems found in the associated system test to the total number of associated systems, and the system penetration testing information is the percentage rate of the number of system penetration passes to the total number of system penetration tests.

[0015] As a preferred solution of the information system security vulnerability assessment method of the present invention, wherein: the module test information in the security-related data is standardized to obtain corresponding standardized vulnerability test data, including:

[0016] Preset a vulnerability standardization model, input module test information into the vulnerability standardization model, and output standardized vulnerability test data corresponding to the module test information through the vulnerability standardization model;

[0017] Among them, the preset vulnerability standardization model is a fully connected neural network model, and the input process is to add randomly initialized fully connected neural network weights.

[0018] As a preferred solution of the information system security vulnerability assessment method of the present invention, it also includes:

[0019] Get module vulnerability data in module test information;

[0020] The module vulnerability data includes: the total number of tests of each module and the number of successfully identified vulnerabilities, the total number of tests of the information system and the number of successfully identified vulnerabilities, and the actual number of vulnerabilities;

[0021] Using the module vulnerability data, a neural network in a preset vulnerability standardization model is trained until the neural network reaches convergence, that is, all module vulnerability data reaches a maximum value, thereby obtaining a vulnerability standardization model;

[0022] Among them, the neural network training process includes the total number of module tests and the number of successfully identified vulnerabilities in the module vulnerability data and the total number of information system tests and the number of successfully identified vulnerabilities. The labels in the training are the actual number of vulnerabilities.

[0023] As a preferred solution of the information system security vulnerability assessment method described in the present invention, an expert weight threshold is established, and vulnerability scanning data, standardized vulnerability test data, security expert opinions and related system information in security-related data are integrated and evaluated to obtain preliminary vulnerability distribution information, including:

[0024] Convert vulnerability scanning data, standardized vulnerability testing data, security expert opinions, and related system information into fluctuating weight distributions respectively;

[0025] The probability mass function is used to perform a fusion evaluation on the fluctuation weight distribution to obtain preliminary vulnerability distribution information.

[0026] As a preferred solution of the information system security vulnerability assessment method of the present invention, wherein: the preliminary vulnerability distribution information and the system penetration test information in the security association data are collaboratively calculated to obtain the final vulnerability distribution information, including:

[0027] The collaborative calculation process uses a conditional probability density function.

[0028] As a preferred solution of the information system security vulnerability assessment method of the present invention, wherein: based on the final vulnerability distribution information, determining the security vulnerability assessment result of the information system includes:

[0029] The point with the largest probability density value on the probability density distribution curve in the final vulnerability distribution information is determined as the security vulnerability assessment result of the information system.

[0030] In a second aspect, the present invention provides an information system security vulnerability assessment system, which comprises:

[0031] The data acquisition and standardization processing module is configured to acquire security-related data of the information system, perform standardization processing on the module test information in the security-related data, and obtain corresponding standardized vulnerability test data;

[0032] The security vulnerability assessment module is configured to establish an expert weight threshold, perform a fusion assessment on vulnerability scanning data, standardized vulnerability test data, security expert opinions, and related system information in the security-related data, and obtain preliminary vulnerability distribution information;

[0033] A security vulnerability distribution processing module is configured to collaboratively calculate the preliminary vulnerability distribution information and the system penetration test information in the security association data to obtain final vulnerability distribution information;

[0034] The security vulnerability assessment result module is configured to determine the security vulnerability assessment result of the information system based on the final vulnerability distribution information.

[0035] In a third aspect, the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: the processor implements any step of the above method when executing the computer program.

[0036] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: the computer program implements any step of the above method when executed by a processor.

[0037] Compared with the prior art, the invention has the following beneficial effects:

[0038] 1. The traditional vulnerability repair effect evaluation method mainly relies on static data, while the present invention builds a multi-dimensional data evaluation model by integrating vulnerability scanning data, module test information, related system information, security expert opinions and system penetration test data. By introducing dynamic data collection and standardized processing, the present invention can reflect the actual effect of system vulnerability repair in real time and adapt to changes in the system environment. In particular, the module test information is standardized, eliminating the differences between test results of different modules, and ensuring data consistency and accuracy in the evaluation process;

[0039] 2. By establishing an expert weight threshold, quantitative data is combined with qualitative data, overcoming the limitation of existing evaluation methods that rely solely on automated tools. The expert weight threshold assigns different importance to multi-dimensional data such as vulnerability scanning data, standardized vulnerability testing data, and security expert opinions, effectively improving the scientificity and rationality of the evaluation results;

[0040] 3. A fluctuation weight distribution calculation method is proposed for each type of vulnerability security data information, and an α weight coefficient is introduced to adjust the amplitude of the event occurrence rate as the number of events increases. A positive value indicates that the discrete event occurrence rate is positively correlated with the number of discrete events, and a negative value indicates that the discrete event occurrence rate is negatively correlated with the number of discrete events. It can adapt to different data fluctuation patterns, whether positive or negative fluctuations. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0042] Figure 1 This is an overall flow chart of an information system security vulnerability assessment method according to an embodiment of the present invention;

[0043] Figure 2 This is a comparison chart of repair time and security score of an information system security vulnerability assessment method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0045] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0046] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0047] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0048] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0049] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0050] Example 1

[0051] Reference Figure 1 , which is the first embodiment of the present invention, and provides an information system security vulnerability assessment method, comprising:

[0052] S1. Obtain security-related data of the information system, standardize the module test information in the security-related data, and obtain corresponding standardized vulnerability test data;

[0053] Further, vulnerability scanning data, module testing information, security expert opinions, associated system information and system penetration testing information;

[0054] Specifically, vulnerability scanning data is the percentage of the number of vulnerabilities found in vulnerability scanning to the total number of scans, module testing information is the percentage of the number of problems found in module testing to the total number of module testing times, security expert opinions are the normalized values ​​of security expert scores from zero to one, associated system information is the percentage of the number of problems found in associated system testing to the total number of associated systems, and system penetration testing information is the percentage of the number of system penetration passes to the total number of system penetration tests;

[0055] Furthermore, a vulnerability standardization model is preset, the module test information is input into the vulnerability standardization model, and standardized vulnerability test data corresponding to the module test information is output through the vulnerability standardization model;

[0056] It should be explained that different modules will generate different types of data during the test process, such as the number of errors, fault types, and problem severity. These data may come from different test tools and environments. Due to the different characteristics and data distribution of each module, if standardization is not performed, it may make it difficult to compare the data of each module, which will affect the accuracy of subsequent evaluation results. Therefore, standardization is required.

[0057] Specifically, through standardization, the test information of all modules is processed to the same scale, so that there will be no deviation in the evaluation due to different data scales;

[0058] Among them, the preset vulnerability standardization model is a fully connected neural network model, and the input process is to add randomly initialized fully connected neural network weights;

[0059] It should be noted that the reason for adding randomly initialized fully connected neural network weights is that if the weight initialization is unreasonable, the neural network may converge prematurely, resulting in poor model training results;

[0060] Further, obtaining module vulnerability data in the module test information;

[0061] Specifically, the module vulnerability data includes the total number of tests and the number of successfully identified vulnerabilities for each module, the total number of tests and the number of successfully identified vulnerabilities for the information system, and the actual number of vulnerabilities;

[0062] Furthermore, the neural network in the preset vulnerability standardization model is trained through the module vulnerability data until the neural network reaches convergence, that is, all module vulnerability data reaches the maximum value, and the vulnerability standardization model is obtained;

[0063] Among them, the neural network training process includes the total number of module tests and the number of successfully identified vulnerabilities in the module vulnerability data and the total number of information system tests and the number of successfully identified vulnerabilities. The labels in the training are the actual number of vulnerabilities.

[0064] It should be noted that using neural network models to train and standardize module vulnerability data can not only directly improve the accuracy of vulnerability repair effect evaluation, but also process a large amount of complex data; for example, vulnerability data of information systems often come from different modules or sources, with different distributions and complexities; neural networks can automatically identify potential patterns in data and utilize them; not only simple standardization, but also the complex relationships hidden behind the data can be identified, so as to more accurately predict the vulnerability repair effect of the system;

[0065] S2. Establish an expert weight threshold, conduct a fusion evaluation of vulnerability scanning data, standardized vulnerability test data, security expert opinions, and related system information in security-related data, and obtain preliminary vulnerability distribution information;

[0066] Specifically, the expert weight threshold formula is expressed as:

[0067]

[0068] Among them, k i represents the weight of the security expert opinion corresponding to the i-th information; b i represents the sum of scores of multiple security experts corresponding to the i-th information, and n represents the number of security experts;

[0069] It should be noted that by inputting the expert's historical evaluation data into the model together with the system's vulnerability repair data, not only can the current system be scored based on the expert's evaluation, but the long-term security status change trend can also be obtained through the analysis model to determine the effectiveness of the expert's weight;

[0070] Furthermore, vulnerability scanning data, standardized vulnerability testing data, security expert opinions, and associated system information are converted into fluctuating weight distributions respectively;

[0071] Specifically, the volatility weight distribution formula is:

[0072]

[0073] Wherein, P(X=k) is the probability mass function (PMF), which indicates the probability that the random variable X takes the value k; in this formula, X represents a discrete event, specifically: vulnerability scanning data, standardized vulnerability testing data, security expert opinions, and associated system information; k is a non-negative integer, representing the number of times the event occurs within the observation window, specifically the data distribution of vulnerability scanning data, standardized vulnerability testing data, security expert opinions, and associated system information; α is a weight coefficient in the range of [0.3, 0.5], which is used to adjust the amplitude of the event occurrence rate as the number of events increases. A positive value indicates that the discrete event occurrence rate is positively correlated with the number of discrete events, and a negative value indicates that the discrete event occurrence rate is negatively correlated with the number of discrete events; λ is a distribution parameter in the range of [0.2, 0.8];

[0074] Furthermore, the probability mass function is used to fusion evaluate the volatility weight distribution to obtain preliminary vulnerability distribution information;

[0075] Specifically, the formula for obtaining preliminary vulnerability distribution information is as follows:

[0076]

[0077] Among them, j(p) is the initial vulnerability distribution information distribution, p is the distribution probability, l i (p) is the fluctuation weight distribution of the i-th vulnerability security data information;

[0078] S3, collaboratively calculating the preliminary vulnerability distribution information and the system penetration test information in the security-related data to obtain the final vulnerability distribution information;

[0079] Furthermore, the collaborative computation process uses a conditional probability density function;

[0080] Specifically, the calculation formula for obtaining the final vulnerability distribution information is:

[0081]

[0082] Among them, π(p|y) is the probability density distribution curve of the final vulnerability distribution information of the system security vulnerability, y is the system penetration test information, and f(y|p) is the conditional probability density of y when p takes a certain value;

[0083] S4. Determine the security vulnerability assessment results of the information system based on the final vulnerability distribution information;

[0084] Further, the point with the maximum probability density value of the probability density distribution curve in the final vulnerability distribution information is determined as the security vulnerability assessment result of the information system;

[0085] Specifically, the point with the largest probability density value of the probability density distribution curve is the most likely security state of the system. By determining the security corresponding to the maximum point, the security vulnerability assessment result of the information system is obtained.

[0086] Furthermore, this embodiment also provides an information system security vulnerability assessment system, including:

[0087] The data acquisition and standardization processing module is configured to acquire security-related data of the information system, perform standardization processing on the module test information in the security-related data, and obtain corresponding standardized vulnerability test data;

[0088] The security vulnerability assessment module is configured to establish an expert weight threshold, perform a fusion assessment on vulnerability scanning data, standardized vulnerability test data, security expert opinions, and related system information in the security-related data, and obtain preliminary vulnerability distribution information;

[0089] A security vulnerability distribution processing module is configured to collaboratively calculate the preliminary vulnerability distribution information and the system penetration test information in the security association data to obtain final vulnerability distribution information;

[0090] The security vulnerability assessment result module is configured to determine the security vulnerability assessment result of the information system based on the final vulnerability distribution information.

[0091] This embodiment also provides a computer device, which is applicable to the information system security vulnerability assessment method, including:

[0092] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the information system security vulnerability assessment method proposed in the above embodiment.

[0093] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0094] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the information system security vulnerability assessment method proposed in the above embodiment is implemented.

[0095] The storage medium proposed in this embodiment and the data storage method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0096] Example 2

[0097] Reference Figure 2 , which is the second embodiment of the present invention, and this embodiment provides an information system security vulnerability assessment method, including: in order to verify the advantages of the information system vulnerability repair effect assessment method of the present invention, a simulation experiment is designed to cover multiple parameter dimensions, involving multiple system modules, and the present invention is used to compare with the prior art respectively;

[0098] The simulation experiment settings are as follows:

[0099] Test environment,The system runs in a virtualized cloud computing environment. The server configuration includes a dual-core processor, 8GB memory, 500GB hard disk storage, and the operating system is Linux; Vulnerability data source: Generate attack data by simulating user behavior, and obtain vulnerability data from system logs, vulnerability scanning tools (such as OpenVAS), and custom security testing tools;

[0100] With the test tools in the simulated experimental environment:

[0101] Existing technology testing tools use static analysis tools such as static code scanners and traditional vulnerability scanning tools;

[0102] Invent assessment tools, using the dynamic vulnerability assessment tool of the present invention, real-time dynamic assessment is performed by collecting multi-dimensional data (such as vulnerability scan results, module test information, security expert opinions, and related system data);

[0103] Simulation experiment steps:

[0104] Data collection: Perform vulnerability scans on each module during normal operation and stress testing, and record initial vulnerability data;

[0105] Vulnerability repair: During the system vulnerability repair process, record the data before and after the repair of each module, including the repair time, the number of vulnerabilities after repair, etc.

[0106] Dynamic evaluation: Use the method of the present invention to dynamically evaluate the vulnerability repair effect in real time and record the security score and performance data of the system after repair;

[0107] The experimental results are shown in Table 1.

[0108] Table 1

[0109]

[0110]

[0111] It can be seen from Table 1 that the present invention performs better than the traditional method in detecting the number of vulnerabilities. For example, module A detects 15 vulnerabilities in the traditional method, while it detects 12 vulnerabilities in the present invention. The present invention improves the accuracy of vulnerability detection by dynamically adjusting the repair process and standardizing the vulnerability assessment method.

[0112] In terms of remaining vulnerabilities after repair, the repair effect of the present invention is significantly better than that of the traditional method; module A still has 4 vulnerabilities after repair using the traditional method, while only 1 is left after using the method of the present invention; this shows that the present invention can handle and repair vulnerabilities more comprehensively and accurately, reducing the security risks of the system;

[0113] In terms of repair time, the method of the present invention significantly shortens the vulnerability repair time and improves the repair efficiency of the system; the repair time of module B is shortened from 48 hours of the traditional method to 32 hours, and the repair time of module C is shortened from 70 hours to 50 hours; the present invention reduces unnecessary repair steps by optimizing the repair process, and adjusts the weight threshold in real time, making the repair process more efficient;

[0114] In terms of dynamic adjustment of the repair threshold, the present invention introduces a dynamic repair threshold adjustment mechanism; for example, the repair threshold of module B in the present invention method is increased to 96%, while the traditional method is fixed at 85%; this enables the present invention to dynamically adjust the repair standard according to the actual situation during the vulnerability repair process, ensure the accuracy of the repair, and avoid excessive or insufficient repair;

[0115] The response time under system load is also a key indicator of the performance of the repaired system under high load conditions. Under system load, the response time of module A under the traditional method is 200 milliseconds, while the response time under the method of the present invention is only 120 milliseconds; the response time of module C is also reduced from 250 milliseconds to 150 milliseconds. The present invention effectively improves the stability and performance of the system under high load by dynamically adjusting the repair process and multi-dimensional data evaluation.

[0116] In terms of the security score after repair, the evaluation method of the present invention also shows obvious advantages in the security score after the system is repaired; the security score of module B is improved from 82 points of the traditional method to 97 points; this significant improvement reflects that the present invention can more comprehensively analyze the potential security risks of the system in the system security evaluation after the vulnerability is repaired, and ensure the repair effect through the dynamic fusion evaluation of multi-dimensional data;

[0117] Combination Figure 2 It can be seen that the method of the present invention significantly shortens the repair time in all modules while improving the security score; compared with traditional methods, the vulnerability repair assessment method of the present invention is not only more efficient in time, but also shows significant advantages in security and repair accuracy, and can better cope with complex information system security requirements, making the present invention more widely applicable in practical applications.

[0118] Those skilled in the art will appreciate that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program codes. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0119] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0122] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0123] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for assessing information system security vulnerabilities, characterized in that: include: Acquire security-related data of the information system, perform standardization on module test information in the security-related data, and obtain corresponding standardized vulnerability test data; Establish expert weight thresholds, conduct integrated evaluation of vulnerability scanning data, standardized vulnerability testing data, security expert opinions, and related system information in security-related data, and obtain preliminary vulnerability distribution information; Co-calculating the preliminary vulnerability distribution information and the system penetration test information in the security association data to obtain final vulnerability distribution information; Based on the final vulnerability distribution information, a security vulnerability assessment result of the information system is determined.

2. The information system security vulnerability assessment method according to claim 1, characterized in that: The security-related data includes: Vulnerability scanning data, module testing information, security expert opinions, associated system information and system penetration testing information; Among them, the vulnerability scanning data is the percentage rate of the number of vulnerabilities found in the vulnerability scan to the total number of scans, the module testing information is the percentage rate of the number of problems found in the module test to the total number of module test times, the security expert opinion is the normalized value from zero to one of the security expert's score, the associated system information is the percentage rate of the number of problems found in the associated system test to the total number of associated systems, and the system penetration testing information is the percentage rate of the number of system penetration passes to the total number of system penetration tests.

3. The information system security vulnerability assessment method according to claim 2, characterized in that: Standardize the module test information in the security-related data to obtain the corresponding standardized vulnerability test data, including: Preset a vulnerability standardization model, input module test information into the vulnerability standardization model, and output standardized vulnerability test data corresponding to the module test information through the vulnerability standardization model; Among them, the preset vulnerability standardization model is a fully connected neural network model, and the input process is to add randomly initialized fully connected neural network weights.

4. The information system security vulnerability assessment method according to claim 2 or 3, characterized in that: Also includes: Get module vulnerability data in module test information; The module vulnerability data includes: the total number of tests of each module and the number of successfully identified vulnerabilities, the total number of tests of the information system and the number of successfully identified vulnerabilities, and the actual number of vulnerabilities; Using the module vulnerability data, a neural network in a preset vulnerability standardization model is trained until the neural network converges, that is, all module vulnerability data reach a maximum value, and a vulnerability standardization model is obtained; Among them, the neural network training process includes the total number of module tests and the number of successfully identified vulnerabilities in the module vulnerability data and the total number of information system tests and the number of successfully identified vulnerabilities. The labels in the training are the actual number of vulnerabilities.

5. The information system security vulnerability assessment method according to claim 4, characterized in that: Establish expert weight thresholds, conduct integrated evaluation of vulnerability scanning data, standardized vulnerability test data, security expert opinions, and related system information in security-related data, and obtain preliminary vulnerability distribution information, including: Convert vulnerability scanning data, standardized vulnerability testing data, security expert opinions, and related system information into fluctuating weight distributions respectively; The probability mass function is used to perform a fusion evaluation on the fluctuation weight distribution to obtain preliminary vulnerability distribution information.

6. The information system security vulnerability assessment method according to claim 5, characterized in that: The preliminary vulnerability distribution information and the system penetration test information in the security association data are collaboratively calculated to obtain final vulnerability distribution information, including: The collaborative calculation process uses a conditional probability density function.

7. The information system security vulnerability assessment method according to claim 6, characterized in that: Based on the final vulnerability distribution information, determine the security vulnerability assessment results of the information system, including: The point with the largest probability density value on the probability density distribution curve in the final vulnerability distribution information is determined as the security vulnerability assessment result of the information system.

8. An information system security vulnerability assessment system, based on the information system security vulnerability assessment method according to any one of claims 1 to 7, characterized in that: include: The data acquisition and standardization processing module is configured to acquire security-related data of the information system, perform standardization processing on the module test information in the security-related data, and obtain corresponding standardized vulnerability test data; The security vulnerability assessment module is configured to establish an expert weight threshold, perform a fusion assessment on vulnerability scanning data, standardized vulnerability test data, security expert opinions, and related system information in the security-related data, and obtain preliminary vulnerability distribution information; A security vulnerability distribution processing module is configured to collaboratively calculate the preliminary vulnerability distribution information and the system penetration test information in the security association data to obtain final vulnerability distribution information; The security vulnerability assessment result module is configured to determine the security vulnerability assessment result of the information system based on the final vulnerability distribution information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images