Expandable network security risk checking method

Abstract

The invention discloses an expandable network security risk checking method, which relates to the technical field of network security, and comprises the following steps: establishing a network information collection mechanism, and collecting network information from each node of a target network; establishing a risk feature library, establishing an initialized feature library, storing feature information of common network security threats in the risk feature library in a classified manner, and establishing indexes and classification tags; extracting a network topological graph from the network topological information, and calculating a network scale evaluation value according to the network topological graph; and generating a troubleshooting strategy according to the network scale evaluation value. According to the method, the troubleshooting strategy is flexibly generated according to the network scale evaluation value, the method is suitable for networks of different scales and architectures, when the network scale changes, the troubleshooting strategy can be adjusted in time, the effectiveness of risk troubleshooting is ensured, and the limitation of a traditional method for specific network architecture design is effectively overcome.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a scalable network security risk investigation method. Background Art

[0002] With the rapid development of network technology, the network environment is becoming increasingly complex, and network security issues are emerging one after another. Enterprises, government agencies and individuals are facing a variety of security threats from network attacks, data leaks, malware, etc.

[0003] Traditional network security risk screening methods often have limitations. For example, they are designed for specific types of network architectures or security threats. When the network system is upgraded, new security risks emerge, or the network scale expands, it is difficult to effectively conduct comprehensive and accurate risk screening. Moreover, different network environments may require different screening strategies and parameters. Existing methods have obvious deficiencies in flexibility and scalability. Summary of the invention

[0004] In view of this, the present invention provides a scalable network security risk investigation method to solve the problems raised by the above background technology.

[0005] The purpose of the present invention can be achieved by the following technical solution: A scalable network security risk investigation method, characterized in that it includes the following steps:

[0006] S1: Establish a network information collection mechanism to collect network information from each node of the target network; the network information includes device hardware information, operating system and application information, network topology information, user and permission information;

[0007] S2: Establish a risk feature library, initialize the feature library, classify and store the feature information of common network security threats in the risk feature library, and establish indexes and classification labels;

[0008] S3: extract a network topology diagram from the network topology information, obtain the number of nodes, the number of links, the number of hierarchical structures and the ratio of key devices according to the network topology diagram, and calculate the network scale assessment value;

[0009] S4: Generate a troubleshooting strategy based on the network scale assessment value, set a small network scale threshold, and generate a small network response strategy when the network scale assessment value is less than or equal to the threshold; generate a large network response strategy when the network scale assessment value is greater than the threshold;

[0010] S5: Mark the network scale assessment value, number of nodes, number of links, number of hierarchical structures and proportion of key equipment in the network as network architecture information; set a variation range for any parameter in the network architecture information. If any parameter in the network architecture information is not within the set variation range, it indicates that the network environment has changed, and steps S3-S5 should be re-executed.

[0011] As a preferred implementation mode proposed by the present invention, based on step S2, a risk feature library is established, and the specific process is as follows:

[0012] S21: Initialize the establishment of a feature library, collect feature information of common network security threats, including feature codes of known viruses, communication modes of Trojan programs, and features of common network attack behaviors; set the feature code of the known virus to Cv = {c1, c2, ..., cm}, where ci represents the feature code fragment of the i-th virus, set the communication mode of the Trojan program to Tt = {t1, t2, ..., tn}, where tj represents the communication mode information of the j-th Trojan program, and set the features of common network attack behaviors to Aa = {a1, a2, ..., ap}, where ak represents the feature mode of the k-th attack behavior;

[0013] S22: Classify and store the feature information in a risk feature library, and create indexes and classification labels; among them, virus features can be classified according to virus families, Trojan program features can be classified according to their functions and propagation methods, and attack behavior features can be classified according to attack types.

[0014] As a preferred implementation mode proposed by the present invention, based on step S2, step S23 is also included: establishing a dynamic update mechanism for the risk feature library, specifically:

[0015] S31: Update from external intelligence sources, set an update time period, and regularly obtain security threat intelligence data from network security intelligence agencies according to the update time period; parse and extract risk feature information from security threat situation data, including virus signature codes, behavior patterns, and network traffic features;

[0016] S32: Use a string matching algorithm to match the risk feature information with the entries in the existing risk feature library:

[0017] For the virus signature code, calculate the similarity between the virus signature code and any signature code in the existing risk signature library, and the similarity is obtained by calculating the edit distance method; if the similarity between the virus signature code and any signature code is less than the preset similarity threshold, it means that the virus signature code is not very similar to the signature code in the risk signature library, then mark the virus signature code as the virus signature code to be updated; add the virus signature code to be updated to the Cv set;

[0018] For network traffic characteristics and behavior patterns, they are transformed into new regular expressions. The regular expressions are composed of several keywords and operators. A unique integer number is assigned to each keyword and operator. The new regular expression vector set is represented as Vne = [V n1 ,V n2 ,...,V ns ], obtain the regular expression vector set representation in the risk feature library The cosine similarity formula is used to calculate the existing regular expression set vector and the new regular expression set vector to obtain the new and old similarity cos(θ), which is expressed as: Wherein, s and q represent the number of dimensions corresponding to the new regular expression vector and the existing regular expression vector, respectively, and f represents the index variable corresponding to the number of the new regular expression vector and the existing regular expression vector;

[0019] The new regular expression is decomposed into a keyword vector and an operator vector, and different weights are assigned to different keywords and operators. The weight vectors of keywords and operators are marked as Wl = [W l1 ,W l2 ,...] and Wo=[W o1 ,W o2 ,...]; after weighting, the cosine similarity formula is used to calculate and process to obtain the weighted similarity, which is expressed as: Wherein, wf represents the corresponding weight value of the keyword or operator in the weight vector of the keyword and the operator;

[0020] The new and old similarities and the weighted similarities are compared with the preset similarity threshold. If any of the new and old similarities and the weighted similarities is less than the preset similarity threshold, the behavior pattern or network traffic feature represented by the new rule expression is marked as a feature to be updated; the feature to be updated is added to the Aa set;

[0021] Generate corresponding classification labels and indexes for the virus signature codes to be updated and the features to be updated.

[0022] As a preferred implementation mode proposed by the present invention, based on step S4, a troubleshooting strategy is generated according to the network scale evaluation value, specifically:

[0023] When generating a small network response strategy, trigger a comprehensive scanning strategy, including vulnerability scanning, network traffic monitoring, and security configuration checks on all nodes; set the time period for vulnerability scanning and network traffic monitoring, and perform security configuration checks while performing vulnerability scanning. Specifically:

[0024] Get each vulnerability found by the vulnerability scan, use the Common Vulnerability Scoring System to assess the priority of the vulnerability, obtain the basic metrics of the vulnerability, and calculate the CVSS score of the vulnerability based on the basic metrics of the vulnerability processed by the Common Vulnerability Scoring System; set risk vulnerability groups, including low-risk vulnerabilities, medium-risk vulnerabilities, and high-risk vulnerabilities; match the CVSS score of the vulnerability with the value range of the risk vulnerability group, so as to classify the vulnerability into low, medium, and high-risk vulnerabilities;

[0025] When generating a large network response strategy, the network area is divided into key areas and ordinary areas, and a deep investigation strategy for the key area and a basic investigation strategy for the ordinary area are generated. Specifically:

[0026] Divide the network into different areas and layers according to the network topology diagram, set a key area library, including several key area names; match the key area library with any area in the different areas divided by the network, mark the area with successful matching as a key area, and mark the area with failed matching as a common area; generate a deep investigation strategy for the key area, and generate a basic investigation strategy for the common area;

[0027] When generating a deep investigation strategy for key areas, use a variety of vulnerability scanning tools to perform vulnerability scanning on key areas and key devices, and obtain the vulnerabilities scanned by each tool and the risk assessment scores corresponding to the vulnerabilities; record the number of vulnerabilities scanned by each vulnerability scanning tool and mark it as the number of industrial scan vulnerabilities, and mark the vulnerability scanning tool with the largest number of industrial scan vulnerabilities as the preferred vulnerability scanning tool; match the vulnerabilities of the preferred vulnerability scanning tool with the vulnerabilities of the remaining vulnerability scanning tools one by one, and mark the vulnerabilities that do not match the preferred vulnerability scanning tool as unprocessed vulnerabilities; mark the vulnerability scanning tool with the largest number of unprocessed vulnerabilities as the secondary vulnerability scanning tool;

[0028] Use the preferred vulnerability scanning tool to repair the vulnerability. After repairing, use the preferred vulnerability scanning tool to repair the unresolved vulnerability. Repeat this process until the vulnerability is repaired. The various vulnerability scanning tools include Nessus, OpenVAS or Microsoft Baseline Security Analyze vulnerability scanning tools.

[0029] When generating a basic troubleshooting strategy for a common area, a small network response strategy is used for processing.

[0030] As a preferred implementation mode proposed by the present invention, based on step S3, the network scale evaluation value is calculated according to the network topology diagram, specifically:

[0031] S31: Obtain the number of elements of the vertex set V in the network topology graph G and mark it as the number of nodes N, that is, N=|V|; obtain the number of elements of the edge set E in the network topology graph G and mark it as the number of links L, that is, L=|E|;

[0032] S32: Determine the number C of hierarchical structures of the network by analyzing the subnet division and device distribution at different levels in the network topology;

[0033] S33: Set a key device name library, where key devices include core servers, routers, firewalls, etc.; count the application devices in the network topology information, match the application devices with the key device name library, and mark the successfully matched application devices as application key devices; record the number of application key devices and mark it as the number of key devices; divide the number of key devices by the total number of application devices to obtain the ratio of key devices in the network, indicating PE;

[0034] S34: Perform weighted calculation on the number of nodes, the number of links, the number of hierarchical structures and the proportion of key equipment in the network to obtain the network scale assessment value PG, which is expressed by the formula: PG=N×g1+L×g2+C×g3+PE×g4; wherein g1, g2, g3, and g4 respectively represent the weights corresponding to the number of nodes, the number of links, the number of hierarchical structures and the proportion of key equipment in the network.

[0035] As a preferred implementation mode proposed by the present invention, after step S4, step S6 is further included, namely, a risk tracking mechanism, specifically:

[0036] S61: Establish a risk database to record the status of each vulnerability, D = {x1, x2, x3}, where x1, x2, and x3 represent unprocessed, processed, and fixed, respectively;

[0037] S62: Continuously monitor the unprocessed and processed vulnerabilities, re-check the unprocessed and processed vulnerabilities according to the set vulnerability checking cycle, calculate the time difference between the generation time of the unprocessed and processed vulnerabilities and the current time to obtain the unprocessed time and the processing time; use the general vulnerability score to obtain the risk assessment score of the vulnerability, and perform weighted processing on the risk assessment score of the vulnerability and its corresponding unprocessed time or processing time to obtain the vulnerability processing delay value;

[0038] S63: Setting a processing delay threshold, comparing the processing delay value of each vulnerability with the processing delay threshold, if the vulnerability processing delay value is greater than the processing delay threshold, indicating that the vulnerability is in a delayed processing state, triggering an early warning mechanism; sending an alarm message to the network administrator, the alarm message includes the vulnerability name, location, risk assessment score, and unprocessed time or excessively long processing time of the vulnerability;

[0039] S64: The network administrator prioritizes the delayed vulnerabilities according to the alarm information, records the processing steps and results, updates the vulnerability status in the risk database to being processed or fixed, and re-executes steps S62 and S63.

[0040] As a preferred implementation mode proposed by the present invention, in step S1, the network information collection mechanism adopts a distributed collection method, deploys a lightweight collection agent program on each node, and the collection agent program transmits the collected network information to the central management server through an encrypted channel.

[0041] As a preferred implementation mode proposed by the present invention, in step S22, the index of the risk feature library adopts a hash index structure, the classification label uses a multi-level classification system, and the virus features are classified into multiple levels according to family, variant, and degree of harm.

[0042] After the risk feature database is established in step S2, the risk feature database is optimized and sorted regularly. The specific steps are as follows:

[0043] Obtain the generation time of any feature information in the risk feature database, and calculate the time difference between the generation time of the feature information and the current time to obtain the feature generation duration;

[0044] Record the intelligence source of each risk characteristic information, set up a source scoring database, including the reliability scores of several intelligence sources; match the intelligence source of the risk characteristic information with the source scoring database to obtain the reliability score corresponding to the risk characteristic information;

[0045] The number of matches of each risk feature information in the actual investigation process is recorded as the risk matching number; the feature generation time, reliability score, and risk matching number are weighted to obtain the risk feature assessment value; a risk expiration assessment threshold is set. If the risk feature assessment value is less than its risk expiration assessment threshold, it means that the risk feature information is expired or no longer applicable, and the risk feature information is deleted from the risk feature library.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] 1. The present invention flexibly generates troubleshooting strategies based on network scale assessment values, which are applicable to networks of different scales and architectures. When the network scale changes, the troubleshooting strategies can be adjusted in a timely manner to ensure the effectiveness of risk troubleshooting, effectively overcoming the limitations of traditional methods designed for specific network architectures.

[0048] 2. The present invention can obtain security threat intelligence data from external intelligence sources in real time through the dynamic update mechanism of the risk feature library. Through accurate matching and marking with the existing risk feature library, it can quickly include newly emerging virus signature codes, behavior patterns and network traffic characteristics into the monitoring scope, and timely update the risk feature library, thereby accurately identifying new network security threats, making up for the defect that traditional methods are difficult to deal with new security risks.

[0049] In summary, the present invention can quickly adapt to changes in a complex and ever-changing network environment, accurately identify and handle risks, reduce the risks of business interruption, data leakage, etc. caused by network security issues, more efficiently manage network security, reduce security management costs, improve the reliability and security of network operations, and ensure the normal development of business. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Further details, features and advantages of the present application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0051] Figure 1 This is a flowchart of a scalable network security risk investigation method proposed by the present invention. DETAILED DESCRIPTION

[0052] Several embodiments of the present application will be described in more detail below with reference to the accompanying drawings so that those skilled in the art can implement the present application. The present application can be embodied in many different forms and purposes and should not be limited to the embodiments described herein. These embodiments are provided to make the present application comprehensive and complete, and to fully convey the scope of the present application to those skilled in the art. The embodiments do not limit the present application.

[0053] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and / or this specification, and will not be interpreted in an idealized or overly formal sense, unless explicitly defined as such herein.

[0054] See also Figure 1 As shown, a scalable network security risk investigation method includes the following steps:

[0055] S1: Establish a network information collection mechanism to collect network information from each node of the target network; the network information includes the hardware information of the device, operating system and application information, network topology information, user and permission information, and each node includes servers, terminal devices, network devices, etc.;

[0056] S2: Establish a risk feature library, initialize the feature library, classify and store the feature information of common network security threats in the risk feature library, and establish indexes and classification labels;

[0057] S3: extract a network topology representation G = (V, E) from the network topology information, obtain the number of nodes, the number of links, the number of hierarchical structures and the ratio of key devices according to the network topology, and calculate the network scale assessment value;

[0058] S4: Generate a troubleshooting strategy based on the network scale assessment value, set a small network scale threshold, and generate a small network response strategy when the network scale assessment value is less than or equal to the threshold; generate a large network response strategy when the network scale assessment value is greater than the threshold;

[0059] S5: Mark the network scale assessment value, number of nodes, number of links, number of hierarchical structures and proportion of key equipment in the network as network architecture information; set a variation range for any parameter in the network architecture information. If any parameter in the network architecture information is not within the set variation range, it indicates that the network environment has changed, and steps S3-S5 should be re-executed.

[0060] In this application, based on step S2, a risk feature library is established, and the specific process is as follows:

[0061] S21: Initialize the establishment of a feature library, collect feature information of common network security threats, including feature codes of known viruses, communication modes of Trojan programs, and features of common network attack behaviors; set the feature code of the known virus to Cv = {c1, c2, ..., cm}, where ci represents the feature code fragment of the i-th virus, set the communication mode of the Trojan program to Tt = {t1, t2, ..., tn}, where tj represents the communication mode information of the j-th Trojan program, and set the features of common network attack behaviors to Aa = {a1, a2, ..., ap}, where ak represents the feature mode of the k-th attack behavior;

[0062] S22: Classify and store the feature information in a risk feature library, and create indexes and classification labels; among them, virus features can be classified according to virus families, Trojan program features can be classified according to their functions and propagation methods, and attack behavior features can be classified according to attack types.

[0063] In the present application, based on step S2, step S23 is also included: establishing a dynamic update mechanism for the risk feature library, specifically:

[0064] S31: Update from external intelligence sources, set an update time period, and regularly obtain security threat intelligence data from network security intelligence agencies according to the update time period; parse and extract risk feature information from security threat situation data, including virus signature codes, behavior patterns, and network traffic features;

[0065] S32: Use a string matching algorithm to match the risk feature information with the entries in the existing risk feature library:

[0066] For the virus signature code, calculate the similarity between the virus signature code and any signature code in the existing risk signature library, and the similarity is obtained by calculating the edit distance method; if the similarity between the virus signature code and any signature code is less than the preset similarity threshold, it means that the virus signature code is not very similar to the signature code in the risk signature library, then mark the virus signature code as the virus signature code to be updated; add the virus signature code to be updated to the Cv set;

[0067] For network traffic characteristics and behavior patterns, they are transformed into new regular expressions. The regular expressions are composed of several keywords and operators. A unique integer number is assigned to each keyword and operator. The new regular expression vector set is represented as Vne = [V n1 ,V n2 ,...,V ns ], obtain the regular expression vector set representation in the risk feature library The cosine similarity formula is used to calculate the existing regular expression set vector and the new regular expression set vector to obtain the new and old similarity cos(θ), which is expressed as: Wherein, s and q represent the number of dimensions corresponding to the new regular expression vector and the existing regular expression vector, respectively, and f represents the index variable corresponding to the number of the new regular expression vector and the existing regular expression vector;

[0068] The new regular expression is decomposed into a keyword vector and an operator vector, and different weights are assigned to different keywords and operators. The weight vectors of keywords and operators are marked as Wl = [W l1 ,W l2 ,...] and Wo=[W o1 ,W o2 ,...]; after weighting, the cosine similarity formula is used to calculate and process to obtain the weighted similarity, which is expressed as: Wherein, wf represents the corresponding weight value of the keyword or operator in the weight vector of the keyword and the operator;

[0069] The new and old similarities and the weighted similarities are compared with the preset similarity threshold. If any of the new and old similarities and the weighted similarities is less than the preset similarity threshold, the behavior pattern or network traffic feature represented by the new rule expression is marked as a feature to be updated; the feature to be updated is added to the Aa set;

[0070] Generate corresponding classification labels and indexes for the virus signature codes to be updated and the features to be updated.

[0071] In this application, based on step S4, a troubleshooting strategy is generated according to the network scale assessment value, specifically:

[0072] When generating a small network response strategy, trigger a comprehensive scanning strategy, including vulnerability scanning, network traffic monitoring, and security configuration checks on all nodes; set the time period for vulnerability scanning and network traffic monitoring, and perform security configuration checks while performing vulnerability scanning. Specifically:

[0073] Get each vulnerability found by the vulnerability scan, use the Common Vulnerability Scoring System to assess the priority of the vulnerability, obtain the basic metrics of the vulnerability, and calculate the CVSS score of the vulnerability based on the basic metrics of the vulnerability processed by the Common Vulnerability Scoring System; set risk vulnerability groups, including low-risk vulnerabilities, medium-risk vulnerabilities, and high-risk vulnerabilities; match the CVSS score of the vulnerability with the value range of the risk vulnerability group, so as to classify the vulnerability into low, medium, and high-risk vulnerabilities;

[0074] When generating a large network response strategy, the network area is divided into key areas and ordinary areas, and a deep investigation strategy for the key areas and a basic investigation strategy for the ordinary areas are generated. Specifically:

[0075] Divide the network into different areas and layers according to the network topology diagram, set a key area library, including several key area names; match the key area library with any area in the different areas divided by the network, mark the area with successful matching as a key area, and mark the area with failed matching as a common area; generate a deep investigation strategy for the key area, and generate a basic investigation strategy for the common area;

[0076] When generating a deep investigation strategy for key areas, use a variety of vulnerability scanning tools to perform vulnerability scanning on key areas and key devices, and obtain the vulnerabilities scanned by each tool and the risk assessment scores corresponding to the vulnerabilities; record the number of vulnerabilities scanned by each vulnerability scanning tool and mark it as the number of industrial scan vulnerabilities, and mark the vulnerability scanning tool with the largest number of industrial scan vulnerabilities as the preferred vulnerability scanning tool; match the vulnerabilities of the preferred vulnerability scanning tool with the vulnerabilities of the remaining vulnerability scanning tools one by one, and mark the vulnerabilities that do not match the preferred vulnerability scanning tool as unprocessed vulnerabilities; mark the vulnerability scanning tool with the largest number of unprocessed vulnerabilities as the secondary vulnerability scanning tool;

[0077] Use the preferred vulnerability scanning tool to repair the vulnerability. After the repair, use the preferred vulnerability scanning tool to repair the unresolved vulnerability. Repeat this process until the vulnerability is repaired. The various vulnerability scanning tools include but are not limited to Nessus, OpenVAS or Microsoft Baseline Security Analyze vulnerability scanning tools. The specific vulnerability scanning tool is set according to the actual situation.

[0078] When generating a basic troubleshooting strategy for a common area, a small network response strategy is used for processing.

[0079] In this application, based on step S3, the network scale assessment value is calculated according to the network topology diagram, specifically:

[0080] S31: Obtain the number of elements of the vertex set V in the network topology graph G and mark it as the number of nodes N, that is, N=|V|; obtain the number of elements of the edge set E in the network topology graph G and mark it as the number of links L, that is, L=|E|;

[0081] S32: Determine the number C of hierarchical structures of the network by analyzing the subnet division and device distribution at different levels in the network topology;

[0082] S33: Set a key device name library, where key devices include core servers, routers, firewalls, etc.; count the application devices in the network topology information, match the application devices with the key device name library, and mark the successfully matched application devices as application key devices; record the number of application key devices and mark it as the number of key devices; divide the number of key devices by the total number of application devices to obtain the ratio of key devices in the network, indicating PE;

[0083] S34: Perform weighted calculation on the number of nodes, the number of links, the number of hierarchical structures and the proportion of key equipment in the network to obtain the network scale assessment value PG, which is expressed by the formula: PG=N×g1+L×g2+C×g3+PE×g4; wherein g1, g2, g3, and g4 respectively represent the weights corresponding to the number of nodes, the number of links, the number of hierarchical structures and the proportion of key equipment in the network.

[0084] In this application, after step S4, step S6 is also included, which is a risk tracking mechanism. Specifically:

[0085] S61: Establish a risk database to record the status of each vulnerability, D = {x1, x2, x3}, where x1, x2, and x3 represent unprocessed, processed, and fixed, respectively;

[0086] S62: Continuously monitor the unprocessed and processed vulnerabilities, re-check the unprocessed and processed vulnerabilities according to the set vulnerability checking cycle, calculate the time difference between the generation time of the unprocessed and processed vulnerabilities and the current time to obtain the unprocessed time and the processing time; use the general vulnerability score to obtain the risk assessment score of the vulnerability, and perform weighted processing on the risk assessment score of the vulnerability and its corresponding unprocessed time or processing time to obtain the vulnerability processing delay value;

[0087] S63: Setting a processing delay threshold, comparing the processing delay value of each vulnerability with the processing delay threshold, if the vulnerability processing delay value is greater than the processing delay threshold, indicating that the vulnerability is in a delayed processing state, triggering an early warning mechanism; sending an alarm message to the network administrator, the alarm message includes the vulnerability name, location, risk assessment score, and unprocessed time or excessively long processing time of the vulnerability;

[0088] S64: The network administrator prioritizes the delayed vulnerabilities according to the alarm information, records the processing steps and results, updates the vulnerability status in the risk database to being processed or fixed, and re-executes steps S62 and S63.

[0089] In the present application, in step S1, the network information collection mechanism adopts a distributed collection method, deploys a lightweight collection agent on each node, and the collection agent transmits the collected network information to the central management server through an encrypted channel.

[0090] In the present application, in step S22, the index of the risk feature library adopts a hash index structure, the classification label uses a multi-level classification system, and the virus features are classified into multiple levels according to family, variant, and degree of harm.

[0091] In this application, after the risk feature library is established in step S2, the risk feature library is optimized and sorted regularly. The specific steps are:

[0092] Obtain the generation time of any feature information in the risk feature database, and calculate the time difference between the generation time of the feature information and the current time to obtain the feature generation duration;

[0093] Record the intelligence source of each risk characteristic information, set up a source scoring database, including the reliability scores of several intelligence sources; match the intelligence source of the risk characteristic information with the source scoring database to obtain the reliability score corresponding to the risk characteristic information;

[0094] The number of matches of each risk feature information in the actual investigation process is recorded as the risk matching number; the feature generation time, reliability score, and risk matching number are weighted to obtain the risk feature assessment value; a risk expiration assessment threshold is set. If the risk feature assessment value is less than its risk expiration assessment threshold, it means that the risk feature information is expired or no longer applicable, and the risk feature information is deleted from the risk feature library.

[0095] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A scalable network security risk investigation method, characterized in that: The following steps are involved: S1: Establish a network information collection mechanism to collect network information from each node of the target network; the network information includes device hardware information, operating system and application information, network topology information, user and permission information; S2: Establish a risk feature library, initialize the feature library, classify and store the feature information of common network security threats in the risk feature library, and establish indexes and classification labels; S3: extract a network topology diagram from the network topology information, obtain the number of nodes, the number of links, the number of hierarchical structures and the ratio of key devices according to the network topology diagram, and calculate the network scale assessment value; S4: Generate a troubleshooting strategy based on the network scale assessment value, set a small network scale threshold, and generate a small network response strategy when the network scale assessment value is less than or equal to the threshold; generate a large network response strategy when the network scale assessment value is greater than the threshold; S5: marking the network scale assessment value, the number of nodes, the number of links, the number of hierarchical structures, and the ratio of key devices in the network as network architecture information; A variation range is set for any parameter in the network architecture information. If any parameter in the network architecture information is not within the set variation range, it indicates that the network environment has changed, and steps S3-S5 are re-executed.

2. According to the scalable network security risk investigation method of claim 1, it is characterized in that: Based on step S2, a risk feature library is established. The specific process is as follows: S21: Initialize the establishment of a feature library, collect feature information of common network security threats, including feature codes of known viruses, communication modes of Trojan programs, and features of common network attack behaviors; set the feature code of the known virus to Cv = {c1, c2, ..., cm}, where ci represents the feature code fragment of the i-th virus, set the communication mode of the Trojan program to Tt = {t1, t2, ..., tn}, where tj represents the communication mode information of the j-th Trojan program, and set the features of common network attack behaviors to Aa = {a1, a2, ..., ap}, where ak represents the feature mode of the k-th attack behavior; S22: Classify and store the feature information in a risk feature library, and create indexes and classification labels; among them, virus features can be classified according to virus families, Trojan program features can be classified according to their functions and propagation methods, and attack behavior features can be classified according to attack types.

3. According to claim 2, a scalable network security risk investigation method is characterized in that: Based on step S2, the method further includes step S23: establishing a dynamic update mechanism for the risk feature library, specifically: S31: Update from external intelligence sources, set an update time period, and regularly obtain security threat intelligence data from network security intelligence agencies according to the update time period; parse and extract risk feature information from security threat situation data, including virus signature codes, behavior patterns, and network traffic features; S32: Use a string matching algorithm to match the risk feature information with the entries in the existing risk feature library: For the virus signature code, calculate the similarity between the virus signature code and any signature code in the existing risk signature library, and the similarity is obtained by calculating the edit distance method; if the similarity between the virus signature code and any signature code is less than the preset similarity threshold, it means that the virus signature code is not very similar to the signature code in the risk signature library, then mark the virus signature code as the virus signature code to be updated; add the virus signature code to be updated to the Cv set; For network traffic characteristics and behavior patterns, they are transformed into new regular expressions. The regular expressions are composed of several keywords and operators. A unique integer number is assigned to each keyword and operator. The new regular expression vector set is represented as Vne = [V n1 ,V n2 ,...,V ns ], obtain the regular expression vector set representation in the risk feature library The cosine similarity formula is used to calculate the existing regular expression set vector and the new regular expression set vector to obtain the new and old similarity cos(θ), which is expressed as: Wherein, s and q represent the number of dimensions corresponding to the new regular expression vector and the existing regular expression vector, respectively, and f represents the index variable corresponding to the number of the new regular expression vector and the existing regular expression vector; The new regular expression is decomposed into a keyword vector and an operator vector, and different weights are assigned to different keywords and operators. The weight vectors of keywords and operators are marked as Wl = [W l1 ,W l2 ,...] and Wo=[W o1 ,W o2 ,...]; after weighting, the cosine similarity formula is used to calculate and process to obtain the weighted similarity, which is expressed as: Wherein, wf represents the corresponding weight value of the keyword or operator in the weight vector of the keyword and the operator; The new and old similarities and the weighted similarities are compared with the preset similarity threshold. If any of the new and old similarities and the weighted similarities is less than the preset similarity threshold, the behavior pattern or network traffic feature represented by the new rule expression is marked as a feature to be updated; the feature to be updated is added to the Aa set; Generate corresponding classification labels and indexes for the virus signature codes to be updated and the features to be updated.

4. According to claim 1, a scalable network security risk investigation method is characterized in that: Based on step S4, a troubleshooting strategy is generated according to the network scale assessment value, specifically: When generating a small network response strategy, trigger a comprehensive scanning strategy, including vulnerability scanning, network traffic monitoring, and security configuration checks on all nodes; set the time period for vulnerability scanning and network traffic monitoring, and perform security configuration checks while performing vulnerability scanning. Specifically: Get each vulnerability found by the vulnerability scan, use the Common Vulnerability Scoring System to assess the priority of the vulnerability, obtain the basic metrics of the vulnerability, and calculate the CVSS score of the vulnerability based on the basic metrics of the vulnerability processed by the Common Vulnerability Scoring System; Set risk vulnerability groups, including low-risk vulnerabilities, medium-risk vulnerabilities, and high-risk vulnerabilities; Match the CVSS score of the vulnerability with the value range of the risk vulnerability group to classify the vulnerability into low, medium, and high risk vulnerabilities; When generating a large network response strategy, the network area is divided into key areas and ordinary areas, and a deep investigation strategy for the key areas and a basic investigation strategy for the ordinary areas are generated. Specifically: Divide the network into different areas and layers according to the network topology diagram, set a key area library, including several key area names; match the key area library with any area in the different areas divided by the network, mark the area with successful matching as a key area, and mark the area with failed matching as a common area; generate a deep investigation strategy for the key area, and generate a basic investigation strategy for the common area; When generating a deep investigation strategy for key areas, use a variety of vulnerability scanning tools to perform vulnerability scanning on key areas and key devices, and obtain the vulnerabilities scanned by each tool and the risk assessment scores corresponding to the vulnerabilities; record the number of vulnerabilities scanned by each vulnerability scanning tool and mark it as the number of industrial scan vulnerabilities, and mark the vulnerability scanning tool with the largest number of industrial scan vulnerabilities as the preferred vulnerability scanning tool; match the vulnerabilities of the preferred vulnerability scanning tool with the vulnerabilities of the remaining vulnerability scanning tools one by one, and mark the vulnerabilities that do not match the preferred vulnerability scanning tool as unprocessed vulnerabilities; mark the vulnerability scanning tool with the largest number of unprocessed vulnerabilities as the secondary vulnerability scanning tool; Use the preferred vulnerability scanning tool to repair the vulnerability. After repairing, use the preferred vulnerability scanning tool to repair the unresolved vulnerability. Repeat this process until the vulnerability is repaired. The various vulnerability scanning tools include Nessus, OpenVAS or Microsoft Baseline Security Analyze vulnerability scanning tools. When generating a basic troubleshooting strategy for a common area, a small network response strategy is used for processing.

5. The scalable network security risk investigation method according to claim 1 is characterized in that: Based on step S3, the network scale assessment value is calculated according to the network topology diagram, specifically: S31: Obtain the number of elements of the vertex set V in the network topology graph G and mark it as the number of nodes N, that is, N=|V|; obtain the number of elements of the edge set E in the network topology graph G and mark it as the number of links L, that is, L=|E|; S32: Determine the number C of hierarchical structures of the network by analyzing the subnet division and device distribution at different levels in the network topology; S33: Set a key device name library, where the key devices include core servers, routers, and firewalls; count the application devices in the network topology information, match the application devices with the key device name library, and mark the successfully matched application devices as application key devices; record the number of application key devices and mark it as the number of key devices; divide the number of key devices by the total number of application devices to obtain the ratio of key devices in the network, indicating PE; S34: Perform weighted calculation on the number of nodes, the number of links, the number of hierarchical structures and the proportion of key equipment in the network to obtain the network scale assessment value PG, which is expressed by the formula: PG=N×g1+L×g2+C×g3+PE×g4; wherein g1, g2, g3, and g4 respectively represent the weights corresponding to the number of nodes, the number of links, the number of hierarchical structures and the proportion of key equipment in the network.

6. The scalable network security risk investigation method according to claim 1 is characterized in that: After step S4, step S6 is also included, risk tracking mechanism, specifically: S61: Establish a risk database to record the status of each vulnerability, D = {x1, x2, x3}, where x1, x2, and x3 represent unprocessed, processed, and fixed, respectively; S62: Continuously monitor the unprocessed and processed vulnerabilities, re-check the unprocessed and processed vulnerabilities according to the set vulnerability checking cycle, calculate the time difference between the generation time of the unprocessed and processed vulnerabilities and the current time to obtain the unprocessed time and the processing time; use the general vulnerability score to obtain the risk assessment score of the vulnerability, and perform weighted processing on the risk assessment score of the vulnerability and its corresponding unprocessed time or processing time to obtain the vulnerability processing delay value; S63: Setting a processing delay threshold, comparing the processing delay value of each vulnerability with the processing delay threshold, if the vulnerability processing delay value is greater than the processing delay threshold, indicating that the vulnerability is in a delayed processing state, triggering an early warning mechanism; sending an alarm message to the network administrator, the alarm message includes the vulnerability name, location, risk assessment score, and unprocessed time or excessively long processing time of the vulnerability; S64: The network administrator prioritizes the delayed vulnerabilities according to the alarm information, records the processing steps and results, updates the vulnerability status in the risk database to being processed or fixed, and re-executes steps S62 and S63.

7. The scalable network security risk investigation method according to claim 1 is characterized in that: In step S1, the network information collection mechanism adopts a distributed collection method, deploys a lightweight collection agent on each node, and the collection agent transmits the collected network information to the central management server through an encrypted channel.

8. The scalable network security risk investigation method according to claim 2 is characterized in that: In step S22, the index of the risk feature library adopts a hash index structure, the classification label uses a multi-level classification system, and the virus features are classified into multiple levels according to family, variant, and degree of harm.

9. The scalable network security risk investigation method according to claim 1 is characterized in that: After the risk feature database is established in step S2, the risk feature database is optimized and sorted regularly. The specific steps are as follows: Obtain the generation time of any feature information in the risk feature database, and calculate the time difference between the generation time of the feature information and the current time to obtain the feature generation duration; Record the intelligence source of each risk characteristic information, set up a source scoring database, including the reliability scores of several intelligence sources; match the intelligence source of the risk characteristic information with the source scoring database to obtain the reliability score corresponding to the risk characteristic information; The number of matches of each risk feature information in the actual screening process is recorded as the number of risk matches; The risk feature is obtained by weighting the feature generation time, reliability score, and risk matching times. Assessment value; Set the risk expiration assessment threshold. If the risk feature assessment value is less than its risk expiration assessment threshold, Indicates that the risk feature information is expired or no longer applicable, and the risk feature information is deleted from the risk feature library.

Images