Extensible network security risk checking method

Abstract

The application discloses a scalable network security risk checking method, and relates to the technical field of network security, and comprises the following steps: establishing a network information collection mechanism to collect network information from each node of a target network; establishing a risk feature library, initializing the feature library, storing feature information of common network security threats in the risk feature library in a classified manner, and establishing indexes and classification labels; extracting a network topology graph from network topology information, calculating a network scale evaluation value according to the network topology graph; and generating a checking strategy according to the network scale evaluation value. The application flexibly generates a checking strategy according to a network scale evaluation value, is suitable for networks of different scales and architectures, can timely adjust the checking strategy when the network scale changes, ensures the effectiveness of risk checking, and effectively overcomes the limitations of traditional methods designed for specific network architectures.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a scalable network security risk assessment method. Background Technology

[0002] With the rapid development of network technology, the network environment is becoming increasingly complex, and network security problems are emerging one after another. Enterprises, government agencies, and individuals all face a variety of security threats, including cyberattacks, data breaches, and malware.

[0003] Traditional network security risk assessment methods often have limitations. For example, they are designed for specific types of network architectures or security threats. When network systems are upgraded, new security risks emerge, or the network scale expands, it is difficult to conduct comprehensive and accurate risk assessments effectively. Moreover, different network environments may require different assessment strategies and parameters, and existing methods are clearly insufficient in terms of flexibility and scalability. Summary of the Invention

[0004] In view of this, the present invention provides an scalable network security risk assessment method to solve the problems mentioned in the background art.

[0005] The objective of this invention can be achieved through the following technical solution: a scalable network security risk assessment method, characterized by comprising the following steps:

[0006] S1: Establish a network information collection mechanism to collect network information from various nodes of the target network; the network information includes device hardware information, operating system and application information, network topology information, user and permission information;

[0007] S2: Establish a risk signature database, initialize the signature database, classify and store the signature information of common cybersecurity threats in the risk signature database, and establish an index and classification labels;

[0008] S3: Extract the network topology map from the network topology information, obtain the number of nodes, links, hierarchical structure and proportion of key devices based on the network topology map, and calculate the network scale assessment value.

[0009] S4: Generate investigation strategies based on network size assessment values, set a small network size threshold, generate a small network response strategy when the network size assessment value is less than or equal to the threshold, and generate a large network response strategy when the network size assessment value is greater than the threshold.

[0010] S5: Mark the network scale assessment value, number of nodes, number of links, number of hierarchical structures and proportion of key equipment in the network as network architecture information; set the range of change for any parameter in the network architecture information. If any parameter in the network architecture information is not within its set range of change, it indicates that the network environment has changed, and steps S3-S5 are executed again.

[0011] As a preferred embodiment of the present invention, a risk feature database is established based on step S2, and the specific process is as follows:

[0012] S21: Initialize the signature database and collect characteristic information of common network security threats, including the signatures of known viruses, the communication patterns of Trojan programs, and the characteristics of common network attack behaviors; set the signatures of known viruses as Cv={c1,c2,...,cm}, where ci represents the signature fragment of the i-th virus, set the communication patterns of Trojan programs as Tt={t1,t2,...,tn}, where tj represents the communication pattern information of the j-th Trojan program, and set the characteristics of common network attack behaviors as Aa={a1,a2,...,ap}, where ak represents the characteristic pattern of the k-th attack behavior;

[0013] S22: Classify and store the feature information in the risk feature database, and establish indexes and classification labels; among them, virus features can be classified according to virus families, Trojan program features can be classified according to their functions and propagation methods, and attack behavior features can be classified according to attack types.

[0014] As a preferred embodiment of the present invention, based on step S2, step S23 is further included: establishing a dynamic update mechanism for the risk feature database, specifically as follows:

[0015] S31: Update from external intelligence sources, set update time cycles, and periodically obtain security threat intelligence data from cybersecurity intelligence agencies according to the update time cycles; analyze and extract risk characteristic information from security threat data, including virus signatures, behavioral patterns, and network traffic characteristics;

[0016] S32: Use a string matching algorithm to match the risk feature information with entries in the existing risk feature database.

[0017] For a virus signature, the similarity between the virus signature and any signature in the existing risk signature database is calculated. The similarity is obtained by calculating the edit distance. If the similarity between the virus signature and any signature is less than its preset similarity threshold, it means that the virus signature is not very similar to the signature in the risk signature database. In this case, the virus signature is marked as a virus signature to be updated. The virus signature to be updated is added to the Cv set.

[0018] Network traffic characteristics and behavior patterns are transformed into new rule expressions. Each rule expression consists of several keywords and operators, with each keyword and operator assigned a unique integer number. The new rule expression vector set is represented as Vne = [V n1 V n2 ,...,V ns [This refers to obtaining a set of rule expression vectors from the risk feature database.] The existing set of regular expression vectors and the new set of regular expression vectors are processed using the cosine similarity formula to obtain the old and new similarity cos(θ), which is expressed as: Where s and q represent the number of dimensions corresponding to the new rule expression vector and the existing rule expression vector, respectively, and f represents the index variable corresponding to the number of the new rule expression vector and the existing rule expression vector.

[0019] The new rule expression is decomposed into keyword vectors and operator vectors. Different weights are assigned to different keywords and operators, and the weight vectors of keywords and operators are labeled as Wl=[W l1 W l2 ,...] and Wo=[W o1 W o2 [,...]; After weighting them, the cosine similarity formula is used to calculate the weighted similarity, which is expressed as: Where wf represents the value of the corresponding weight of the keyword or operator in the weight vector of the keyword and operator;

[0020] Both the new and old similarity and the weighted similarity are compared with the preset similarity threshold. If either the new and old similarity or the weighted similarity is less than the preset similarity threshold, the behavior pattern or network traffic feature represented by the new rule expression is marked as a feature to be updated; the feature to be updated is added to the Aa set.

[0021] Generate corresponding classification labels and indexes for the virus signature codes to be updated and the features to be updated.

[0022] As a preferred embodiment of the present invention, based on step S4, a troubleshooting strategy is generated according to the network size assessment value, specifically:

[0023] The system generates a small-scale network response strategy, triggering a comprehensive scan, including vulnerability scanning, network traffic monitoring, and security configuration checks on all nodes. It sets the time intervals for vulnerability scanning and network traffic monitoring, and performs security configuration checks concurrently with vulnerability scanning. Specifically:

[0024] For each vulnerability identified by the vulnerability scan, the priority of the vulnerability is evaluated using a general vulnerability scoring system. The basic metrics of the vulnerability are obtained, and the CVSS score of the vulnerability is calculated based on the basic metrics of the general vulnerability scoring system. Risk vulnerability groups are set up, including low-risk, medium-risk, and high-risk vulnerabilities. The CVSS score of the vulnerability is matched with the value range of the risk vulnerability group to classify the vulnerability into low, medium, and high-risk vulnerabilities.

[0025] The large-scale network response strategy is generated, triggering the division of the network area into critical and ordinary areas, and generating in-depth investigation strategies for critical areas and basic investigation strategies for ordinary areas. Specifically:

[0026] The network is divided into different regions and layers based on the network topology diagram. A key region database is set, including several key region names. The key region database is matched with any region in the different regions of the network. Regions that match successfully are marked as key regions, and regions that do not match are marked as ordinary regions. In-depth investigation strategies are generated for key regions, and basic investigation strategies are generated for ordinary regions.

[0027] When generating a deep investigation strategy for critical areas, multiple vulnerability scanning tools are used to scan critical areas and critical devices to obtain vulnerabilities detected by each tool and their corresponding risk assessment scores. The number of vulnerabilities detected by each vulnerability scanning tool is recorded and marked as the number of vulnerabilities detected by the "manual scan". The vulnerability scanning tool with the largest number of vulnerabilities detected by the "manual scan" is marked as the preferred vulnerability scanning tool. The vulnerabilities of the preferred vulnerability scanning tool are matched one by one with the vulnerabilities of the other vulnerability scanning tools. Vulnerabilities that do not match the preferred vulnerability scanning tool are marked as unprocessed vulnerabilities. The vulnerability scanning tool with the largest number of unprocessed vulnerabilities is marked as the secondary vulnerability scanning tool.

[0028] Use the preferred vulnerability scanning tool to patch the vulnerabilities. After patching, use the preferred vulnerability scanning tool to patch the unpatched vulnerabilities. Repeat this process until all vulnerabilities are patched. Various vulnerability scanning tools include Nessus, OpenVAS, or Microsoft Baseline Security Analyze.

[0029] When generating basic investigation strategies for ordinary areas, a small network response strategy is used.

[0030] As a preferred embodiment of the present invention, based on step S3, the network size evaluation value is calculated according to the network topology diagram, specifically as follows:

[0031] S31: Obtain the number of elements in the vertex set V in the network topology graph G and label it as the number of nodes N, i.e., N = |V|; Obtain the number of elements in the edge set E in the network topology graph G and label it as the number of links L, i.e., L = |E|;

[0032] S32: Determine the number of network hierarchy C by analyzing the subnetting and device distribution at different levels in the network topology;

[0033] S33: Set up a critical device name database, including core servers, routers, firewalls, etc.; count the application devices in the network topology information, match the application devices with the critical device name database, and mark the application devices that match successfully as application critical devices; record the number of application critical devices and mark it as the number of critical devices; divide the number of critical devices by the total number of application devices to obtain the proportion of critical devices in the network, represented by PE.

[0034] S34: The network size assessment value PG is obtained by weighting the number of nodes, links, hierarchical structures and the proportion of key equipment in the network. The formula is: PG=N×g1+L×g2+C×g3+PE×g4; where g1, g2, g3 and g4 represent the weights corresponding to the number of nodes, links, hierarchical structures and the proportion of key equipment in the network, respectively.

[0035] As a preferred embodiment of the present invention, following step S4, step S6, a risk tracking mechanism, is further included, specifically:

[0036] S61: Establish a risk database and record the status of each vulnerability, represented as D = {x1, x2, x3}, where x1, x2, and x3 represent unprocessed, being processed, and fixed, respectively.

[0037] S62: Continuously monitor unprocessed and processed vulnerabilities, re-investigate unprocessed and processed vulnerabilities according to the set vulnerability investigation cycle, calculate the unprocessed duration and processing duration by calculating the time difference between the generation time and the current time of unprocessed and processed vulnerabilities respectively; obtain the vulnerability risk assessment score by using the general vulnerability scoring method, and obtain the vulnerability processing delay value by weighting the vulnerability risk assessment score with its corresponding unprocessed duration or processing duration;

[0038] S63: Set a processing delay threshold. Compare the processing delay value of each vulnerability with the processing delay threshold. If the vulnerability processing delay value is greater than the processing delay threshold, it means that the vulnerability is in a delayed processing state, and the early warning mechanism is triggered. Send an alarm message to the network administrator. The alarm message includes the vulnerability name, location, risk assessment score, and unprocessed duration or excessive processing time.

[0039] S64: The network administrator prioritizes the delayed processing of vulnerabilities based on the alarm information, records the processing steps and results, updates the status of the vulnerabilities in the risk database to "processing" or "fixed", and re-executes steps S62 and S63.

[0040] As a preferred embodiment of the present invention, in step S1, the network information collection mechanism adopts a distributed collection method, deploying a lightweight collection agent program on each node, and the collection agent program transmits the collected network information to the central management server through an encrypted channel.

[0041] As a preferred embodiment of the present invention, in step S22, the index of the risk feature database adopts a hash index structure, the classification label uses a multi-level classification system, and the virus features are classified in multiple levels according to family, variant, and degree of harm.

[0042] After establishing the risk feature database in step S2, the risk feature database is periodically optimized and organized. The specific steps are as follows:

[0043] Obtain the generation time of any feature information in the risk feature database, and calculate the feature generation duration by calculating the time difference between the generation time of the feature information and the current time.

[0044] Record the intelligence source for each risk feature information, set up a source scoring database, including the reliability scores of several intelligence sources; match the intelligence source of the risk feature information with the source scoring database to obtain the reliability score corresponding to the risk feature information;

[0045] The number of times each risk feature is matched during the actual investigation process is recorded and marked as the risk matching number; the risk feature evaluation value is obtained by weighting the feature generation time, reliability score, and risk matching number; a risk expiration evaluation threshold is set. If the risk feature evaluation value is less than its risk expiration evaluation threshold, it means that the risk feature information has expired or is no longer applicable, and the risk feature information is deleted from the risk feature database.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] 1. This invention generates investigation strategies flexibly based on network size assessment values, which are applicable to networks of different sizes and architectures. When the network size changes, the investigation strategies can be adjusted in a timely manner to ensure the effectiveness of risk investigation and effectively overcome the limitations of traditional methods designed for specific network architectures.

[0048] 2. This invention, through a dynamic update mechanism of the risk feature database, can obtain security threat intelligence data from external intelligence sources in real time. By accurately matching and labeling with the existing risk feature database, it can quickly include newly emerging virus signatures, behavioral patterns, and network traffic characteristics into the monitoring scope, update the risk feature database in a timely manner, and thus accurately identify new network security threats, making up for the shortcomings of traditional methods in dealing with new security risks.

[0049] In summary, this invention can quickly adapt to changes in complex and ever-changing network environments, accurately identify and handle risks, reduce the risks of business interruption and data leakage caused by network security issues, manage network security more efficiently, reduce security management costs, improve the reliability and security of network operations, and ensure the normal operation of business. Attached Figure Description

[0050] Further details, features, and advantages of this application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0051] Figure 1 This is a flowchart of an scalable network security risk assessment method proposed in this invention. Detailed Implementation

[0052] Several embodiments of this application will now be described in more detail with reference to the accompanying drawings to enable those skilled in the art to implement this application. This application may be embodied in many different forms and for various purposes and should not be limited to the embodiments set forth herein. These embodiments are provided to make this application thorough and complete, and to fully convey the scope of this application to those skilled in the art. The embodiments described do not limit this application.

[0053] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having a meaning consistent with their meaning in the relevant field and / or the context of this specification, and shall not be interpreted in an idealized or overly formal sense unless expressly defined herein.

[0054] Please see Figure 1 As shown, a scalable network security risk assessment method includes the following steps:

[0055] S1: Establish a network information collection mechanism to collect network information from various nodes of the target network; the network information includes device hardware information, operating system and application information, network topology information, user and permission information, and various nodes include servers, terminal devices, network devices, etc.

[0056] S2: Establish a risk signature database, initialize the signature database, classify and store the signature information of common cybersecurity threats in the risk signature database, and establish an index and classification labels;

[0057] S3: Extract the network topology diagram representation G=(V,E) from the network topology information, obtain the number of nodes, the number of links, the number of hierarchical structures and the proportion of key devices based on the network topology diagram, and calculate the network scale assessment value.

[0058] S4: Generate investigation strategies based on network size assessment values, set a small network size threshold, generate a small network response strategy when the network size assessment value is less than or equal to the threshold, and generate a large network response strategy when the network size assessment value is greater than the threshold.

[0059] S5: Mark the network scale assessment value, number of nodes, number of links, number of hierarchical structures and proportion of key equipment in the network as network architecture information; set the range of change for any parameter in the network architecture information. If any parameter in the network architecture information is not within its set range of change, it indicates that the network environment has changed, and steps S3-S5 are executed again.

[0060] In this application, a risk feature database is established based on step S2, and the specific process is as follows:

[0061] S21: Initialize the signature database and collect characteristic information of common network security threats, including the signatures of known viruses, the communication patterns of Trojan programs, and the characteristics of common network attack behaviors; set the signatures of known viruses as Cv={c1,c2,...,cm}, where ci represents the signature fragment of the i-th virus, set the communication patterns of Trojan programs as Tt={t1,t2,...,tn}, where tj represents the communication pattern information of the j-th Trojan program, and set the characteristics of common network attack behaviors as Aa={a1,a2,...,ap}, where ak represents the characteristic pattern of the k-th attack behavior;

[0062] S22: Classify and store the feature information in the risk feature database, and establish indexes and classification labels; among them, virus features can be classified according to virus families, Trojan program features can be classified according to their functions and propagation methods, and attack behavior features can be classified according to attack types.

[0063] In this application, based on step S2, step S23 is also included: establishing a dynamic update mechanism for the risk feature database, specifically as follows:

[0064] S31: Update from external intelligence sources, set update time cycles, and periodically obtain security threat intelligence data from cybersecurity intelligence agencies according to the update time cycles; analyze and extract risk characteristic information from security threat data, including virus signatures, behavioral patterns, and network traffic characteristics;

[0065] S32: Use a string matching algorithm to match the risk feature information with entries in the existing risk feature database.

[0066] For a virus signature, the similarity between the virus signature and any signature in the existing risk signature database is calculated. The similarity is obtained by calculating the edit distance. If the similarity between the virus signature and any signature is less than its preset similarity threshold, it means that the virus signature is not very similar to the signature in the risk signature database. In this case, the virus signature is marked as a virus signature to be updated. The virus signature to be updated is added to the Cv set.

[0067] Network traffic characteristics and behavior patterns are transformed into new rule expressions. Each rule expression consists of several keywords and operators, with each keyword and operator assigned a unique integer number. The new rule expression vector set is represented as Vne = [V n1 V n2 ,...,V ns [This refers to obtaining a set of rule expression vectors from the risk feature database.] The existing set of regular expression vectors and the new set of regular expression vectors are processed using the cosine similarity formula to obtain the old and new similarity cos(θ), which is expressed as: Where s and q represent the number of dimensions corresponding to the new rule expression vector and the existing rule expression vector, respectively, and f represents the index variable corresponding to the number of the new rule expression vector and the existing rule expression vector.

[0068] The new rule expression is decomposed into keyword vectors and operator vectors. Different weights are assigned to different keywords and operators, and the weight vectors of keywords and operators are labeled as Wl=[W l1 W l2 ,...] and Wo=[W o1 W o2 [,...]; After weighting them, the cosine similarity formula is used to calculate the weighted similarity, which is expressed as: Where wf represents the value of the corresponding weight of the keyword or operator in the weight vector of the keyword and operator;

[0069] Both the new and old similarity and the weighted similarity are compared with the preset similarity threshold. If either the new and old similarity or the weighted similarity is less than the preset similarity threshold, the behavior pattern or network traffic feature represented by the new rule expression is marked as a feature to be updated; the feature to be updated is added to the Aa set.

[0070] Generate corresponding classification labels and indexes for the virus signature codes to be updated and the features to be updated.

[0071] In this application, based on step S4, a screening strategy is generated according to the network size assessment value, specifically:

[0072] The system generates a small-scale network response strategy, triggering a comprehensive scan, including vulnerability scanning, network traffic monitoring, and security configuration checks on all nodes. It sets the time intervals for vulnerability scanning and network traffic monitoring, and performs security configuration checks concurrently with vulnerability scanning. Specifically:

[0073] For each vulnerability identified by the vulnerability scan, the priority of the vulnerability is evaluated using a general vulnerability scoring system. The basic metrics of the vulnerability are obtained, and the CVSS score of the vulnerability is calculated based on the basic metrics of the general vulnerability scoring system. Risk vulnerability groups are set up, including low-risk, medium-risk, and high-risk vulnerabilities. The CVSS score of the vulnerability is matched with the value range of the risk vulnerability group to classify the vulnerability into low, medium, and high-risk vulnerabilities.

[0074] The large-scale network response strategy is generated, triggering the division of the network area into critical and ordinary areas, and generating in-depth investigation strategies for critical areas and basic investigation strategies for ordinary areas. Specifically:

[0075] The network is divided into different regions and layers based on the network topology diagram. A key region database is set, including several key region names. The key region database is matched with any region in the different regions of the network. Regions that match successfully are marked as key regions, and regions that do not match are marked as ordinary regions. In-depth investigation strategies are generated for key regions, and basic investigation strategies are generated for ordinary regions.

[0076] When generating a deep investigation strategy for critical areas, multiple vulnerability scanning tools are used to scan critical areas and critical devices to obtain vulnerabilities detected by each tool and their corresponding risk assessment scores. The number of vulnerabilities detected by each vulnerability scanning tool is recorded and marked as the number of vulnerabilities detected by the "manual scan". The vulnerability scanning tool with the largest number of vulnerabilities detected by the "manual scan" is marked as the preferred vulnerability scanning tool. The vulnerabilities of the preferred vulnerability scanning tool are matched one by one with the vulnerabilities of the other vulnerability scanning tools. Vulnerabilities that do not match the preferred vulnerability scanning tool are marked as unprocessed vulnerabilities. The vulnerability scanning tool with the largest number of unprocessed vulnerabilities is marked as the secondary vulnerability scanning tool.

[0077] Use the preferred vulnerability scanning tool to patch the vulnerabilities. After patching, use the preferred vulnerability scanning tool to patch the unpatched vulnerabilities. Repeat this process until all vulnerabilities are patched. The various vulnerability scanning tools include, but are not limited to, Nessus, OpenVAS, or Microsoft Baseline Security Analyze. The specific vulnerability scanning tool should be selected based on the actual situation.

[0078] When generating basic investigation strategies for ordinary areas, a small network response strategy is used.

[0079] In this application, based on step S3, the network size assessment value is calculated according to the network topology diagram, specifically as follows:

[0080] S31: Obtain the number of elements in the vertex set V in the network topology graph G and label it as the number of nodes N, i.e., N = |V|; Obtain the number of elements in the edge set E in the network topology graph G and label it as the number of links L, i.e., L = |E|;

[0081] S32: Determine the number of network hierarchy C by analyzing the subnetting and device distribution at different levels in the network topology;

[0082] S33: Set up a critical device name database, including core servers, routers, firewalls, etc.; count the application devices in the network topology information, match the application devices with the critical device name database, and mark the application devices that match successfully as application critical devices; record the number of application critical devices and mark it as the number of critical devices; divide the number of critical devices by the total number of application devices to obtain the proportion of critical devices in the network, represented by PE.

[0083] S34: The network size assessment value PG is obtained by weighting the number of nodes, links, hierarchical structures and the proportion of key equipment in the network. The formula is: PG=N×g1+L×g2+C×g3+PE×g4; where g1, g2, g3 and g4 represent the weights corresponding to the number of nodes, links, hierarchical structures and the proportion of key equipment in the network, respectively.

[0084] In this application, following step S4, step S6, a risk tracking mechanism, is also included, specifically:

[0085] S61: Establish a risk database and record the status of each vulnerability, represented as D = {x1, x2, x3}, where x1, x2, and x3 represent unprocessed, being processed, and fixed, respectively.

[0086] S62: Continuously monitor unprocessed and processed vulnerabilities, re-investigate unprocessed and processed vulnerabilities according to the set vulnerability investigation cycle, calculate the unprocessed duration and processing duration by calculating the time difference between the generation time and the current time of unprocessed and processed vulnerabilities respectively; obtain the vulnerability risk assessment score by using the general vulnerability scoring method, and obtain the vulnerability processing delay value by weighting the vulnerability risk assessment score with its corresponding unprocessed duration or processing duration;

[0087] S63: Set a processing delay threshold. Compare the processing delay value of each vulnerability with the processing delay threshold. If the vulnerability processing delay value is greater than the processing delay threshold, it means that the vulnerability is in a delayed processing state, and the early warning mechanism is triggered. Send an alarm message to the network administrator. The alarm message includes the vulnerability name, location, risk assessment score, and unprocessed duration or excessive processing time.

[0088] S64: The network administrator prioritizes the delayed processing of vulnerabilities based on the alarm information, records the processing steps and results, updates the status of the vulnerabilities in the risk database to "processing" or "fixed", and re-executes steps S62 and S63.

[0089] In this application, in step S1, the network information collection mechanism adopts a distributed collection method, deploying a lightweight collection agent program on each node, and the collection agent program transmits the collected network information to the central management server through an encrypted channel.

[0090] In this application, in step S22, the index of the risk feature database adopts a hash index structure, the classification label uses a multi-level classification system, and the virus features are classified in multiple levels according to family, variant, and degree of harm.

[0091] In this application, after establishing the risk feature database in step S2, the risk feature database is periodically optimized and organized. The specific steps are as follows:

[0092] Obtain the generation time of any feature information in the risk feature database, and calculate the feature generation duration by calculating the time difference between the generation time of the feature information and the current time.

[0093] Record the intelligence source for each risk feature information, set up a source scoring database, including the reliability scores of several intelligence sources; match the intelligence source of the risk feature information with the source scoring database to obtain the reliability score corresponding to the risk feature information;

[0094] The number of times each risk feature is matched during the actual investigation process is recorded and marked as the risk matching number; the risk feature evaluation value is obtained by weighting the feature generation time, reliability score, and risk matching number; a risk expiration evaluation threshold is set. If the risk feature evaluation value is less than its risk expiration evaluation threshold, it means that the risk feature information has expired or is no longer applicable, and the risk feature information is deleted from the risk feature database.

[0095] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. An expandable network security risk investigation method, characterized in that, Comprising the following steps: S1: Establish a network information collection mechanism to collect network information from each node of the target network; wherein the network information includes hardware information of the device, operating system and application program information, network topology information, user and permission information; S2: Establish a risk feature library, initialize the feature library, store the feature information of common network security threats in the risk feature library, and establish indexes and classification labels; After establishing the risk feature library in step S2, periodically optimize and arrange the risk feature library, the specific steps are: obtaining the generation time of any feature information in the risk feature library, calculating the feature generation time length by time difference between the generation time of the feature information and the current time; record the intelligence source of each risk feature information, set up a source score database including the reliability score of several intelligence sources; match the intelligence source of the risk feature information with the source score database to obtain the reliability score corresponding to the risk feature information; record the matching number of each risk feature information in the actual investigation process as the risk matching number; the feature generation time, reliability score and risk matching number are weighted to obtain the risk feature evaluation value; set a risk expiration evaluation threshold, if the risk feature evaluation value is less than the risk expiration evaluation threshold, it means that the risk feature information is expired or no longer applicable, then delete the risk feature information from the risk feature library; S3: Extract the network topology graph from the network topology information, obtain the number of nodes, the number of links, the number of hierarchical structures and the proportion of key devices according to the network topology graph, and calculate the network scale evaluation value, which is: S31: Obtain the element number of the vertex set V in the network topology graph G, marked as the node number N, that is ; Obtain the element number of the edge set E in the network topology graph G, marked as the link number L, that is ; S32: Determine the number of hierarchical structures C of the network by analyzing the subnet division and device distribution of different levels in the network topology; S33: Set up a key device name library, the key devices include core servers, routers and firewalls; count the application devices in the network topology information, match the application devices with the key device name library, and mark the application devices that match successfully as application key devices; record the number of application key devices as the number of key devices; divide the number of key devices by the total number of application devices to obtain the proportion of key devices in the network, denoted as PE; S34: The network size evaluation value PG is calculated by weighting the number of nodes, the number of links, the number of hierarchies and the proportion of key devices in the network, which is expressed by the formula: ; wherein g1, g2, g3, g4 respectively represent the weights corresponding to the number of nodes, the number of links, the number of hierarchies and the proportion of key devices in the network. S4: Generate an investigation strategy according to the network scale evaluation value, set a small network scale threshold, when the network scale evaluation value is less than or equal to the threshold, generate a small network response strategy; when the network scale evaluation value is greater than the threshold, generate a large network response strategy; S5: Mark the network scale evaluation value, the number of nodes, the number of links, the number of hierarchical structures and the proportion of key devices in the network as network architecture information; set a change range for any parameter in the network architecture information, if any parameter in the network architecture information is not in its set change range, it means that the network environment has changed, re-execute steps S3-S5; S6: Establish a risk database to record the status of each vulnerability, represented as D={x1, x2, x3}, x1, x2, x3 represent untreated, in-process, and repaired respectively; continuously monitor untreated and in-process vulnerabilities, re-examine untreated and in-process vulnerabilities according to the set vulnerability examination period, and calculate the time difference between the generation time and the current time of untreated and in-process vulnerabilities to obtain the untreated duration and in-process duration; obtain the risk assessment score of the vulnerability by using the general vulnerability scoring, and perform weighted processing on the risk assessment score of the vulnerability and its corresponding untreated duration or in-process duration to obtain the vulnerability processing delay value; set a processing delay threshold, compare the processing delay value of each vulnerability with the processing delay threshold, if the vulnerability processing delay value is greater than the processing delay threshold, it means that the vulnerability is in the state of delayed processing, then trigger the early warning mechanism; send an alarm information to the network administrator, which contains the vulnerability name, location, risk assessment score, and untreated duration or in-process duration; the network administrator processes the delayed vulnerability according to the alarm information, records the processing steps and results, updates the status of the vulnerability in the risk database to in-process or repaired, and re-executes step S6; Based on step S2, a risk feature library is established, and the specific process is as follows: S21: Initialize the feature library, collect the feature information of common network security threats, including the feature codes of known viruses, the communication modes of Trojan programs, and the features of common network attack behaviors; set the feature codes of known viruses as Cv={cl,c2,…,cm}, where ci represents the feature code segment of the ith virus, set the communication modes of Trojan programs as Tt={tl,t2,…,tn}, where tj represents the communication mode information of the jth Trojan program, and set the features of common network attack behaviors as Aa={al,a2.,…,ap}, where ak represents the feature mode of the kth attack behavior; S22: Store the feature information in the risk feature library, establish indexes and classification labels; among them, the virus features are classified according to virus families, the features of Trojan programs are classified according to their functions and propagation methods, and the features of attack behaviors are classified according to attack types; Based on step S2, it also includes step S23: Establish a dynamic update mechanism for the risk feature library, specifically: S231: Update from external intelligence sources, set an update time period, and periodically obtain security threat intelligence data from network security intelligence agencies according to the update time period; extract risk feature information from security threat situation data, including virus feature codes, behavior patterns, and network traffic features; S232: The risk feature information is matched with the entries in the existing risk feature library by using a string matching algorithm: for the virus feature code, the similarity between the virus feature code and any feature code in the existing risk feature library is calculated, and the similarity is obtained by calculating the edit distance method; if the similarity between the virus feature code and any feature code is less than the preset similarity threshold, it means that the similarity between the virus feature code and the feature code in the risk feature library is not high, and the virus feature code is marked as a virus feature code to be updated; the virus feature code to be updated is added to the Cv set; For network traffic features and behavior patterns, convert them into new rule expressions, which are composed of several keywords and operators, and assign a unique integer number to each keyword and operator; the new rule expression vector set is represented as Vne=[Vn1,Vn2,…,Vn], and the existing rule expression vector set in the risk feature library is represented as Vex=[Vex1,Vex2,…,Vexq], the existing rule expression set vector and the new rule expression set vector are processed by using the cosine similarity formula to obtain the similarity cos(θ) between the old and the new, the formula is: ; wherein s, q respectively represent the number of dimensions corresponding to the new rule expression vector and the existing rule expression vector, and f represents the index variable corresponding to the number of the new rule expression vector and the existing rule expression vector; the new rule expression is decomposed into a keyword vector and an operator vector, different weights are assigned to different keywords and operators, and the weight vectors of the keywords and operators are marked as Wl=[Wl1,Wl2….] and Wo=[Wo1,Wo2…] respectively; the weighted similarity is obtained by calculating and processing using the cosine similarity formula after weighting, and the formula is: ; wherein wf represents the corresponding weight value of the keyword or operator in the weight vector of the keyword and operator; the new and old similarity and the weighted similarity are compared with the preset similarity threshold, and if any one of the new and old similarity and the weighted similarity is less than the preset similarity threshold, the behavior mode or network traffic feature represented by the new rule expression is marked as a to-be-updated feature; the to-be-updated feature is added to the Aa set; and corresponding classification labels and indexes are generated for the to-be-updated virus feature code and the to-be-updated feature.

2. The method of claim 1, wherein, Based on step S4, generate troubleshooting strategies according to network size evaluation value, specifically: generate small network response strategy, trigger comprehensive scanning strategy, including vulnerability scanning, network traffic monitoring and security configuration checking for all nodes; set the time period of vulnerability scanning and network traffic monitoring, and perform security configuration checking at the same time of vulnerability scanning, specifically: obtain each vulnerability scanned by vulnerability scanning, use the Common Vulnerability Scoring System to evaluate the priority of the vulnerability, obtain the basic metric of the vulnerability, and calculate the CVSS score of the vulnerability according to the basic metric of the vulnerability processed by the Common Vulnerability Scoring System; Set risk vulnerability group, including low-risk vulnerability, medium-risk vulnerability and high-risk vulnerability; Match the CVSS score of the vulnerability with the value range of the risk vulnerability group, so as to divide the vulnerability into low-risk, medium-risk and high-risk vulnerabilities; Generate large network response strategy, trigger network area division into key area and ordinary area, and generate key area deep troubleshooting strategy and ordinary area basic troubleshooting strategy, specifically: divide the network into different areas and levels according to the network topology graph, set the key area library including several key area names; match the key area library with any area in the network division, mark the matched area as a key area, and mark the unmatched area as an ordinary area; generate deep troubleshooting strategy for key area and basic troubleshooting strategy for ordinary area; In generating the key area depth troubleshooting strategy, a plurality of vulnerability scanning tools are used to perform vulnerability scanning on the key area and the key equipment, to obtain vulnerabilities scanned by each tool and a risk assessment score corresponding to the vulnerabilities; the number of vulnerabilities scanned by each vulnerability scanning tool is recorded and marked as a tool scanning vulnerability number, a vulnerability scanning tool with the largest tool scanning vulnerability number is marked as an optimal vulnerability scanning tool; the vulnerabilities of the optimal vulnerability scanning tool are matched with the vulnerabilities of the remaining vulnerability scanning tools one by one, and the vulnerabilities that are not matched with the optimal vulnerability scanning tool are marked as untreated vulnerabilities; a vulnerability scanning tool with the largest number of untreated vulnerabilities is marked as a suboptimal vulnerability scanning tool; the optimal vulnerability scanning tool is used to perform repair processing on the vulnerabilities, and after the repair processing, the optimal vulnerability scanning tool is used to perform repair processing on the untreated vulnerabilities; this is repeated until the repair of the vulnerabilities is completed; wherein the plurality of vulnerability scanning tools include Nessus, OpenVAS or Microsoft Baseline SecurityAnalyze vulnerability scanning tools; in generating the general area basic troubleshooting strategy, a small network coping strategy is used for processing.

3. The method of claim 1, wherein, In step S1, the network information collection mechanism adopts a distributed collection mode, and a lightweight collection agent program is deployed on each node. The collection agent program transmits the collected network information to the central management server through an encrypted channel.

4. The method of claim 1, wherein, In step S22, the index of the risk feature library adopts a hash index structure, the classification label uses a multi-level classification system, and the virus features are classified in multiple levels according to families, varieties and damage degrees.

Images