Equipment security assessment method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses an equipment security assessment method and device, equipment and a storage medium, and the method comprises the steps: obtaining to-be-detected information of target equipment; the to-be-detected information is information associated with operation parameters of target equipment; according to the importance degree relationship between different types of sub-information in the to-be-detected information, respectively determining a security evaluation parameter corresponding to each type of sub-information; and determining a security assessment result of the target device according to the security assessment parameter. According to the technical scheme, the problems that in the prior art, the equipment safety analysis angle is one-sided, and the safety evaluation result is inaccurate are solved, safety evaluation can be conducted on the target equipment in combination with the importance relation between different types of information in the to-be-detected information, and the accuracy of the safety evaluation result is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of electrical equipment safety management, and in particular to an equipment safety assessment method, apparatus, device and storage medium. Background Art

[0002] With the development of intelligent and information-based power systems, the role of operating systems in power systems is becoming increasingly important. Power system operating systems undertake key tasks such as real-time control, monitoring and data processing of power grid operations. However, due to the vulnerability of power grid systems, power systems are facing increasingly complex security challenges. Existing power system security assessment methods usually only focus on one-sided threats or vulnerabilities, making it difficult to comprehensively and accurately assess the security situation of the system. Summary of the invention

[0003] The embodiments of the present invention provide a device security assessment method, apparatus, equipment and storage medium. The technical solution of the embodiments of the present invention solves the problems of the prior art that the device security analysis perspective is relatively one-sided and the security assessment results are inaccurate. The security of the target device can be assessed based on the importance relationship between different types of information in the information to be detected, thereby improving the accuracy of the security assessment results.

[0004] In a first aspect, an embodiment of the present invention provides a device security assessment method, the method comprising:

[0005] Obtain information to be detected of the target device; the information to be detected is information associated with the operating parameters of the target device; according to the importance relationship between different types of sub-information in the information to be detected, determine the security assessment parameters corresponding to each type of sub-information; according to the security assessment parameters, determine the security assessment result of the target device.

[0006] In a second aspect, an embodiment of the present invention provides a device for evaluating equipment safety, the device comprising:

[0007] An information acquisition module is used to acquire information to be detected of a target device; the information to be detected is information associated with operating parameters of the target device; an evaluation parameter determination module is used to determine the security evaluation parameters corresponding to each type of sub-information according to the importance relationship between different types of sub-information in the information to be detected; and an evaluation result determination module is used to determine the security evaluation result of the target device according to the security evaluation parameters.

[0008] In a third aspect, an embodiment of the present invention provides a computer device, the computer device comprising:

[0009] one or more processors;

[0010] A memory for storing one or more programs;

[0011] When the one or more programs are executed by the one or more processors, the one or more processors implement the device security assessment method described in any embodiment.

[0012] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the device security assessment method described in any embodiment.

[0013] The technical solution provided by the embodiment of the present invention obtains the information to be detected of the target device; the information to be detected is information associated with the operating parameters of the target device; according to the importance relationship between different types of sub-information in the information to be detected, the security assessment parameters corresponding to each type of sub-information are determined; according to the security assessment parameters, the security assessment result of the target device is determined. The technical solution of the embodiment of the present invention solves the problem that the device security analysis angle is relatively one-sided and the security assessment result is inaccurate in the prior art. It can combine the importance relationship between different types of information in the information to be detected to perform security assessment on the target device and improve the accuracy of the security assessment result. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flow chart of a device security assessment method provided by an embodiment of the present invention;

[0015] Figure 2 is a flow chart of another device security assessment method provided by an embodiment of the present invention;

[0016] Figure 3 It is a structural schematic diagram of a system for performing equipment safety assessment provided by an embodiment of the present invention;

[0017] Figure 4 It is a structural schematic diagram of a device safety assessment device provided by an embodiment of the present invention;

[0018] Figure 5 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Figure 1It is a flow chart of a device safety assessment method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of assessing the safety of power equipment. The method can be executed by a device safety assessment device, which can be implemented by software and / or hardware.

[0021] like Figure 1 As shown, the device security assessment method includes the following steps:

[0022] S110: Obtain information to be detected of the target device.

[0023] Among them, the target device may be a device that needs to be security tested. The technical solution of the embodiment of the present invention can analyze the operating parameters of the target device to obtain the security status assessment result of the current state of the target device. The information to be detected is information associated with the operating parameters of the target device. By analyzing whether there is abnormal data in each type of information to be detected, the security status analysis result of the target device can be obtained. Specifically, the information to be detected includes: at least one of: operating information, asset information, equipment performance and status information, vulnerability information, safety margin information and log information.

[0024] S120: Determine security assessment parameters corresponding to each type of sub-information according to the importance relationship between different types of sub-information in the information to be detected.

[0025] Among them, the sub-information can be a type of information in the device operation information. That is, the same type of information in the device operation information can be used as a sub-information. The security assessment parameter can be a parameter that represents the degree of security risk of the information to be detected. Among them, the security assessment parameter may include an assessment weight and an assessment parameter. Specifically, the assessment weight corresponding to each type of sub-information can be determined separately according to the importance relationship between different types of sub-information in the information to be detected; further, for each type of sub-information, the security score of the sub-information can be performed based on a preset information evaluation mechanism to obtain the security assessment parameter corresponding to the sub-information.

[0026] S130: Determine a security assessment result of the target device according to the security assessment parameter.

[0027] Among them, the security assessment parameter can be a parameter representing the security assessment result of the information to be detected. Specifically, the security assessment parameter of each type of sub-information can be analyzed separately or as a whole to obtain the security assessment result of the target device. Exemplarily, for each sub-information, the assessment weight corresponding to the sub-information and the assessment parameter can be multiplied to obtain the sub-assessment parameter, and finally the sub-assessment parameters of all the sub-information are added to obtain the security assessment parameter, and then the security assessment parameter is compared with the corresponding security threshold, and the security assessment result of the target device is determined according to the comparison result.

[0028] The technical solution provided by the embodiment of the present invention obtains the information to be detected of the target device; the information to be detected is information associated with the operating parameters of the target device; according to the importance relationship between different types of sub-information in the information to be detected, the security assessment parameters corresponding to each type of sub-information are determined; according to the security assessment parameters, the security assessment result of the target device is determined. The technical solution of the embodiment of the present invention solves the problem that the device security analysis angle is relatively one-sided and the security assessment result is inaccurate in the prior art. It can combine the importance relationship between different types of information in the information to be detected to perform security assessment on the target device and improve the accuracy of the security assessment result.

[0029] Figure 2 It is another flow chart of a device safety assessment method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to scenarios in which the safety of power equipment is assessed. Based on the above embodiment, this embodiment further explains how to obtain the information to be detected of the target device; and how to determine the security assessment parameters corresponding to each type of sub-information according to the importance relationship between different types of sub-information in the information to be detected. The device can be implemented by software and / or hardware and integrated in a computer device with application development capabilities.

[0030] like Figure 2 As shown, the device security assessment method includes the following steps:

[0031] S210: When an information detection instruction is received, determine device identification information of the target device according to the information detection instruction.

[0032] Among them, the information detection instruction can be an interactive instruction requesting to start device security detection. Specifically, the information detection instruction can be sent manually, or can be automatically sent by the machine at preset intervals, which is not limited here. The target device can be a device that needs to be security-checked. The technical solution of the embodiment of the present invention can analyze the operating parameters of the target device to obtain the security status assessment result of the current state of the target device. The device identification information can be the unique identity identification information of the target device. Specifically, the device identification information in the information detection instruction can be identified to obtain the device identification information of the target device.

[0033] S220: Extract device operation information corresponding to the device identification information from a preset database according to the device identification information, and use the device operation information as the information to be detected of the target device.

[0034] The preset database may be a database for storing device operation parameters of the target device. The device operation information may be information about the device operation parameters of the target device. Specifically, based on the device identification information, the device operation parameters corresponding to the device identification information may be matched from the preset database to obtain the device operation information.

[0035] The information to be detected may be information that needs to be tested for security status. By analyzing whether there is abnormal data in each type of information to be detected, the security status analysis result of the target device can be obtained. Specifically, the information to be detected includes: at least one of: operation information, asset information, equipment performance and status information, vulnerability information, safety margin information and log information.

[0036] Among them, flow information may include: real-time data of parameters such as current, voltage and power. Asset information may include: asset information such as physical equipment and network data. Equipment performance and status information may include: power supply capacity information, equipment operation status information (transformer, generator and line, etc.) Vulnerability information may include: transient safety information, static safety voltage information, line vulnerability, node vulnerability and grid structure information. Safety margin information may include: load safety margin, power generation / transmission margin and load shedding rate. Log information may include: business operation behavior log, equipment operation log, access log and maintenance log.

[0037] Optionally, storing the device operation information of the target device in the preset database includes: acquiring the device operation information of the target device; generating device identification information corresponding to the target device according to the asset area, asset type, asset number and special security code of the target device; determining the information coding of each type of sub-information in the device operation information according to the device identification information of the target device; for each type of sub-information in the device operation information, storing the sub-information in a storage unit corresponding to the preset database according to the information coding of the sub-information.

[0038] Among them, the asset area can be the region to which the target device belongs. Optionally, the number of the region to which the target device belongs can be used as the asset area. The asset type can be the device type of the target device. Optionally, the number of the device type of the target device can be used as the asset type. The asset number can be the device number of the target device. The special security code can be a security code used to represent the unique identity of the target device. Optionally, the special security code can be generated randomly. Further, the asset area, asset type, asset number and special security code of the target device can be multiplied, and the product obtained can be used as the device identification information of the target device.

[0039] For example, if the area code of a device is 01, the asset type classification is 02, the asset number is 3456, and the randomly generated special security code is 78910, then the device identification information of the device is:

[0040] Code Asset =01×02×3456×78910=545425920

[0041] Sub-information may be a type of information in the device operation information. That is, the same type of information in the device operation information may be used as a sub-information. The information code may be a code representing the unique identity of the sub-information. Specifically, a corresponding sorting code may be set for each type of sub-information in the device operation information, and then the device identification information may be combined with the sorting code to obtain the information code corresponding to each type of sub-information.

[0042] Exemplarily, the information encoding corresponding to the sub-information of the target device may be expressed in the form of:

[0043] The information codes are connected by "-". If the target device does not contain the corresponding type of sub-information, "XX" is used instead to indicate that there is no information. The device identification information and the information code are connected by ":", indicating that the subsequent coded information belongs to the device identification information;

[0044] In summary, the target device's information to be detected is expressed as follows:

[0045] Code=545425920:01-02-03-XX-05-...-

[0046] Furthermore, the storage address of each type of sub-information in the device operation information can be determined based on the information coding, and then the sub-information is stored in the storage address of the corresponding storage unit.

[0047] S230. For each type of sub-information in the information to be detected, determine a feature evaluation parameter corresponding to the sub-information, and determine an evaluation coefficient according to a comparison result of importance between the sub-information.

[0048] The characteristic evaluation parameter may be a parameter indicating the security status of the sub-information. Specifically, the sub-information may be scored for security based on a preset information evaluation mechanism to obtain the characteristic evaluation parameter corresponding to the sub-information. Exemplarily, the parameter of the sub-information may be feature extracted to obtain a corresponding characteristic vector, and then the value of the characteristic vector may be obtained, and the obtained value may be used as the characteristic evaluation parameter.

[0049] The evaluation coefficient may be a weight coefficient corresponding to the feature evaluation parameter. Specifically, the importance of the sub-information may be compared, and the evaluation coefficient may be determined based on the comparison result of the importance of the sub-information.

[0050] Optionally, an evaluation coefficient is determined based on the result of comparing the importance between the sub-information, including: separately determining the importance parameters corresponding to each type of sub-information; for the importance parameters corresponding to the target sub-information, comparing the importance parameters corresponding to the target sub-information with the importance parameters corresponding to other sub-information in pairs, and separately determining the target importance coefficient of the target sub-information relative to each type of other sub-information; and determining the evaluation coefficient corresponding to the target sub-information based on the importance coefficients.

[0051] The target sub-information may be the sub-information corresponding to the evaluation coefficient currently being determined. Specifically, the sub-information corresponding to the evaluation coefficient currently being determined may be used as the target sub-information, and the sub-information other than the target sub-information may be used as other sub-information. After the evaluation coefficient corresponding to the target sub-information is determined, the other sub-information may be used as the next target sub-information in sequence, until the evaluation coefficients corresponding to all the sub-information are obtained.

[0052] The importance parameter is a parameter used to indicate the importance of the sub-information. Exemplarily, the importance parameter of each type of sub-information can be set in advance or determined through data analysis.

[0053] The target importance parameter may be a parameter indicating the importance of the target sub-information compared to other sub-information. Specifically, the importance parameters corresponding to the target sub-information may be compared with the importance parameters corresponding to other sub-information in pairs, thereby obtaining the target importance coefficient of the target sub-information relative to each type of other sub-information.

[0054] Optionally, the target importance coefficients of the target sub-information relative to each type of other sub-information can be summed to obtain the sum of the target importance coefficients; the importance coefficients of all sub-information relative to other sub-information can be summed to obtain the total of the importance coefficients; the sum of the target importance coefficients can be compared with the total of the importance coefficients, and the obtained ratio can be used as the evaluation coefficient corresponding to the target sub-information.

[0055] Among them, the target importance coefficient sum can be the sum value of all target importance parameters corresponding to the target sub-information. Specifically, by adding up all target importance parameters corresponding to the target sub-information, the target importance coefficient sum can be obtained. The sum of importance coefficients can be the sum value of importance parameters of all sub-information relative to other sub-information. Specifically, by adding up the importance coefficients of all sub-information relative to other sub-information, the sum of importance coefficients can be obtained. Furthermore, the target importance coefficient sum can be compared with the sum of importance coefficients, and the obtained ratio can be used as the evaluation coefficient corresponding to the target sub-information.

[0056] S240: Determine the security assessment parameter according to the assessment coefficients and feature assessment parameters of all the sub-information.

[0057] The security assessment parameter may be a parameter representing the security assessment result of the information to be detected. Specifically, for each sub-information, the assessment coefficient corresponding to the sub-information and the characteristic assessment parameter may be multiplied to obtain the sub-assessment parameter, and finally the sub-assessment parameters of all the sub-information may be added together to obtain the security assessment parameter.

[0058] Exemplarily, the calculation formula of the sub-evaluation parameter of the sub-information is as follows:

[0059] S i =w 1 f 1 +w 2 f 2 +w 3 f 3 +w 4 f 4 +w 5 f 5 +w 6 f 6

[0060] Among them, f1 ~f 6 They represent the characteristic evaluation parameters corresponding to flow information, equipment performance and status information, safety margin information, log information, asset information, and vulnerability information, respectively. 1 ~w 6 Yes 1 ~f 6 The corresponding weight.

[0061] Furthermore, the calculation formula of the importance parameter is:

[0062]

[0063] Among them, I f Represents the importance of the data. By comparing the importance of different data, the importance parameter F of the sub-information is obtained. ij , and then calculate the weights:

[0064] Furthermore, the calculation formula of the evaluation coefficient corresponding to the sub-information is:

[0065]

[0066] Furthermore, the calculation formula of the safety assessment parameter is:

[0067] SSA=S 1 +S 2 +S 3 +S 4 +S 5 +S 6

[0068] S250: Determine a security assessment result of the target device according to the security assessment parameter.

[0069] Among them, the security assessment result can be the result of the security assessment of the target device. Exemplarily, the security assessment parameter can be compared with the corresponding security threshold, and the security assessment result of the target device can be determined based on the comparison result. For example, if the number of security thresholds is one, and the size of the security assessment parameter is proportional to the security level of the device, when the security assessment parameter is less than the security threshold, the security assessment result can be determined to be an abnormal assessment result; when the security assessment parameter is greater than the security threshold, the security assessment result can be determined to be a normal assessment result. Among them, the abnormal assessment result indicates that there is a greater security risk in the target device. The normal assessment result indicates that no security risk has been detected in the target device.

[0070] Optionally, when there is an abnormal assessment result in the security assessment result, log information corresponding to the abnormal assessment result is generated, and according to the abnormal type corresponding to the abnormal assessment result, an emergency mechanism corresponding to the abnormal type is executed.

[0071] The log information may be information recording historical security detection results of the target device, wherein the log information includes at least one of a timestamp, a log identifier, log content information, a log type, an abnormal event, and associated subject information.

[0072] The abnormality type may be the security risk type corresponding to the abnormal evaluation result. Exemplarily, the corresponding information abnormality type may be set for each sub-information according to the type of sub-information in the information to be detected. If any sub-information corresponding to the information to be detected has an abnormality, the abnormality type corresponding to the abnormal evaluation result may be determined to be the information abnormality type corresponding to the sub-information. The emergency mechanism may be an emergency handling mechanism in the presence of security risks. Specifically, each abnormality type may have a corresponding emergency mechanism. It may be determined that after determining the abnormality type corresponding to the abnormal evaluation result, the emergency mechanism corresponding to the abnormality type is executed to ensure the safe operation of the target device.

[0073] Among them, log information is a method of organizing and standardizing log data, with the goal of ensuring that log information is structured, readable, and easy to analyze. Log information is usually broken down into multiple standardized parts for better storage, retrieval, and analysis, which can be expressed as:

[0074] L=(T,S,M,C,A,U)

[0075] Among them, L represents the log entry; T represents the timestamp, which is the time when the log record occurs; S represents the system or service (Source), which is the system or service identifier that generates the log; M represents the message, which describes the main content of the log, such as the event and status that occurred; C represents the category, which classifies the log type, such as error, warning, information, etc.; A represents the action, which describes the specific action or event that occurred; U represents the user or subject, which describes the user or system subject related to the log.

[0076] For example, in order to better understand the technical solution provided by the present invention, a specific embodiment is introduced below: For example, Figure 3 FIG. 1 is a schematic diagram of a device safety assessment system provided by an embodiment of the present invention. Figure 3 As shown, the equipment security assessment system includes: a security management and response layer, a security situation analysis and assessment layer, a data management and preprocessing layer, a distributed message queue management layer, and a data collection layer.

[0077] Among them, the data acquisition layer is used to collect security-related data from the power system operating system; the distributed message queue management layer is used to realize decoupled services, ensure the reliable transmission and processing of messages, realize asynchronous data transmission, and improve message transmission efficiency, application scalability and stability; the data management and preprocessing layer is used to preprocess and analyze the collected data and extract key security features; the security situation analysis and evaluation layer is used to analyze security situation data of different levels and types, and to establish a security situation analysis and evaluation model based on a multi-level security analysis method to realize the evaluation of the overall security situation of the power system operating system; the security management and response layer is used to generate security warnings and response plans based on the security situation assessment results; the results are managed, and potential threats and useful information in the analysis results are mined to ensure the stable operation of the power grid.

[0078] The beneficial effects of the present invention include:

[0079] 1. Hierarchical data processing: The present invention divides the security assessment of the power system into multiple levels, each of which has a clear functional division of labor, from data collection to management and analysis, and then to the final security situation management and response, ensuring that each step can be effectively executed and reducing the possibility of information loss and misjudgment.

[0080] Comprehensive security situation assessment: By combining log analysis, asset analysis, vulnerability analysis and equipment operation analysis, the present invention can comprehensively capture security threats in the system and provide accurate security situation assessment. This method can help power system operators better understand the current status of the system and predict possible security incidents in advance.

[0081] 2. Real-time response and adjustment: The present invention can not only evaluate the current security situation, but also dynamically adjust the system's security strategy through the security response module and provide real-time security protection measures. This function is of great significance for responding to ever-changing security threats.

[0082] 3. Data-driven preventive security measures: Through the analysis of historical data and the prediction of security threats, the present invention can identify potential security risks in advance and take preventive measures to reduce the vulnerability of the system.

[0083] 4. Efficient data processing and storage: The present invention adopts streaming storage, big data storage and data preprocessing technology to ensure efficient processing and rapid retrieval of massive data, providing strong data support for security situation assessment.

[0084] The technical solution provided by the embodiment of the present invention determines the device identification information of the target device according to the information detection instruction when an information detection instruction is received; extracts the device operation information corresponding to the device identification information from a preset database according to the device identification information, and uses the device operation information as the information to be detected for the target device; determines the feature evaluation parameters corresponding to each type of sub-information in the information to be detected, and determines the evaluation coefficient according to the comparison result of the importance between the sub-information; determines the security evaluation parameters according to the evaluation coefficients and feature evaluation parameters of all the sub-information; and determines the security evaluation result of the target device according to the security evaluation parameters.

[0085] The technical solution of the embodiment of the present invention solves the problems of the prior art that the device security analysis perspective is relatively one-sided and the security assessment results are inaccurate. It can combine the importance relationship between different types of information in the information to be detected to perform security assessment on the target device and improve the accuracy of the security assessment results.

[0086] Figure 4 It is a structural schematic diagram of an equipment safety assessment device provided in an embodiment of the present invention. The embodiment of the present invention can be applied to the scenario of assessing the safety of power equipment. The device can be implemented by software and / or hardware and integrated into a computer device with application development function.

[0087] like Figure 4 As shown, the device safety assessment apparatus includes: an information acquisition module 310 , an assessment parameter determination module 320 and an assessment result determination module 330 .

[0088] Among them, the information acquisition module 310 is used to obtain the information to be detected of the target device; the information to be detected is information associated with the operating parameters of the target device; the evaluation parameter determination module 320 is used to determine the security evaluation parameters corresponding to each type of sub-information according to the importance relationship between different types of sub-information in the information to be detected; the evaluation result determination module 330 is used to determine the security evaluation result of the target device according to the security evaluation parameters.

[0089] The technical solution provided by the embodiment of the present invention obtains the information to be detected of the target device; the information to be detected is information associated with the operating parameters of the target device; according to the importance relationship between different types of sub-information in the information to be detected, the security assessment parameters corresponding to each type of sub-information are determined; according to the security assessment parameters, the security assessment result of the target device is determined. The technical solution of the embodiment of the present invention solves the problem that the device security analysis angle is relatively one-sided and the security assessment result is inaccurate in the prior art. It can combine the importance relationship between different types of information in the information to be detected to perform security assessment on the target device and improve the accuracy of the security assessment result.

[0090] In an optional embodiment, the evaluation parameter determination module 320 is specifically used to: determine the evaluation coefficient and characteristic evaluation parameter corresponding to each type of sub-information in the information to be detected; and determine the security evaluation parameter based on the evaluation coefficient and characteristic evaluation parameter of all the sub-information.

[0091] In an optional embodiment, the evaluation parameter determination module 320 includes: an evaluation coefficient determination unit, used to: determine the importance parameters corresponding to each type of sub-information respectively; wherein the importance parameters are used to represent the parameters of the importance of the sub-information; for the importance parameters corresponding to the target sub-information, compare the importance parameters corresponding to the target sub-information with the importance parameters corresponding to other sub-information respectively, and determine the target importance coefficient of the target sub-information relative to each type of other sub-information respectively; and determine the evaluation coefficient corresponding to the target sub-information based on the importance coefficient.

[0092] In an optional embodiment, the evaluation coefficient determination unit includes: an importance coefficient analysis subunit, which is used to: add the target importance coefficients of the target sub-information relative to each type of other sub-information to obtain a target importance coefficient sum; add the importance coefficients of all sub-information relative to other sub-information to obtain a total importance coefficient; compare the target importance coefficient sum with the total importance coefficient, and use the obtained ratio as the evaluation coefficient corresponding to the target sub-information.

[0093] In an optional embodiment, the information acquisition module 310 is specifically used to: when receiving an information detection instruction, determine the device identification information of the target device according to the information detection instruction; based on the device identification information, extract the device operation information corresponding to the device identification information from a preset database, and use the device operation information as the information to be detected for the target device.

[0094] In an optional embodiment, the information acquisition module 310 includes: an information storage unit, used to: obtain the device operation information of the target device; generate device identification information corresponding to the target device according to the asset area, asset type, asset number and special security code of the target device; determine the information coding of each type of sub-information in the device operation information according to the device identification information of the target device; for each type of sub-information in the device operation information, store the sub-information in the storage unit corresponding to the preset database according to the information coding of the sub-information.

[0095] In an optional embodiment, the equipment security assessment device also includes: an assessment log recording module, which is used to: when there is an assessment abnormality result in the security assessment result, generate log information corresponding to the assessment abnormality result, and execute an emergency mechanism corresponding to the abnormality type according to the abnormality type corresponding to the assessment abnormality result; wherein the log information includes: at least one of a timestamp, a log identifier, a log content information, a log type, an abnormal event and associated subject information.

[0096] The equipment security assessment device provided in the embodiment of the present invention can execute the equipment security assessment method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0097] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Figure 5 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. The computer device 12 can be any terminal device with computing capability and can be configured in the device security assessment device.

[0098] like Figure 5 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0099] The bus 18 may be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0100] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0101] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0102] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0103] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed through an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 20. Figure 5 As shown, the network adapter 20 communicates with other modules of the computer device 12 via the bus 18. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with computer device 12, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0104] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing the device security assessment method provided in the embodiment of the present invention, which includes:

[0105] Obtain information to be detected of the target device; the information to be detected is information associated with the operating parameters of the target device; according to the importance relationship between different types of sub-information in the information to be detected, determine the security assessment parameters corresponding to each type of sub-information; according to the security assessment parameters, determine the security assessment result of the target device.

[0106] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the device security assessment method provided by any embodiment of the present invention is implemented, including:

[0107] Obtain information to be detected of the target device; the information to be detected is information associated with the operating parameters of the target device; according to the importance relationship between different types of sub-information in the information to be detected, determine the security assessment parameters corresponding to each type of sub-information; according to the security assessment parameters, determine the security assessment result of the target device.

[0108] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0109] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0110] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0111] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or combinations thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0112] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0113] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A device safety assessment method, characterized in that: include: Acquire information to be detected of the target device; the information to be detected is information associated with operating parameters of the target device; Determine the security assessment parameters corresponding to each type of sub-information according to the importance relationship between different types of sub-information in the information to be detected; A security assessment result of the target device is determined according to the security assessment parameter.

2. The method according to claim 1, characterized in that: The step of determining the security assessment parameters corresponding to each type of sub-information according to the importance relationship between different types of sub-information in the information to be detected includes: For each type of sub-information in the information to be detected, determining an evaluation coefficient and a feature evaluation parameter corresponding to the sub-information; The security evaluation parameter is determined according to the evaluation coefficients and characteristic evaluation parameters of all the sub-information.

3. The method according to claim 2, characterized in that The determining the evaluation coefficient corresponding to the sub-information includes: Determine the importance parameter corresponding to each type of sub-information respectively; wherein the importance parameter is a parameter used to indicate the importance of the sub-information; For the importance parameter corresponding to the target sub-information, the importance parameter corresponding to the target sub-information is compared with the importance parameters corresponding to other sub-information respectively, and the target importance coefficient of the target sub-information relative to each type of other sub-information is determined respectively; An evaluation coefficient corresponding to the target sub-information is determined according to the importance coefficient.

4. The method according to claim 3, characterized in that The determining, according to the importance coefficient, an evaluation coefficient corresponding to the target sub-information includes: Adding the target importance coefficients of the target sub-information relative to each type of other sub-information to obtain a sum of the target importance coefficients; Add up the importance coefficients of all sub-information relative to other sub-information to obtain the total importance coefficient; The sum of the target importance coefficients is compared with the sum of the importance coefficients, and the obtained ratio is used as the evaluation coefficient corresponding to the target sub-information.

5. The method according to claim 1, characterized in that The obtaining of the to-be-detected information of the target device includes: In case of receiving the information detection instruction, determining the device identification information of the target device according to the information detection instruction; According to the device identification information, device operation information corresponding to the device identification information is extracted from a preset database, and the device operation information is used as the information to be detected of the target device.

6. The method according to claim 5, characterized in that Storing the device operation information of the target device in the preset database includes: Obtaining device operation information of the target device; Generate device identification information corresponding to the target device according to the asset area, asset type, asset number and special security code of the target device; Determine, according to the device identification information of the target device, the information code of each type of sub-information in the device operation information; For each type of sub-information in the device operation information, the sub-information is stored in a storage unit corresponding to the preset database according to the information coding of the sub-information.

7. The method according to claim 1, characterized in that The method further comprises: In the case where there is an abnormal assessment result in the security assessment result, log information corresponding to the abnormal assessment result is generated, and according to the abnormal type corresponding to the abnormal assessment result, an emergency mechanism corresponding to the abnormal type is executed; The log information includes at least one of a timestamp, a log identifier, log content information, a log type, an abnormal event, and associated subject information.

8. An equipment safety assessment device, characterized in that: The device comprises: An information acquisition module, used to acquire information to be detected of a target device; the information to be detected is information associated with operating parameters of the target device; An evaluation parameter determination module, used to determine the security evaluation parameters corresponding to each type of sub-information according to the importance relationship between different types of sub-information in the information to be detected; The evaluation result determination module is used to determine the security evaluation result of the target device according to the security evaluation parameter.

9. A computer device, characterized in that: The computer device comprises: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the device security assessment method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the device security assessment method as described in any one of claims 1 to 7 is implemented.

Images