Host infection loss determination method and device, computer equipment, storage medium and computer program product

Abstract

The invention relates to a host infection loss determination method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: respectively determining an infection state corresponding to each host in a target network and a communication relationship among the hosts; constructing an infection constraint condition corresponding to the target network according to the communication relationship between the hosts and the probability of mutual conversion of the hosts between the infection states; solving an infection balance point of a target infection state corresponding to the target network according to the infection state corresponding to each host and the infection constraint condition; and determining infection loss of each host according to the infection state conversion condition of the infection balance point corresponding to each host. By adopting the method, the estimation accuracy of the host loss can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for determining host infection losses. Background Art

[0002] With the rapid development of cloud computing and the Internet, network security issues have become increasingly complex and severe. As one of the main means of network attacks, malware has been evolving and expanding in its propagation methods and impact range, especially in cloud service and cloud network environments. Due to the high interconnectivity and resource sharing characteristics of cloud networks, malware can quickly spread among a wide range of network nodes, posing a serious security threat.

[0003] In order to deal with malware attacks, it is very important to estimate the possible losses that the network may suffer when a malware attack occurs. Related technologies often assume a fixed loss value for such events, but this method relies on the subjective experience of technicians who set the loss value, and there is a problem of insufficient accuracy in estimating the host infection loss. Summary of the invention

[0004] Based on this, it is necessary to provide a method, apparatus, computer device, storage medium and computer program product for determining host infection loss in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for determining host infection loss. The method comprises:

[0006] Determine the infection status of each host in the target network and the communication relationship between the hosts;

[0007] Constructing infection constraint conditions corresponding to the target network according to the communication relationship between the hosts and the probability of the hosts switching between the infection states;

[0008] According to the infection status corresponding to each of the hosts and the infection constraint conditions, solving the infection equilibrium point of the target network corresponding to the target infection status;

[0009] The infection loss of each host is determined according to the infection state conversion of each host corresponding to the infection balance point.

[0010] In one of the embodiments, the infection constraint condition includes at least a host quantity change rate constraint condition for each infection state, and the host quantity change rate constraint condition is used to represent the rate at which the number of hosts in the infection state changes over time.

[0011] In one of the embodiments, the infection state includes at least an uninfected state and an infected state, and the probability of the host switching from the uninfected state to the infected state is used to represent the probability of the host switching from the uninfected state to the infected state when a host having a communication relationship with the host is in the infected state;

[0012] The constructing of infection constraint conditions corresponding to the target network according to the communication relationship between the hosts and the probability of mutual conversion between the infection states includes:

[0013] Constructing a contact probability constraint condition, wherein the contact probability constraint condition is used to characterize the probability that the host in an uninfected state communicates with the host in an infected state;

[0014] According to the probability of transition from the uninfected state to the infected state and the contact probability constraint, a host quantity change rate constraint for the infected state is constructed.

[0015] In one embodiment, solving the infection equilibrium point of the target network corresponding to the target infection state according to the initial infection state and the infection constraint condition includes:

[0016] According to the host number change rate constraint condition corresponding to the target infection state, an infection equilibrium point constraint condition for the target infection state is constructed, and the infection equilibrium point constraint condition is used to indicate that the rate at which the number of hosts in the target infection state changes over time is 0;

[0017] According to the infection balance point constraint condition, the infection status corresponding to each of the hosts, and each infection constraint condition among the infection constraints except the host number change rate constraint condition corresponding to the target infection status, the infection balance point of the target network corresponding to the target infection status is solved.

[0018] In one embodiment, determining the infection loss of each host according to the infection state conversion of each host corresponding to the infection balance point includes:

[0019] For any of the hosts, determining the infection count of the host corresponding to the infection equilibrium point, where the infection count is the number of times the host is converted from an uninfected state to an infected state when reaching the infection equilibrium point;

[0020] The infection loss of each host is determined according to the initial value of each host, the number of infections and the single infection loss.

[0021] In one embodiment, the method further comprises:

[0022] Determine the average infection loss and the variance of the infection loss of the target network according to the infection loss of each host;

[0023] According to the infection loss average value, the infection loss variance and a preset safety factor, the expected loss repair resources for the host in the target network are determined.

[0024] In a second aspect, the present application also provides a host infection loss determination device. The device comprises:

[0025] A first determination module is used to respectively determine the infection status corresponding to each host in the target network and the communication relationship between the hosts;

[0026] A construction module, used to construct infection constraint conditions corresponding to the target network according to the communication relationship between the hosts and the probability of the hosts switching between the infection states;

[0027] A second determination module is used to solve the infection equilibrium point of the target infection state corresponding to the target network according to the infection state corresponding to each of the hosts and the infection constraint condition;

[0028] The third determination module is used to determine the infection loss of each host according to the infection state conversion of each host corresponding to the infection balance point.

[0029] In one of the embodiments, the infection constraint condition includes at least a host quantity change rate constraint condition for each infection state, and the host quantity change rate constraint condition is used to represent the rate at which the number of hosts in the infection state changes over time.

[0030] In one of the embodiments, the infection state includes at least an uninfected state and an infected state, and the probability of the host switching from the uninfected state to the infected state is used to represent the probability of the host switching from the uninfected state to the infected state when a host having a communication relationship with the host is in the infected state;

[0031] The building blocks are also used to:

[0032] Constructing a contact probability constraint condition, wherein the contact probability constraint condition is used to characterize the probability that the host in an uninfected state communicates with the host in an infected state;

[0033] According to the probability of transition from the uninfected state to the infected state and the contact probability constraint, a host quantity change rate constraint for the infected state is constructed.

[0034] In one embodiment, the second determining module is further used to:

[0035] According to the host number change rate constraint condition corresponding to the target infection state, an infection equilibrium point constraint condition for the target infection state is constructed, and the infection equilibrium point constraint condition is used to indicate that the rate at which the number of hosts in the target infection state changes over time is 0;

[0036] According to the infection balance point constraint condition, the infection status corresponding to each of the hosts, and each infection constraint condition among the infection constraints except the host number change rate constraint condition corresponding to the target infection status, the infection balance point of the target network corresponding to the target infection status is solved.

[0037] In one embodiment, the third determination module is further used to:

[0038] For any of the hosts, determining the infection count of the host corresponding to the infection equilibrium point, where the infection count is the number of times the host is converted from an uninfected state to an infected state when reaching the infection equilibrium point;

[0039] The infection loss of each host is determined according to the initial value of each host, the number of infections and the single infection loss.

[0040] In one embodiment, the device further comprises:

[0041] A fourth determination module, configured to determine an average infection loss and an infection loss variance of the target network according to the infection loss of each host;

[0042] The fifth determination module is used to determine the expected loss repair resources for the host in the target network according to the infection loss average value, the infection loss variance and a preset safety factor.

[0043] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, any one of the above methods is implemented.

[0044] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, any of the above methods is implemented.

[0045] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, any of the above methods is implemented.

[0046] The host infection loss determination method, device, computer equipment, storage medium and computer program product described above construct infection constraints corresponding to the target network based on the communication relationship between the hosts and the probability of each host switching between the infection states, and calculate the infection equilibrium point based on the infection constraints, and further calculate the infection loss of each host at the infection equilibrium point. Therefore, it is possible to estimate when the target network will reach the infection equilibrium point based on the actual situation of the target network, and further determine the infection loss based on the actual situation of each host in the target network at the infection equilibrium point, thereby improving the estimation accuracy of the host infection loss. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of a flow chart of a method for determining host infection loss in one embodiment;

[0048] Figure 2 is a flow chart of step 104 in one embodiment;

[0049] Figure 3 A schematic diagram of the mutual conversion of different infection states in one embodiment;

[0050] Figure 4 is a schematic diagram of a target network in one embodiment;

[0051] Figure 5 is a flow chart of step 108 in one embodiment;

[0052] Figure 6 A schematic diagram of a process for determining expected loss repair resources in one embodiment;

[0053] Figure 7 It is a structural block diagram of a host infection loss determination device in one embodiment;

[0054] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] In one embodiment, Figure 1 As shown, a method for determining host infection loss is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0057] Step 102, respectively determine the infection status of each host in the target network and the communication relationship between the hosts.

[0058] In the embodiment of the present application, the target network can be an undivided network or can be divided into multiple subnets. Each host is a host in the target network. The infection status of each host can be set by a person skilled in the art according to the actual situation of the target network. Exemplarily, the infection status can at least include an uninfected state (the host is not infected with malware) and an infected state (the host is infected with malware). Depending on the different situations of the target network, it can also include a protection state (the host is installed with security software, and the probability of infection is reduced), a monitoring state (monitoring the infected host so that the host has a certain probability of being repaired), an immune state (the infected host will not be infected with malware after being repaired), etc., which are not specifically limited in the embodiment of the present application.

[0059] The communication relationship between two hosts means that the two hosts can communicate with each other, and the two hosts may transmit malware to each other through communication. If the analysis is performed on a specific target network, the actual communication status of each host in the target network can be obtained as the communication relationship between the hosts. If the analysis is performed on an unspecified target network, the target network can be modeled as a scale-free network, that is, the connectivity distribution of the network nodes follows a power-law distribution, and the communication relationship between the hosts is set according to the connectivity of the network nodes in the scale-free network.

[0060] After obtaining the infection status and communication relationship between each host, the target network can be represented as a graph. The nodes in the graph represent hosts, the edges between nodes represent the communication relationship between hosts, and the value of the edge can represent the probability of the host being infected through the communication relationship. After constructing the graph, the adjacency matrix of the graph can also be obtained to facilitate the subsequent calculation of the infection equilibrium point.

[0061] Step 104: construct infection constraint conditions corresponding to the target network based on the communication relationship between the hosts and the probability of the hosts switching between the infection states.

[0062] In the embodiment of the present application, the probability of the host switching between the infection states can be set by a person skilled in the art according to actual needs. For example, when the infection state includes an uninfected state and an infected state, it can be set that the probability of the host in the uninfected state switching between the infection states is 100% after contacting with other infected hosts. The probability of being infected, that is, the probability of transition from the uninfected state to the infected state is ; You can also set the malware in the infected host to The probability of being eliminated, that is, the probability of the infected state converting to the uninfected state is When other infection states exist, those skilled in the art may also set the probability of conversion between other infection states according to actual needs.

[0063] Infection constraints refer to conditions that need to be met when malware spreads in a target network. Exemplarily, the infection constraints may include a total host number constraint, which is used to indicate that at any time, the sum of the number of hosts corresponding to different infection states in the target network is equal to the original number of hosts in the target network. The infection constraints may also include a host number change rate constraint for each infection state, which is used to indicate the rate at which the number of hosts in an infected state changes over time. For example, when the infection state includes an uninfected state and an infected state, the host number change rate constraint corresponding to the infected state may be set to the host number change rate corresponding to the infected state, which is equal to the product of the probability of transition from the uninfected state to the infected state and the number of hosts in the uninfected state.

[0064] In one embodiment, Figure 2 As shown, when the infection state includes at least an uninfected state and an infected state, the probability of the host converting from the uninfected state to the infected state is used to represent the probability of the host converting from the uninfected state to the infected state when the host having a communication relationship with the host is in the infected state; according to the communication relationship between the hosts and the probability of conversion between the infection states, the infection constraint conditions corresponding to the target network are constructed, including:

[0065] Step 202, constructing a contact probability constraint condition, where the contact probability constraint condition is used to characterize the probability of a host in an uninfected state communicating with a host in an infected state;

[0066] Step 204: construct a host quantity change rate constraint condition for the infected state based on the probability of transition from the uninfected state to the infected state and the contact probability constraint condition.

[0067] In an embodiment of the present application, since when a host that has a communication relationship with the host is in an infected state, the probability of the host converting from an uninfected state to an infected state is also related to the probability of the host contacting the host in the infected state, when constructing a constraint on the rate of change of the number of hosts in the infected state, a contact probability constraint can be constructed first, and then, based on the probability of conversion from the uninfected state to the infected state and the contact probability constraint, a constraint on the rate of change of the number of hosts in the infected state is constructed.

[0068] Since the more hosts a host can communicate with, the smaller the probability that the host will contact an infected host after a host that has a communication relationship with the host is in an infected state, the contact probability constraint condition can be made related to the number of hosts a host can communicate with. As shown in formula (1):

[0069] Formula (I)

[0070] in, It refers to the probability that a host in an uninfected state (this host) contacts an infected host at time t. It is the number of hosts with which this host can communicate. is the number of hosts in the target network that are in an infected state and can communicate with i hosts, n is the maximum number of hosts that can communicate with i in the target network, is the probability that a host with i as the number of communicable hosts can communicate with this host.

[0071] Therefore, the constraint condition for the change rate of the number of hosts in the infected state can be: the change rate of the number of hosts in the infected state is equal to the product of the probability of the host switching from the uninfected state to the infected state, the contact probability constraint condition, and the number of hosts in the uninfected state. See formula (2):

[0072] Formula (II)

[0073] in, It refers to the number of hosts in the target network that are not infected and can communicate with i hosts.

[0074] It should be noted that, as the number of hosts in the uninfected state increases due to the conversion of hosts in the uninfected state to the infected state, the number of hosts in the uninfected state will also decrease accordingly. Therefore, when the conversion of hosts in the infected state to the uninfected state is not considered, the constraint condition for the rate of change of the number of hosts in the uninfected state can be: the rate of change of the number of hosts in the uninfected state is equal to the negative probability of the host converting from the uninfected state to the infected state.

[0075] In one embodiment, the infection state also includes a protection state, a monitoring state, and an immune state;

[0076] The probability of transitioning from the uninfected state to the protected state is used to indicate the probability that the vulnerability in the uninfected host is repaired by the security software; the probability of transitioning from the protected state to the infected state is used to indicate the probability that malware breaks through the security software protection and attacks the vulnerability; the probability of transitioning from the protected state to the uninfected state is used to indicate the probability that the security software successfully fights against the malware;

[0077] The probability of transitioning from the uninfected state to the monitored state is used to indicate the probability that a host in the uninfected state is monitored; the probability of transitioning from the infected state to the monitored state is used to indicate the probability that a host in the infected state is monitored; the probability of transitioning from the monitored state to the immune state is used to indicate the probability that a host in the monitored state is immune to malware attacks by patching;

[0078] The probability of transitioning from the immune state to the uninfected state is used to indicate the probability of patch failure for hosts in the immune state.

[0079] In the embodiment of the present application, three new infection states are set to indicate the states of common hosts in the network against malware: protection state, monitoring state, and immune state. The protection state is used to indicate that security software is installed on an uninfected host, and the security software can preferentially discover and repair vulnerabilities that may be exploited by malware. That is, a host in a protection state is a host with certain protection capabilities. Correspondingly, in the embodiment of the present application, the uninfected state in the aforementioned embodiment is defined as a host that does not have security software installed and can be infected by malware using vulnerabilities.

[0080] The monitoring status is used to indicate that the monitoring software in the network has monitored the host. The monitoring software has a certain probability of changing the host to an immune state through antivirus, patching, etc.

[0081] The immune state is used to indicate that the host will not be infected by malware, but there is a certain probability that the patch will fail, causing the host in the immune state to be converted to a host in the uninfected state.

[0082] In one embodiment, the target network includes at least two subnets, and when hosts in different subnets communicate with each other, the probability of the host transitioning from an uninfected state to an infected state is different from the probability of the host transitioning from an uninfected state to an infected state when hosts in the same subnet communicate with each other.

[0083] In the embodiment of the present application, in order to be more in line with the actual network conditions, different probabilities of transition from an uninfected state to an infected state can be set for the situations of communication between different subnets and the situations of communication between the same subnets. Because communication between different subnets generally needs to go through a gateway, and some subnets need to use different communication protocols when communicating, the probability of malware spreading between different subnets is generally smaller than the probability of malware spreading between the same subnets.

[0084] The infection status below includes the above five infection statuses (uninfected, protected, infected, monitored, and immune). The target network has two subnets: subnet A and subnet B (see the diagram for details). Figure 4) as an example, an example of various infection constraints for the target network is provided. The various parameters in the infection constraint conditions are shown in Table 1 below:

[0085] Table 1

[0086]

[0087] The degree value refers to the number of hosts in different subnets that have a communication relationship with the host. The degree value (i, j) means that the host is located in subnet A, the number of hosts in subnet A that have a communication relationship with the host is i, and the number of hosts in subnet B that have a communication relationship with the host is j. Similarly, the degree value (k, l) means that the host is located in subnet B, the number of hosts in subnet A that have a communication relationship with the host is k, and the number of hosts in subnet B that have a communication relationship with the host is l. Based on the above parameters, the following formula (III) can be constructed to construct the host number change rate constraint for each infection state. The schematic diagram of the conversion between each infection state can also be seen Figure 3 :

[0088] Formula (III)

[0089] The basic principle of the above formula (III) is that the rate of change of the number of hosts corresponding to a certain infection state is equal to the sum of the rate of change of other infection states to this infection state and the rate of change of this infection state to other infection states. (m, n is A or B) refers to the contact probability constraint between the host in subnet m and the host in subnet n, see formula (IV):

[0090] Formula (IV)

[0091] in, (m, n is A or B) refers to the number of hosts in subnet n that have a communication relationship with this host when the host is in subnet m. is the maximum value of degree i in subnet A. Similarly is the maximum value of j, is the maximum value of k, is the maximum value of l. is the probability that the host with degree (i, j) communicates with the host in subnet A. The meanings of other parameters are similar and will not be described in detail in the embodiments of the present application.

[0092] On the basis of the above formula (III), the total number of hosts can be constrained, that is, the total number of hosts in subnet A remains unchanged, the total number of hosts in subnet B remains unchanged, and the degree of the host remains unchanged. See formula (V):

[0093] Formula (V)

[0094] in, is the total number of hosts in subnet A, Refers to the total number of hosts with degree (i, j) in subnet A. The meanings of other parameters are similar.

[0095] Step 106, according to the infection status and infection constraint conditions corresponding to each host, the infection equilibrium point corresponding to the target infection status of the target network is solved.

[0096] In an embodiment of the present application, the infection state initially set for each host is substituted into the infection constraint condition, and after solving each infection constraint condition, the infection balance point corresponding to a certain target infection state can be solved. The infection balance point is the time point when the number of hosts in the target infection state no longer changes, or the time point when the number of hosts in the target infection state no longer changes and the number of hosts in the target infection state reaches a preset number. For example, when the infection balance point to be solved is a disease balance point, the infection balance point is the time point when the number of hosts in the infected state no longer changes. When the infection balance point to be solved is a disease-free balance point, the infection balance point is the time point when the number of hosts in the infected state no longer changes and the number of hosts in the infected state is 0.

[0097] In one embodiment, when the infection constraint condition includes at least a constraint condition on the rate of change of the number of hosts in each infection state, the infection equilibrium point can be obtained by solving the following method:

[0098] According to the host number change rate constraint corresponding to the target infection state, the infection equilibrium point constraint for the target infection state is constructed. The infection equilibrium point constraint is used to indicate that the rate at which the number of hosts in the target infection state changes over time is 0;

[0099] According to the infection equilibrium point constraint conditions, the infection status corresponding to each host, and each infection constraint condition except the host number change rate constraint condition corresponding to the target infection status, the infection equilibrium point of the target network corresponding to the target infection status is solved.

[0100] In the embodiment of the present application, when it is necessary to solve the infection balance point corresponding to the target infection state, the infection balance point constraint condition for the target infection state can be first constructed according to the host number change rate constraint condition corresponding to the target infection state, that is, the host number change rate in the target infection state is 0. For example, when using the infection constraint condition shown in formula (III), if it is necessary to solve the infection balance point (disease balance point) of the target network corresponding to the infected state, the value on the left side of the host number change rate constraint condition corresponding to the infected state can be set to 0 to indicate that the host number change rate in the infected state is 0, and the infection balance point constraint condition for the infected state is obtained.

[0101] Furthermore, after substituting the infection state initially set for each host into each other infection constraint condition and infection equilibrium point constraint condition, the infection constraint condition and infection equilibrium point constraint condition can be solved. If a valid solution is successfully obtained after the solution, it means that the target infection state has a corresponding infection equilibrium point, and the solution result is the infection equilibrium point. If a valid solution cannot be obtained after the solution, it means that the target infection state does not have a corresponding infection equilibrium point.

[0102] In one embodiment, the method further includes:

[0103] According to the probability of each host switching between different infection states, the transfer matrix of the target network is constructed;

[0104] According to the preset new infection matrix and transfer matrix, the reproduction matrix of the target network is determined, the basic reproduction number is determined according to the characteristic spectrum of the reproduction matrix, and the stable trend of the disease-free equilibrium point of the target network is determined according to the basic reproduction number.

[0105] In the embodiment of the present application, it is possible to determine whether the target network is likely to reach a disease-free equilibrium point by referring to the concept of epidemiology. The transfer matrix of the target network can be constructed based on the probability of each host switching between each infection state. The new infection matrix is ​​constructed based on the probability that a host in an uninfected state becomes a host in an infected state without contacting a host in an infected state. The probability can be set in advance.

[0106] According to the new infection matrix and the transfer matrix, the regeneration matrix can be determined, see formula (VI):

[0107] Formula (VI)

[0108] in, is the reproduction matrix, F is the new infection matrix, is the transfer matrix.

[0109] According to the characteristic spectrum of the reproduction matrix, the basic reproduction number can be obtained, that is, .when When <1, the target network may reach a disease-free equilibrium point. When >1, the target network cannot stably maintain the disease-free equilibrium state.

[0110] Step 108, determining the infection loss of each host according to the infection state conversion of each host corresponding to the infection balance point.

[0111] In the embodiment of the present application, the infection loss of the host can be analyzed according to the infection state conversion of the host corresponding to the infection balance point. For example, when the infection state includes an uninfected state, a protection state, and an infected state, the resource overhead of the security software can be set to a when the host is converted from an uninfected state to a protection state, and the information loss of the host can be set to b when the host is converted from an uninfected state to an infected state, or from a protection state to an infected state. Then, the infection loss of the host is determined according to the number of times the host is converted from an uninfected state to a protection state, from an uninfected state to an infected state, and from a protection state to an infected state when reaching the infection balance point, as well as the loss caused by the conversion between different infection states.

[0112] In one embodiment, Figure 5 As shown, the infection loss of each host is determined according to the infection state conversion of each host corresponding to the infection balance point, including:

[0113] Step 502, for any host, determining the infection count of the host corresponding to the infection balance point, where the infection count is the number of times the host changes from an uninfected state to an infected state when reaching the infection balance point;

[0114] Step 504, determining the infection loss of each host according to the initial value, infection times and single infection loss of each host.

[0115] In the embodiment of the present application, the number of times a host changes from an uninfected state to an infected state is analyzed. A simulation model can be constructed according to the infection constraint conditions of the aforementioned embodiment, and the number of infections of the host corresponding to the infection equilibrium point can be calculated by making the simulation model simulate the infection state conversion of each host in the target network from the initial moment to the infection equilibrium point.

[0116] The initial value of a host can be proportional to the number of other hosts that have communication relationships with the host, because the more hosts a host can communicate with, the more important it is. The loss of a single infection can be related to the direct loss of information lost by the host due to infection and the time required to recover from the infection state. See formula (VII):

[0117] Formula (VII)

[0118] in, is the infection loss of host i corresponding to the infection equilibrium point, is the number of infections of host i, is the single infection loss, where is the direct loss of infection for the mth infection, is the indirect loss of infection for the mth infection.

[0119] The direct loss of infection can be modeled by random cost. The random cost can be related to the initial value of the host. For example, formula (8):

[0120] Formula (8)

[0121] in is the direct loss cost rate caused by malware, is a function of x, where x is the information loss of host i is the initial value of the host. B(a,b) is the Beta function, B(a,b)= ,in , a, b> 0. Formula (8) assumes that the ratio of information loss to initial value follows Beta distribution, and the initial value and direct infection loss are independent of each other.

[0122] Initial value reference formula (IX):

[0123] Formula (IX)

[0124] in, is the coefficient, and k is the number of other hosts that have a communication relationship with this host.

[0125] The indirect loss of infection is positively correlated with the host's recovery time. See formula (10):

[0126] Formula (10)

[0127] in, It is the value that the host can generate during the recovery period. is the recovery time cost rate, is the coefficient, k is the number of other hosts that have communication relationships with this host (assuming that the value that a host can generate is proportional to the number of hosts it can communicate with), It is the recovery time. Used to relate the indirect cost of infection to the initial value of the host. is the initial cost rate.

[0128] Therefore, the total infection loss of all hosts in the target network can be found in formula (XI):

[0129] Formula (XI)

[0130] Among them, N is the total number of hosts in the target network, and M is a parameter used to simulate the additional loss caused to the target network by host infection in addition to the infection loss of each host.

[0131] In one embodiment, Figure 6 As shown, the above method also includes:

[0132] Step 602, determining the average infection loss and the infection loss variance of the target network according to the infection loss of each host;

[0133] Step 604: Determine expected loss repair resources for hosts in the target network based on the infection loss average, the infection loss variance, and a preset safety factor.

[0134] In the embodiment of the present application, the infection loss of the host calculated in the above embodiment can be used to estimate how much resources are needed to repair each host in the target network, so that the server can reserve these resources to repair the host, and at the same time, the server can use other resources normally to perform other services. The estimated expected loss repair resources should have a certain margin in addition to covering the infection loss of the host, so as to avoid the situation where the reserved expected loss repair resources are less than the actual infection loss, affecting the host repair.

[0135] The embodiment of the present application uses the average value of infection loss as the repair resource reserved by the server for each host. And uses the product of the preset safety factor and the infection loss variance as the margin reserved by the server. Therefore, the expected loss repair resource is the sum of the average value of infection loss and the product of the preset safety factor and the infection loss variance, see formula (XII):

[0136] Formula (12)

[0137] in, is the expected loss repair resource, is the average infection loss, is the preset safety factor, is the infection loss variance.

[0138] In addition to being applied to the case where the server reserves resources for host repair, the above method can also be applied to the case where the insurance company sets premiums for the target network. The premium is set by the insurance company. By setting the premium for the target network through the above method, the insurance company can better reflect the actual risk when pricing, and at the same time ensure that both direct losses and indirect losses can be reasonably covered within the insurance scope.

[0139] The host infection loss determination method provided in the embodiment of the present application constructs the infection constraint conditions corresponding to the target network according to the communication relationship between the hosts and the probability of each host switching between the infection states, and calculates the infection equilibrium point according to the infection constraint conditions, and further calculates the infection loss of each host at the infection equilibrium point. Therefore, it is possible to estimate when the target network can reach the infection equilibrium point according to the actual situation of the target network, and further determine the infection loss according to the actual situation of each host in the target network at the infection equilibrium point, thereby improving the estimation accuracy of the host infection loss.

[0140] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0141] Based on the same inventive concept, the embodiment of the present application also provides a host infection loss determination device for implementing the host infection loss determination method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more host infection loss determination device embodiments provided below can refer to the limitations of the host infection loss determination method above, and will not be repeated here.

[0142] In one embodiment, Figure 7 As shown, a host infection loss determination device 700 is provided, comprising: a first determination module 702, a construction module 704, a second determination module 706, and a third determination module 708, wherein:

[0143] The first determination module 702 is used to respectively determine the infection status corresponding to each host in the target network and the communication relationship between the hosts;

[0144] A construction module 704 is used to construct infection constraint conditions corresponding to the target network according to the communication relationship between the hosts and the probability of the hosts switching between the infection states;

[0145] The second determination module 706 is used to solve the infection equilibrium point of the target infection state corresponding to the target network according to the infection state corresponding to each of the hosts and the infection constraint condition;

[0146] The third determination module is used to determine the infection loss of each host according to the infection state conversion of each host corresponding to the infection balance point.

[0147] In one of the embodiments, the infection constraint condition includes at least a host quantity change rate constraint condition for each infection state, and the host quantity change rate constraint condition is used to represent the rate at which the number of hosts in the infection state changes over time.

[0148] In one of the embodiments, the infection state includes at least an uninfected state and an infected state, and the probability of the host switching from the uninfected state to the infected state is used to represent the probability of the host switching from the uninfected state to the infected state when a host having a communication relationship with the host is in the infected state;

[0149] The building block 704 is further used for:

[0150] Constructing a contact probability constraint condition, wherein the contact probability constraint condition is used to characterize the probability that the host in an uninfected state communicates with the host in an infected state;

[0151] According to the probability of transition from the uninfected state to the infected state and the contact probability constraint, a host quantity change rate constraint for the infected state is constructed.

[0152] In one embodiment, the second determining module 706 is further configured to:

[0153] According to the host number change rate constraint condition corresponding to the target infection state, an infection equilibrium point constraint condition for the target infection state is constructed, and the infection equilibrium point constraint condition is used to indicate that the rate at which the number of hosts in the target infection state changes over time is 0;

[0154] According to the infection balance point constraint condition, the infection status corresponding to each of the hosts, and each infection constraint condition among the infection constraints except the host number change rate constraint condition corresponding to the target infection status, the infection balance point of the target network corresponding to the target infection status is solved.

[0155] In one embodiment, the third determination module 708 is further configured to:

[0156] For any of the hosts, determining the infection count of the host corresponding to the infection equilibrium point, where the infection count is the number of times the host is converted from an uninfected state to an infected state when reaching the infection equilibrium point;

[0157] The infection loss of each host is determined according to the initial value of each host, the number of infections and the single infection loss.

[0158] In one embodiment, the device further comprises:

[0159] A fourth determination module, configured to determine an average infection loss and an infection loss variance of the target network according to the infection loss of each host;

[0160] The fifth determination module is used to determine the expected loss repair resources for the host in the target network according to the infection loss average value, the infection loss variance and a preset safety factor.

[0161] Each module in the above device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0162] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a host infection loss determination method is implemented.

[0163] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0164] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0165] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0166] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0167] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0168] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0169] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0170] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for determining host infection loss, characterized in that: The method comprises: Determine the infection status of each host in the target network and the communication relationship between the hosts; Constructing infection constraint conditions corresponding to the target network according to the communication relationship between the hosts and the probability of the hosts switching between the infection states; According to the infection status corresponding to each of the hosts and the infection constraint conditions, solving the infection equilibrium point of the target network corresponding to the target infection status; The infection loss of each host is determined according to the infection state conversion of each host corresponding to the infection balance point.

2. The method according to claim 1, characterized in that The infection constraint condition at least includes a host quantity change rate constraint condition for each infection state, and the host quantity change rate constraint condition is used to represent the rate at which the number of hosts in the infection state changes over time.

3. The method according to claim 2, characterized in that The infection state includes at least an uninfected state and an infected state, and the probability of the host switching from the uninfected state to the infected state is used to represent the probability of the host switching from the uninfected state to the infected state when a host having a communication relationship with the host is in the infected state; The infection constraint conditions corresponding to the target network are constructed according to the communication relationship between the hosts and the probability of the hosts switching between the infection states, including: Constructing a contact probability constraint condition, wherein the contact probability constraint condition is used to characterize the probability that the host in an uninfected state communicates with the host in an infected state; According to the probability of transition from the uninfected state to the infected state and the contact probability constraint, a host quantity change rate constraint for the infected state is constructed.

4. The method according to claim 2, characterized in that: The step of solving the infection equilibrium point of the target network corresponding to the target infection state according to the infection state corresponding to each of the hosts and the infection constraint condition includes: According to the host number change rate constraint condition corresponding to the target infection state, an infection equilibrium point constraint condition for the target infection state is constructed, and the infection equilibrium point constraint condition is used to indicate that the rate at which the number of hosts in the target infection state changes over time is 0; According to the infection balance point constraint condition, the infection status corresponding to each of the hosts, and each infection constraint condition among the infection constraints except the host number change rate constraint condition corresponding to the target infection status, the infection balance point of the target network corresponding to the target infection status is solved.

5. The method according to claim 1, characterized in that The determining the infection loss of each host according to the infection state conversion of each host corresponding to the infection balance point includes: For any of the hosts, determining the infection count of the host corresponding to the infection equilibrium point, where the infection count is the number of times the host is converted from an uninfected state to an infected state when reaching the infection equilibrium point; The infection loss of each host is determined according to the initial value of each host, the number of infections and the single infection loss.

6. The method according to claim 1, characterized in that The method further comprises: Determine the average infection loss and the variance of the infection loss of the target network according to the infection loss of each host; According to the infection loss average value, the infection loss variance and a preset safety factor, the expected loss repair resources for the host in the target network are determined.

7. A host infection loss determination device, characterized in that: The device comprises: A first determination module is used to respectively determine the infection status corresponding to each host in the target network and the communication relationship between the hosts; A construction module, used to construct infection constraint conditions corresponding to the target network according to the communication relationship between the hosts and the probability of the hosts switching between the infection states; A second determination module is used to solve the infection equilibrium point of the target infection state corresponding to the target network according to the infection state corresponding to each of the hosts and the infection constraint condition; The third determination module is used to determine the infection loss of each host according to the infection state conversion of each host corresponding to the infection balance point.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images