Network asset risk monitoring management system and method

Abstract

The invention discloses a network asset risk monitoring management system and method, and relates to the technical field of network asset management, and the method comprises the steps: collecting the data of network assets in real time according to preset network asset parameters; constructing asset risk analysis characteristics according to the network asset parameters, preprocessing the data of the network assets, and calculating values of the asset risk analysis characteristics according to the preprocessed data of the network assets; asset risk analysis features are combined to form feature vectors, and a comprehensive risk coefficient is calculated through multi-dimensional nonlinear combination and weight adjustment; and setting a threat level threshold according to the comprehensive risk coefficient, judging the risk level of the current asset, and executing a monitoring management strategy according to the risk level. Through real-time dynamic monitoring, multi-dimensional risk feature analysis, a flexible risk level adjustment mechanism and accurate threat identification and response, an efficient, accurate and flexible security risk management method is provided for network assets, and the accuracy of risk assessment and the response capability of management are effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network asset management, and in particular to a monitoring and management system and method for network asset risks. Background Art

[0002] With the rapid development of information technology, the types and quantity of network assets of enterprises and organizations are increasing, including servers, databases, applications, etc. However, with the increase of network assets, the security risks they face are becoming increasingly complex. In the existing technology, traditional network security management methods mainly rely on static security policies and manual monitoring, which is difficult to cope with complex and changing network environments and sudden security incidents. In particular, when facing abnormal access, abnormal traffic and external attacks, there is a lack of effective real-time monitoring and evaluation mechanisms, resulting in the inability to fully guarantee the security of network assets.

[0003] Some existing network asset risk assessment methods are usually based on single parameter analysis, which makes it difficult to comprehensively consider multi-dimensional risk factors and cannot dynamically adjust the results of risk assessment. This inflexible assessment method is prone to misjudgment, which may miss potential security threats and may also generate false alarms for normal network behaviors, increasing the complexity of management. Summary of the invention

[0004] Based on the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a monitoring and management system and method for network asset risks to solve the above-mentioned technical problems.

[0005] To achieve the above-mentioned purpose, the present invention provides the following technical solution: a method for monitoring and managing network asset risks, comprising:

[0006] Collecting network asset operation data and access behavior data in real time according to preset network asset parameters, where the access behavior data includes external access data and internal access data;

[0007] Constructing asset risk analysis features according to network asset parameters, preprocessing the operation data and access behavior data, and calculating the value of the asset risk analysis features according to the preprocessed operation data and access behavior data, wherein the asset risk analysis features include asset vulnerability features, abnormal behavior frequency features, external threat association features, and internal access abnormality features;

[0008] The asset risk analysis features are combined to form a feature vector, and a comprehensive risk coefficient is calculated through multi-dimensional nonlinear combination and weight adjustment;

[0009] Set the threat level threshold based on the comprehensive risk factor, determine the risk level of the current assets, and implement monitoring and management strategies based on the risk level.

[0010] The present invention is further configured such that the operation data includes the number of network asset connections, the number of interfaces, the traffic multiples, the abnormal trigger intensity, the abnormal response time and the event duration; the external access data includes the threat level coefficient and the external response rate; the internal access data includes the internal access path, the internal access frequency, the access permission level and the internal delay time.

[0011] The present invention is further configured to construct asset risk analysis features based on network asset parameters, including:

[0012] Calculate asset vulnerability characteristics based on the number of network asset connections, number of interfaces, and traffic multiples;

[0013] Calculate the frequency characteristics of abnormal behavior based on abnormal trigger intensity, abnormal response time and event duration;

[0014] Calculate external threat correlation characteristics based on threat level coefficient and external response rate;

[0015] Calculate internal access anomaly characteristics based on internal access path, internal access frequency, access permission level, and internal delay time.

[0016] The present invention is further configured such that the calculation logic of the asset vulnerability feature is: Among them, V is the asset vulnerability characteristic, T is the time period, a is the number of network asset connections, b is the number of interfaces, c represents the traffic multiplier, which is the ratio of the current traffic to the baseline traffic, γ is the vulnerability amplification index, λ is the attenuation coefficient, η is the adjustment factor, and θ is the traffic fluctuation frequency.

[0017] The present invention is further configured such that the calculation logic of the abnormal behavior frequent occurrence feature is: Among them, A is the frequent occurrence feature of abnormal behavior, N is the number of abnormal events, Γ n is the abnormal trigger intensity, indicating the intensity of the nth abnormal event, α is the modulation factor, Δr n Indicates the abnormal response time difference, which is the difference between the actual response time and the benchmark response time. n is the abnormal event category weight, which indicates the impact of different types of abnormalities on the frequent occurrence characteristics of abnormal behaviors, σ is the time delay coefficient, φ n is the event duration, ψ is the reference duration, ξ n is the event fluctuation parameter.

[0018] The present invention is further configured such that the calculation logic of the external threat association feature is: Among them, E is the external threat association feature, L is the time interval, δ is the threat level coefficient, i is the number of external accesses, ω is the association frequency coefficient, χ is the successful access rate, j is the number of external threat events, ν is the environmental impact attenuation factor, τ is the time attenuation adjustment coefficient, k is the external response rate, ζ is the access delay weight, and l is the environmental fluctuation correction value.

[0019] The present invention is further configured such that the calculation logic of the internal access abnormality feature is: Among them, I is the internal access anomaly feature, R is the internal access path set, m is the internal access frequency, dr is the access permission level, o is the number of access path nodes, σ is the normalization parameter used to balance the path complexity calculation results, q is the internal delay time, r is the delay difference coefficient, and u is the standard response time.

[0020] The present invention is further configured such that the calculation logic of the comprehensive risk coefficient is: Among them, Ddr is the comprehensive risk coefficient, T is the time period, V is the asset vulnerability characteristic, A is the frequent occurrence characteristic of abnormal behavior, E is the external threat association characteristic, and I is the internal access abnormality characteristic.

[0021] The present invention is further configured to set a threat level threshold according to the comprehensive risk factor, determine the risk level of the current asset, and execute a monitoring management strategy according to the risk level, including:

[0022] When the comprehensive risk factor is greater than the first threat level threshold, the current network asset is marked as high risk, the network interface of the high-risk network asset is closed, and access is denied;

[0023] When the traffic threat analysis coefficient is less than or equal to the first threat level threshold and greater than the second threat level threshold, the current network asset is marked as medium risk, the monitoring frequency is increased, and an alarm signal is generated to notify the security management personnel to conduct risk analysis;

[0024] When the traffic threat analysis coefficient is less than or equal to the second threat level threshold, the current network asset is marked as low risk and access to the network asset is allowed.

[0025] The present invention also provides a monitoring and management system for network asset risks, the system comprising:

[0026] Data collection module: collects the operation data and access behavior data of network assets in real time according to the preset network asset parameters, wherein the access behavior data includes external access data and internal access data;

[0027] Feature construction module: constructs asset risk analysis features according to network asset parameters, preprocesses the operation data and access behavior data, and calculates the value of the asset risk analysis features according to the preprocessed operation data and access behavior data, wherein the asset risk analysis features include asset vulnerability features, abnormal behavior frequency features, external threat association features, and internal access abnormality features;

[0028] Risk calculation module: combines the asset risk analysis features to form a feature vector, and calculates the comprehensive risk coefficient through multi-dimensional nonlinear combination and weight adjustment;

[0029] Strategy execution module: Sets the threat level threshold according to the comprehensive risk factor, determines the risk level of the current asset, and executes the monitoring management strategy according to the risk level.

[0030] The present invention provides a monitoring and management system and method for network asset risks. The method collects operation data and access behavior data of network assets in real time according to preset network asset parameters, wherein the access behavior data includes external access data and internal access data; constructs asset risk analysis features according to the network asset parameters, preprocesses the operation data and access behavior data, and calculates the value of the asset risk analysis features according to the preprocessed operation data and access behavior data, wherein the asset risk analysis features include asset vulnerability features, abnormal behavior frequency features, external threat association features, and internal access abnormality features; combines the asset risk analysis features to form a feature vector, and calculates a comprehensive risk coefficient through multi-dimensional nonlinear combination and weight adjustment; sets a threat level threshold according to the comprehensive risk coefficient, determines the risk level of the current asset, and executes a monitoring and management strategy according to the risk level, and the beneficial effects produced include:

[0031] 1. Multi-dimensional risk feature analysis: The method of the present invention can integrate multiple risk features, use multi-dimensional nonlinear combination and weight adjustment to conduct comprehensive risk assessment. By introducing multi-dimensional risk assessment indicators, it significantly improves the ability to capture complex risk factors and reduces the probability of misjudgment and missed judgment;

[0032] 2. Flexible risk level adjustment mechanism: The present invention sets multi-level risk level thresholds, automatically adjusts the risk level according to the comprehensive risk coefficient, and realizes dynamic management of risk level. The level adjustment mechanism of the present invention can flexibly respond to different risk states according to real-time calculation results, thereby improving the flexibility and pertinence of risk management;

[0033] 3. Accurate threat identification and response: The present invention can accurately identify common network abnormal events such as abnormal traffic and sudden connections through feature value calculation and abnormal feature extraction, and automatically trigger corresponding management measures based on risk levels, thereby improving the accuracy of identifying security threats and reducing interference with normal network behavior.

[0034] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0036] Figure 1 A flowchart of a method for monitoring and managing network asset risks shown as an exemplary embodiment of the present invention;

[0037] Figure 2 The present invention is a schematic structural diagram of a network asset risk monitoring and management system according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0038] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0039] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0040] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0041] Embodiment 1

[0042] Monitoring and management methods for network asset risks, such as Figure 1 As shown, including:

[0043] Collecting network asset operation data and access behavior data in real time according to preset network asset parameters, where the access behavior data includes external access data and internal access data;

[0044] Constructing asset risk analysis features according to network asset parameters, preprocessing the operation data and access behavior data, and calculating the value of the asset risk analysis features according to the preprocessed operation data and access behavior data, wherein the asset risk analysis features include asset vulnerability features, abnormal behavior frequency features, external threat association features, and internal access abnormality features;

[0045] The asset risk analysis features are combined to form a feature vector, and a comprehensive risk coefficient is calculated through multi-dimensional nonlinear combination and weight adjustment;

[0046] Set the threat level threshold based on the comprehensive risk factor, determine the risk level of the current assets, and implement monitoring and management strategies based on the risk level.

[0047] The present invention is further configured such that the operation data includes the number of network asset connections, the number of interfaces, the traffic multiples, the abnormal trigger intensity, the abnormal response time and the event duration; the external access data includes the threat level coefficient and the external response rate; the internal access data includes the internal access path, the internal access frequency, the access permission level and the internal delay time.

[0048] Specifically, operation data is used to directly reflect the current status and potential vulnerabilities of network assets. By collecting this data, the operation characteristics of assets under normal and abnormal conditions can be evaluated, providing a basis for risk assessment; Network asset connection number: indicates the number of connections that network assets currently have with other devices or services, reflecting the network activity of assets. The more connections there are, the greater the exposure of the asset and the higher the potential risk; Number of interfaces: refers to the number of network interfaces opened by network assets. The more open interfaces, the more vulnerable the asset is to unauthorized access or attack; Traffic multiples: the ratio of actual traffic to baseline traffic, reflecting the change in traffic. Abnormal traffic multiples may indicate risks such as DDoS attacks and data leaks; Abnormal trigger intensity: measures the intensity or impact of abnormal events when they occur, such as a sudden increase in CPU usage or a surge in traffic, indicating that the system is processing sudden high loads or malicious activities; Abnormal response time: the length of time it takes for the system to respond after an abnormal event occurs. A longer delayed response time may reflect insufficient system processing capabilities or performance pressure; Event duration: the duration of each abnormal event from start to end. Abnormalities with longer durations usually mean more serious risks, such as ongoing data leaks or internal abuse. External access data is used to analyze the interaction between network assets and the outside world, and to assess the impact of external threats on assets. It is an important data source for external threat correlation characteristics. Threat level coefficient: Quantify the threat level of external access requests based on their nature and source. A high threat level may indicate a known malicious IP, frequent scanning attacks, or unauthorized access attempts. External response rate: refers to the speed at which network assets respond to external access requests. Abnormal rates may indicate large-scale access or attacks, such as external high-frequency scanning, DDoS attacks, etc. Internal access data focuses on the access behavior of internal users or systems, assessing whether there are non-compliant access patterns or abnormal behaviors, thereby constructing internal access abnormality characteristics. Internal access path: describes the path taken by internal visitors in the network, including the nodes visited and the number of hops. High path complexity may indicate that conventional access controls have been bypassed or there are signs of lateral movement; Internal access frequency: the frequency with which internal users or systems access network assets. High-frequency access may be related to data abuse, automated operations, or internal abnormal behavior; Access permission level: reflects the visitor's permission level. Abuse of high permissions may bring significant security risks and require key monitoring and management; Internal delay time: describes the delay time of internal access requests. Excessive delay may indicate resource contention or system performance bottlenecks.

[0049] The present invention is further configured to construct asset risk analysis features based on network asset parameters, including:

[0050] The asset vulnerability feature is calculated according to the number of network asset connections, the number of interfaces and the flow rate. The present invention is further configured such that the calculation logic of the asset vulnerability feature is: Among them, V is the vulnerability characteristic of the asset, T is the time period, a is the number of network asset connections, b is the number of interfaces, c represents the traffic multiplier, which is the ratio of the current traffic to the baseline traffic, γ is the vulnerability amplification index, λ is the attenuation coefficient, η is the adjustment factor, and θ is the traffic fluctuation frequency. Specifically, the above calculation logic is used to evaluate the vulnerability characteristics of network assets, and by combining factors such as the number of network connections, the number of interfaces, and the traffic multiplier, the risk exposure of the asset within a specific time is calculated. Through nonlinear functions and dynamic adjustment coefficients, the assessment process is more in line with the actual operating status and can accurately capture the vulnerability changes of assets. The vulnerability amplification index γ is used to nonlinearly amplify the impact of the number of connections and interfaces. The higher the value, the more significant the risk increase. The range is 1.5-3.0; the attenuation coefficient λ is used to control the attenuation effect of the number of interfaces on the overall risk to prevent the number of interfaces from having an excessive impact on the assessment. The range is 0.1-0.5; the adjustment factor η is used to adjust the overall vulnerability calculation and balance the contribution of each risk factor to the final result. The range is 0.5-2.0; the traffic fluctuation frequency θ is used to capture the periodicity of traffic changes and reflect the dynamic changes of risks through trigonometric functions. The range is 0.1-2.0. Through nonlinear and dynamic adjustment, the risk calculation results more truly reflect the operating status and vulnerability changes of network assets; using time integration and trigonometric functions, the risk fluctuations of assets in different time periods are evaluated to provide comprehensive security situation awareness.

[0051] The abnormal behavior frequent occurrence feature is calculated according to the abnormal trigger intensity, abnormal response time and event duration; the present invention is further configured that the calculation logic of the abnormal behavior frequent occurrence feature is: Among them, A is the frequent occurrence feature of abnormal behavior, N is the number of abnormal events, Γ n is the abnormal trigger intensity, indicating the intensity of the nth abnormal event, α is the modulation factor, Δr n Indicates the abnormal response time difference, which is the difference between the actual response time and the benchmark response time. n is the abnormal event category weight, which indicates the impact of different types of abnormalities on the frequent occurrence characteristics of abnormal behaviors, σ is the time delay coefficient, φ n is the event duration, ψ is the reference duration, ξ nis the event fluctuation parameter. Specifically, the above calculation logic is used to evaluate the frequency characteristics of abnormal behavior. By combining multiple factors such as the trigger intensity, response time, and event duration of abnormal events, the impact of abnormal behavior on network assets is comprehensively evaluated. Through nonlinear combination and multi-parameter adjustment, the complex characteristics of abnormal behavior can be fully reflected; the modulation factor is used to adjust the coefficient through experience to ensure the reasonable impact of abnormal intensity on the result, and the value range is 0.5-1.5; the time delay coefficient has a value range of 0.1-1.0, which measures the impact of response delay on abnormal characteristics; the continuous characteristic weight has a value range of 1-5, which indicates the impact of event duration on the system, and is used to reflect the risk impact of different durations; the event fluctuation parameter has a value range of 0.1-2.0, which is used to measure the dynamics and fluctuation intensity of abnormal events. By combining multi-dimensional data such as event intensity, response time, and duration, the frequency of abnormal behavior can be accurately identified and quantified; the use of nonlinear modulation factors and time-related parameters ensures that the evaluation of abnormal behavior can dynamically adapt to changes in actual operating conditions and enhance the real-time nature of risk assessment.

[0052] The external threat correlation feature is calculated according to the threat level coefficient and the external response rate; the present invention is further configured such that the calculation logic of the external threat correlation feature is: Among them, E is the external threat correlation feature, L is the time interval, δ is the threat level coefficient, i is the number of external accesses, ω is the correlation frequency coefficient, χ is the successful access rate, j is the number of external threat events, ν is the environmental impact attenuation factor, τ is the time attenuation adjustment coefficient, k is the external response rate, ζ is the access delay weight, and l is the environmental fluctuation correction value. Specifically, the above calculation logic is used to evaluate the external threat correlation feature, and quantitatively evaluate the impact of external threats on network assets through a complex combination of factors such as external access frequency, external response rate and threat level coefficient. Through the combination of multiple nonlinear functions and adjustment coefficients, the risk status under a complex external threat environment can be reflected. The threat level coefficient ranges from 1 to 5, indicating the severity of external threats. The higher the value, the higher the threat level. The correlation frequency coefficient ranges from 0.1 to 1.0, which is used to adjust the weight of the access frequency in the overall assessment. The environmental impact attenuation factor ranges from 0.1 to 0.5, which is used to reduce the uncertainty of the external environment on the threat assessment. The time attenuation adjustment coefficient ranges from 0.1 to 0.3, which is used to adjust the speed of the external threat event in the time dimension. The access delay weight ranges from 0.5 to 2.0, which adjusts the impact of the response rate on threat association. The environmental fluctuation correction value ranges from 0.1 to 1.0, which is used to correct the impact of the external environment on risk assessment. Through dynamic adjustment of multiple parameters, a comprehensive and real-time reflection of external threats can be achieved, and external attacks and potential threat behaviors can be effectively captured. The comprehensive evaluation of multi-dimensional factors can accurately identify complex threat patterns and help network assets prevent external risks in advance.

[0053] The internal access abnormality feature is calculated according to the internal access path, the internal access frequency, the access permission level and the internal delay time; the present invention is further configured that the calculation logic of the internal access abnormality feature is: Among them, I is the internal access abnormality feature, R is the set of internal access paths, m is the internal access frequency, dr is the access permission level, o is the number of access path nodes, σ is the standardized parameter used to balance the path complexity calculation results, q is the internal delay time, r is the delay difference coefficient, and u is the standard response time. The above calculation logic is used to evaluate the internal access abnormality features, and the abnormal characteristics of internal access are comprehensively quantified by combining multiple data such as internal access path, access frequency, permission level and delay time. The formula uses multi-level nonlinear combination and dynamic adjustment to accurately capture the impact of internal abnormal access behavior on system risk; the value range of the standardized parameter is 0.5-1.5, which is used to balance the impact of path complexity in the calculation; the value range of the delay difference coefficient is 0.1-1.0, which is used to measure the degree of deviation between the actual response time and the standard response; by comprehensively evaluating the path, permission, frequency and response time of internal access, the abnormal behavior in internal access can be accurately identified; the introduction of nonlinear functions and time adjustment coefficients ensures that the risk assessment results can dynamically adapt to changes in internal access behavior.

[0054] The present invention is further configured such that the calculation logic of the comprehensive risk coefficient is: Among them, Ddr is the comprehensive risk coefficient, T is the time period, V is the asset vulnerability feature, A is the abnormal behavior frequency feature, E is the external threat association feature, and I is the internal access abnormality feature. Specifically, the above calculation logic is used to calculate the comprehensive risk coefficient. By combining asset vulnerability, abnormal behavior frequency feature, external threat association feature and internal access abnormality feature, the overall risk level faced by network assets is quantitatively evaluated in the form of a combination of multiple nonlinear functions and dynamic adjustments. Multiple risk factors are nonlinearly combined to ensure that the comprehensive risk assessment is comprehensive and detailed, and to avoid the deviation of a single feature from affecting the overall result. Multiple nonlinear functions are used to dynamically adjust the risk features so that the assessment results can adapt to the changes in risk over time and provide more accurate risk judgments. The impact of risk features in the assessment cycle is accumulated through time integration, which helps to more comprehensively reflect the actual risks faced by assets. Complex adjustment mechanisms such as hyperbolic tangent functions are used to enhance the ability to capture the linkage effects between different risk features and improve the insight into risk trends. The comprehensive risk coefficient provides a scientific data basis for network security managers, helping to formulate targeted prevention and control measures and improve the overall network security level.

[0055] The present invention is further configured to set a threat level threshold according to the comprehensive risk factor, determine the risk level of the current asset, and execute a monitoring management strategy according to the risk level, including:

[0056] When the comprehensive risk factor is greater than the first threat level threshold, the current network asset is marked as high risk, the network interface of the high-risk network asset is closed, and access is denied;

[0057] When the traffic threat analysis coefficient is less than or equal to the first threat level threshold and greater than the second threat level threshold, the current network asset is marked as medium risk, the monitoring frequency is increased, and an alarm signal is generated to notify the security management personnel to conduct risk analysis;

[0058] When the traffic threat analysis coefficient is less than or equal to the second threat level threshold, the current network asset is marked as low risk and access to the network asset is allowed. Specifically, when the comprehensive risk coefficient is greater than the first threat level threshold, it is judged as high risk. The system immediately shuts down the network interface of the high-risk asset, blocks external access, and prevents further threats.

[0059] When the comprehensive risk factor is less than or equal to the first threat level threshold and greater than the second threat level threshold, it is judged as medium risk. The system issues a medium-level alarm for the asset, increases the monitoring frequency, and generates a warning message to notify the security administrator.

[0060] When the comprehensive risk factor is lower than the second threat level threshold, it is judged as low risk. Normal access is allowed without taking additional protective measures. By calculating the comprehensive risk factor in real time and determining the risk level, the system can quickly identify and respond to potential security threats and reduce risk exposure time. According to different risk levels, the system takes differentiated protective measures, such as closing high-risk interfaces and increasing the frequency of medium-risk monitoring, to avoid resource waste and improve protection effects.

[0061] Embodiment 2

[0062] See also Figure 2 The exemplary network asset risk monitoring and management system includes:

[0063] Data collection module: collects the operation data and access behavior data of network assets in real time according to the preset network asset parameters, wherein the access behavior data includes external access data and internal access data;

[0064] Feature construction module: constructs asset risk analysis features according to network asset parameters, preprocesses the operation data and access behavior data, and calculates the value of the asset risk analysis features according to the preprocessed operation data and access behavior data, wherein the asset risk analysis features include asset vulnerability features, abnormal behavior frequency features, external threat association features, and internal access abnormality features;

[0065] Risk calculation module: combines the asset risk analysis features to form a feature vector, and calculates the comprehensive risk coefficient through multi-dimensional nonlinear combination and weight adjustment;

[0066] Strategy execution module: Sets the threat level threshold according to the comprehensive risk factor, determines the risk level of the current asset, and executes the monitoring management strategy according to the risk level.

[0067] It should be noted that the network asset risk monitoring and management system provided in the above embodiment and the network asset risk monitoring and management method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs operations has been described in detail in the method embodiment and will not be repeated here. In actual application, the network asset risk monitoring and management system provided in the above embodiment can distribute the above functions to different functional modules as needed, that is, divide the internal structure of the system into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0068] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0069] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0070] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0071] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0072] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0073] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0074] In the several embodiments provided in the present application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0075] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0076] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0077] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0078] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for monitoring and managing network asset risks, characterized in that: include: Collecting network asset operation data and access behavior data in real time according to preset network asset parameters, where the access behavior data includes external access data and internal access data; Constructing asset risk analysis features according to network asset parameters, preprocessing the operation data and access behavior data, and calculating the value of the asset risk analysis features according to the preprocessed operation data and access behavior data, wherein the asset risk analysis features include asset vulnerability features, abnormal behavior frequency features, external threat association features, and internal access abnormality features; The asset risk analysis features are combined to form a feature vector, and a comprehensive risk coefficient is calculated through multi-dimensional nonlinear combination and weight adjustment; Set the threat level threshold based on the comprehensive risk factor, determine the risk level of the current assets, and implement monitoring and management strategies based on the risk level.

2. The method for monitoring and managing network asset risks according to claim 1, characterized in that: The operation data includes the number of network asset connections, the number of interfaces, the traffic multiples, the abnormal trigger intensity, the abnormal response time and the event duration; the external access data includes the threat level coefficient and the external response rate; the internal access data includes the internal access path, the internal access frequency, the access permission level and the internal delay time.

3. The method for monitoring and managing network asset risks according to claim 2, characterized in that: Construct asset risk analysis features based on network asset parameters, including: Calculate asset vulnerability characteristics based on the number of network asset connections, number of interfaces, and traffic multiples; Calculate the frequency characteristics of abnormal behavior based on abnormal trigger intensity, abnormal response time and event duration; Calculate external threat correlation characteristics based on threat level coefficient and external response rate; Calculate internal access anomaly characteristics based on internal access path, internal access frequency, access permission level, and internal delay time.

4. The method for monitoring and managing network asset risks according to claim 3, characterized in that: The calculation logic of the asset vulnerability characteristics is: Among them, V is the asset vulnerability characteristic, T is the time period, a is the number of network asset connections, b is the number of interfaces, c represents the traffic multiplier, which is the ratio of the current traffic to the baseline traffic, γ is the vulnerability amplification index, λ is the attenuation coefficient, η is the adjustment factor, and θ is the traffic fluctuation frequency.

5. The method for monitoring and managing network asset risks according to claim 3, characterized in that: The calculation logic of the abnormal behavior frequent occurrence feature is: Among them, A is the frequent occurrence feature of abnormal behavior, N is the number of abnormal events, Γ n is the abnormal trigger intensity, indicating the intensity of the nth abnormal event, α is the modulation factor, Δr n Indicates the abnormal response time difference, which is the difference between the actual response time and the benchmark response time. n is the abnormal event category weight, which indicates the impact of different types of abnormalities on the frequent occurrence characteristics of abnormal behaviors, σ is the time delay coefficient, φ n is the event duration, ψ is the reference duration, ξ n is the event fluctuation parameter.

6. The method for monitoring and managing network asset risks according to claim 3, characterized in that: The calculation logic of the external threat correlation feature is: Among them, E is the external threat association feature, L is the time interval, δ is the threat level coefficient, i is the number of external accesses, ω is the association frequency coefficient, χ is the successful access rate, j is the number of external threat events, ν is the environmental impact attenuation factor, τ is the time attenuation adjustment coefficient, k is the external response rate, ζ is the access delay weight, and l is the environmental fluctuation correction value.

7. The method for monitoring and managing network asset risks according to claim 3, characterized in that: The calculation logic of the internal access abnormality feature is: Among them, I is the internal access anomaly feature, R is the internal access path set, m is the internal access frequency, dr is the access permission level, o is the number of access path nodes, σ is the normalization parameter used to balance the path complexity calculation results, q is the internal delay time, r is the delay difference coefficient, and u is the standard response time.

8. The method for monitoring and managing network asset risks according to claim 3, characterized in that: The calculation logic of the comprehensive risk coefficient is: Among them, Ddr is the comprehensive risk coefficient, T is the time period, V is the asset vulnerability characteristic, A is the frequent occurrence characteristic of abnormal behavior, E is the external threat association characteristic, and I is the internal access abnormality characteristic.

9. The method for monitoring and managing network asset risks according to claim 8, characterized in that: Set the threat level threshold according to the comprehensive risk factor, determine the risk level of the current asset, and implement monitoring and management strategies based on the risk level, including: When the comprehensive risk factor is greater than the first threat level threshold, the current network asset is marked as high risk, the network interface of the high-risk network asset is closed, and access is denied; When the traffic threat analysis coefficient is less than or equal to the first threat level threshold and greater than the second threat level threshold, the current network asset is marked as medium risk, the monitoring frequency is increased, and an alarm signal is generated to notify the security management personnel to conduct risk analysis; When the traffic threat analysis coefficient is less than or equal to the second threat level threshold, the current network asset is marked as low risk and access to the network asset is allowed.

10. A network asset risk monitoring and management system, characterized in that: include: Data collection module: collects the operation data and access behavior data of network assets in real time according to the preset network asset parameters, wherein the access behavior data includes external access data and internal access data; Feature construction module: constructs asset risk analysis features according to network asset parameters, preprocesses the operation data and access behavior data, and calculates the value of the asset risk analysis features according to the preprocessed operation data and access behavior data, wherein the asset risk analysis features include asset vulnerability features, abnormal behavior frequency features, external threat association features, and internal access abnormality features; Risk calculation module: combines the asset risk analysis features to form a feature vector, and calculates the comprehensive risk coefficient through multi-dimensional nonlinear combination and weight adjustment; Strategy execution module: Sets the threat level threshold according to the comprehensive risk factor, determines the risk level of the current asset, and executes the monitoring management strategy according to the risk level.

Images