Real-time risk control method and system

Abstract

The invention discloses a real-time risk control method and system, and relates to the technical field of network security. Establishing a vulnerability attack graph based on a vulnerability set in a bank computer system; determining a vulnerability value and a vulnerability utilization probability corresponding to each node in the vulnerability attack graph; based on the vulnerability utilization probability corresponding to each node and the vulnerability utilization probability corresponding to an upstream node of each node, determining a comprehensive vulnerability utilization probability corresponding to each node; calculating a vulnerability risk value corresponding to each node based on the vulnerability value corresponding to each node, the vulnerability value corresponding to a downstream node of each node and the comprehensive vulnerability utilization probability corresponding to each node; and if the target node of which the corresponding vulnerability risk value exceeds the preset risk threshold exists in the vulnerability attack graph, increasing the security protection level of the target node and / or the upstream node of the target node. According to the method and the system, the risk that vulnerabilities in the system are permeated can be reduced, and the overall security of the bank computer system is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a real-time risk control method and system. Background Art

[0002] With the continuous advancement of technology, bank computer systems are gradually becoming more intelligent and adaptive, but at the same time they are also facing more and more network security threats, posing a serious threat to the operation and security of enterprises. Therefore, it is often necessary to conduct risk assessments on vulnerabilities in bank computer systems and take corresponding risk control measures based on the risk assessment results.

[0003] At present, the risk control of vulnerabilities is mostly based on the risk assessment of a single vulnerability. In actual situations, for network attacks on bank computer systems, attackers often cannot directly launch attacks on targets in the bank computer system. Instead, they look for vulnerabilities at the network boundary of the bank computer system as the starting point of the attack and use the correlation between the vulnerabilities to attack the target. Therefore, for the risk assessment of a single vulnerability, it is impossible to accurately assess the vulnerabilities in the bank computer system, which makes the vulnerabilities in the bank computer system easy to be penetrated, thereby causing unnecessary losses.

[0004] Therefore, how to provide an effective solution to reduce the risk of vulnerability penetration in bank computer systems has become a difficult problem to be solved in the prior art. Summary of the invention

[0005] The purpose of the present invention is to provide a real-time risk control method and system to solve the above-mentioned problems existing in the prior art.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a real-time risk control method, comprising:

[0008] Establishing a vulnerability attack graph based on the set of vulnerabilities in the bank's computer system, wherein the vulnerability attack graph is established using the vulnerabilities in the bank's computer system as nodes and the network attack paths between the vulnerabilities as edges;

[0009] Determine the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph, wherein the vulnerability value represents the loss caused to the bank computer system after the vulnerability is successfully attacked, and the vulnerability exploitation probability represents the probability of the vulnerability being successfully attacked;

[0010] Determine the comprehensive vulnerability exploitation probability corresponding to each node in the vulnerability attack graph based on the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph and the vulnerability exploitation probability corresponding to the upstream node of each node;

[0011] Calculate the vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability utilization probability corresponding to each node;

[0012] If there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold, the security protection level of the target node and / or an upstream node of the target node is increased.

[0013] Based on the above disclosed content, the present invention establishes a vulnerability attack graph based on the vulnerability set in the bank computer system, and determines the vulnerability value and vulnerability utilization probability corresponding to each node in the vulnerability attack graph, and then determines the comprehensive vulnerability utilization probability corresponding to each node in the vulnerability attack graph based on the vulnerability utilization probability corresponding to each node in the vulnerability attack graph and the vulnerability utilization probability corresponding to the upstream node of each node, and calculates the vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability utilization probability corresponding to each node, and if there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds the preset risk threshold, the security protection level of the target node and / or the upstream node of the target node is increased. In this way, when the risk control of the vulnerability in the bank computer system is carried out, the correlation between the vulnerabilities in the bank computer system can be taken into account, so as to accurately evaluate the vulnerability risk of each vulnerability in the bank computer system, and when the vulnerability risk is too high, the security protection level of the corresponding node and / or the upstream node is increased, so that all the vulnerabilities in the bank computer system maintain a low vulnerability risk, reduce the risk of the vulnerability in the bank computer system being infiltrated, and improve the overall security of the bank computer system.

[0014] In one possible design, before establishing a vulnerability attack graph based on the set of vulnerabilities in the bank's computer system, the method further includes:

[0015] extracting a set of vulnerabilities in the bank's computer system;

[0016] The method of establishing a vulnerability attack graph based on a set of vulnerabilities in a bank computer system includes:

[0017] The vulnerability attack graph is established based on the network topology structure of the components where the vulnerabilities in the vulnerability set are located.

[0018] In a possible design, determining the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph includes:

[0019] Determine the vulnerability value corresponding to each node in the vulnerability attack graph according to the following formula (1);

[0020] V i =αGS i +βXS i +γWS i (1)

[0021] Determine the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph according to the following formula (2);

[0022]

[0023] Among them, α, β, γ, x, y and z are weighting coefficients, V i Indicates the vulnerability value corresponding to the i-th node, GS i represents the functional loss caused by the vulnerability corresponding to the i-th node being breached, XS i represents the information loss caused by the vulnerability corresponding to the i-th node being breached, WS i represents the physical loss caused by the vulnerability corresponding to the i-th node being breached, P i represents the probability of vulnerability exploitation corresponding to the i-th node, FY i Indicates the security protection strength of the network environment where the vulnerability corresponding to the i-th node is located, FX i Indicates the probability that the vulnerability corresponding to the i-th node is discovered, CB i Represents the attack cost of the vulnerability corresponding to the i-th node.

[0024] In a possible design, the physical loss caused by the vulnerability corresponding to the i-th node being breached is positively correlated with the software and hardware costs of the component where the i-th node is located.

[0025] In a possible design, determining the comprehensive vulnerability exploitation probability corresponding to each node in the vulnerability attack graph based on the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph and the vulnerability exploitation probability corresponding to the upstream node of each node includes:

[0026] For any node in the vulnerability attack graph, if the node has no upstream node, the vulnerability exploitation probability corresponding to the node is used as the comprehensive vulnerability exploitation probability corresponding to the node;

[0027] If any of the nodes has an upper-level node, the comprehensive vulnerability exploitation probability corresponding to the any of the nodes is determined according to the following formula (3);

[0028] PZ i =P i *PZ i-1 (3)

[0029] Among them, PZi represents the comprehensive vulnerability exploitation probability corresponding to the i-th node, PZ i-1 represents the comprehensive vulnerability exploitation probability corresponding to the upper-level node of the i-th node;

[0030] If any of the nodes has multiple upper-level nodes in an AND relationship, the comprehensive vulnerability exploitation probability corresponding to any of the nodes is determined according to the following formula (4);

[0031]

[0032] Among them, PZ j represents the comprehensive vulnerability exploitation probability corresponding to the jth node in the upper-level node corresponding to the i-th node, and k represents the total number of nodes in the upper-level node corresponding to the i-th node;

[0033] If any of the nodes has multiple upper-level nodes in an OR relationship, the comprehensive vulnerability exploitation probability corresponding to any of the nodes is determined according to the following formula (5);

[0034]

[0035] If any of the nodes has multiple upper-level nodes that contain an AND relationship and an OR relationship, the multiple upper-level nodes of the node are split into two-level nodes, and the relationships between nodes at the same level in the two-level nodes are an AND relationship and an OR relationship respectively;

[0036] Calculate the comprehensive vulnerability exploitation probability corresponding to each section in the upper-level node of any node;

[0037] Calculate the comprehensive vulnerability exploitation probability corresponding to any node based on the vulnerability exploitation probability corresponding to any node and the comprehensive vulnerability exploitation probability corresponding to each node in the upper-level node of any node;

[0038] Among them, the multiple upper-level nodes of the or relationship of any node mean that the vulnerability corresponding to any node in the multiple upper-level nodes can be attacked after the vulnerability corresponding to any node in the multiple upper-level nodes is breached, and the multiple upper-level nodes of the and relationship of any node mean that the vulnerability corresponding to any node can be attacked only after the vulnerabilities corresponding to the multiple upper-level nodes are all breached.

[0039] In a possible design, the vulnerability risk value corresponding to each node in the vulnerability attack graph is calculated according to the following formula (6);

[0040]

[0041] Among them, FX i represents the vulnerability risk value corresponding to the i-th node, V iIndicates the vulnerability value corresponding to the i-th node, PZ i represents the comprehensive vulnerability exploitation probability corresponding to the i-th node, m represents the total number of downstream nodes of the i-th node, V n represents the vulnerability value corresponding to the nth downstream node of the ith node, PZ n Represents the comprehensive vulnerability exploitation probability corresponding to the nth downstream node of the i-th node.

[0042] In one possible design, the method further includes:

[0043] If there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold, an early warning message is generated.

[0044] In a second aspect, the present invention provides a real-time risk control system, comprising:

[0045] An establishing unit, used to establish a vulnerability attack graph based on the set of vulnerabilities in the bank's computer system, wherein the vulnerability attack graph is established using the vulnerabilities in the bank's computer system as nodes and network attack paths between the vulnerabilities as edges;

[0046] A first determination unit is used to determine the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph, wherein the vulnerability value represents the loss caused to the bank computer system after the vulnerability is successfully attacked, and the vulnerability exploitation probability represents the probability of the vulnerability being successfully attacked;

[0047] A second determining unit is used to determine the comprehensive vulnerability exploitation probability corresponding to each node in the vulnerability attack graph based on the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph and the vulnerability exploitation probability corresponding to the upstream node of each node;

[0048] A calculation unit, configured to calculate a vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability exploitation probability corresponding to each node;

[0049] The adjustment unit is used to increase the security protection level of the target node and / or the upstream node of the target node if there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold.

[0050] In a third aspect, the present invention provides an electronic device comprising a memory, a processor and a transceiver which are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the real-time risk control method as described in the first aspect or any possible design of the first aspect.

[0051] In a fourth aspect, the present invention provides a computer-readable storage medium having instructions stored thereon, which, when executed on a computer, executes the real-time risk control method described in the first aspect or any possible design of the first aspect.

[0052] In a fifth aspect, the present invention provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the real-time risk control method as described in the first aspect or any possible design of the first aspect.

[0053] Beneficial effects:

[0054] The real-time risk control method and system provided by the present invention can take into account the correlation between the vulnerabilities in the bank's computer system when performing risk control on the vulnerabilities in the bank's computer system, thereby accurately assessing the vulnerability risk of each vulnerability in the bank's computer system, and when the vulnerability risk is too high, increase the security protection level of the corresponding node and / or upstream node, so that all vulnerabilities in the bank's computer system maintain a low vulnerability risk, reduce the risk of vulnerabilities in the bank's computer system being infiltrated, improve the overall security of the bank's computer system, and facilitate practical application and promotion. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flowchart of a real-time risk control method provided in an embodiment of the present application;

[0056] Figure 2 A schematic block diagram of a real-time risk control system provided in an embodiment of the present application;

[0057] Figure 3 A schematic block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0059] It should be understood that although the terms first, second, etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another unit. For example, a first unit can be referred to as a second unit, and similarly, a second unit can be referred to as a first unit without departing from the scope of the exemplary embodiments of the present invention.

[0060] It should be understood that the term "and / or" that may appear in this article is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" that may appear in this article describes another type of association object relationship, indicating that two relationships may exist. For example, A / and B can represent two situations: A exists alone, and A and B exist alone. In addition, the character " / " that may appear in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0061] In order to reduce the risk of vulnerabilities in bank computer systems being infiltrated, an embodiment of the present application provides a real-time risk control method and system, which can reduce the risk of vulnerabilities in bank computer systems being infiltrated and improve the overall security of bank computer systems.

[0062] The real-time risk control method provided in the embodiment of the present application can be applied to a bank computer system. It is understandable that the execution subject does not constitute a limitation on the embodiment of the present application.

[0063] The real-time risk control method provided in the embodiments of the present application will be described in detail below.

[0064] like Figure 1 As shown, it is a flowchart of the real-time risk control method provided in the first aspect of the embodiment of the present application, which is used to perform risk control on vulnerabilities in a bank computer system. The real-time risk control method may include but is not limited to the following steps S101-S105.

[0065] Step S101: Establish a vulnerability attack graph based on the vulnerability set in the bank's computer system.

[0066] The vulnerability attack graph is established by using the vulnerabilities in the bank's computer system as nodes and the network attack paths between the vulnerabilities as edges.

[0067] When performing risk control on vulnerabilities in a bank's computer system, a special vulnerability scanning tool can be used to scan the vulnerabilities in the bank's computer system, and all the vulnerabilities in the bank's computer system can be extracted to obtain a vulnerability set. Then, a vulnerability attack graph can be established based on the topological relationship of each component in the bank's computer system and the components where each vulnerability is located. The vulnerability attack graph can be a directed graph (Directed Graph) with vulnerabilities as nodes and network attack paths between vulnerabilities as edges.

[0068] Step S102: Determine the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph.

[0069] Among them, the vulnerability value represents the loss caused to the bank's computer system after the vulnerability is successfully attacked, and the vulnerability exploitation probability represents the probability of the vulnerability being successfully attacked.

[0070] The value of a vulnerability may include, but is not limited to, the functional loss caused by the vulnerability being breached, the information loss caused by the vulnerability being breached, and the physical loss caused by the vulnerability being breached. The functional loss caused by the vulnerability being breached can be determined based on the functional loss of the component corresponding to the vulnerability after the vulnerability is breached, the information loss caused by the vulnerability being breached can be determined based on the Common Vulnerability Scoring System (CVSS), and the physical loss caused by the vulnerability being breached can be determined based on the software and hardware costs of the component where the vulnerability is located.

[0071] The probability of vulnerability exploitation may include, but is not limited to, the security protection strength of the network environment where the vulnerability is located, the probability of the vulnerability being discovered, and the attack cost of the vulnerability. The higher the security protection strength of the network environment where the vulnerability is located, the lower the corresponding probability of vulnerability exploitation. The higher the probability of vulnerability being discovered, the higher the corresponding probability of vulnerability exploitation. The higher the attack cost of the vulnerability, the lower the corresponding probability of vulnerability exploitation. The probability of vulnerability discovery can be determined based on pre-set vulnerability level standards, and the attack cost of the vulnerability can be determined based on pre-set attack cost standards for various types of vulnerabilities.

[0072] In one or more embodiments, the vulnerability value corresponding to each node in the vulnerability attack graph may be determined according to the following formula (1).

[0073] V i =αGS i +βXS i +γWS i (1)

[0074] The vulnerability exploitation probability corresponding to each node in the vulnerability attack graph can be determined according to the following formula (2).

[0075]

[0076] Among them, α, β, γ, x, y and z all represent weighting coefficients, α+β+γ=1, x+y+z=1, V i Indicates the vulnerability value corresponding to the i-th node, GS i represents the functional loss caused by the vulnerability corresponding to the i-th node being breached, XS i represents the information loss caused by the vulnerability corresponding to the i-th node being breached, WS i represents the physical loss caused by the vulnerability corresponding to the i-th node being breached, P i represents the probability of vulnerability exploitation corresponding to the i-th node, FY i Indicates the security protection strength of the network environment where the vulnerability corresponding to the i-th node is located, FX i Indicates the probability that the vulnerability corresponding to the i-th node is discovered, CB i Represents the attack cost of the vulnerability corresponding to the i-th node. The physical loss caused by the vulnerability corresponding to the i-th node being breached is positively correlated with the software and hardware costs of the component where the i-th node is located.

[0077] Step S103: Based on the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph and the vulnerability exploitation probability corresponding to the upstream node of each node, determine the comprehensive vulnerability exploitation probability corresponding to each node in the vulnerability attack graph.

[0078] Specifically, for any node in the vulnerability attack graph, if any node has no upstream node, the vulnerability exploitation probability corresponding to any node is used as the comprehensive vulnerability exploitation probability corresponding to any node.

[0079] If any of the nodes has an upper-level node, the comprehensive vulnerability exploitation probability corresponding to the any of the nodes is determined according to the following formula (3).

[0080] PZ i =P i *PZ i-1 (3)

[0081] Among them, PZ i represents the comprehensive vulnerability exploitation probability corresponding to the i-th node, PZ i-1 It shows the comprehensive vulnerability exploitation probability corresponding to the previous node of the i-th node.

[0082] If any of the nodes has multiple upper-level nodes in an AND relationship, the comprehensive vulnerability exploitation probability corresponding to the any of the nodes is determined according to the following formula (4).

[0083]

[0084] Among them, PZj represents the comprehensive vulnerability exploitation probability corresponding to the jth node in the upper-level node corresponding to the ith node, and k represents the total number of nodes in the upper-level node corresponding to the ith node.

[0085] If any of the nodes has multiple upper-level nodes in an OR relationship, the comprehensive vulnerability exploitation probability corresponding to any of the nodes is determined according to the following formula (5).

[0086]

[0087] If any node has multiple upper-level nodes including AND relationships and OR relationships, the multiple upper-level nodes of the node are split into two-level nodes, and the relationships between nodes at the same level in the two-level nodes are AND relationships and OR relationships, respectively. Then, the comprehensive vulnerability exploitation probability corresponding to each section in the upper-level node of the node is calculated according to the above formula (4) or (5), and based on the vulnerability exploitation probability corresponding to the node and the comprehensive vulnerability exploitation probability corresponding to each section in the upper-level node of the node, the comprehensive vulnerability exploitation probability corresponding to the node is calculated.

[0088] Among them, the multiple upper-level nodes of the or relationship of any node mean that the vulnerability corresponding to any node in the multiple upper-level nodes can be attacked after the vulnerability corresponding to any node in the multiple upper-level nodes is breached, and the multiple upper-level nodes of the and relationship of any node mean that the vulnerability corresponding to any node can be attacked only after the vulnerabilities corresponding to the multiple upper-level nodes are all breached.

[0089] Step S104: Calculate the vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability exploitation probability corresponding to each node.

[0090] In one or more embodiments, the vulnerability risk value corresponding to each node in the vulnerability attack graph may be calculated according to the following formula (6).

[0091]

[0092] Among them, FX i represents the vulnerability risk value corresponding to the i-th node, V i Indicates the vulnerability value corresponding to the i-th node, PZ i represents the comprehensive vulnerability exploitation probability corresponding to the i-th node, m represents the total number of downstream nodes of the i-th node, V n represents the vulnerability value corresponding to the nth downstream node of the ith node, PZ nRepresents the comprehensive vulnerability exploitation probability corresponding to the nth downstream node of the i-th node.

[0093] Step S105: If there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold, the security protection level of the target node and / or the upstream node of the target node is increased.

[0094] Among them, the preset risk threshold can be set based on experience.

[0095] In one or more embodiments, if there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold, an early warning message may also be generated to alert relevant personnel.

[0096] The real-time risk control method provided by the present invention establishes a vulnerability attack graph based on the vulnerability set in the bank computer system, and determines the vulnerability value and vulnerability utilization probability corresponding to each node in the vulnerability attack graph, and then determines the comprehensive vulnerability utilization probability corresponding to each node in the vulnerability attack graph based on the vulnerability utilization probability corresponding to each node in the vulnerability attack graph and the vulnerability utilization probability corresponding to the upstream node of each node, and calculates the vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability utilization probability corresponding to each node, and if there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds the preset risk threshold, the security protection level of the target node and / or the upstream node of the target node is increased. In this way, when the risk control of the vulnerability in the bank computer system is carried out, the correlation between the vulnerabilities in the bank computer system can be taken into account, so as to accurately evaluate the vulnerability risk of each vulnerability in the bank computer system, and when the vulnerability risk is too high, the security protection level of the corresponding node and / or the upstream node is increased, so that all the vulnerabilities in the bank computer system maintain a low vulnerability risk, reduce the risk of the vulnerability in the bank computer system being infiltrated, improve the overall security of the bank computer system, and facilitate practical application and promotion.

[0097] See also Figure 2 A second aspect of an embodiment of the present application provides a real-time risk control system, the real-time risk control system comprising:

[0098] An establishing unit, used to establish a vulnerability attack graph based on the set of vulnerabilities in the bank's computer system, wherein the vulnerability attack graph is established using the vulnerabilities in the bank's computer system as nodes and network attack paths between the vulnerabilities as edges;

[0099] A first determination unit is used to determine the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph, wherein the vulnerability value represents the loss caused to the bank computer system after the vulnerability is successfully attacked, and the vulnerability exploitation probability represents the probability of the vulnerability being successfully attacked;

[0100] A second determining unit is used to determine the comprehensive vulnerability exploitation probability corresponding to each node in the vulnerability attack graph based on the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph and the vulnerability exploitation probability corresponding to the upstream node of each node;

[0101] A calculation unit, configured to calculate a vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability exploitation probability corresponding to each node;

[0102] The adjustment unit is used to increase the security protection level of the target node and / or the upstream node of the target node if there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold.

[0103] The working process, working details and technical effects of the real-time risk control system provided in the second aspect of this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0104] like Figure 3 As shown, the third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the real-time risk control method as described in the first aspect of the embodiment.

[0105] For specific examples, the memory may include but is not limited to random access memory (RAM), read-only memory (ROM), flash memory, first-in-first-out memory (FIFO) and / or first-in-last-out memory (FILO), etc.; the processor may be but is not limited to a microprocessor of the STM32F105 series, an ARM (Advanced RISC-Machines), an X86 or other architecture processor, or a processor with an integrated NPU (neural-network processing units); the transceiver may be but is not limited to a WiFi (Wireless Fidelity) wireless transceiver, a Bluetooth wireless transceiver, a General Packet Radio Service (GPRS) wireless transceiver, a ZigBee protocol (a low-power local area network protocol based on the IEEE802.15.4 standard, ZigBee) wireless transceiver, a 3G transceiver, a 4G transceiver and / or a 5G transceiver, etc.

[0106] The fourth aspect of this embodiment provides a computer-readable storage medium storing instructions including the real-time risk control method described in the first aspect of the embodiment, that is, the computer-readable storage medium stores instructions, and when the instructions are run on a computer, the real-time risk control method described in the first aspect is executed. The computer-readable storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive, and / or a memory stick, etc., and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0107] A fifth aspect of this embodiment provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the real-time risk control method as described in the first aspect of the embodiment, wherein the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0108] It should be understood that certain details are provided in the following description to facilitate a complete understanding of the example embodiments. However, it should be understood by those of ordinary skill in the art that the example embodiments can be implemented without these certain details. For example, the system can be shown in a block diagram to avoid obscuring the example with unnecessary details. In other examples, well-known processes, structures, and techniques may not be shown in unnecessary detail to avoid obscuring the example embodiments.

[0109] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A real-time risk control method, characterized in that: include: Establishing a vulnerability attack graph based on the set of vulnerabilities in the bank's computer system, wherein the vulnerability attack graph is established using the vulnerabilities in the bank's computer system as nodes and the network attack paths between the vulnerabilities as edges; Determine the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph, wherein the vulnerability value represents the loss caused to the bank computer system after the vulnerability is successfully attacked, and the vulnerability exploitation probability represents the probability of the vulnerability being successfully attacked; Determine the comprehensive vulnerability exploitation probability corresponding to each node in the vulnerability attack graph based on the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph and the vulnerability exploitation probability corresponding to the upstream node of each node; Calculate the vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability utilization probability corresponding to each node; If there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold, the security protection level of the target node and / or an upstream node of the target node is increased.

2. The real-time risk control method according to claim 1, characterized in that: Before establishing a vulnerability attack graph based on the set of vulnerabilities in the bank's computer system, the method further includes: extracting a set of vulnerabilities in the bank's computer system; The method of establishing a vulnerability attack graph based on a set of vulnerabilities in a bank computer system includes: The vulnerability attack graph is established based on the network topology structure of the components where the vulnerabilities in the vulnerability set are located.

3. The real-time risk control method according to claim 1, characterized in that: Determining the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph includes: Determine the vulnerability value corresponding to each node in the vulnerability attack graph according to the following formula (1); V i =αGS i +βXS i +γWS i (1) Determine the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph according to the following formula (2); Among them, α, β, γ, x, y and z are weighting coefficients, V i Indicates the vulnerability value corresponding to the i-th node, GS i represents the functional loss caused by the vulnerability corresponding to the i-th node being breached, XS i represents the information loss caused by the vulnerability corresponding to the i-th node being breached, WS i represents the physical loss caused by the vulnerability corresponding to the i-th node being breached, P i represents the probability of vulnerability exploitation corresponding to the i-th node, FY i Indicates the security protection strength of the network environment where the vulnerability corresponding to the i-th node is located, FX i Indicates the probability that the vulnerability corresponding to the i-th node is discovered, CB i Represents the attack cost of the vulnerability corresponding to the i-th node.

4. The real-time risk control method according to claim 3, characterized in that: The physical loss caused by the vulnerability corresponding to the i-th node being breached is positively correlated with the software and hardware costs of the component where the i-th node is located.

5. The real-time risk control method according to claim 3, characterized in that: Determining the comprehensive vulnerability utilization probability corresponding to each node in the vulnerability attack graph based on the vulnerability utilization probability corresponding to each node in the vulnerability attack graph and the vulnerability utilization probability corresponding to the upstream node of each node includes: For any node in the vulnerability attack graph, if the node has no upstream node, the vulnerability exploitation probability corresponding to the node is used as the comprehensive vulnerability exploitation probability corresponding to the node; If any of the nodes has an upper-level node, the comprehensive vulnerability exploitation probability corresponding to the any of the nodes is determined according to the following formula (3); PZ i =P i *PZ i-1 (3) Among them, PZ i represents the comprehensive vulnerability exploitation probability corresponding to the i-th node, PZ i-1 represents the comprehensive vulnerability exploitation probability corresponding to the upper-level node of the i-th node; If any of the nodes has multiple upper-level nodes in an AND relationship, the comprehensive vulnerability exploitation probability corresponding to any of the nodes is determined according to the following formula (4); Among them, PZ j represents the comprehensive vulnerability exploitation probability corresponding to the jth node in the upper-level node corresponding to the i-th node, and k represents the total number of nodes in the upper-level node corresponding to the i-th node; If any of the nodes has multiple upper-level nodes in an OR relationship, the comprehensive vulnerability exploitation probability corresponding to any of the nodes is determined according to the following formula (5); If any of the nodes has multiple upper-level nodes that contain an AND relationship and an OR relationship, the multiple upper-level nodes of the node are split into two-level nodes, and the relationships between nodes at the same level in the two-level nodes are an AND relationship and an OR relationship respectively; Calculate the comprehensive vulnerability exploitation probability corresponding to each section in the upper-level node of any node; Calculate the comprehensive vulnerability exploitation probability corresponding to any node based on the vulnerability exploitation probability corresponding to any node and the comprehensive vulnerability exploitation probability corresponding to each node in the upper-level node of any node; Among them, the multiple upper-level nodes of the or relationship of any node mean that the vulnerability corresponding to any node in the multiple upper-level nodes can be attacked after the vulnerability corresponding to any node in the multiple upper-level nodes is breached, and the multiple upper-level nodes of the and relationship of any node mean that the vulnerability corresponding to any node can be attacked only after the vulnerabilities corresponding to the multiple upper-level nodes are all breached.

6. The real-time risk control method according to claim 1, characterized in that: Calculate the vulnerability risk value corresponding to each node in the vulnerability attack graph according to the following formula (6); Among them, FX i represents the vulnerability risk value corresponding to the i-th node, V i Indicates the vulnerability value corresponding to the i-th node, PZ i represents the comprehensive vulnerability exploitation probability corresponding to the i-th node, m represents the total number of downstream nodes of the i-th node, V n represents the vulnerability value corresponding to the nth downstream node of the ith node, PZ n Represents the comprehensive vulnerability exploitation probability corresponding to the nth downstream node of the i-th node.

7. The real-time risk control method according to claim 1, characterized in that: The method further comprises: If there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold, an early warning message is generated.

8. A real-time risk control system, characterized in that: include: An establishing unit, used to establish a vulnerability attack graph based on the set of vulnerabilities in the bank's computer system, wherein the vulnerability attack graph is established using the vulnerabilities in the bank's computer system as nodes and network attack paths between the vulnerabilities as edges; A first determination unit is used to determine the vulnerability value and vulnerability exploitation probability corresponding to each node in the vulnerability attack graph, wherein the vulnerability value represents the loss caused to the bank computer system after the vulnerability is successfully attacked, and the vulnerability exploitation probability represents the probability of the vulnerability being successfully attacked; A second determining unit is used to determine the comprehensive vulnerability exploitation probability corresponding to each node in the vulnerability attack graph based on the vulnerability exploitation probability corresponding to each node in the vulnerability attack graph and the vulnerability exploitation probability corresponding to the upstream node of each node; A calculation unit, configured to calculate a vulnerability risk value corresponding to each node in the vulnerability attack graph based on the vulnerability value corresponding to each node in the vulnerability attack graph, the vulnerability value corresponding to the downstream node of each node, and the comprehensive vulnerability exploitation probability corresponding to each node; The adjustment unit is used to increase the security protection level of the target node and / or the upstream node of the target node if there is a target node in the vulnerability attack graph whose corresponding vulnerability risk value exceeds a preset risk threshold.

9. An electronic device, characterized in that: It includes a memory, a processor and a transceiver which are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the real-time risk control method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or the instruction is executed by a computer, the real-time risk control method according to any one of claims 1 to 7 is implemented.

Images