Risk assessment method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a risk assessment method and device, equipment and a storage medium. The method comprises the steps of obtaining type data and feature data of a to-be-evaluated target; determining at least one piece of risk information of the to-be-evaluated target based on the type data and the feature data; obtaining a search result corresponding to each piece of risk information; the search result is determined and obtained according to each piece of risk information and a search keyword; the search result comprises evaluation data corresponding to the risk information; and predicting the search result corresponding to each piece of risk information according to a preset model to obtain a first evaluation result corresponding to the to-be-evaluated target. By adopting the technical scheme of the embodiment of the invention, the degree of the potential risk of the to-be-assessed target can be determined according to the first assessment result, and the potential risk of the to-be-assessed target can be effectively predicted.

Description

Technical Field

[0001] The present application relates to the field of network security services, and specifically to a risk assessment method, apparatus, device and storage medium. Background Art

[0002] With the development of the global digital economy, the amount of software product code and data is growing exponentially, the connections and mutual influences between participants in each stage of the software life cycle are becoming increasingly complex, and supply chain attack cases are on the rise, with increasingly serious hazards and impacts. Software supply chain security covers all participants and the entire life cycle of the information and communication technology supply chain. Among related technologies, the cybersecurity industry lacks technology or products to predict software supply chain risks. There is currently no effective solution to this problem. Summary of the invention

[0003] In view of this, embodiments of the present application provide a risk assessment method, apparatus, device and storage medium, which are intended to effectively predict the potential risks of a target to be assessed.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides a risk assessment method, including:

[0006] Obtain type data and feature data of the target to be evaluated;

[0007] Determine at least one risk information of the target to be assessed based on the type data and the characteristic data;

[0008] Obtain search results corresponding to each of the risk information; the search results are determined based on each of the risk information and search keywords; the search results include assessment data corresponding to the risk information;

[0009] The search results corresponding to each risk information are predicted according to a preset model to obtain a first evaluation result corresponding to the target to be evaluated.

[0010] In the above scheme, the type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name; the at least one risk information includes first risk information; and determining the at least one risk information of the target to be evaluated based on the type data and the feature data includes:

[0011] Extracting attribute keywords from the feature data based on the type data to determine attribute information corresponding to the target to be evaluated;

[0012] The first risk information is determined according to the attribute information; the first risk information represents the inherent risk information of the target to be assessed.

[0013] In the above scheme, the type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name; the at least one risk information includes second risk information; and the at least one risk information of the target to be evaluated is determined based on the type data and the feature data, including:

[0014] Extracting the second risk information from the feature data based on the identification information and the type data; the identification information represents the supplier identification information; the second risk information represents the risk information of the supplier to which the target to be evaluated belongs;

[0015] Or, the feature data is searched using a search engine, the identification information, and the type data to obtain the second risk information.

[0016] In the above scheme, the type data of the target to be evaluated includes at least one of a second type with source code and a third type without source code; the at least one risk information includes third risk information; and determining the at least one risk information of the target to be evaluated based on the type data and the feature data includes:

[0017] The feature data corresponding to the second type and / or the third type are extracted in a preset manner to obtain the third risk information; the third risk information represents the risk information of the third-party dependency library used by the target to be evaluated.

[0018] In the above scheme, the type data of the target to be evaluated includes a first type accessed through a network and a fourth type identified by a name; the at least one risk information includes fourth risk information; and the at least one risk information of the target to be evaluated is determined based on the type data and the characteristic data, including:

[0019] Using a recognition engine to identify the feature data corresponding to the first type, to obtain service information of the platform to be evaluated; the service information includes at least one of port information, service fingerprint information, and component version information of the platform to be evaluated;

[0020] The fourth risk information is determined based on the service information and the characteristic data corresponding to the fourth type; the fourth risk information represents the risk information of the component version of the target to be evaluated.

[0021] In the above scheme, the type data of the target to be evaluated includes at least one of a first type accessed through a network and a fourth type identified by a name; the at least one risk information includes fifth risk information; and the at least one risk information of the target to be evaluated is determined based on the type data and the characteristic data, including:

[0022] Using a search tool to search for characteristic data corresponding to the first type and / or the fourth type, to obtain domain name information of the platform to be evaluated;

[0023] A query is performed based on the domain name information to determine the fifth risk information; the fifth risk information represents the threat intelligence information of the target to be assessed.

[0024] In the above solution, the search keyword includes at least one of a first keyword representing a network security event, a second keyword representing a vulnerability, a third keyword representing a security qualification, a fourth keyword representing a project, and a fifth keyword representing a scale; and obtaining the search result corresponding to each of the risk information includes:

[0025] combining the risk information with at least one of the first keyword, the second keyword, the third keyword, the fourth keyword, and the fifth keyword respectively to obtain a search condition corresponding to the risk information;

[0026] A search is performed based on a search engine and the search conditions to obtain search results corresponding to the risk information.

[0027] In the above solution, obtaining the search result corresponding to each risk information includes:

[0028] combining the second risk information with at least one of the first keyword, the second keyword, the third keyword, the fourth keyword, and the fifth keyword respectively to obtain a first search condition corresponding to the second risk information;

[0029] A search is performed based on the search engine and the first search condition to obtain search results corresponding to the second risk information.

[0030] In the above solution, the search keyword includes a second keyword representing a vulnerability; and determining the search result corresponding to each risk information according to each risk information, the search keyword and the search engine includes:

[0031] combining the fourth risk information with the second keyword to obtain a second search condition corresponding to the fourth risk information;

[0032] The second search condition is searched based on the search engine to obtain search results corresponding to the fourth risk information.

[0033] In the above scheme, the preset model includes at least a first preset model and a second preset model; the search result corresponding to each risk information is predicted according to the preset model to obtain a first assessment result corresponding to the target to be assessed, including:

[0034] Inputting the search results corresponding to each of the risk information into the first preset model to obtain the second evaluation results corresponding to each of the risk information; the first preset model is used to predict the evaluation results of the risk information based on the search results of the risk information;

[0035] Input at least one of the second assessment results into the second preset model to obtain a first assessment result corresponding to the target to be assessed; the second preset model is used to predict the assessment result of the target to be assessed based on at least one assessment result of the risk information.

[0036] In the above solution, the method further includes:

[0037] If it is determined that the target to be evaluated includes at least one component, each of the components is determined as a sub-evaluation target;

[0038] Determining at least one sub-risk information of the sub-assessment target;

[0039] Obtaining a sub-search result corresponding to each of the sub-risk information; the sub-search result is determined according to each of the sub-risk information and the search keyword; the sub-search result includes evaluation data corresponding to the sub-risk information;

[0040] Inputting the sub-search results into the first preset model to obtain a third evaluation result corresponding to each sub-risk information; the first preset model is also used to predict the evaluation result of the sub-risk information based on the sub-search results of the sub-risk information;

[0041] At least one of the third assessment results is input into the second preset model to obtain a fourth assessment result of the sub-assessment target; the second preset model is also used to predict the assessment result of the sub-assessment target based on the assessment result score of at least one of the sub-risk information.

[0042] In the above solution, the method further includes:

[0043] The first evaluation result and the fourth evaluation result are input into a third preset model to obtain a target evaluation result of the target to be evaluated; the third preset model is used to predict the target evaluation result of the target to be evaluated based on the evaluation result of the target to be evaluated and the evaluation result of the sub-evaluation target.

[0044] In the above solution, the method further includes:

[0045] Acquire a training sample set of the sample evaluation target based on the data set of the sample evaluation target; wherein the training sample set includes sample search results and labels of the sample evaluation target used to train the initial model, the sample search results and the labels have a mapping relationship, and the labels are used to represent the scores of the sample search results;

[0046] Determine an initial model based on the data set and the training sample set;

[0047] The training sample set is input into the initial model for training to obtain the first preset model.

[0048] The present application provides a risk assessment device, including:

[0049] A first acquisition module is used to acquire type data and feature data of the target to be evaluated;

[0050] A first determination module, configured to determine at least one risk information of the target to be assessed based on the type data and the feature data;

[0051] A second acquisition module is used to obtain search results corresponding to each of the risk information; the search results are determined based on each of the risk information and the search keyword; the search results include evaluation data corresponding to the risk information;

[0052] The prediction module is used to predict the search results corresponding to each risk information according to a preset model to obtain a first evaluation result corresponding to the target to be evaluated.

[0053] An embodiment of the present application provides a risk assessment device, including a processor and a memory for storing a computer program that can be run on the processor, wherein:

[0054] The processor is used to execute the steps of the above risk assessment method when running the computer program.

[0055] An embodiment of the present application provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned risk assessment method are implemented.

[0056] The embodiment of the present application provides a risk assessment method, device, equipment and storage medium. The method includes: obtaining type data and feature data of the target to be assessed; determining at least one risk information of the target to be assessed based on the type data and the feature data; obtaining search results corresponding to each of the risk information; the search results are determined based on each of the risk information and search keywords; the search results include assessment data corresponding to the risk information; predicting the search results corresponding to each of the risk information according to a preset model to obtain a first assessment result corresponding to the target to be assessed. By adopting the technical solution of the embodiment of the present application, at least one risk information can be determined for the platform information of the target to be assessed, and then the search results corresponding to each risk information can be obtained and the search results of each risk information can be predicted using a preset model to obtain the first assessment result of the target to be assessed, thereby determining the degree of potential risk of the target to be assessed according to the first assessment result, and effectively predicting the potential risk of the target to be assessed. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a schematic diagram of the risk assessment method implementation process of the present application embodiment;

[0058] Figure 2 This is a schematic diagram of the risk assessment method implementation process in an application example of this application;

[0059] Figure 3 This is a schematic diagram of the structure of the risk assessment device according to an embodiment of the present application;

[0060] Figure 4 This is a schematic diagram of the structure of the risk assessment device according to an embodiment of the present application. DETAILED DESCRIPTION

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0062] The embodiments of the present application provide a risk assessment method, apparatus, device and storage medium, which are intended to effectively predict the potential risks of a target to be assessed.

[0063] Software supply chain security covers all participants in the information and communication technology supply chain, including software and hardware developers, product or service operators, distribution channels and sellers; the entire life cycle of the information and communication technology supply chain includes: design, development and production, distribution, acquisition and deployment, operation and maintenance, destruction and other links.

[0064] For example, the security risk points in each link are summarized as follows:

[0065] In the design phase, there is a risk of backdoors or persistent vulnerabilities being implanted in standards and algorithm design, hardware design, operating system design, and software design. Typical risk points include: the risk of preset backdoors in standards and algorithm design; the risk of backdoors in commercial product design.

[0066] In the development and production stages, typical risk points include: the risk of tampering in product development and production; the risk of defects in algorithm development; development tools being tampered with and malicious code being injected into the product; and open source operating system source code being infected.

[0067] In the distribution stage, typical risk points include: the risk of tampering during the hardware device distribution stage; the risk of hijacking and replacement during software distribution.

[0068] During the acquisition and deployment implementation phase, typical risk points include: risk of contamination of software dependent components.

[0069] In the operation and maintenance phase, typical risk points include: operation and maintenance modules or components are tampered with, resulting in the risk of high-privilege malware being implanted during operation and maintenance.

[0070] In the destruction stage, typical risk points include: lack of data destruction measures leading to the risk of leakage.

[0071] Among the related technologies, solutions for supply chain risk management include technologies, standards or products such as Software Component Analysis (SCA) or Software Bill of Materials (SBOM), but there is still a lack of technologies or products for predicting supply chain risks.

[0072] The present application embodiment provides a risk assessment method, such as Figure 1 As shown, the method includes:

[0073] Step 101: Obtain type data and feature data of a target to be evaluated.

[0074] Exemplarily, the target to be evaluated may be software to be evaluated or a system platform to be evaluated. The characteristic data may be data used to characterize the usage characteristics or attribute characteristics of the target to be evaluated, wherein the characteristics of the target to be evaluated may include at least one of the following: name, vendor, version, operating environment, user data, business performance, etc.

[0075] Exemplarily, natural language information input by a user terminal can be received and generative artificial intelligence can be used to extract keywords from the natural language information to obtain type data and feature data of the target to be evaluated.

[0076] In an application example, the type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name.

[0077] It can be understood that the type data can be data used to characterize the access type or attribute type of the target to be evaluated; among them, the first type can be a software system platform type accessed through the network, the second type can be a software program file package type with source code, the third type can be a compiled program file package type without source code, and the fourth type can be a type identified by system name and composition information.

[0078] Exemplarily, the feature data corresponding to the first type may generally include the network access address of the target to be evaluated; the feature data corresponding to the second type may generally include the source code file compression package or source code file of the target to be evaluated; the feature data corresponding to the third type may generally include the program file package or file fragments of the target to be evaluated; the feature data corresponding to the fourth type may generally include the name of the target to be evaluated or necessary descriptive information, specifically, including extractable "keywords & application scenario context", wherein the application scenario context includes but is not limited to whether it is applied to an intranet environment or a public network environment; whether key business data is stored or processed; whether sensitive personnel information is stored or processed; and the approximate number of users who access it on a daily basis.

[0079] Step 102: Determine at least one risk information of the target to be evaluated based on the type data and the feature data.

[0080] It can be understood that different types of data corresponding to different characteristic data can determine different risk information. For example, based on the characteristic data corresponding to the first type, the second type, the third type or the fourth type, the risk information of the target to be evaluated can be determined; for example, based on the characteristic data corresponding to the first type, the second type, the third type or the fourth type, the risk information of the supplier to which the target to be evaluated belongs can be determined; for example, based on the characteristic data corresponding to the second type or the third type, the risk information of the third-party dependency library used by the target to be evaluated can be determined; for example, based on the characteristic data corresponding to the first type and the fourth type, the risk information of the component version of the target to be evaluated can be determined; for example, based on the characteristic data corresponding to the first type or the fourth type, the threat intelligence information of the target to be evaluated can be determined.

[0081] In an application example, the type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name; the at least one risk information includes the first risk information; and determining the at least one risk information of the target to be evaluated based on the type data and the feature data includes:

[0082] Extract attribute keywords from feature data based on type data to determine attribute information corresponding to the target to be evaluated;

[0083] The first risk information is determined according to the attribute information; the first risk information represents the inherent risk information of the target to be evaluated.

[0084] Exemplarily, the attribute keyword may be a life cycle link keyword, which may specifically include design, development and production, distribution, acquisition and deployment implementation, operation and maintenance, destruction, etc. The attribute information may be life cycle link information, which may specifically include design information, development and production information, distribution information, acquisition and deployment implementation information, operation and maintenance information, destruction information, etc. Determining the first risk information according to the attribute information may be determining at least one of the design information, development and production information, distribution information, acquisition and deployment implementation information, operation and maintenance information, and destruction information as the first risk information.

[0085] In an application example, the type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name; the at least one risk information includes the second risk information; and determining the at least one risk information of the target to be evaluated based on the type data and the feature data includes:

[0086] Extracting second risk information from the feature data based on the identification information and the type data; the identification information represents the supplier identification information; the second risk information represents the risk information of the supplier to which the target to be evaluated belongs;

[0087] Or, the feature data is searched using a search engine, identification information and type data to obtain the second risk information.

[0088] Exemplarily, the second risk information may be extracted from the feature data based on the identification information and the type data. To determine the feature data corresponding to the type data, the identification information may be used to extract the supplier information from the feature data, and the supplier information may be determined as the second risk information.

[0089] Exemplarily, the second risk information can be obtained by searching the characteristic data using a search engine, identification information and type data. In order to determine the characteristic data corresponding to the type data, the characteristic data can be searched using a search engine and identification information to obtain supplier information, and the supplier information can be determined as the second risk information.

[0090] In an application example, the type data of the target to be evaluated includes at least one of a second type with source code and a third type without source code; the at least one risk information includes the third risk information; and determining the at least one risk information of the target to be evaluated based on the type data and the feature data includes:

[0091] The characteristic data corresponding to the second type and / or the third type are extracted in a preset manner to obtain third risk information; the third risk information represents the risk information of the third-party dependency library used by the target to be evaluated.

[0092] Exemplarily, the preset method may be at least one of decompression and text analysis; the feature data corresponding to the second type is extracted using the preset method to obtain the third risk information, which may be to decompress and perform text analysis on the source code file compression package or source code file of the target to be evaluated in the feature data to obtain the risk information of the third-party dependency library information used by the target to be evaluated.

[0093] Exemplarily, the preset method may be a string scan; the feature data corresponding to the third type is extracted using the preset method to obtain the third risk information, which may be a string scan of the executable program file of the target to be evaluated in the feature data to obtain the risk information of the third-party dependent library information used by the target to be evaluated.

[0094] In an application example, the type data of the target to be evaluated includes a first type accessed through a network and a fourth type identified by a name; the at least one risk information includes the fourth risk information; and determining the at least one risk information of the target to be evaluated based on the type data and the feature data includes:

[0095] Using the recognition engine to recognize the feature data corresponding to the first type, and obtaining service information of the platform to be evaluated; the service information includes at least one of port information, service fingerprint information, and component version information of the platform to be evaluated;

[0096] Based on the service information and characteristic data corresponding to the fourth type, fourth risk information is determined; the fourth risk information represents risk information of a component version of the target to be evaluated.

[0097] Exemplarily, the recognition engine may be an asset recognition engine; the method of using the recognition engine to recognize the characteristic data may include a network mapper (nmap) or a fingerprint recognition tool (whatweb). Using the recognition engine to recognize the characteristic data corresponding to the first type may be used to recognize the port and service version of the platform to be evaluated based on nmap; or may be used to recognize the World Wide Web (Web) component of the platform to be evaluated based on whatweb.

[0098] Exemplarily, the fourth risk information is determined based on the service information and the characteristic data corresponding to the fourth type. The fourth risk information can be obtained based on the service information combined with the system name and component information in the characteristic data corresponding to the fourth type.

[0099] In an application example, the type data of the target to be evaluated includes at least one of a first type accessed through a network and a fourth type identified by a name; the at least one risk information includes fifth risk information; and determining the at least one risk information of the target to be evaluated based on the type data and the feature data includes:

[0100] Using a search tool to search for characteristic data corresponding to the first type and / or the fourth type, to obtain domain name information of the platform to be evaluated;

[0101] A query is performed based on the domain name information to determine the fifth risk information; the fifth risk information represents the threat intelligence information of the target to be assessed.

[0102] Exemplarily, the feature data corresponding to the first type and / or the fourth type can be searched using a search tool, and open source network basic information collection tools such as domain name information query (whois), domain name system (Domain Name System, DNS) enumeration and scanning tools (dnsrecon) can be combined to collect domain name, subdomain name and other information of the platform to be evaluated.

[0103] Exemplarily, querying based on domain name information to determine the fifth risk information can be performed by performing threat intelligence association query based on domain names and subdomain names, thereby obtaining intelligence related to current attacks that may not be obtained based solely on search engines.

[0104] Step 103: Obtain search results corresponding to each risk information; the search results are determined based on each risk information and search keywords; the search results include assessment data corresponding to the risk information.

[0105] Exemplarily, obtaining the search results corresponding to each risk information may be determining the search results corresponding to each risk information according to each risk information, search keywords and search engines, and specifically, each risk information may be combined with the search keywords to obtain search conditions, and the search conditions may be input into the search engine to obtain the search results corresponding to each risk information. The assessment data corresponding to the search results is used to characterize the risk of each risk information.

[0106] It is understandable that the search keywords include at least network security incident keywords, vulnerability-related keywords, security qualification-related keywords, important project-related keywords and supplier size keywords.

[0107] In an application example, the search keyword includes at least one of a first keyword representing a network security event, a second keyword representing a vulnerability, a third keyword representing a security qualification, a fourth keyword representing a project, and a fifth keyword representing a scale; and obtaining search results corresponding to each risk information includes:

[0108] Combining the risk information with at least one of the first keyword, the second keyword, the third keyword, the fourth keyword, and the fifth keyword to obtain a search condition corresponding to the risk information;

[0109] Search based on the search engine and search conditions to obtain search results corresponding to the risk information.

[0110] Exemplarily, the first keyword may include Chinese and English expressions of words such as attack, compromise, data leakage, extortion, user lawsuit, and institutional investigation; the second keyword may include Chinese and English expressions of words such as Common Vulnerabilities and Exposures (CVE), China National Vulnerability Database (CNVD), Exploit, Proof of Concept (PoC), Remote Command / Code Execute (RCE), Disk Operating System (DOS), Code Execution, Denial of Service, Vulnerability Verification, and Vulnerability Number; the third keyword may include ISO / IEC27001, Information Security Management System Certification, Capability Maturity Model Integration (CMMI), Security Maturity Model Certification, ISO / IEC 15408, Common Criteria Certification, the number of patents applied for and disclosed, and Gartner Magic Quadrant. The fourth keyword may include the Chinese and English expressions of terms such as "Winning the bid for XXX project" and "Obtaining XXX recognition"; the fifth keyword may include financial-related indicators such as stock price, total number of employees, enterprise valuation, operating income, and distribution of subsidiaries.

[0111] In some embodiments, obtaining search results corresponding to each risk information includes:

[0112] combining the second risk information with at least one of the first keyword, the second keyword, the third keyword, the fourth keyword, and the fifth keyword respectively to obtain a first search condition corresponding to the second risk information;

[0113] A search is performed based on the search engine and the first search condition to obtain search results corresponding to the second risk information.

[0114] Exemplarily, the second risk information may be combined with the first keyword, the second keyword, the third keyword, the fourth keyword, and the fifth keyword, respectively, to obtain the first search condition corresponding to the second risk information.

[0115] In some embodiments, the search keyword includes a second keyword representing a vulnerability; and determining a search result corresponding to each risk information according to each risk information, the search keyword, and the search engine includes:

[0116] combining the fourth risk information with the second keyword to obtain a second search condition corresponding to the fourth risk information;

[0117] The second search condition is searched based on the search engine to obtain search results corresponding to the fourth risk information.

[0118] Exemplarily, the second search condition corresponding to the fourth risk information can be obtained based on the service information and the system name and composition information in the characteristic data corresponding to the fourth type, combined with the second keyword; the second search condition is searched based on the search engine to obtain the search results corresponding to the fourth risk information, thereby attempting to discover the historical vulnerability information that has been made public (i.e., the assessment data corresponding to the fourth risk information), and further achieve risk prediction for the target to be assessed.

[0119] In a related embodiment, for the case where the target to be evaluated includes the second type / third type, and feature data corresponding to the fourth type, in addition to extracting third-party dependency library information from the feature data corresponding to the second type / third type, the third-party dependency library information and the system name and composition information in the feature data corresponding to the fourth type will be combined with the second keyword, and the search engine will be called to search, thereby attempting to discover historical vulnerability information that has been disclosed, and then on this basis, the fourth risk information is combined with the second keyword to obtain the second search condition corresponding to the fourth risk information; the second search condition is searched based on the search engine to obtain the search result corresponding to the fourth risk information.

[0120] Step 104: predict the search results corresponding to each risk information according to the preset model to obtain a first assessment result corresponding to the target to be assessed.

[0121] In an application example, the preset model includes at least a first preset model and a second preset model; the search results corresponding to each risk information are predicted according to the preset model to obtain a first assessment result corresponding to the target to be assessed, including:

[0122] The search results corresponding to each risk information are input into the first preset model to obtain the second evaluation results corresponding to each risk information; the first preset model is used to predict the evaluation results of the risk information based on the search results of the risk information;

[0123] At least one second assessment result is input into a second preset model to obtain a first assessment result corresponding to the target to be assessed; the second preset model is used to predict the assessment result of the target to be assessed based on the assessment result of at least one risk information.

[0124] Exemplarily, the second evaluation result may be the first score; the first preset model can evaluate the risk information by predicting the search results, output a first score corresponding to the risk information, and can also determine the potential risks of the target to be evaluated based on the first score. Specifically, if the first score is greater than a preset threshold, the risk information corresponding to the first score has potential risks.

[0125] Exemplarily, the first evaluation result may be a first evaluation score; the second preset model can evaluate the risk of the target to be evaluated by predicting the first score, and output the first evaluation score of the target to be evaluated. It can also determine the degree of potential risk of the target to be evaluated based on the first evaluation score, specifically, determine the evaluation level corresponding to the first evaluation score, and the evaluation level can be used to characterize the risk level of the target to be evaluated.

[0126] In some embodiments, the method further comprises:

[0127] A training sample set of the sample evaluation target is obtained based on the data set of the sample evaluation target; wherein the training sample set includes sample search results and labels of the sample evaluation target used to train the initial model, and there is a mapping relationship between the sample search results and the labels, and the labels are used to represent the scores of the sample search results;

[0128] Determine an initial model based on the data set and the training sample set;

[0129] The training sample set is input into the initial model for training to obtain the first preset model.

[0130] Exemplarily, the first preset model may be a model for conducting risk information evaluation based on the data obtained through the above search.

[0131] Exemplarily, the data set of the sample evaluation target can be the above-mentioned descriptive information that collects a large amount of software risk information, and data annotation engineers perform network security reputation rating on each risk information to form labeled data. In the process of labeling the data set, erroneous or irrelevant data will also be cleaned up.

[0132] Exemplarily, obtaining a training sample set of a sample evaluation target based on a data set of a sample evaluation target can be implemented based on a feature engineering process. Specifically, semantic features such as security event keywords, security certificates, etc. are extracted from the sample evaluation target. Unstructured data such as text descriptions are structured. For non-large language models (LLM), when training sub-models, factors such as feature extraction, feature selection, and feature scaling also need to be considered.

[0133] Exemplarily, the initial model is determined based on the data set and the training sample set. An appropriate model can be selected based on the data set size, the number of features, and the available computing resources. Models that can be tried include a Bayesian model based on semantic features, a Poisson regression model based on security event counts, a graph neural network based on network embedding to capture risk information relationships, etc., or a certain LLM model can be selected.

[0134] Exemplarily, the training sample set is input into the initial model for training, and the first preset model can be obtained based on the model training and evaluation process. Specifically, the training goal is to let the model learn to identify features related to risk information from the data. The labeled data set is divided into training, validation and test sets, and appropriate evaluation indicators are selected to iteratively optimize the model hyperparameters.

[0135] In some embodiments, the first preset model is deployed as a model, specifically, the model is deployed as an application programming interface (API) service of a risk information reputation query or risk warning system.

[0136] In some embodiments, the method further comprises:

[0137] If it is determined that the target to be evaluated includes at least one component, each component is determined as a sub-evaluation target;

[0138] Determining at least one sub-risk information of the sub-assessment target;

[0139] Obtaining sub-search results corresponding to each sub-risk information; the sub-search results are determined based on each sub-risk information and the search keyword; the sub-search results include evaluation data corresponding to the sub-risk information;

[0140] Inputting the sub-search results into the first preset model to obtain a third evaluation result corresponding to each sub-risk information; the first preset model is also used to predict the evaluation result of the sub-risk information based on the sub-search results of the sub-risk information;

[0141] At least one third assessment result is input into the second preset model to obtain a fourth assessment result of the sub-assessment target; the second preset model is also used to predict the assessment result of the sub-assessment target based on the assessment result score of at least one sub-risk information.

[0142] Exemplarily, the target to be evaluated can be a first-level evaluation target; the sub-evaluation target can be a second-level evaluation target determined after evaluating the first-level evaluation target. For example, if it is found that the target to be evaluated includes three components X, Y, and Z, X, Y, and Z are further set as second-level evaluation targets, and the query and associated search and risk determination process of the above-mentioned network security event keywords, vulnerability-related keywords, security qualification-related keywords, important project-related keywords, and supplier scale keywords are respectively performed; if the second-level evaluation target also includes sub-components, a third-level evaluation target can be set, and the keyword query and associated search and risk determination process are re-performed.

[0143] Exemplarily, the third evaluation result may be the second score; the fourth evaluation result may be the second evaluation score; at least one sub-risk information of the sub-assessment target is determined; based on each sub-risk information, the search keyword and the search engine, the sub-search result corresponding to each sub-risk information is determined; the sub-search result includes the evaluation data corresponding to the sub-risk information; the sub-search result is input into the first preset model to obtain the second score corresponding to each sub-risk information; the first preset model is also used to predict the score of the sub-risk information based on the sub-search result of the sub-risk information; at least one second score is input into the second preset model to obtain the second evaluation score of the sub-assessment target; the second preset model is also used to predict the evaluation score of the sub-assessment target based on the score of at least one sub-risk information. The steps can refer to the description of steps 102, 103, 104 and 105 in the aforementioned embodiments, which will not be repeated here.

[0144] In some embodiments, the method further comprises:

[0145] The first evaluation result and the fourth evaluation result are input into the third preset model to obtain the target evaluation result of the target to be evaluated; the third preset model is used to predict the target evaluation result of the target to be evaluated based on the evaluation result of the target to be evaluated and the evaluation results of the sub-evaluation targets.

[0146] Exemplarily, the target evaluation result may be a target score; the third preset model can evaluate the risk of the target to be evaluated by predicting the first evaluation score and the second evaluation score, and output the target score of the target to be evaluated. It can also determine the degree of potential risk of the target to be evaluated based on the target score, specifically, determine the evaluation level corresponding to the target score, and the evaluation level can be used to characterize the risk level of the target to be evaluated.

[0147] In order to understand the embodiments of the present application, a network attack threat prediction method for a software supply chain attack scenario is taken as an example for explanation below.

[0148] This embodiment uses generative artificial intelligence through the following basic ideas, dispatches search engines, asset fingerprint recognition engines, software vulnerability databases, threat intelligence libraries and other external interfaces and domain-specific intelligence sources to assist security designers or security researchers in identifying or predicting potential software supply chain cyber attack risks of target software or system platforms (hereinafter referred to as "risk assessment targets"). Figure 2 As shown, the method comprises the following steps:

[0149] Step 201: Combined with generative artificial intelligence, through natural language interaction with the user, preliminarily determine the type of "risk assessment target" and the keywords and application scenario context that can be referenced for risk assessment.

[0150] The "risk assessment objectives" provided by users supported by this embodiment include but are not limited to at least one of the following:

[0151] A. Software system platform accessible through the Internet. In this scenario, users usually enter the network access address of the "risk assessment target";

[0152] B. Software program file package with source code; in this scenario, the user may upload the source code file compressed package or source code file of the "risk assessment target";

[0153] C. Compiled program file packages without source code. In this scenario, users may upload program file packages or file fragments of the "risk assessment target";

[0154] D. System name and composition information: For this scenario, users usually enter the name of the "risk assessment target" or necessary description information, including the extractable "keywords & application scenario context";

[0155] In this embodiment, the keyword of "risk assessment target" is extracted from the user interaction, and particular attention is paid to and attempts are made to extract Chinese and English words related to the name, supplier, version, operating environment, user data, business performance, etc. of the software system.

[0156] The application scenario context includes, but is not limited to, whether it is applied to an intranet environment or a public network environment; whether it stores or processes critical business data; whether it stores or processes personnel sensitive information; and the approximate number of users accessing the site on a daily basis.

[0157] Step 202: Automatically organize search conditions based on multi-dimensional keywords, schedule the search engine to search for risk information of the "risk assessment target", and obtain search results; and input the search results into the model to determine the first score of the risk information.

[0158] For example, the search engine is scheduled to collect data on supplier capabilities and reputation assessment for the "risk assessment target", and the collected multi-dimensional information is input into the model to judge the supplier's reputation:

[0159] If the user has input supplier information in "Step 201", the supplier information input by the user will be used directly. If the user has not input supplier information in Step 1, an attempt will be made to search for the supplier information using a search engine based on the provided "risk assessment target" information (i.e., at least one of A, B, C, and D provided by the user).

[0160] The search engine will be automatically scheduled to search for suppliers and "risk assessment targets" in combination with lists of network security events, vulnerabilities, security qualifications, keywords related to important projects, and keywords related to supplier size, and automatically collect reputation information related to suppliers and "risk assessment targets". The details are as follows:

[0161] The keywords of network security events for related searches include but are not limited to the following Chinese and English expressions: attack, compromise, data leakage, extortion, user lawsuit, and agency investigation, etc.;

[0162] The vulnerability-related keywords for the associated search include but are not limited to the following Chinese and English expressions: CVE, CNVD, Exploit, PoC, RCE, DOS, vulnerability exploit, code execution, denial of service, vulnerability verification, vulnerability number, etc.;

[0163] Keywords related to security qualifications include, but are not limited to, the following Chinese and English expressions: ISO / IEC27001, information security management system certification, CMMI, security maturity model certification, ISO / IEC 15408, Common Criteria for Assessment Criteria certification, the number of patents applied for and disclosed, and the definition of the technology quadrant of the enterprise by Gartner Magic Quadrant, etc.;

[0164] Related searches for keywords related to important projects include but are not limited to the following phrases in Chinese and English: winning the bid for XXX project, obtaining XXX recognition, etc.;

[0165] The keywords for the supplier size search include but are not limited to the following phrases in Chinese and English: stock price, total number of employees, enterprise valuation, operating income, distribution of subsidiaries and other financial related indicators;

[0166] The above-mentioned network security incident keywords, vulnerability-related keywords, security qualification-related keywords, important project-related keywords, and supplier size keywords will be automatically combined with suppliers and "risk assessment goals" in sequence as search conditions, passed into the search engine, and search results will be obtained; the search results will be passed into the supplier reputation evaluation model, the supplier will be evaluated on its reputation, and the output is a reputation score.

[0167] Note: The model training process used in this embodiment to carry out supplier reputation evaluation based on the data obtained from the above search is as follows:

[0168] The first step is to build a labeled data set: collect the above-mentioned descriptive information of a large number of software vendors, and have data annotation engineers perform network security reputation ratings on each vendor to form labeled data. In the process of labeling the data set, erroneous or irrelevant data will also be cleaned up.

[0169] Step 2: Feature Engineering: Extract semantic features from supplier information, such as security event keywords, security certificates, etc. Structure unstructured data such as text descriptions. When training non-LLM sub-models, factors such as feature extraction, feature selection, and feature scaling also need to be considered.

[0170] Step 3: Model selection: Select an appropriate model based on the size of the dataset, the number of features, and available computing resources. You can try a Bayesian model based on semantic features, a Poisson regression model based on security event counts, a graph neural network based on network embedding to capture supplier relationships, or choose an LLM model.

[0171] Step 4: Model training and evaluation: The goal of training is to let the model learn to identify features related to high-reputation suppliers from the data. Divide the labeled data set into training, validation, and test sets, select appropriate evaluation indicators, and iteratively optimize the model hyperparameters.

[0172] Step 5: Model deployment: Deploy the model as an API service for supplier reputation query or risk warning system.

[0173] Step 203: Invoke the search engine and SCA to analyze or query the component composition information and historical vulnerability information of the “risk assessment target”.

[0174] In "step 201", when the information provided by the user through interaction includes the information "B. Software program file package with source code", the solution will automatically decompress and perform text analysis on the source code data package submitted by the user, and extract important third-party dependency library information therein;

[0175] In "step 201", when the information provided by the user through interaction includes: "C. compiled program file package without source code", the solution will automatically scan the string of the executable program file submitted by the user and extract the information that may be related to the third-party dependent library;

[0176] In "Step 201", when the information provided by the user through interaction includes: "D. System name and composition information" and any information of B and C above, in addition to extracting the third-party dependency library information based on the input of the above B and C scenarios, the third-party dependency library information and "D system name and composition information" will be combined as one of the search conditions, combined with the vulnerability-related keywords in step 2, and the search engine will be called to search, thereby trying to discover historical vulnerability information that has been made public.

[0177] In "Step 201", when the information provided by the user through interaction includes: "A. Software system platform accessible via the network", and there is no third-party dependency library information for the "risk assessment target", the following step 204 will be executed.

[0178] Step 204: Call the asset identification engine to conduct port, service fingerprint and component, and vulnerability scanning and identification for the "risk assessment target".

[0179] It also recursively queries the vendor capabilities and reputation of the identified constituent assets and system components, and recursively queries the historical vulnerability media intelligence information of the relevant components.

[0180] When the information provided by the user through interaction in "Step 201" includes "A. Software system platform accessible through the network", the asset identification engine will be used to identify the ports, service fingerprints and component versions of the target system. The implementation method includes but is not limited to using nmap or whatweb to perform the above-mentioned identification on the target.

[0181] Example: Identify the target system's port and service version based on nmap; or identify the target system's web components based on whatweb.

[0182] After identifying the component and version information corresponding to the port, the "D system name and composition information" will be combined as one of the search conditions, combined with the vulnerability-related keywords in step 202, and the search engine will be called to search, thereby trying to discover historical vulnerability information that has been made public and perform vulnerability scans on the target.

[0183] In addition, with the user's authorization, we will try to combine open source network basic information collection tools such as whois and dnsrecon to collect domain names, subdomains and other information of the "risk assessment target".

[0184] Recursive query means, for example: if it is found that the "risk assessment target" is composed of three components X, Y, and Z, then X, Y, and Z are further set as the second-level "risk assessment targets", and the above-mentioned network security event keywords, vulnerability-related keywords, security qualification-related keywords, important project-related keywords, supplier scale keywords, and the related search and risk assessment process are executed respectively, and so on.

[0185] Step 205: Call the threat intelligence library to query the associated threat intelligence for the "risk assessment target" business assets or the assets of the carrier operator.

[0186] A threat intelligence association query is performed on the domain name and subdomain name of the "risk assessment target" system collected in step 204, so as to obtain intelligence related to the current attack utilization that may not be obtained based on search engines alone.

[0187] Based on the above data, a model prediction is performed on the search results corresponding to the risk information to obtain the first score corresponding to each risk information; multiple first scores are predicted by the first risk scoring model to obtain the first assessment score of the "risk assessment target". The first assessment score of the "risk assessment target" and the second assessment score of the second-level "risk assessment target" can also be predicted by the second risk scoring model to obtain a comprehensive risk score of the "risk assessment target", and a potential comprehensive supply chain risk prediction report of the "risk assessment target" is formed.

[0188] The key reference factors for analysis are as follows:

[0189]

[0190]

[0191] The training process of the first risk scoring model and / or the second risk scoring model is the same as the model training process in “step 202”.

[0192] The present application embodiment provides a risk assessment device, such as Figure 3 As shown, the risk assessment device 300 includes:

[0193] The first acquisition module 301 is used to acquire type data and feature data of the target to be evaluated;

[0194] A first determination module 302, configured to determine at least one risk information of a target to be evaluated based on the type data and the feature data;

[0195] The second acquisition module 303 is used to obtain search results corresponding to each risk information; the search results are determined based on each risk information and the search keyword; the search results include assessment data corresponding to the risk information;

[0196] The prediction module 304 is used to predict the search results corresponding to each risk information according to a preset model to obtain a first evaluation result corresponding to the target to be evaluated.

[0197] In some embodiments, the type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name.

[0198] In some embodiments, the type data of the target to be evaluated includes at least one of a first type accessed through the network, a second type with source code, a third type without source code, and a fourth type identified by name; at least one risk information includes first risk information; the first determination module 302 is also used to extract attribute keywords from the feature data based on the type data to determine the attribute information corresponding to the target to be evaluated; determine the first risk information based on the attribute information; the first risk information represents the risk information of the target to be evaluated itself.

[0199] In some embodiments, the type data of the target to be evaluated includes at least one of a first type accessed through the network, a second type with source code, a third type without source code, and a fourth type identified by name; at least one risk information includes second risk information; the first determination module 302 is also used to extract the second risk information in the feature data based on the identification information and the type data; the identification information represents the supplier identification information; the second risk information represents the risk information of the supplier to which the target to be evaluated belongs; or, the feature data is searched using a search engine and the identification information and the type data to obtain the second risk information.

[0200] In some embodiments, the type data of the target to be evaluated includes at least one of a second type with source code and a third type without source code; at least one risk information includes third risk information; the first determination module 302 is also used to extract feature data corresponding to the second type and / or the third type using a preset method to obtain third risk information; the third risk information represents the risk information of the third-party dependency library used by the target to be evaluated.

[0201] In some embodiments, the type data of the target to be evaluated includes a first type accessed through the network and a fourth type identified by a name; at least one risk information includes fourth risk information; the first determination module 302 is also used to use the recognition engine to identify the characteristic data corresponding to the first type to obtain the service information of the platform to be evaluated; the service information includes at least one of the port information, service fingerprint information and component version information of the platform to be evaluated; based on the service information and the characteristic data corresponding to the fourth type, the fourth risk information is determined; the fourth risk information represents the risk information of the component version of the target to be evaluated.

[0202] In some embodiments, the type data of the target to be evaluated includes at least one of a first type accessed through the network and a fourth type identified by a name; at least one risk information includes fifth risk information; the first determination module 302 is also used to use a search tool to search for characteristic data corresponding to the first type and / or the fourth type to obtain domain name information of the platform to be evaluated; query based on the domain name information to determine the fifth risk information; the fifth risk information represents the threat intelligence information of the target to be evaluated.

[0203] In some embodiments, the search keywords include at least one of a first keyword characterizing a network security incident, a second keyword characterizing a vulnerability, a third keyword characterizing a security qualification, a fourth keyword characterizing a project, and a fifth keyword characterizing a scale; the second acquisition module 303 is also used to combine the risk information with at least one of the first keyword, the second keyword, the third keyword, the fourth keyword, and the fifth keyword, respectively, to obtain search conditions corresponding to the risk information; and search based on the search engine and the search conditions to obtain search results corresponding to the risk information.

[0204] In some embodiments, the second acquisition module 303 is also used to combine the second risk information with at least one of the first keyword, the second keyword, the third keyword, the fourth keyword and the fifth keyword, respectively, to obtain a first search condition corresponding to the second risk information; and to search based on the search engine and the first search condition to obtain search results corresponding to the second risk information.

[0205] In some embodiments, the search keyword includes a second keyword that characterizes the vulnerability; the second acquisition module 303 is also used to combine the fourth risk information with the second keyword to obtain a second search condition corresponding to the fourth risk information; and search the second search condition based on a search engine to obtain a search result corresponding to the fourth risk information.

[0206] In some embodiments, the preset model includes at least a first preset model and a second preset model; the prediction module 204 is also used to input the search results corresponding to each risk information into the first preset model to obtain the second evaluation results corresponding to each risk information; the first preset model is used to predict the evaluation results of the risk information based on the search results of the risk information; at least one second evaluation result is input into the second preset model to obtain the first evaluation result corresponding to the target to be evaluated; the second preset model is used to predict the evaluation result of the target to be evaluated based on the evaluation result of at least one risk information.

[0207] In some embodiments, the risk assessment device 300 further includes:

[0208] A second determination module is used to determine each component as a sub-evaluation target if it is determined that the target to be evaluated includes at least one component;

[0209] A third determination module, used to determine at least one sub-risk information of a sub-assessment target;

[0210] A fourth determination module is used to obtain a sub-search result corresponding to each sub-risk information; the sub-search result is determined based on each sub-risk information and the search keyword; the sub-search result includes the evaluation data corresponding to the sub-risk information;

[0211] A first input module is used to input the sub-search results into a first preset model to obtain a third evaluation result corresponding to each sub-risk information; the first preset model is also used to predict the evaluation result of the sub-risk information based on the sub-search results of the sub-risk information;

[0212] The second input module is used to input at least one third assessment result into the second preset model to obtain a fourth assessment result of the sub-assessment target; the second preset model is also used to predict the assessment result of the sub-assessment target based on the assessment result of at least one sub-risk information.

[0213] In some embodiments, the risk assessment device 300 further includes:

[0214] The third input module is used to input the first evaluation result and the fourth evaluation result into the third preset model to obtain the target evaluation result of the target to be evaluated; the third preset model is used to predict the target evaluation result of the target to be evaluated based on the evaluation result of the target to be evaluated and the evaluation results of the sub-evaluation targets.

[0215] In some embodiments, the risk assessment device 300 further includes:

[0216] A third acquisition module is used to acquire a training sample set of the sample evaluation target based on the data set of the sample evaluation target; wherein the training sample set includes sample search results and labels of the sample evaluation target used to train the initial model, and there is a mapping relationship between the sample search results and the labels, and the labels are used to represent the scores of the sample search results;

[0217] A fifth determination module, used to determine an initial model based on the data set and the training sample set;

[0218] The training module is used to input the training sample set into the initial model for training to obtain a first preset model.

[0219] It should be noted that: when the risk assessment device provided in the above embodiment is controlled, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the risk assessment device provided in the above embodiment and the aforementioned risk assessment method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0220] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a risk assessment device. Figure 4 Only an exemplary structure of the risk assessment device is shown, not all structures, and it can be implemented as needed. Figure 4 Partial or complete structure shown.

[0221] like Figure 4 As shown, the risk assessment device 400 provided in the embodiment of the present application includes: at least one processor 401, a memory 402 and a user interface 403. The various components in the risk assessment device 400 are coupled together through a bus system 404. It can be understood that the bus system 404 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 404 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, in Figure 4 Various buses are labeled as bus system 404 .

[0222] The user interface 403 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0223] The memory 402 in the embodiment of the present application is used to store various types of data to support the operation of the control device. Examples of such data include: any computer program used to operate on the control device.

[0224] The risk assessment method disclosed in the embodiment of the present application can be applied to the processor 401, or implemented by the processor 401. The processor 401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the risk assessment method can be completed by the hardware integrated logic circuit in the processor 401 or the instructions in the form of software. The above-mentioned processor 401 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 401 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 402. The processor 401 reads the information in the memory 402 and completes the steps of the risk assessment method provided in the embodiment of the present application in combination with its hardware.

[0225] In an exemplary embodiment, the risk assessment device may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to perform the aforementioned method.

[0226] It can be understood that the memory 402 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0227] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, which may be a computer-readable storage medium, for example, a memory 402 storing a computer program, and the computer program may be executed by a processor 401 of the risk assessment device to complete the steps described in the method of the present application. The computer-readable storage medium may be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disk, or a CD-ROM.

[0228] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0229] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0230] The above is only a specific implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A risk assessment method, characterized in that: include: Obtain type data and feature data of the target to be evaluated; Determine at least one risk information of the target to be assessed based on the type data and the characteristic data; Obtain search results corresponding to each of the risk information; the search results are determined based on each of the risk information and search keywords; the search results include assessment data corresponding to the risk information; The search results corresponding to each risk information are predicted according to a preset model to obtain a first evaluation result corresponding to the target to be evaluated.

2. The method according to claim 1, characterized in that: The type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name; the at least one risk information includes first risk information; the at least one risk information of the target to be evaluated is determined based on the type data and the feature data, including: Extracting attribute keywords from the feature data based on the type data to determine attribute information corresponding to the target to be evaluated; The first risk information is determined according to the attribute information; the first risk information represents the inherent risk information of the target to be assessed.

3. The method according to claim 1, characterized in that The type data of the target to be evaluated includes at least one of a first type accessed through a network, a second type with source code, a third type without source code, and a fourth type identified by a name; the at least one risk information includes second risk information; the at least one risk information of the target to be evaluated is determined based on the type data and the feature data, including: Extracting the second risk information from the feature data based on the identification information and the type data; the identification information represents the supplier identification information; the second risk information represents the risk information of the supplier to which the target to be evaluated belongs; Or, the feature data is searched using a search engine, the identification information and the type data to obtain the second risk information.

4. The method according to claim 1, characterized in that: The type data of the target to be evaluated includes at least one of a second type with source code and a third type without source code; the at least one risk information includes third risk information; and the at least one risk information of the target to be evaluated is determined based on the type data and the characteristic data, including: The feature data corresponding to the second type and / or the third type are extracted in a preset manner to obtain the third risk information; the third risk information represents the risk information of the third-party dependency library used by the target to be evaluated.

5. The method according to claim 1, characterized in that The type data of the target to be evaluated includes a first type accessed through a network and a fourth type identified by a name; the at least one risk information includes fourth risk information; and the at least one risk information of the target to be evaluated is determined based on the type data and the characteristic data, including: Using a recognition engine to identify the feature data corresponding to the first type, to obtain service information of the platform to be evaluated; the service information includes at least one of port information, service fingerprint information, and component version information of the platform to be evaluated; The fourth risk information is determined based on the service information and the characteristic data corresponding to the fourth type; the fourth risk information represents the risk information of the component version of the target to be evaluated.

6. The method according to claim 1, characterized in that The type data of the target to be evaluated includes at least one of a first type accessed through a network and a fourth type identified by a name; the at least one risk information includes fifth risk information; and the at least one risk information of the target to be evaluated is determined based on the type data and the characteristic data, including: Using a search tool to search for characteristic data corresponding to the first type and / or the fourth type, to obtain domain name information of the platform to be evaluated; A query is performed based on the domain name information to determine the fifth risk information; the fifth risk information represents the threat intelligence information of the target to be assessed.

7. The method according to claim 1, characterized in that The search keywords include at least one of a first keyword representing a network security incident, a second keyword representing a vulnerability, a third keyword representing a security qualification, a fourth keyword representing a project, and a fifth keyword representing a scale; The obtaining of search results corresponding to each risk information includes: combining the risk information with at least one of the first keyword, the second keyword, the third keyword, the fourth keyword, and the fifth keyword respectively to obtain a search condition corresponding to the risk information; A search is performed based on the search engine and the search conditions to obtain search results corresponding to the risk information.

8. The method according to claim 1, characterized in that The preset model includes at least a first preset model and a second preset model; the prediction of the search results corresponding to each risk information according to the preset model to obtain the first assessment result corresponding to the target to be assessed includes: Inputting the search results corresponding to each of the risk information into the first preset model to obtain the second evaluation results corresponding to each of the risk information; the first preset model is used to predict the evaluation results of the risk information based on the search results of the risk information; Input at least one of the second assessment results into the second preset model to obtain a first assessment result corresponding to the target to be assessed; the second preset model is used to predict the assessment result of the target to be assessed based on at least one assessment result of the risk information.

9. A risk assessment device, characterized in that: comprising a processor and a memory for storing a computer program that can be run on the processor, wherein: The processor is used to execute the method according to any one of claims 1 to 8 when running a computer program.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images