Network security situation awareness evaluation processing method

Abstract

The invention discloses a network security situation awareness evaluation processing method, which comprises the following steps of: collecting network security evaluation influence parameters, specific conditions and importance levels of each dimension in a current network server cluster according to a plurality of evaluation dimensions such as asset importance, a topological mode, an access control strategy and a security configuration mode; a data basis is provided for subsequent analysis and calculation; by establishing a linear relation model among all dimensions, the dependency relation and the influence degree among different parameters are known, and key safety influence factors and possible risk propagation paths can be identified; analyzing an influence path between different evaluation dimensions, and further optimizing the layout of security measures and strategies; and the comprehensive security assessment score of the current network server cluster is calculated in combination with the assessment dimension weight and the collected specific data, so that a decision maker can comprehensively understand the network security state, and the assessment dimension with the maximum influence is preferentially processed to improve the overall network security.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security situation awareness assessment processing method. Background Art

[0002] Traditional network security situational awareness assessment processing methods are often unable to effectively manage complex network environments and multi-dimensional security assessment data. As the scale and complexity of networks increase, the assessment process becomes cumbersome and difficult to manage, which affects the accuracy and practicality of the assessment results.

[0003] Research has found that most of the network security assessment processing methods or security situation awareness methods disclosed in the existing technology still use a single dimension for security assessment. Although some methods also collect a large number of influencing factors, they cannot achieve comprehensive and reliable information assessment based on multi-dimensional influencing factors, and thus cannot achieve the technical goal of fully understanding and perceiving the network security situation. Summary of the invention

[0004] The purpose of the present invention is to provide a network security situation awareness assessment and processing method to solve the above-mentioned technical problems pointed out in the prior art.

[0005] The present invention provides a network security situation awareness assessment processing method, comprising the following steps:

[0006] Acquire multiple assessment dimensions of security assessment transactions corresponding to the current network server cluster; perform an assessment reference data collection operation for the assessment dimensions to obtain multiple network security assessment impact parameters S={s1, s2, s3, ...si}, where si represents the i-th network security assessment impact parameter;

[0007] Performing an evaluation correlation analysis on the network security evaluation influencing parameters, and outputting a plurality of dimensional correlation networks, wherein the dimensional correlation networks represent correlations between the network security evaluation influencing parameters of a plurality of evaluation dimensions;

[0008] Perform parameter impact weight analysis according to the plurality of dimension-associated networks to determine the assessment dimension weight W of the security assessment transaction currently associated with the current network server cluster, and then calculate the network security assessment score T of the current network server cluster in combination with the network security assessment impact parameter S and the assessment dimension weight W;

[0009] The network security assessment score T is calculated as follows:

[0010] T = ∑S × W.

[0011] Preferably, the evaluation dimensions include asset importance, topology, access control strategy, and security configuration method.

[0012] Preferably, the dimensional association network is obtained based on multivariate linear regression analysis;

[0013] The linear regression equation of the dimensional association network is expressed as:

[0014] YS i =∑β j S j +∈;

[0015] In the formula, YS i is the linear regression equation of the influencing parameters of the ith network security assessment; β j S is the regression coefficient of the jth network security assessment influencing parameter; j is the jth network security assessment influencing parameter other than the current i-th network security assessment influencing parameter; ∑β j S j is a regression term, which represents the sum of the products of all network security assessment influencing parameters except the current i-th network security assessment influencing parameter and the regression coefficients corresponding to all network security assessment influencing parameters except the current i-th network security assessment influencing parameter; ∈ is the residual.

[0016] Preferably, the parameter impact weight analysis based on the multiple dimension association networks to determine the assessment dimension weight W of the security assessment transaction currently associated with the current network server cluster includes the following steps:

[0017] Establishing a path model based on all the dimensional association networks formed by network security assessment parameters;

[0018] Obtain the regression coefficient β of the linear regression equation of each dimension association network i According to the regression coefficient β i Calculate and obtain the impact metric D of each network security assessment parameter in the path model Si ;

[0019] Calculating the path effect Z for each path in the path model according to the regression coefficient;

[0020] According to the impact metric D Si Calculate and obtain the evaluation dimension weight W with the path effect Z;

[0021] The calculation method of the evaluation dimension weight W is:

[0022] Preferably, the path model is a mixed complex relationship network of bidirectional and unidirectional.

[0023] Preferably, the impact metric D Si The calculation method is:

[0024] D Si =β i ·σ Si ;

[0025] In the formula, σ Si is the standardized variable value of the i-th network security assessment parameter;

[0026] The path effect Z is calculated as follows:

[0027] Z=β i ×β j ;

[0028] In the formula, β i , β j are the regression coefficients of the starting and ending points of each path in the path model.

[0029] Preferably, establishing a path model based on all the dimensional association networks comprises the following steps:

[0030] During the initial operation, an initial path model is established;

[0031] Sort the dimensional association networks from high to low according to the priority of the dependent variable to obtain a dimensional association network sequence set; traverse from the first dimensional association network according to the dimensional association network sequence set, put the dimensional association network into the initial path model, and obtain a first path model;

[0032] Y'S i =∑(∑β j S j )+∈;

[0033] In the formula, Y'S i is the first regression equation of the current first path model; β j S is the regression coefficient of the jth network security assessment influencing parameter; j is the jth network security assessment influencing parameter other than the current i-th network security assessment influencing parameter; ∑β j S j is a regression term, which represents the product of all network security assessment influencing parameters except the current i-th network security assessment influencing parameter and the regression coefficients corresponding to all network security assessment influencing parameters except the current i-th network security assessment influencing parameter; ∈ is the residual; ∑(∑β j S j ) represents the sum of the regression terms of the associated networks of each dimension in the current first path model;

[0034] Obtain a first regression equation of the first path model; calculate and obtain the model fitness F based on the regression coefficient of the first regression equation; determine whether the fitness F is greater than or equal to a preset fitness threshold f'; if so, further determine whether the current dimensional associated network sequence set has been traversed; if so, output the first path model as the final path model; if not, return to the above operation until the current dimensional associated network sequence set has been traversed.

[0035] Preferably, the model fitness F is calculated as follows:

[0036]

[0037] Where Y i Represents the value of the regression equation of the current first path model; is the standard measure of the regression equation of the path model; It is the average value of the regression equation of each dimension association network in the current first path model;

[0038] Preferably, the step of establishing a path model based on all the dimensional association networks further includes the following steps:

[0039] Acquire a first node and a second node according to the dependent variable and the independent variable in each of the dimensional association networks;

[0040] A plurality of directed paths are obtained according to the connection between each of the first nodes and the second nodes; and a path model is obtained based on all the directed paths.

[0041] The present invention also provides a storage medium, which includes a stored program, wherein when the program is running, the device where the readable storage medium is located is controlled to execute the above-mentioned network security situation awareness assessment and processing method.

[0042] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0043] By analyzing the above-mentioned network security situation awareness assessment processing method provided by the present invention, it can be known that in specific applications, network security assessment influencing parameters are collected according to multiple assessment dimensions such as asset importance, topology, access control strategy, security configuration mode, etc., and the specific situation and importance level of each dimension in the current network server cluster provide a data basis for subsequent analysis and calculation; in specific applications, by establishing a linear relationship model between each dimension, the dependency and influence degree between different parameters can be understood; in a further technical solution, a path model is established based on the association network of all the dimensions so that the influence path between different assessment dimensions can be analyzed, such as the influence of asset importance on topology or access control strategy, which is helpful It is used to identify key security influencing factors and possible risk transmission channels, and then optimize the layout of security measures and strategies; finally, it combines the evaluation dimension weights and the specific data collected to calculate the comprehensive security assessment score of the current network server cluster, which helps decision makers to fully understand the network security status and give priority to the evaluation dimensions with the greatest impact to improve the overall network security; through multi-dimensional data collection and correlation analysis, it provides a comprehensive assessment of the network security status, avoiding the one-sidedness of a single indicator or perspective, and the dimension correlation network and weight analysis help identify key points and potential security risks in the system; decision makers can prioritize the most influential factors according to the weights of the evaluation dimensions to maximize network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of the overall operation steps of a network security situation awareness assessment and processing method;

[0045] Figure 2 A schematic diagram of the operation steps for analyzing and obtaining the evaluation dimension weight W in a network security situation awareness evaluation processing method;

[0046] Figure 3 A schematic diagram of path model simulation in a network security situation awareness assessment processing method;

[0047] Figure 4 A schematic diagram of the operation steps for establishing a path model in a network security situation awareness assessment and processing method;

[0048] Figure 5 A schematic diagram of directed path operation steps for establishing a path model in a network security situation awareness assessment and processing method. DETAILED DESCRIPTION

[0049] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0051] like Figure 1 As shown, the present invention provides a network security situation awareness assessment processing method, comprising the following operating steps:

[0052] Step S10: obtaining multiple assessment dimensions of security assessment transactions corresponding to the current network server cluster; performing an assessment reference data collection operation for the assessment dimensions to obtain multiple network security assessment impact parameters S = {s1, s2, s3, ... si}, where si represents the i-th network security assessment impact parameter;

[0053] The evaluation dimensions include asset importance, topology, access control strategy, and security configuration method;

[0054] It should be noted that the asset importance in the above assessment dimension is to assess the importance level of various assets in the network, such as key business systems, data storage, key services, etc.;

[0055] The topological method is to evaluate the physical and logical topology of the network, including the layout of network devices, connection methods, subnet division, etc.

[0056] Access control policy is to evaluate the access control measures in the network, such as firewall settings, network isolation policies, etc.

[0057] Security configuration management is to evaluate the security configuration of systems and applications, such as password policies, update management, vulnerability patching, etc.

[0058] Through the evaluation reference data collection operation of the above-mentioned multiple evaluation dimensions, the network security evaluation influencing parameters in various dimensions of the current network server cluster can be actually understood, providing a real data basis for subsequent network security evaluation; the above-mentioned network security evaluation influencing parameters are numerical parameters obtained by collecting and quantifying the actual conditions of each evaluation dimension.

[0059] Step S20: performing an assessment correlation analysis on the network security assessment influencing parameters, and outputting a plurality of dimensional correlation networks, wherein the dimensional correlation networks represent correlations between the network security assessment influencing parameters of a plurality of assessment dimensions;

[0060] The dimension association network is obtained based on multiple linear regression analysis;

[0061] The linear regression equation of the dimensional association network is expressed as:

[0062] YS i =∑β j S j +∈;

[0063] In the formula, YS i is the linear regression equation of the influencing parameters of the ith network security assessment; β j S is the regression coefficient of the jth network security assessment influencing parameter; j is the jth network security assessment influencing parameter other than the current i-th network security assessment influencing parameter; ∑β j S j is a regression term, which represents the sum of the products of all network security assessment influencing parameters except the current i-th network security assessment influencing parameter and the regression coefficients corresponding to all network security assessment influencing parameters except the current i-th network security assessment influencing parameter; ∈ is the residual;

[0064] It should be noted that the above-mentioned evaluation correlation analysis can help understand the dependencies between different parameters, the degree of influence, and possible threat propagation paths; for example, it can analyze the impact of asset importance on topology security, or the impact of security configuration management on access control policies, etc., which helps to identify key security influencing factors and possible risk propagation paths;

[0065] The above-mentioned evaluation correlation analysis can be analyzed by multiple linear regression. Multiple linear regression is a method used in statistics to analyze the relationship between multiple independent variables and a continuous dependent variable (the relationship between multiple independent variables and a continuous dependent variable is the relationship between any multiple network security evaluation influencing parameters S and a network security evaluation influencing parameter S. This is because the network security evaluation influencing parameter S will change continuously in the current network server cluster due to the change of the cluster). It is an extension of linear regression and is suitable for exploring how multiple independent variables jointly affect the dependent variable.

[0066] Multiple linear regression includes independent variables, dependent variables regression equation and regression coefficients;

[0067] Among them, the independent variable is the variable used to predict or explain the dependent variable; in multiple linear regression, there can be multiple independent variables, each of which can affect the change of the dependent variable;

[0068] The dependent variable is the variable we wish to understand or predict, and multiple linear regression attempts to build a model that predicts or explains changes in the dependent variable through a combination of independent variables;

[0069] The core of the regression equation is to describe the relationship between the independent variable and the dependent variable through a linear equation. The general form is:

[0070] Y=β0+β1X1+β2X2+…+β p X p +∈;

[0071] Among them, Y is the dependent variable (i.e., any parameter S that affects network security assessment); X1, X2, X p is the independent variable (i.e., any network security assessment influencing parameter S other than the dependent variable); β0, β1, β p is the regression coefficient;∈ is the residual;

[0072] The regression coefficient shows the degree of influence of each independent variable on the dependent variable, that is, how the independent variable changes when the dependent variable increases by one unit when other independent variables remain unchanged;

[0073] The residual is the difference between the observed value and the predicted value, which represents the part that cannot be explained by the model. The goal of multiple linear regression is to make the residual as small as possible to achieve the best fit.

[0074] The above-mentioned evaluation correlation relationship analysis can be performed by multiple linear regression. The network security evaluation influencing parameters obtained by parameter mining in step S10 are randomly divided into dimensions as dependent variables and independent variables. Then, by assuming that there is a linear relationship between the dependent variable and the independent variable, the correlation relationship between the network security evaluation influencing parameters of each dimension is determined by using the goodness of fit and calculating the residual, thereby obtaining a dimensional correlation network. The above-mentioned multiple linear regression method is common knowledge among technicians in this field and will not be repeated in this application.

[0075] Step S30: Analyze the evaluation dimension weight W of the security assessment transaction currently associated with the current network server cluster according to the parameter influence weight of the multiple dimension association networks, and then calculate the network security assessment score T of the current network server cluster in combination with the network security assessment influence parameter S and the evaluation dimension weight W;

[0076] The network security assessment score T is calculated as follows:

[0077] T = ∑ S × W;

[0078] It should be noted that the above embodiment of the present application combines multiple dimensional association networks and performs weight analysis to obtain the evaluation dimension weight, which reflects the importance of each evaluation dimension to the current network server cluster security assessment; combined with the specific data in step S10 and the weight analysis in step S30, a comprehensive security assessment score is calculated for the current network server cluster. This score can help decision makers understand the network security status and thus choose to provide corresponding network security strategies;

[0079] The embodiment of the present application uses a systematic method to comprehensively evaluate the security status of the current network server cluster from multiple perspectives. Through clear evaluation dimensions, established relationship networks and weight analysis, multiple security evaluation dimensions are covered, ensuring a comprehensive evaluation and in-depth analysis of the network security status; by establishing a relationship network between evaluation parameters, the potential propagation paths and key nodes of security issues are revealed, which is helpful for key protection and risk management; through weight analysis, the relative importance of each evaluation dimension in the overall security evaluation is provided, helping decision makers to prioritize high-risk and key issues;

[0080] The above-mentioned embodiment of the present application collects network security assessment influencing parameters according to multiple assessment dimensions such as asset importance, topology, access control strategy, and security configuration method, and the specific situation and importance level of each dimension in the current network server cluster, providing a data basis for subsequent analysis and calculation; by establishing a linear relationship model between each dimension, understanding the dependency and influence degree between different parameters, it is helpful to identify key security influencing factors and possible risk propagation paths; analyzing the influence paths between different assessment dimensions, such as the impact of asset importance on topology or access control strategy, and then optimizing the layout of security measures and strategies; combining the assessment dimension weight (W) and the specific data collected in step S10 to calculate the comprehensive security assessment score (T) of the current network server cluster, it is helpful for decision makers to fully understand the network security status and give priority to the assessment dimensions with the greatest impact to improve overall network security.

[0081] Further, in step S30, when performing parameter influence weight analysis on the evaluation dimension weight W of the security assessment transaction currently associated with the current network server cluster according to the plurality of dimension association networks, each evaluation dimension (each network security assessment influence parameter S is taken as an evaluation dimension) is used as a dependent variable, and other evaluation dimensions are used as independent variables, thereby obtaining an association relationship network corresponding to each evaluation dimension;

[0082] For example, the correlation between the six network security assessment influencing parameters A, B, C, D, E, and F, takes A as the dependent variable, B, C, D, E, and F as independent variables, and obtains the correlation network of A. Then, B is taken as the dependent variable, and A, C, D, E, and F are taken as independent variables to obtain the correlation network of B. Then, C is taken as the dependent variable, and A, B, D, E, and F are taken as independent variables to obtain the correlation network of C, and so on. In these correlation networks, because the larger the regression coefficient in the linear regression equation, the larger the weight of the corresponding network security assessment parameter, the greater the weight of the corresponding network security assessment parameter. Therefore, the present application implements The example uses the regression coefficient as the weight of each parameter in each association network, so that the association network of A will obtain the regression coefficients of B, C, D, E, and F as the weights of B, C, D, E, and F during the analysis process, and the regression coefficients of A, C, D, E, and F will be obtained as the weights of A, C, D, E, and F during the analysis process of the association network of B...; these associations correspond to different dependent variables, and the corresponding weights of each network security assessment influencing parameter are also inconsistent. Therefore, in order to obtain the weights of each network security assessment influencing parameter (i.e., the evaluation dimension weight), further analysis is required.

[0083] Specifically, Figure 2 As shown, in step S30, the evaluation dimension weight W of the security assessment transaction currently associated with the current network server cluster is analyzed based on the parameter impact weight of the multiple dimension associated networks, including the following operation steps:

[0084] Step S31: establishing a path model based on all the dimension association networks; that is, establishing a path model based on all the dimension association networks formed by network security assessment parameters;

[0085] The path model is a mixed complex relationship network of bidirectional and unidirectional;

[0086] It should be noted that in the above-mentioned embodiment of the present application, the path model (such as Figure 3 As shown), the impact between each network security assessment parameter can be intuitively viewed;

[0087] The above path model is a mixed complex relationship network of two-way and one-way established on the basis of the association network of each dimension, among which the two-way relationship network (such as Figure 3The bold double-arrow path in the figure refers to the mutual influence of two evaluation dimensions at both ends of a path (that is, between the two evaluation dimensions, when one evaluation dimension is used as the dependent variable, the other evaluation dimension appears in the dimension association network corresponding to the dependent variable. For example, there is a path connecting two evaluation dimensions A and B in the path model. In the dimension association network for A, B exists as an independent variable. At the same time, in the dimension association network for B, A exists as an independent variable). A one-way relationship network (such as Figure 3 The bold one-way arrow path in the figure refers to a one-way influence relationship in which only one of the evaluation dimensions at both ends of a path affects the other end (that is, between two evaluation dimensions, when only one of the evaluation dimensions is used as the dependent variable, the other evaluation dimension appears in the dimension association network corresponding to the dependent variable, while when the other evaluation dimension is used as the dependent variable, the evaluation dimension does not appear in the dimension association network corresponding to the dependent variable. For example, there is a path connecting two evaluation dimensions C and D in the path model. In the dimension association network for C, D exists as an independent variable, while in the dimension association network for D, C does not exist as an independent variable).

[0088] Step S32: Obtain the regression coefficient β of the linear regression equation of each dimension association network i (The linear regression equation of the dimensional association network has been explained in the above steps, which will not be repeated here. The dimensional association network is obtained based on multivariate linear regression analysis); according to the regression coefficient β i Calculate and obtain the impact metric D of each network security assessment parameter in the path model Si ;

[0089] The impact metric D Si The calculation method is:

[0090] D Si =β i ·σ Si ;

[0091] In the formula, σ Si is the standardized variable value of the i-th network security assessment parameter;

[0092] It should be noted that the above standardized variable value σ Si It is a commonly used data processing method in multiple linear regression analysis, which helps to eliminate the dimensional differences between different variables and make each variable comparable; specifically, the standardized variable value σ Si It is obtained by mathematically processing the original variable (i.e. the above network security assessment parameters). The commonly used standardization method is to subtract the original variable from its mean and then divide it by the standard deviation. The standardized variable value σ SiIt is a dimensionless value, which indicates the relative position or deviation of the network security assessment parameter in the sample, which helps to accurately assess the importance of each influencing parameter and more accurately reflect their contribution in subsequent steps;

[0093] Step S33: Calculating the path effect Z for each path in the path model according to the regression coefficient;

[0094] The path effect Z is calculated as follows:

[0095] Z=β i ×β j ;

[0096] In the formula, β i , β j are the regression coefficients of the starting and ending points of each path in the path model (for example, the current Figure 3 In the path model composed of the dimensional association network constructed by the association relationship of the five network security assessment influencing parameters A, B, C, D, and E, when the network security assessment influencing parameter A is used as the dependent variable, the regression coefficient of the network security assessment influencing parameter B is β i ; When the network security assessment influencing parameter B is used as the dependent variable, the regression coefficient of the network security assessment influencing parameter A is β j , at this time, network security assessment influencing parameter A and network security assessment influencing parameter B form a path pointing to each other, β i , β j are the regression coefficients of A and B on the path respectively)

[0097] It should be noted that the above path effect calculation allows the complex impact path to be decomposed into a combination of direct and indirect effects. This allows us to quantify the contribution of each variable to the final result, thereby understanding the role of each variable in the overall impact.

[0098] Step S34: According to the impact metric D Si Calculate and obtain the evaluation dimension weight W with the path effect Z;

[0099] The calculation method of the evaluation dimension weight W is: That is, the above formula is the evaluation dimension weight W of the i-th network security evaluation parameter i ; I will not go into details about this.

[0100] It should be noted that in the above-mentioned embodiment of the present application, during the calculation process of the evaluation dimension weight W, the impact metric is considered to measure the direct influence of each evaluation dimension (i.e., the above-mentioned network security evaluation parameter), which can reflect the degree of influence of the evaluation dimension on the final result when the final result (i.e., the network security evaluation result) changes; and the influence paths between each evaluation dimension are considered, and these paths can directly affect the final evaluation result, that is, on a path network security evaluation parameter A→network security evaluation parameter B, when the weight of network security evaluation parameter A is large, it will directly affect the value of network security evaluation parameter B. By comprehensively considering the direct impact metric and all indirect impact effects, the weight calculation can more comprehensively understand the overall contribution of each evaluation dimension to the final evaluation result.

[0101] During the specific implementation of the above-mentioned embodiment of the present application, the technicians found that there are parameters that do not affect each other in multiple dimensional association networks. For example, in the multiple dimensional association networks established by the four network security assessment parameters A, B, C, and D, there is a dimensional association network about the network security assessment parameter A: A|BC; the dimensional association network about the network security assessment parameter B: B|ACD; the dimensional association network about the network security assessment parameter C: C|AB; the dimensional association network about the network security assessment parameter D: D|B; therefore, in the established path model, there will be no interconnected paths between A and D, and C and D. Therefore, it is also necessary to optimize the paths that are not mutually associated between A and D, and C and D, to prevent the excessively large path model from performing unnecessary calculations in the subsequent process and wasting system resources.

[0102] Specifically, Figure 4 As shown, in step S31, a path model is established based on all the dimensional association networks, including the following steps:

[0103] Step S311: During the initial operation, an initial path model is established; the initial path model is empty and does not contain any variables;

[0104] Step S312: sorting the dimensional association networks from high to low according to the priority of the dependent variable to obtain a dimensional association network sequence set; traversing from the first dimensional association network according to the dimensional association network sequence set, placing the dimensional association network into the initial path model to obtain a first path model;

[0105] The first regression equation of the first path model is expressed as:

[0106] Y'S i =∑(∑β j S j )+∈;

[0107] In the formula, Y'Si is the first regression equation of the current first path model; β j S is the regression coefficient of the jth network security assessment influencing parameter; j is the jth network security assessment influencing parameter other than the current i-th network security assessment influencing parameter; ∑β j S j is a regression term, which represents the product of all network security assessment influencing parameters except the current i-th network security assessment influencing parameter and the regression coefficients corresponding to all network security assessment influencing parameters except the current i-th network security assessment influencing parameter; ∈ is the residual; ∑(∑β j S j ) represents the sum of the regression terms of the associated networks of each dimension in the current first path model;

[0108] It should be noted that the above-mentioned embodiment of the present application preferentially traverses the dimension association network with high priority, which essentially takes the evaluation dimension with high priority as the basis of the path model, so that the result of the subsequent analysis of the weight of each dimension is more accurate. At the same time, giving priority to the dimension association network with high priority helps to reduce unnecessary calculations;

[0109] The first regression equation of the first path model in the above-mentioned embodiment of the present application is based on the regression equations of the associated networks of each dimension in the first path model to construct a new regression equation (ie, the first regression equation), which can simplify calculations and improve system operation efficiency.

[0110] Step S313: obtain the first regression equation of the first path model; calculate the model fitness F based on the regression coefficient of the first regression equation; determine whether the fitness F is greater than or equal to a preset fitness threshold f'; if so (if not, the current dimensional association network is screened out in the first path model), then further determine whether the current dimensional association network sequence set has been traversed; if so, output the first path model as the final path model; if not, return to the above operation until the current dimensional association network sequence set has been traversed.

[0111] The model fitness F is calculated as follows:

[0112]

[0113] Where Y i Represents the value of the regression equation of the current first path model; is the standard measure of the regression equation of the path model; It is the average value of the regression equation of each dimension association network in the current first path model;

[0114] It should be noted that, in the specific implementation process of the above-mentioned embodiment of the present application, an initially empty path model is established, and then each dimensional association network is sequentially placed into the path model according to the priority of its dependent variable. The first path model obtained in the first iteration is the path model represented by the regression equation of the dimensional association network with the highest priority of the dependent variable in each dimensional association network;

[0115] In this way, in each subsequent iteration, the regression equation of the dimension association network in the new iteration is added to the regression equation in the previous iteration, and a new regression equation is obtained to represent the first path model of the new iteration;

[0116] In further operations, the model fitness is calculated to determine whether the model is reasonable (if it is not reasonable, then after adding the first path model, it will cause unnecessary waste of computing power in the subsequent calculation process), and by judging whether all dimensional association networks have been iterated, it is determined whether each dimensional association network is taken into account. Finally, after meeting the fitness requirements and iterating all dimensional association networks, the final path model is output.

[0117] Specifically, Figure 5 As shown, in step S31, a path model is established based on all the dimension association networks, and the following operation steps are also included:

[0118] Step S301: obtaining a first node and a second node according to the dependent variable and the independent variable in each dimension association network;

[0119] It should be noted that the above embodiment of the present application uses the independent variable in the dimensional association network as the first node and the dependent variable as the second node, that is, the generation of the first node will lead to the generation of the second node;

[0120] For example: There are currently four evaluation dimensions A, B, C, and D. For the dimension association network of A (i.e., A is the dependent variable), there are three evaluation dimensions B, C, and D (i.e., B, C, and D are independent variables), then A is taken as the second node, and B, C, and D are taken as the first nodes respectively;

[0121] In the dimension association network of B, there are two evaluation dimensions A and D. Then B is taken as the second node, A and D are taken as the first nodes, and so on. No further details are given.

[0122] Step S302: obtaining a plurality of directed paths according to the connection between each of the first nodes and the second nodes; and obtaining a path model based on all the directed paths.

[0123] It should be noted that in the above embodiment of the present application, the second node is used as the starting end (cause) and the first node is used as the ending end (effect) to connect the directed paths, so that all directed paths are integrated to obtain the path model;

[0124] The directed paths in the above-mentioned embodiments of the present application include unidirectional and bidirectional directed paths. Continuing with the above example, in the dimension association network of C, there is one evaluation dimension of D, then C is used as the second node and D is used as the first node; in the dimension association network of D, there are three evaluation dimensions of A, B, and C, then D is used as the second node, and A, B, and C are used as the first nodes respectively; thus, the following paths can be obtained: B→A, C→A, D→A, A→B, D→B, D→C, A→D, B→D, C→D; further, Four bidirectional relationship networks and one unidirectional relationship network C→A;

[0125] Through the above-mentioned embodiments of the present application, the causal relationship or influence relationship between each evaluation dimension is clearly and intuitively defined, so as to accurately determine which dimensions may directly affect the changes or performances of other dimensions.

[0126] In summary, a network security situation awareness assessment processing method proposed in the example of the present invention collects network security assessment influencing parameters according to multiple assessment dimensions such as asset importance, topology, access control strategy, and security configuration mode, and the specific situation and importance level of each dimension in the current network server cluster, so as to provide a data basis for subsequent analysis and calculation; in specific applications, by establishing a linear relationship model between various dimensions, the dependency and influence degree between different parameters are understood, which is helpful to identify key security influencing factors and possible risk propagation paths; in a further technical solution, a path model is established based on the association network of all the dimensions, so that the influence path between different assessment dimensions can be analyzed, such as the influence of asset importance on topology or access control strategy, and then the layout of security measures and strategies is optimized;

[0127] Taking into account the influence paths between each evaluation dimension, which can directly affect the final evaluation results, the weight calculation can more comprehensively understand the overall contribution of each evaluation dimension to the final evaluation results by comprehensively considering the direct impact measurement and all indirect impact effects.

[0128] Furthermore, when obtaining the path model, an initially empty path model is established, and then each dimensional association network is sequentially placed into the path model according to the priority of its dependent variable. The first path model obtained in the first iteration is the path model represented by the regression equation of the dimensional association network with the highest priority of the dependent variable among the dimensional association networks.

[0129] In this way, in each subsequent iteration, the regression equation of the dimension association network in the new iteration is added to the regression equation in the previous iteration, and a new regression equation is obtained to represent the first path model of the new iteration;

[0130] In further operations, the model fitness is calculated to determine whether the model is reasonable (if it is unreasonable, then after adding the first path model, it will cause unnecessary waste of computing power in the subsequent calculation process), and by judging whether all dimensional association networks have been iterated, it is determined whether each dimensional association network is taken into account. Finally, after meeting the fitness requirements and iterating all dimensional association networks, the final path model is output; finally, it combines the evaluation dimension weights and the specific data collected to calculate the comprehensive security assessment score of the current network server cluster, which helps decision makers to fully understand the network security status and give priority to the evaluation dimensions with the greatest impact to improve overall network security.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. A person skilled in the art may modify the technical solutions described in the above embodiments, or replace part or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security situation awareness assessment processing method, characterized in that: The steps are as follows: Acquire multiple assessment dimensions of security assessment transactions corresponding to the current network server cluster; perform an assessment reference data collection operation for the assessment dimensions to obtain multiple network security assessment impact parameters S={s1, s2, s3, ...si}, where si represents the i-th network security assessment impact parameter; Performing an evaluation correlation analysis on the network security evaluation influencing parameters, and outputting a plurality of dimensional correlation networks, wherein the dimensional correlation networks represent correlations between the network security evaluation influencing parameters of a plurality of evaluation dimensions; Perform parameter impact weight analysis on the security assessment transaction currently associated with the current network server cluster according to the plurality of dimension-associated networks, and then calculate the network security assessment score T of the current network server cluster in combination with the network security assessment impact parameter S and the assessment dimension weight W; The network security assessment score T is calculated as follows: T = ∑S × W.

2. A network security situation awareness assessment processing method according to claim 1, characterized in that: The evaluation dimensions include asset importance, topology, access control strategy, and security configuration method.

3. A network security situation awareness assessment processing method according to claim 2, characterized in that: The dimension association network is obtained based on multiple linear regression analysis; The linear regression equation of the dimensional association network is expressed as: Y.S. i =∑β j S j +∈; In the formula, YS i is the linear regression equation of the influencing parameters of the ith network security assessment; β j S is the regression coefficient of the jth network security assessment influencing parameter; j is the jth network security assessment influencing parameter other than the current i-th network security assessment influencing parameter; ∑β j S j is a regression term, which represents the sum of the products of all network security assessment influencing parameters except the current i-th network security assessment influencing parameter and the regression coefficients corresponding to all network security assessment influencing parameters except the current i-th network security assessment influencing parameter; ∈ is the residual.

4. A network security situation awareness assessment processing method according to claim 3, characterized in that: The step of performing parameter influence weight analysis on the security assessment transaction currently associated with the current network server cluster according to the plurality of dimensionally associated networks comprises the following steps: Establishing a path model based on all the dimensional association networks formed by network security assessment parameters; Obtain the regression coefficient β of the linear regression equation of each dimension association network i According to the regression coefficient β i Calculate and obtain the impact metric D of each network security assessment parameter in the path model Si ; Calculating the path effect Z for each path in the path model according to the regression coefficient; According to the impact metric D Si Calculate and obtain the evaluation dimension weight W with the path effect Z; The calculation method of the evaluation dimension weight W is:

5. A network security situation awareness assessment processing method according to claim 4, characterized in that: The path model is a mixed complex relationship network of bidirectional and unidirectional relationships.

6. A network security situation awareness assessment processing method according to claim 5, characterized in that: The impact metric D Si The calculation method is: D Si =b i ·s Si ; In the formula, σ Si is the standardized variable value of the i-th network security assessment parameter; The path effect Z is calculated as follows: Z＝β i ×β j ； In the formula, β i , β j are the regression coefficients of the starting and ending points of each path in the path model.

7. A network security situation awareness assessment processing method according to claim 6, characterized in that: Establishing a path model based on all the dimensional association networks includes the following steps: During the initial operation, an initial path model is established; Sort the dimensional association networks from high to low according to the priority of the dependent variable to obtain a dimensional association network sequence set; traverse from the first dimensional association network according to the dimensional association network sequence set, put the dimensional association network into the initial path model, and obtain a first path model; The first regression equation of the first path model is expressed as: Y’S i =∑(∑β j S j )+∈; In the formula, Y'S i is the first regression equation of the current first path model; β j S is the regression coefficient of the jth network security assessment influencing parameter; j is the jth network security assessment influencing parameter other than the current i-th network security assessment influencing parameter; ∑β j S j is a regression term, which represents the product of all network security assessment influencing parameters except the current i-th network security assessment influencing parameter and the regression coefficients corresponding to all network security assessment influencing parameters except the current i-th network security assessment influencing parameter; ∈ is the residual; ∑(∑β j S j ) represents the sum of the regression terms of the associated networks of each dimension in the current first path model; Obtain a first regression equation of the first path model; calculate and obtain the model fitness F based on the regression coefficient of the first regression equation; determine whether the fitness F is greater than or equal to a preset fitness threshold f'; if so, further determine whether the current dimensional associated network sequence set has been traversed; if so, output the first path model as the final path model; if not, return to the above operation until the current dimensional associated network sequence set has been traversed.

8. A network security situation awareness assessment processing method according to claim 7, characterized in that: The model fitness F is calculated as follows: Where Y i Represents the value of the regression equation of the current first path model; is the standard measure of the regression equation of the path model; It is the average value of the regression equation of each dimension association network in the current first path model.

9. A network security situation awareness assessment processing method according to claim 8, characterized in that: The step of establishing a path model based on all the dimensional association networks also includes the following steps: Acquire a first node and a second node according to the dependent variable and the independent variable in each of the dimensional association networks; A plurality of directed paths are obtained according to the connection between each of the first nodes and the second nodes; and a path model is obtained based on all the directed paths.

10. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the readable storage medium is located is controlled to execute a network security situation awareness assessment processing method as described in any one of claims 1 to 9 above.

Images