Pre-insurance risk assessment method and device, equipment and storage medium

Abstract

The invention provides a pre-insurance risk assessment method, device and equipment and a storage medium, and relates to the technical field of network security insurance, and the method comprises the steps: obtaining network asset attack surface surveying and mapping data, questionnaire survey data and network security threat intelligence analysis data of a user; inputting the network asset attack surface surveying and mapping data and the questionnaire survey data into a pre-trained Transform model for analysis to obtain a multi-dimensional scoring result, inputting the network security threat intelligence analysis data into a pre-trained logistic regression model to obtain an influence factor, and analyzing the influence factor to obtain a multi-dimensional scoring result; and finally, obtaining a risk assessment score of the user based on the scoring result and the influence factor. Therefore, the network asset attack surface surveying and mapping data, the questionnaire survey data and the network security threat intelligence analysis data are integrated, and the machine learning model and the logistic regression model are combined for risk assessment, so that a comprehensive and accurate risk assessment score is provided for the user, and powerful support is provided for network security guarantee of the user.

Description

Technical Field

[0001] The present application relates to the field of cybersecurity insurance technology, and in particular to a pre-insurance risk assessment method, device, equipment and storage medium. Background Art

[0002] In recent years, with the explosive growth in the scale, scope, complexity and degree of damage of cyber attacks, cybersecurity issues have become increasingly prominent. Therefore, cybersecurity insurance has emerged along with the development of the digital economy and plays an increasingly important role in business operations. Cybersecurity insurance is a type of insurance for corporate network security. In recent years, the domestic cybersecurity insurance market has grown by more than 100% annually, but it still faces the problem of difficulty in quantifying the risk assessment of insured customers during the insurance process. Summary of the invention

[0003] In response to the above problems, this application provides a pre-insurance risk assessment method, including the following contents:

[0004] In a first aspect, the present application provides a pre-insurance risk assessment method, the method comprising:

[0005] Obtain network asset attack surface mapping data, questionnaire survey data, and network security threat intelligence analysis data of the user to be evaluated; the questionnaire survey data is obtained based on the completion of a questionnaire personalized and generated based on the network asset attack surface mapping data;

[0006] Input the network asset attack surface mapping data and the questionnaire survey data into a pre-trained Transformer model for analysis to obtain scoring results in multiple dimensions;

[0007] Inputting the network security threat intelligence analysis data into a pre-trained logistic regression model to obtain an impact factor;

[0008] A risk assessment score for the user is obtained based on the scoring result and the influencing factor.

[0009] Optionally, the training process of the pre-trained Transformer model includes:

[0010] A model analysis dimension is set, wherein the model analysis dimension includes a plurality of different dimensions; and a score is obtained for each different model analysis dimension of the trained Transformer model;

[0011] Acquire training data and process the training data, wherein the training data includes network asset attack surface mapping data and questionnaire survey data;

[0012] Based on the processed training data, the Transformer model is trained so that the trained Transformer model can perform data analysis according to the set model analysis dimension.

[0013] Optionally, the training of the Transformer model based on the processed training data includes:

[0014] Select the pre-trained Transformer model;

[0015] Configure mean square error as the loss function and adaptive learning rate optimization algorithm as the optimizer;

[0016] The pre-trained Transformer model is trained based on the pre-trained Transformer model, loss function and optimizer, and the model parameters are updated through forward propagation and back propagation until the model reaches a preset convergence condition on the validation set or triggers an early stopping mechanism.

[0017] Optionally, the setting model analysis dimensions includes:

[0018] Set six analysis dimensions: security management, risk identification, security protection, threat detection, incident response and disaster recovery.

[0019] Optionally, the training process of the logistic regression model includes:

[0020] Collect industry threat intelligence data, including emergencies, types of attacks suffered by specific enterprises, and security component vulnerability information;

[0021] Constructing feature vectors based on the threat intelligence data, including whether the insured enterprise belongs to a high-risk industry and whether it uses security components with vulnerabilities;

[0022] Initialize the weight of the logistic regression model, where the weight value is set according to the importance of the threat intelligence prediction project;

[0023] The logistic regression model is trained and the loss function is minimized by adjusting the weight parameters to obtain the influencing factors of the insured enterprise's security level affected by threat intelligence.

[0024] In a second aspect, the present application provides a pre-insurance risk assessment device, the device comprising:

[0025] An acquisition unit, used to acquire network asset attack surface mapping data, questionnaire survey data, and network security threat intelligence analysis data of the user to be evaluated; the questionnaire survey data is obtained based on the completion of a questionnaire personalized and generated based on the network asset attack surface mapping data;

[0026] An input unit, used to input the network asset attack surface mapping data and the questionnaire survey data into a pre-trained Transformer model for analysis to obtain scoring results in multiple dimensions;

[0027] The input unit is also used to input the network security threat intelligence analysis data into a pre-trained logistic regression model to obtain an impact factor;

[0028] An output unit is configured to obtain a risk assessment score for the user based on the scoring result and the influencing factor.

[0029] Optionally, the device further comprises a Transformer model training unit, which is used to set a model analysis dimension, wherein the model analysis dimension comprises a plurality of different dimensions; the trained Transformer model obtains a score for each different model analysis dimension;

[0030] Acquire training data and process the training data, wherein the training data includes network asset attack surface mapping data and questionnaire survey data;

[0031] Based on the processed training data, the Transformer model is trained so that the trained Transformer model can perform data analysis according to the set model analysis dimension.

[0032] Optionally, the training of the Transformer model based on the processed training data includes:

[0033] Select the pre-trained Transformer model;

[0034] Configure mean square error as the loss function and adaptive learning rate optimization algorithm as the optimizer;

[0035] The pre-trained Transformer model is trained based on the pre-trained Transformer model, loss function and optimizer, and the model parameters are updated through forward propagation and back propagation until the model reaches a preset convergence condition on the validation set or triggers an early stopping mechanism.

[0036] Optionally, the setting model analysis dimensions includes: setting six analysis dimensions of security management, risk identification, security protection, threat detection, incident response and disaster recovery.

[0037] Optionally, the device further comprises a logistic regression model training unit for collecting industry threat intelligence data, including emergencies, types of attacks suffered by specific enterprises, and security component vulnerability information;

[0038] Constructing feature vectors based on the threat intelligence data, including whether the insured enterprise belongs to a high-risk industry and whether it uses security components with vulnerabilities;

[0039] Initialize the weight of the logistic regression model, where the weight value is set according to the importance of the threat intelligence prediction project;

[0040] The logistic regression model is trained and the loss function is minimized by adjusting the weight parameters to obtain the influencing factors of the insured enterprise's security level affected by threat intelligence.

[0041] In a third aspect, the present application provides a device comprising a memory and a processor, wherein the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the pre-insurance risk assessment method introduced in any implementation of the first aspect.

[0042] In a fourth aspect, the present application provides a computer-readable storage medium, in which codes are stored. When the codes are executed, the device executing the codes implements the pre-insurance risk assessment method introduced in any implementation of the first aspect.

[0043] The present application provides a pre-insurance risk assessment method. When executing the method, the network asset attack surface mapping data, questionnaire survey data and network security threat intelligence analysis data of the user to be assessed are first obtained; the questionnaire survey data is obtained based on the filling situation of the questionnaire generated based on the personalized network asset attack surface mapping data, and then the network asset attack surface mapping data and the questionnaire survey data are input into a pre-trained Transformer model for analysis to obtain scoring results in multiple dimensions, and then the network security threat intelligence analysis data is input into a pre-trained logistic regression model to obtain the influencing factors, and finally the risk assessment score of the user is obtained based on the scoring results and the influencing factors. In this way, by integrating the network asset attack surface mapping data, questionnaire survey data and network security threat intelligence analysis data, and combining the advanced machine learning model Transformer model and logistic regression model for risk assessment, the method provides users with comprehensive, accurate and personalized risk assessment scores, and provides strong support for users' network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flow chart of a pre-insurance risk assessment method provided in an embodiment of the present application;

[0046] Figure 2 A flowchart of a training method for a Transformer model provided in an embodiment of the present application;

[0047] Figure 3 A flow chart of a method for training a logistic regression model provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the structure of a pre-insurance risk assessment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0051] Figure 1 A flowchart of a pre-insurance risk assessment method provided in an embodiment of the present application. Figure 1 As shown, the pre-insurance risk assessment method provided by the embodiment of the present application may include:

[0052] S101. Obtain network asset attack surface mapping data, questionnaire survey data, and network security threat intelligence analysis data of the user to be evaluated.

[0053] Network asset attack surface mapping data refers to the mapping data on the network asset attack surface that enterprises need to provide to insurance companies during the process of purchasing network security insurance. For insurance companies, it is necessary to collect exposure information through the name of the target enterprise, that is, to detect the assets of insured customers from the perspective of attackers, build detailed data on exposed assets, and automatically and proactively collect asset data, including but not limited to: company business scope, company basic information, company equity structure, domain name, IP, website details, port, fingerprint, social software, APP, certificate, protocol, component, service, etc.

[0054] Conduct risk mining on exposed asset data to obtain multiple types of risks, including but not limited to: high-risk ports, weak passwords, vulnerability detection, certificate validity, data leakage, code leakage, database exposure, etc.

[0055] The questionnaire survey data refers to the overall framework designed around the six dimensions of possible security incidents, including security management capabilities, risk identification capabilities, security protection capabilities, threat detection capabilities, incident response capabilities, and disaster recovery capabilities. Labels are designed based on the network asset attack surface mapping data, and personalized questionnaires for enterprises are generated adaptively to form the security atomic capabilities that enterprises possess.

[0056] Cybersecurity threat intelligence analysis data refers to industry threat intelligence data collected from open source news and security consulting websites, such as intelligence on attacks on certain industries, the attack methods and preferences of certain attack organizations, etc.

[0057] S102: Input the network asset attack surface mapping data and the questionnaire survey data into a pre-trained Transformer model for analysis to obtain scoring results in multiple dimensions.

[0058] The pre-trained Transformer model can evaluate the enterprise from the six dimensions of security management capability, risk identification capability, security protection capability, threat detection capability, incident response capability, and disaster recovery capability based on the enterprise's network asset attack surface mapping data and the questionnaire survey data. The evaluation results include 6 scores, namely A1, A2, A3, A4, A5, and A6, corresponding to the security levels of the six dimensions of 1 security management, 2 risk identification, 3 security protection, 4 threat detection, 5 incident response, and 6 disaster recovery. Each Ai (i is 1-6) ranges from 0 to 100.

[0059] S103: Input the network security threat intelligence analysis data into a pre-trained logistic regression model to obtain an impact factor.

[0060] The trained logistic regression model in this application is b=ω1x1+...+ω n x n +β, where xi represents the threat intelligence prediction item in the network security threat intelligence analysis data, n is the number of prediction items, and β is the standard parameter in logistic regression, which is used to prevent overfitting. Taking the industry hazard prediction item as an example, assume that x1 represents whether the insured customer belongs to a high-risk industry, 1 represents yes, and 0 represents no. ω1 represents the weight corresponding to the hazard prediction item, ω i The value range is [0,1], and ω1+...+ω n= 1. b is the impact factor calculated by the logistic regression model.

[0061] It should be noted that the initialization weights in the embodiment of the present application are not achieved by random initialization weights, but rely on the experience of security personnel. For example, if the insured enterprise belongs to a dangerous industry, x1 has a higher impact on the influencing factor b, then the weight corresponding to ω1 should also be higher. In addition, since the value range of b is 0 to positive infinity, it is difficult to classify and apply it to subsequent predictions. In the embodiment of the present application, the formula is used: b r The value range becomes (0,1).

[0062] S104: Obtain a risk assessment score for the user based on the scoring result and the influencing factor.

[0063] After the scoring results A1, A2, A3, A4, A5, and A6 of the six dimensions are calculated based on step S102, they are added together to obtain a score A based on the Transformer model, where A=A1+...+A6.

[0064] Based on the total score A and the impact factor b after adjusting the value range r Calculate the final total score P, P = A·b r .

[0065] The above embodiment introduces a pre-insurance risk assessment method provided by the present application, in which a pre-trained Transformer model and a pre-trained logistic regression model are used. The training process of the pre-trained Transformer model and the pre-trained logistic regression model in the present application is introduced below in combination with specific embodiments.

[0066] Combination Figure 2 As shown, Figure 2 A flow chart of a training method for a Transformer model provided in an embodiment of the present application, the method comprising:

[0067] S201. Setting a model analysis dimension, wherein the model analysis dimension includes a plurality of different dimensions.

[0068] Establish a security risk analysis framework for insured enterprises based on the following six dimensions: 1) security management, 2) risk identification, 3) security protection, 4) threat detection, 5) incident response, and 6) disaster recovery.

[0069] So that the trained Transformer model can get a score for each different model analysis dimension.

[0070] S202: Acquire training data and process the training data, wherein the training data includes network asset attack surface mapping data and questionnaire survey data.

[0071] The specific process of processing enterprise network asset attack surface mapping data: First, collect data from different channels of enterprise attack surface asset mapping to ensure that the acquired data is comprehensive, including network asset information such as open port details, service types, IP address ranges, domain name information, and application system structure layout. Then, according to the different insured enterprises, classify and label these data and integrate them for storage. In this process, the data must be strictly reviewed to ensure that it is accurate, complete, and consistent in format. At the same time, duplicate records are removed, missing data points are filled, and text information (such as service types) is converted into codes that can be quantified and analyzed.

[0072] Processing flow of questionnaire survey data: Comprehensively collect questionnaire survey information submitted by each insured enterprise to ensure the integrity of the information and the uniformity of the format. The survey content covers multiple dimensions such as the enterprise's network security management system, employee safety training status, the maturity of the emergency response mechanism, and the allocation of security budgets. For the multiple-choice questions, formulate quantitative standards and directly record numerical data such as the specific number of security trainings and the purchase amount of security equipment. In addition, the rationality of the data is ensured by cross-checking the internal logic of the questionnaire (for example, the degree of match between budget investment and actual equipment purchases). For vague or missing parts in the questionnaire, actively communicate with the enterprise to complete and optimize the data.

[0073] S203: Based on the processed training data, the Transformer model is trained so that the trained Transformer model can perform data analysis according to the set model analysis dimension.

[0074] First, select a pre-trained Transformer model. According to the task characteristics (regression analysis to predict quantitative security scores) and data characteristics (integration of multi-source enterprise network security related features), select a suitable pre-trained Transformer model from the transformer library, such as BERT (Bidirectional Encoder Representation). Instantiate the model class and select the bert-base-uncased version with no pre-trained weights for specific fields, in preparation for subsequent fine-tuning training based on enterprise security data.

[0075] Loss Function Selection,Given that the goal is to predict a continuous safety score, the,mean squared error (MSE) loss function is used to measure the,error between the model prediction value and the true safety score.

[0076] Optimizer configuration: Select an adaptive learning rate optimization algorithm (such as Adam), and adaptively adjust the learning rate for different parameters to improve convergence efficiency. Instantiate the optimizer, set the initial learning rate, and dynamically adjust the learning rate according to the validation set loss curve during training. Set the total number of training rounds, start the outer loop to traverse each epoch, set the model to training mode at the beginning of each epoch, and enable training-related mechanisms such as Batch Normalization and Dropout. For each training batch, input the enterprise feature data into the model to obtain the predicted safety score output. Call automatic derivative backpropagation to calculate the model parameter gradients, and update the model parameters based on the gradients.

[0077] After each epoch of training, switch the model to evaluation mode and disable Batch Normalization and Dropout randomness. Infer and predict the safety score on the validation set, calculate the validation set MSE loss and other evaluation indicators (such as mean absolute error MAE). If the validation set loss does not decrease for several consecutive epochs, the early stopping mechanism is triggered to terminate the training in advance to prevent overfitting. Save the current optimal model parameter state for subsequent loading and use.

[0078] The trained Transformer model can give risk scores for each of the six dimensions in the analysis framework (security management, risk identification, security protection, threat detection, incident response, and disaster recovery). The risk score for each dimension ranges from 0 to 100 and is used to assess the level of corporate network security.

[0079] Through the above method, a Transformer model-based enterprise network security data analysis system can be trained to achieve quantitative evaluation and prediction of the enterprise network security level.

[0080] Combine the following Figure 3 The training process of the logistic regression model in this application is introduced, such as Figure 3 As shown, Figure 3 A flow chart of a method for training a logistic regression model provided in an embodiment of the present application, the method comprising:

[0081] S301. Collect industry threat intelligence data, including emergencies, types of attacks suffered by specific enterprises, and security component vulnerability information.

[0082] It is necessary to identify the sources of threat intelligence, which may include public security announcements, vulnerability databases, news reports, industry reports, security forums, social media, and professional threat intelligence service providers. Screen threat intelligence related to insurance business from the above sources, such as emergencies (such as large-scale hacker attacks), types of attacks suffered by specific companies (such as DDoS attacks, ransomware attacks), and security component vulnerability information (such as operating system, database, and application software vulnerabilities). Record the screened intelligence data, including key information such as the time, location, affected scope, attack type, and vulnerability details of the incident. Threat intelligence is a dynamic process, so the collected data needs to be updated regularly to ensure the timeliness and accuracy of the intelligence.

[0083] S302: construct a feature vector based on the threat intelligence data, including whether the insured enterprise belongs to a high-risk industry and whether it uses security components with vulnerabilities.

[0084] Based on the collected threat intelligence data, define a series of features related to the security level of the insured enterprise. These features may include whether the enterprise belongs to a high-risk industry (such as finance, medical care, government agencies, etc.), whether it uses vulnerable security components (such as specific operating system versions, application software versions, etc.). Encode the defined features so that they can be input into the model. For categorical features (such as industry type), one-hot encoding (One-Hot Encoding) or label encoding (Label Encoding) can be used; for numerical features (such as the number of vulnerable components used), their numerical representation can be used directly. Combine the encoded features into a feature vector, each feature vector corresponds to the security status of an insured enterprise.

[0085] S303: Initialize the weight of the logistic regression model, where the weight value is set according to the importance of the threat intelligence prediction item.

[0086] Determine to use a logistic regression model for training. Logistic regression is a statistical method widely used for classification tasks, and is used to determine whether the security level of the insured enterprise is significantly affected by threat intelligence. According to the importance of the threat intelligence prediction project, set initial values ​​for the weights of the logistic regression model. These initial values ​​can be random, but can also be adjusted based on experience or prior knowledge. In an embodiment of the present application, the initial value of the weight is set according to the importance of the threat intelligence prediction project.

[0087] S304. Train the logistic regression model, minimize the loss function by adjusting the weight parameters, and obtain the influencing factors of the insured enterprise's security level affected by threat intelligence.

[0088] The constructed feature vector is used as input, and whether the insured enterprise is significantly affected by threat intelligence (such as whether a security incident has occurred) is used as the output label to prepare the training data set. The logistic regression model is trained using the training data set. During the training process, the weight parameters are adjusted to minimize the loss function (such as the cross entropy loss function) so that the model's prediction results are closer to the true label. After the training is completed, the weight parameters of the logistic regression model can be obtained. These weight parameters reflect the degree to which different features affect the insured enterprise's security level from threat intelligence, that is, the impact factor.

[0089] The above are some specific implementations of a pre-insurance risk assessment method provided in the embodiment of the present application. Based on this, the present application also provides a corresponding device. The device provided in the embodiment of the present application will be introduced from the perspective of functional modularization.

[0090] Figure 4 This is a schematic diagram of the structure of a pre-insurance risk assessment device provided in an embodiment of the present application. Figure 4 As shown, the pre-insurance risk assessment device 400 provided in the embodiment of the present application includes:

[0091] The acquisition unit 410 is used to acquire network asset attack surface mapping data, questionnaire survey data and network security threat intelligence analysis data of the user to be evaluated; the questionnaire survey data is obtained based on the filling situation of the questionnaire generated based on the network asset attack surface mapping data;

[0092] An input unit 420 is used to input the network asset attack surface mapping data and the questionnaire survey data into a pre-trained Transformer model for analysis to obtain scoring results in multiple dimensions;

[0093] The input unit is also used to input the network security threat intelligence analysis data into a pre-trained logistic regression model to obtain an impact factor;

[0094] The output unit 430 obtains the risk assessment score of the user based on the scoring result and the impact factor.

[0095] In one implementation of the embodiment of the present application, the device further includes a Transformer model training unit, which is used to set a model analysis dimension, wherein the model analysis dimension includes a plurality of different dimensions; the trained Transformer model obtains a score for each different model analysis dimension;

[0096] Acquire training data and process the training data, wherein the training data includes network asset attack surface mapping data and questionnaire survey data;

[0097] Based on the processed training data, the Transformer model is trained so that the trained Transformer model can perform data analysis according to the set model analysis dimension.

[0098] In one implementation of the embodiment of the present application, the training of the Transformer model based on the processed training data includes:

[0099] Select the pre-trained Transformer model;

[0100] Configure mean square error as the loss function and adaptive learning rate optimization algorithm as the optimizer;

[0101] The pre-trained Transformer model is trained based on the pre-trained Transformer model, loss function and optimizer, and the model parameters are updated through forward propagation and back propagation until the model reaches a preset convergence condition on the validation set or triggers an early stopping mechanism.

[0102] In one implementation of the embodiment of the present application, the setting model analysis dimensions includes: setting six analysis dimensions: security management, risk identification, security protection, threat detection, incident response and disaster recovery.

[0103] In one implementation of the embodiment of the present application, the device further includes a logistic regression model training unit for collecting industry threat intelligence data, including emergencies, types of attacks suffered by specific enterprises, and security component vulnerability information;

[0104] Constructing feature vectors based on the threat intelligence data, including whether the insured enterprise belongs to a high-risk industry and whether it uses security components with vulnerabilities;

[0105] Initialize the weight of the logistic regression model, where the weight value is set according to the importance of the threat intelligence prediction project;

[0106] The logistic regression model is trained and the loss function is minimized by adjusting the weight parameters to obtain the influencing factors of the insured enterprise's security level affected by threat intelligence.

[0107] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0108] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.

[0109] The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method described in any embodiment of the present application.

[0110] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0111] It is understandable that in the specific implementation of the present application, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved, when the above embodiments of the present application are applied to specific products or technologies, need to obtain user permission or consent, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0112] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0113] It should also be noted that the various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and apparatus embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiments. The device and apparatus embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0114] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A pre-insurance risk assessment method, characterized in that: The method comprises: Obtain network asset attack surface mapping data, questionnaire survey data, and network security threat intelligence analysis data of the user to be evaluated; the questionnaire survey data is obtained based on the completion of a questionnaire personalized and generated based on the network asset attack surface mapping data; Input the network asset attack surface mapping data and the questionnaire survey data into a pre-trained Transformer model for analysis to obtain scoring results in multiple dimensions; Inputting the network security threat intelligence analysis data into a pre-trained logistic regression model to obtain an impact factor; A risk assessment score for the user is obtained based on the scoring result and the influencing factor.

2. The method according to claim 1, characterized in that The training process of the pre-trained Transformer model includes: A model analysis dimension is set, where the model analysis dimension includes a plurality of different dimensions; and a score is obtained for each different model analysis dimension of the trained Transformer model; Acquire training data and process the training data, wherein the training data includes network asset attack surface mapping data and questionnaire survey data; Based on the processed training data, the Transformer model is trained so that the trained Transformer model can perform data analysis according to the set model analysis dimension.

3. The method according to claim 2, characterized in that The training of the Transformer model based on the processed training data includes: Select the pre-trained Transformer model; Configure mean square error as the loss function and adaptive learning rate optimization algorithm as the optimizer; The pre-trained Transformer model is trained based on the pre-trained Transformer model, loss function and optimizer, and the model parameters are updated through forward propagation and back propagation until the model reaches a preset convergence condition on the validation set or triggers an early stopping mechanism.

4. The method according to claim 2, characterized in that: The setting model analysis dimensions include: Set six analysis dimensions: security management, risk identification, security protection, threat detection, incident response and disaster recovery.

5. The method according to claim 1, characterized in that The training process of the logistic regression model includes: Collect industry threat intelligence data, including emergencies, types of attacks suffered by specific enterprises, and security component vulnerability information; Constructing feature vectors based on the threat intelligence data, including whether the insured enterprise belongs to a high-risk industry and whether it uses security components with vulnerabilities; Initialize the weight of the logistic regression model, where the weight value is set according to the importance of the threat intelligence prediction project; The logistic regression model is trained and the loss function is minimized by adjusting the weight parameters to obtain the influencing factors of the insured enterprise's security level affected by threat intelligence.

6. A pre-insurance risk assessment device, characterized in that: The device comprises: An acquisition unit, used to acquire network asset attack surface mapping data, questionnaire survey data, and network security threat intelligence analysis data of the user to be evaluated; the questionnaire survey data is obtained based on the filling situation of the questionnaire generated based on the network asset attack surface mapping data; An input unit, used to input the network asset attack surface mapping data and the questionnaire survey data into a pre-trained Transformer model for analysis to obtain scoring results in multiple dimensions; The input unit is also used to input the network security threat intelligence analysis data into a pre-trained logistic regression model to obtain an impact factor; An output unit is configured to obtain a risk assessment score for the user based on the scoring result and the influencing factor.

7. The device according to claim 6, characterized in that The device also includes a Transformer model training unit, which is used to set a model analysis dimension, wherein the model analysis dimension includes a plurality of different dimensions; the trained Transformer model obtains a score for each different model analysis dimension; Acquire training data and process the training data, wherein the training data includes network asset attack surface mapping data and questionnaire survey data; Based on the processed training data, the Transformer model is trained so that the trained Transformer model can perform data analysis according to the set model analysis dimension.

8. The device according to claim 6, characterized in that The device also includes a logistic regression model training unit for collecting industry threat intelligence data, including emergencies, types of attacks suffered by specific enterprises, and security component vulnerability information; Constructing feature vectors based on the threat intelligence data, including whether the insured enterprise belongs to a high-risk industry and whether it uses security components with vulnerabilities; Initialize the weight of the logistic regression model, where the weight value is set according to the importance of the threat intelligence prediction project; The logistic regression model is trained and the loss function is minimized by adjusting the weight parameters to obtain the influencing factors of the insured enterprise's security level affected by threat intelligence.

9. A computing device, characterized in that The computing device includes: a memory and a processor; The memory is used to store computer programs; The processor is configured to implement the method according to any one of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images