Information security assessment method and system based on cloud platform

Abstract

The invention relates to the technical field of information security, and particularly discloses an information security assessment method and system based on a cloud platform, and the method comprises the following steps: S1, obtaining a system operation and maintenance record, and extracting vulnerability data during each operation and maintenance from the system operation and maintenance record; s2, calculating a vulnerability value according to the vulnerability data; coordinate points are generated and fitted to obtain a fitted curve, and the fitted curve is divided into a first curve and a second curve; determining a reference line according to the first curve, and determining a normal proportion according to the position relation between the reference line and the second curve; and S3, calculating a system risk value according to the first average vulnerability value, the second curve and the abnormal proportion, and adjusting a preset operation and maintenance period according to the system risk value. According to the method, the actual operation and maintenance period of the system can be dynamically adjusted, the overall operation and maintenance cost is reduced, and the situation of operation and maintenance service interruption is reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security assessment method and system based on a cloud platform. Background Art

[0002] A cloud platform is an Internet-based computing and storage service platform that provides on-demand access to shared computing resources without the need for users to purchase, manage, and maintain physical hardware. Information security refers to the use of relevant technologies to protect the confidentiality, integrity, and availability of information and prevent unauthorized access. Its goal is to ensure the security and reliability of data and information in information systems while providing security protection for users.

[0003] Vulnerability refers to a defect, weakness or security flaw in an information system, network, hardware, software or protocol, which may be exploited by attackers to gain unauthorized access to the system, obtain data, cause damage or cause system paralysis. It is one of the key factors threatening the security of information systems and data.

[0004] At present, vulnerability detection mainly relies on manual regular operation and maintenance. Regular vulnerability detection helps to find potential security issues in a timely manner and prevent attackers from exploiting these vulnerabilities to launch attacks. However, regular vulnerability detection requires a lot of resources, including manpower, time and money, especially when detecting multiple systems, and the scanning process may affect system performance and cause business interruption. In addition, processing a large number of detection results will further increase management and maintenance costs. Summary of the invention

[0005] The purpose of the present invention is to provide a cloud platform-based information security assessment method and system to solve the following technical problems: Regular vulnerability detection requires a lot of resources, including manpower, time and money, especially when detecting multiple systems, and the scanning process may affect system performance and cause business interruption. In addition, processing a large number of detection results will further increase management and maintenance costs.

[0006] The purpose of the present invention can be achieved by the following technical solutions: The information security assessment method based on the cloud platform includes the following steps: S1: Obtain system operation and maintenance records, and extract vulnerability data from them during each operation and maintenance. The vulnerability data includes the basic score Ajc of the vulnerability, the total number of vulnerabilities Azs, and the time Azc spent on repairing a single vulnerability; S2: Calculate the vulnerability value K=ε*Ajc max *Azs*Azc max , where Ajc maxIndicates the maximum value of the base score of the vulnerability described, Azc max It represents the maximum time taken to repair a single vulnerability, and ε is the preset vulnerability value correction coefficient; Generate coordinate points (i, K i ), K i represents the vulnerability value when the system is operated and maintained for the i-th time, and the fitting curve f(x) is obtained by fitting the coordinate points, x∈[0,N], N represents the total number of system operations and maintenance, and the fitting curve in the first number interval [0,Nys] is taken as the first curve F fir (x), the fitting curve in the second numerical interval [Nys, N] is taken as the second curve F sec (x), Nys represents the preset operation and maintenance times threshold; Calculate the first average vulnerability value , will pass through (0, Kave fir ) and a straight line parallel to the horizontal plane is used as a reference line, and the intersection of the reference line and the second curve is recorded as a reference point. The ratio c of the value interval corresponding to the normal curve between two adjacent reference points to the second numerical interval [Nys, N] is counted and recorded as the normal ratio. The normal curve is the second curve below the reference line; S3: Calculate the system risk value P according to the first average vulnerability value, the second curve and the abnormal ratio, and adjust the preset operation and maintenance period Tys according to the system risk value.

[0007] As a further solution of the present invention: in the step S3, the process of calculating the system risk value P according to the first average vulnerability value, the second curve and the abnormal proportion specifically includes: Calculate the second average vulnerability value and the maximum vulnerability value K max =max(F sec (x)); Determine the target curve G(x)=F sec (x)-Kave fir , the system risk value is calculated by the following formula: ; Among them, η is the preset system risk value correction coefficient.

[0008] As a further solution of the present invention: in step S3, the process of adjusting the preset operation and maintenance cycle according to the system risk value specifically includes: Calculate the actual period Tsj = μ (Pys-P) * Tys, where μ is the preset operation and maintenance period length correction coefficient, Pys represents the preset standard system risk value, the system is operated and maintained at Tsc + Tsj, and Tsc represents the time of the most recent operation and maintenance of the system.

[0009] As a further solution of the present invention: when the actual period Tsj≥3Tys exists, the system is operated and maintained at Tsc+3Tys.

[0010] As a further solution of the present invention: the step S3 further includes the following steps: Get the system risk value P; When 0<P≤K1, the system risk value is low, and the safety status of the system is judged to be high; When K1<P≤K2, the system risk value is average, the system security status is judged to be average, and it is marked, and the management personnel are given a first-level prompt; When K2<P, the system risk value is very high, and the system security status is judged to be low, and it is marked and the management personnel are given a secondary prompt; K1K2 are preset judgment thresholds, and K1<K2.

[0011] As a further solution of the present invention: the specific methods of the first-level prompt and the second-level prompt are based on settings by management personnel.

[0012] As a further solution of the present invention: in the step S1, the basic score of the vulnerability is determined based on CVSS.

[0013] The information security assessment system based on the cloud platform includes: Collection module: obtains system operation and maintenance records, and extracts vulnerability data from them during each operation and maintenance. The vulnerability data includes the basic score Ajc of the vulnerability, the total number of vulnerabilities Azs, and the time Azc spent on repairing a single vulnerability; Analysis module: Calculate vulnerability value K=ε*Ajc max *Azs*Azc max , where Ajc max Indicates the maximum value of the base score of the vulnerability described, Azc max It represents the maximum time taken to repair a single vulnerability, and ε is the preset vulnerability value correction coefficient; Generate coordinate points (i, K i ), K i represents the vulnerability value when the system is operated and maintained for the i-th time, and the fitting curve f(x) is obtained by fitting the coordinate points, x∈[0,N], N represents the total number of system operations and maintenance, and the fitting curve in the first number interval [0,Nys] is taken as the first curve F fir (x), the fitting curve in the second numerical interval [Nys, N] is taken as the second curve F sec (x), Nys represents the preset operation and maintenance times threshold; Calculate the first average vulnerability value , will pass through (0, Kave fir ) and a straight line parallel to the horizontal plane is used as a reference line, and the intersection of the reference line and the second curve is recorded as a reference point. The ratio c of the value interval corresponding to the normal curve between two adjacent reference points to the second numerical interval [Nys, N] is counted and recorded as the normal ratio. The normal curve is the second curve below the reference line; Adjustment module: calculates the system risk value P according to the first average vulnerability value, the second curve and the abnormal proportion, and adjusts the preset operation and maintenance period Tys according to the system risk value.

[0014] Beneficial effects of the present invention: In the present invention, firstly, vulnerability data is obtained from the operation and maintenance records, and a vulnerability value is calculated based on the vulnerability data to reflect the comprehensive vulnerability situation of the system during operation and maintenance. The larger the vulnerability value, the more serious the vulnerability situation of the system during operation and maintenance. After that, coordinate points are generated and fitted to obtain a fitting curve, and the fitting curve is divided into a first curve and a second curve. Then, a reference line is determined based on the first curve, and a normal proportion is determined based on the positional relationship between the reference line and the second curve. It can be understood that the first curve reflects the change trend of the comprehensive vulnerability situation of the system in the early stage, and the first average vulnerability value is calculated based on the first curve to reflect the average value over a period of time. The average comprehensive vulnerability situation is obtained, and this is used as a reference point to obtain a reference line, and then it can be determined whether the comprehensive vulnerability situation improves (i.e., the second curve is below the reference line) or deteriorates (i.e., the second curve is above the reference line) over time. The normal ratio is used to quantify the degree of improvement. The higher the normal ratio, the higher the proportion of the value interval corresponding to the second curve below the reference line, which reflects that the comprehensive vulnerability situation of the system has improved more compared with the situation during early operation and maintenance; finally, the system risk value P is calculated according to the first average vulnerability value, the second curve and the abnormal ratio, and the preset operation and maintenance cycle Tys is adjusted according to the system risk value. The present invention can dynamically adjust the actual cycle of system operation and maintenance to reduce the overall operation and maintenance cost. At the same time, after adjusting the cycle of system operation and maintenance, the number of times the system with a lower risk value is operated and maintained can be reduced, thereby reducing the business interruption caused by affecting system performance during the operation and maintenance process. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The present invention will be further described below in conjunction with the accompanying drawings.

[0016] Figure 1 It is a flow chart of the information security assessment method based on the cloud platform of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] See also Figure 1 As shown, the present invention is an information security assessment method based on a cloud platform, comprising the following steps: S1: Obtain system operation and maintenance records, and extract vulnerability data from them during each operation and maintenance. The vulnerability data includes the basic score Ajc of the vulnerability, the total number of vulnerabilities Azs, and the time Azc spent on repairing a single vulnerability; S2: Calculate the vulnerability value K=ε*Ajc max *Azs*Azc max , where Ajc max Indicates the maximum value of the base score of the vulnerability described, Azc max It represents the maximum time taken to repair a single vulnerability, and ε is the preset vulnerability value correction coefficient; Generate coordinate points (i, K i ), K i represents the vulnerability value when the system is operated and maintained for the i-th time, and the fitting curve f(x) is obtained by fitting the coordinate points, x∈[0,N], N represents the total number of system operations and maintenance, and the fitting curve in the first number interval [0,Nys] is taken as the first curve F fir (x), the fitting curve in the second numerical interval [Nys, N] is taken as the second curve F sec (x), Nys represents the preset operation and maintenance times threshold; Calculate the first average vulnerability value , will pass through (0, Kave fir ) and a straight line parallel to the horizontal plane is used as a reference line, and the intersection of the reference line and the second curve is recorded as a reference point. The ratio c of the value interval corresponding to the normal curve between two adjacent reference points to the second numerical interval [Nys, N] is counted and recorded as the normal ratio. The normal curve is the second curve below the reference line; S3: Calculate the system risk value P according to the first average vulnerability value, the second curve and the abnormal ratio, and adjust the preset operation and maintenance period Tys according to the system risk value.

[0019] It should be noted that, first, the vulnerability data is obtained from the operation and maintenance records, and the vulnerability value is calculated based on the vulnerability data to reflect the comprehensive vulnerability situation of the system during operation and maintenance. The larger the vulnerability value, the more serious the vulnerability situation of the system during operation and maintenance; then, the coordinate points are generated and fitted to obtain a fitting curve, and the fitting curve is divided into a first curve and a second curve; then, a reference line is determined based on the first curve, and a normal proportion is determined based on the positional relationship between the reference line and the second curve; it can be understood that the first curve reflects the trend of changes in the comprehensive vulnerability situation of the system in the early stage, and the first average vulnerability value is calculated based on the first curve to reflect the average comprehensive vulnerability situation in the past period of time, and this is used as a reference point to obtain a reference line, and then it can be determined whether the comprehensive vulnerability situation is improving over time (i.e., the first average vulnerability value is calculated based on the first curve to reflect the average comprehensive vulnerability situation in the past period of time, and the reference line is obtained based on this, and then it can be determined whether the comprehensive vulnerability situation is improving over time (i.e., the first average vulnerability value is calculated based on the first curve to reflect the average comprehensive vulnerability situation in the past period of time), ... first average vulnerability value is calculated based on this, and the first average vulnerability value is calculated based on this, and then it can be determined whether the comprehensive vulnerability situation is improving over time (i.e., the first average vulnerability value is calculated based on the first average vulnerability value). The normal ratio is used to quantify the degree of improvement. The higher the normal ratio, the higher the proportion of the value interval corresponding to the second curve below the reference line, which reflects that the comprehensive vulnerability of the system has improved more compared with the situation in the early operation and maintenance. Finally, the system risk value P is calculated according to the first average vulnerability value, the second curve and the abnormal ratio, and the preset operation and maintenance period Tys is adjusted according to the system risk value. At the same time, after adjusting the cycle of system operation and maintenance, the number of times the system with a lower risk value is operated and maintained can be reduced, thereby reducing the business interruption caused by affecting system performance during the operation and maintenance process (reducing the number of operations and maintenance, thereby reducing the business interruption caused by operation and maintenance).

[0020] In another preferred embodiment of the present invention, in step S3, the process of calculating the system risk value P according to the first average vulnerability value, the second curve and the abnormal proportion specifically includes: Calculate the second average vulnerability value and the maximum vulnerability value K max =max(F sec (x)); Determine the target curve G(x)=F sec (x)-Kave fir , the system risk value is calculated by the following formula: ; Among them, η is the preset system risk value correction coefficient.

[0021] It is worth noting that the higher the second average vulnerability value, the more serious the overall vulnerability situation of the second curve, and therefore the system risk value should be higher, thereby reducing the length of subsequent actual cycles and avoiding system information security risks caused by longer operation and maintenance intervals. The relationship between the remaining parameters and the system risk value can refer to the above ideas and will not be repeated here. The system risk value correction coefficient can be obtained based on experience.

[0022] In another preferred embodiment of the present invention, in step S3, the process of adjusting the preset operation and maintenance cycle according to the system risk value specifically includes: Calculate the actual period Tsj = μ (Pys-P) * Tys, where μ is the preset operation and maintenance period length correction coefficient, Pys represents the preset standard system risk value, the system is operated and maintained at Tsc + Tsj, and Tsc represents the time of the most recent operation and maintenance of the system.

[0023] It is understandable that the risk status of the system changes dynamically. A fixed operation and maintenance cycle may lead to resource waste (such as unnecessary operation and maintenance) or risk neglect (such as delayed operation and maintenance when the risk is high). By introducing the system risk value P to dynamically adjust the operation and maintenance cycle, operation and maintenance can be made more intelligent and flexible. When the current risk value P of the system is lower than the preset standard system risk value Pys, it means that the system is in good operating condition. Therefore, the operation and maintenance cycle can be appropriately extended, and frequent operation and maintenance can be reduced, thereby reducing resource consumption and labor costs caused by system maintenance, as well as business interruptions that may be caused during operation and maintenance. By flexibly adjusting the operation and maintenance cycle, the system can reduce unnecessary maintenance in a low-risk state and deal with problems in a timely manner in a high-risk state, thereby maximizing operation and maintenance efficiency and minimizing system risks.

[0024] In another preferred embodiment of the present invention, when the actual period Tsj≥3Tys exists, the system is operated and maintained at Tsc+3Tys.

[0025] It should be noted that in some cases, due to the low risk value P of the system (which means that the system is in good operating condition), the calculated actual operation and maintenance cycle Tsj will be significantly extended. Although the system may show a low risk in the current state, too long a period of no operation and maintenance will lead to the accumulation of potential problems or the failure to discover and repair unexpected failures in time. Therefore, a cycle upper limit (3Tys) is set to prevent the system from not being maintained for too long and avoid hidden problems that gradually arise in the system over a long period of time; to ensure that even if the system remains in a low-risk state for a long time, the operation and maintenance cannot be extended indefinitely. This upper limit ensures that even in the most ideal case, the system must be maintained at least once every 3 standard operation and maintenance cycles to prevent the accumulation of potential problems caused by long-term non-maintenance; similarly, if the actual cycle is too short (the threshold for judging that the actual cycle is too short can be set manually), you can choose to send an early warning message to notify the management personnel to handle it.

[0026] In another preferred embodiment of the present invention, the step S3 further includes the following steps: Get the system risk value P; When 0<P≤K1, the system risk value is low, and the safety status of the system is judged to be high; When K1<P≤K2, the system risk value is average, the system security status is judged to be average, and it is marked, and the management personnel are given a first-level prompt; When K2<P, the system risk value is very high, and the system security status is judged to be low, and it is marked and the management personnel are given a secondary prompt; K1K2 are preset judgment thresholds, and K1<K2.

[0027] It should be noted that by dividing the system risk value into multiple intervals, refined operation and maintenance management can be achieved. When the system risk is low (0 < P ≤ K1), frequent intervention is not required and only routine maintenance is required. When the risk value rises to a medium level (K1 < P ≤ K2), managers are reminded to pay closer attention to the system and issue a first-level prompt. When the risk value is high (P > K2), the system will issue a second-level prompt, prompting managers to take emergency measures to prevent major problems from occurring. In the case of different system risk values ​​P, corresponding risk response strategies are provided, and first- and second-level prompts are used to assist managers in making correct judgments in a timely manner, thereby improving the system's risk identification capabilities and optimizing the use of operation and maintenance resources.

[0028] In another preferred embodiment of the present invention, the specific modes of the primary prompt and the secondary prompt are set based on management personnel.

[0029] In another preferred embodiment of the present invention, in the step S1, the basic score of the vulnerability is determined based on CVSS.

[0030] It is worth noting that CVSS (Common Vulnerability Scoring System) is a standardized scoring system for evaluating the severity of vulnerabilities in computer systems. Determining the basic score of vulnerabilities through CVSS can ensure that the assessment of vulnerability risks has a unified standard, avoiding deviations between different managers or systems when assessing vulnerabilities. The CVSS scoring system can quantify complex vulnerability risks into a clear value, thereby helping managers make better decisions. By quantifying the basic score of vulnerabilities, the risk level of the vulnerability can be more intuitively displayed, facilitating subsequent analysis.

[0031] The information security assessment system based on the cloud platform includes: Collection module: obtains system operation and maintenance records, and extracts vulnerability data from them during each operation and maintenance. The vulnerability data includes the basic score Ajc of the vulnerability, the total number of vulnerabilities Azs, and the time Azc spent on repairing a single vulnerability; Analysis module: Calculate vulnerability value K=ε*Ajc max *Azs*Azc max, where Ajc max Indicates the maximum value of the base score of the vulnerability described, Azc max It represents the maximum time taken to repair a single vulnerability, and ε is the preset vulnerability value correction coefficient; Generate coordinate points (i, K i ), K i represents the vulnerability value when the system is operated and maintained for the i-th time, and the fitting curve f(x) is obtained by fitting the coordinate points, x∈[0,N], N represents the total number of system operations and maintenance, and the fitting curve in the first number interval [0,Nys] is taken as the first curve F fir (x), the fitting curve in the second numerical interval [Nys, N] is taken as the second curve F sec (x), Nys represents the preset operation and maintenance times threshold; Calculate the first average vulnerability value , will pass through (0, Kave fir ) and a straight line parallel to the horizontal plane is used as a reference line, and the intersection of the reference line and the second curve is recorded as a reference point. The ratio c of the value interval corresponding to the normal curve between two adjacent reference points to the second numerical interval [Nys, N] is counted and recorded as the normal ratio. The normal curve is the second curve below the reference line; Adjustment module: calculates the system risk value P according to the first average vulnerability value, the second curve and the abnormal proportion, and adjusts the preset operation and maintenance period Tys according to the system risk value.

[0032] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. The information security assessment method based on cloud platform is characterized by: The following steps are involved: S1: Obtain system operation and maintenance records, and extract vulnerability data from them during each operation and maintenance. The vulnerability data includes the basic score Ajc of the vulnerability, the total number of vulnerabilities Azs, and the time Azc spent on repairing a single vulnerability; S2: Calculate the vulnerability value K=ε*Ajc max *Azs*Azc max , where Ajc max Indicates the maximum value of the base score of the vulnerability described, Azc max It represents the maximum time taken to repair a single vulnerability, and ε is the preset vulnerability value correction coefficient; Generate coordinate points (i, K i ), K i represents the vulnerability value when the system is operated and maintained for the i-th time, and the fitting curve f(x) is obtained by fitting the coordinate points, x∈[0,N], N represents the total number of system operations and maintenance, and the fitting curve in the first number interval [0,Nys] is taken as the first curve F fir (x), the fitting curve in the second numerical interval [Nys, N] is taken as the second curve F sec (x), Nys represents the preset operation and maintenance times threshold; Calculate the first average vulnerability value , will pass through (0, Kave fir ) and a straight line parallel to the horizontal plane is used as a reference line, and the intersection of the reference line and the second curve is recorded as a reference point. The ratio c of the value interval corresponding to the normal curve between two adjacent reference points to the second numerical interval [Nys, N] is counted and recorded as the normal ratio. The normal curve is the second curve below the reference line; S3: Calculate the system risk value P according to the first average vulnerability value, the second curve and the abnormal ratio, and adjust the preset operation and maintenance period Tys according to the system risk value.

2. The cloud platform-based information security assessment method according to claim 1, characterized in that: In step S3, the process of calculating the system risk value P according to the first average vulnerability value, the second curve and the abnormal ratio specifically includes: Calculate the second average vulnerability value and the maximum vulnerability value K max =max(F sec (x)); Determine the target curve G(x)=F sec (x)-Kave fir , the system risk value is calculated by the following formula: ； Among them, η is the preset system risk value correction coefficient.

3. The cloud platform-based information security assessment method according to claim 1, characterized in that: In step S3, the process of adjusting the preset operation and maintenance cycle according to the system risk value specifically includes: Calculate the actual period Tsj = μ (Pys-P) * Tys, where μ is the preset operation and maintenance period length correction coefficient, Pys represents the preset standard system risk value, the system is operated and maintained at Tsc + Tsj, and Tsc represents the time of the most recent operation and maintenance of the system.

4. The cloud platform-based information security assessment method according to claim 3, characterized in that: When the actual period Tsj≥3Tys exists, the system is operated and maintained at Tsc+3Tys.

5. The cloud platform-based information security assessment method according to claim 1, characterized in that: The step S3 further includes the following steps: Get the system risk value P; When 0<P≤K1, the system risk value is low, and the safety status of the system is judged to be high; When K1<P≤K2, the system risk value is average, the system security status is judged to be average, and it is marked, and the management personnel are given a first-level prompt; When K2<P, the system risk value is very high, and the system security status is judged to be low, and it is marked and the management personnel are given a secondary prompt; K1K2 are preset judgment thresholds, and K1<K2.

6. The cloud platform-based information security assessment method according to claim 5, characterized in that: The specific methods of the first-level prompt and the second-level prompt are based on the settings of the administrator.

7. The cloud platform-based information security assessment method according to claim 1, characterized in that: In the step S1, the basic score of the vulnerability is determined based on CVSS.

8. The information security assessment system based on the cloud platform is characterized by: include: Collection module: obtains system operation and maintenance records, and extracts vulnerability data from them during each operation and maintenance. The vulnerability data includes the basic score Ajc of the vulnerability, the total number of vulnerabilities Azs, and the time Azc spent on repairing a single vulnerability; Analysis module: Calculate vulnerability value K=ε*Ajc max *Azs*Azc max , where Ajc max Indicates the maximum value of the base score of the vulnerability described, Azc max It represents the maximum time taken to repair a single vulnerability, and ε is the preset vulnerability value correction coefficient; Generate coordinate points (i, K i ), K i represents the vulnerability value when the system is operated and maintained for the i-th time, and the fitting curve f(x) is obtained by fitting the coordinate points, x∈[0,N], N represents the total number of system operations and maintenance, and the fitting curve in the first number interval [0,Nys] is taken as the first curve F fir (x), the fitting curve in the second numerical interval [Nys, N] is taken as the second curve F sec (x), Nys represents the preset operation and maintenance times threshold; Calculate the first average vulnerability value , will pass through (0, Kave fir ) and a straight line parallel to the horizontal plane is used as a reference line, and the intersection of the reference line and the second curve is recorded as a reference point. The ratio c of the value interval corresponding to the normal curve between two adjacent reference points to the second numerical interval [Nys, N] is counted and recorded as the normal ratio. The normal curve is the second curve below the reference line; Adjustment module: calculates the system risk value P according to the first average vulnerability value, the second curve and the abnormal proportion, and adjusts the preset operation and maintenance period Tys according to the system risk value.

Images