State evaluation method and system based on network security

Abstract

The invention discloses a state evaluation method and system based on network security, and relates to the technical field of network security, and the method comprises the steps: obtaining at least one attackable path, and obtaining an association set of network nodes; calculating risk coefficients of the historical security vulnerabilities, and forming attack features for the historical security vulnerabilities; forming a dangerous critical value for the attackable path; based on the risk critical value of the attackable path, evaluating the attack scale of the network attack to obtain an overall prediction scale; acquiring the emergency repair speed of the network node, and calculating to obtain an attack counteracting scale; and when the total prediction scale does not exceed the attack offset scale, judging that the network security is in a normal state, otherwise, judging that the network security is in an abnormal state. By arranging the node analysis module, the vulnerability analysis module, the attack analysis module, the attack prediction module and the repair prediction module, an evaluation result which is relatively consistent with an actual situation can be obtained, and the evaluation result has a relatively high reference value.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a state assessment method and system based on network security. Background Art

[0002] With the rapid development of computer technology, information networks have become an important guarantee for social development and are of vital importance to individuals, enterprises and units. Network security is to ensure that the hardware, software and data in the network system are protected and not damaged, changed or leaked due to accidental or malicious reasons, so that the network system can operate continuously and reliably and the network service is not interrupted. Therefore, it is necessary to conduct network security assessment, issue timely warnings at the initial moment of abnormality, and then carry out targeted processing.

[0003] The existing network architecture is complex and there are many types of network attacks. When conducting assessments, the errors in status assessments are large, making it impossible to make accurate judgments, which in turn affects the timeliness of targeted processing. Summary of the invention

[0004] In order to solve the above technical problems, a network security-based status assessment method and system are provided. This technical solution solves the problem proposed in the above background technology that the existing network architecture is complex and there are many types of network attacks. When conducting the assessment, the error in the status assessment is large, which makes it impossible to make an accurate judgment, thereby affecting the timeliness of targeted processing.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is: A network security status assessment method, comprising: Acquire a topological framework of network operation, the topological framework is composed of at least one network node and its connection relationship, perform defense analysis on the topological framework, obtain at least one attackable path, the attackable path is composed of network node connections, perform correlation analysis on the network nodes, and obtain a correlation set of network nodes; Obtain at least one historical security vulnerability, calculate the risk coefficient of the historical security vulnerability based on the effect of the historical security vulnerability, and form an attack feature for the historical security vulnerability; Acquire at least one network attack within a preset time in the network operating environment, and match the network attack with the attack characteristics of the historical security vulnerability with the historical security vulnerability; A critical value of danger is formed for the attackable path, and when the danger coefficient is greater than the critical value, the historical security vulnerability corresponding to the danger coefficient causes network damage to the attackable path, wherein different attackable paths have different critical values ​​of danger; Based on the critical value of the attackable path, the attack scale of at least one network attack is evaluated to obtain an overall predicted scale, which is the attack scale within a preset time; Obtain the emergency repair speed of network nodes and calculate the attack offset scale; When the overall predicted scale does not exceed the attack offset scale, the network security is judged to be in a normal state; otherwise, the network security is judged to be in an abnormal state.

[0006] Preferably, the obtaining of the topological architecture of the network operation comprises the following steps: Acquire at least one network node used for data transmission when the network is running, and acquire at least one transmission path used for data transmission when the network is running; The network nodes that the transmission path passes through are matched with the transmission path, and the network nodes corresponding to the same transmission path are in a connected relationship; The correspondence between network nodes and transmission paths and the transmission paths are summarized to obtain the topological architecture of network operation.

[0007] Preferably, the performing defense analysis on the topology architecture to obtain at least one attackable path comprises the following steps: Based on historical data, obtain repair strategies for historical security vulnerabilities; Use historical security vulnerabilities to test the network nodes for a preset number of times. After each test, use the repair strategy of the historical security vulnerabilities to repair the network nodes; The number of times the network node correctly identifies historical security vulnerabilities is divided by a preset number to obtain an identification accuracy rate, and the identification accuracy rates of the network node relative to at least one historical security vulnerability are averaged to obtain an identification accuracy average; Use the defense formula to calculate the vulnerability recognition rate of the transmission path; When the vulnerability identification rate is lower than the preset value, the transmission path is considered as an attackable path; The defense formula is as follows: ; Among them, A is the vulnerability identification rate, i is the subscript, and n is the total number of network nodes in the transmission path. is the correct mean value of identification of the i-th network node in the transmission path.

[0008] Preferably, the performing correlation analysis on the network nodes to obtain the correlation set of the network nodes comprises the following steps: The transmission path where the network node appears is used as the target transmission path; Taking the remaining network nodes different from the network node in the target transmission path as the target network nodes; Determine whether the network node is a necessary node for data transmission of the target network node. If so, add the target network node to the associated set of the network node. If not, do nothing. The initial state of the associated set of the network node is an empty set.

[0009] Preferably, the calculation of the risk coefficient of the historical security vulnerability based on the effect of the historical security vulnerability comprises the following steps: Based on historical data, obtain the data repair costs caused by historical security vulnerabilities, obtain the data damage amount of historical security vulnerabilities, obtain the vulnerability repairability rate of historical security vulnerabilities, and obtain the failure triggering rate of historical security vulnerabilities; Use the criticality formula to calculate the criticality coefficient of historical security vulnerabilities; The hazard formula is as follows: ; Among them, B is the risk coefficient of historical security vulnerabilities, a is the data repair cost, b is the amount of data destruction, c is the failure rate, and d is the vulnerability repair rate.

[0010] Preferably, forming attack features for historical security vulnerabilities comprises the following steps: Based on the historical data, obtaining at least one historical attack that triggered the historical security vulnerability; Extract features of historical attacks and obtain at least one suspected feature; Based on historical data, the probability of triggering historical security vulnerabilities when suspected features appear is counted; When the trigger probability is greater than the preset probability, the suspected feature is used as the attack feature of the historical security vulnerability, where the preset probability is set based on empirical data.

[0011] Preferably, forming a critical risk value for the attackable path comprises the following steps: Obtain the value range of the risk coefficient of the historical security vulnerability and the value range of the high risk coefficient of the equally spaced share, and obtain at least one identification point; The historical security vulnerability with a risk factor equal to the value at the identification point is taken as the target historical security vulnerability; Summarize the attack features of the target's historical security vulnerabilities to obtain vulnerability-triggered attacks; Use vulnerability trigger attacks to attack the attackable path. When the attack triggers a vulnerability, the identification point is used as the target identification point. After the attack, the target historical security vulnerability repair strategy is used to repair the vulnerability. The minimum value of at least one target identification point is used as the danger threshold.

[0012] Preferably, the step of evaluating the attack scale of at least one network attack to obtain an overall predicted scale comprises the following steps: Obtain at least one target attackable path, which satisfies that the risk coefficient of the historical security vulnerability corresponding to the network attack exceeds the risk critical value of the target attackable path; Obtaining and merging the associated sets corresponding to the network nodes through which at least one target attackable path passes, to obtain an abnormal node set; The number of elements in the abnormal node set is taken as the overall prediction scale.

[0013] Preferably, the obtaining of the emergency repair speed of the network node and calculating the attack offset scale comprises the following steps: Obtain the network's emergency repair speed for network nodes. The emergency repair speed is the number of attacked network nodes repaired per unit time. Multiply the emergency repair speed by the preset time to get the attack offset scale.

[0014] A network security-based status assessment system, used to implement the network security-based status assessment method, comprising: A node analysis module, wherein the node analysis module obtains a topological framework of network operation, wherein the topological framework is composed of at least one network node and its connection relationship, performs a defense analysis on the topological framework, obtains at least one attackable path, wherein the attackable path is composed of network node connections, performs a correlation analysis on the network nodes, and obtains an associated set of network nodes; A vulnerability analysis module, wherein the vulnerability analysis module obtains at least one historical security vulnerability, calculates a risk factor of the historical security vulnerability based on the effect of the historical security vulnerability, and forms an attack feature for the historical security vulnerability; An attack analysis module, wherein the attack analysis module obtains at least one network attack within a preset time in the network operation environment, and matches the network attack with the attack characteristics of the historical security vulnerability with the historical security vulnerability; A numerical value forming module, wherein the numerical value forming module forms a critical value for the attackable path, and when the criticality coefficient is greater than the critical value, the historical security vulnerability corresponding to the criticality coefficient causes network damage to the attackable path; An attack prediction module, wherein the attack prediction module evaluates the attack scale of at least one network attack based on the danger threshold of the attackable path to obtain an overall predicted scale; A repair prediction module, wherein the repair prediction module obtains the emergency repair speed of the network node and calculates the attack offset scale; The state assessment module determines that the network security is in a normal state when the overall predicted scale does not exceed the attack offset scale; otherwise, the network security is in an abnormal state.

[0015] Compared with the prior art, the present invention has the following beneficial effects: By setting up a node analysis module, a vulnerability analysis module, an attack analysis module, an attack prediction module and a repair prediction module, the transmission path can be analyzed according to the topological architecture of the network operation, and the characteristics of different security vulnerabilities can be combined to estimate the damage that may be caused by the security vulnerabilities. In this way, the impact of security vulnerabilities caused by network attacks in the network operation environment can be estimated, and the final judgment can be made in combination with the network's own repair capabilities. In this way, an evaluation result that is more consistent with the actual situation can be obtained, and the evaluation result has a strong reference value. It can issue an early warning at the initial moment of the abnormality, and then carry out targeted processing in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of the network security status assessment method of the present invention; Figure 2 A schematic diagram of a process of obtaining a topological architecture of network operation according to the present invention; Figure 3 A schematic diagram of a process of analyzing the defense capability of a topology architecture to obtain at least one attackable path according to the present invention; Figure 4 A schematic diagram of a process of performing correlation analysis on network nodes to obtain a correlation set of network nodes according to the present invention; Figure 5 A schematic diagram of a flow chart of calculating the risk coefficient of a historical security vulnerability based on the effect of the historical security vulnerability of the present invention; Figure 6 A schematic diagram of a process for forming attack features for historical security vulnerabilities according to the present invention; Figure 7 A schematic diagram of a process for forming a critical value of a risk for an attackable path according to the present invention; Figure 8 A schematic diagram of a process for evaluating the attack scale of at least one network attack to obtain an overall predicted scale according to the present invention; Fig. 9 The present invention is a flow chart of obtaining the emergency repair speed of network nodes and calculating the attack offset scale. DETAILED DESCRIPTION

[0017] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0018] Reference Figure 1 As shown, a state assessment method based on network security includes: Acquire a topological framework of network operation, the topological framework is composed of at least one network node and its connection relationship, perform defense analysis on the topological framework, obtain at least one attackable path, the attackable path is composed of network node connections, perform correlation analysis on the network nodes, and obtain a correlation set of network nodes; Obtain at least one historical security vulnerability, calculate the risk coefficient of the historical security vulnerability based on the effect of the historical security vulnerability, and form an attack feature for the historical security vulnerability; Acquire at least one network attack within a preset time in the network operating environment, and match the network attack with the attack characteristics of the historical security vulnerability with the historical security vulnerability; A critical value of danger is formed for the attackable path, and when the danger coefficient is greater than the critical value, the historical security vulnerability corresponding to the danger coefficient causes network damage to the attackable path, wherein different attackable paths have different critical values ​​of danger; Based on the critical value of the attackable path, the attack scale of at least one network attack is evaluated to obtain an overall predicted scale, which is the attack scale within a preset time; Obtain the emergency repair speed of network nodes and calculate the attack offset scale; When the overall predicted scale does not exceed the attack offset scale, the network security is judged to be in a normal state; otherwise, the network security is judged to be in an abnormal state.

[0019] There are many types of network attacks, so the effects of network attacks are also different. Each network attack will trigger different security vulnerabilities, and the recognition capabilities of different network nodes may be different. Therefore, security vulnerabilities may not be identified, defense may not be carried out, and the attack may be successful. In addition, since network nodes may appear in multiple transmission paths, once a network node is abnormal, the corresponding transmission path may also be abnormal, depending on whether the transmission of the transmission path must pass through the network node. Therefore, it is more complicated to estimate the scale caused by the problem of the network node. Therefore, it is difficult to determine whether it exceeds the repair speed of the antivirus software carried by the network itself, which leads to a large misjudgment in the assessment of the network status. This misjudgment will lead to the unnecessary hiring of experts to repair the network, thereby increasing costs. Therefore, in this solution, the above-mentioned situations are dealt with in a targeted manner to ensure a high degree of assessment accuracy.

[0020] Reference Figure 2 As shown, obtaining the topology architecture of network operation includes the following steps: Acquire at least one network node used for data transmission when the network is running, and acquire at least one transmission path used for data transmission when the network is running; The network nodes that the transmission path passes through are matched with the transmission path, and the network nodes corresponding to the same transmission path are in a connected relationship; The correspondence between network nodes and transmission paths and the transmission paths are summarized to obtain the topological architecture of network operation.

[0021] Transmission paths may cross each other.

[0022] Reference Figure 3 As shown, performing defense analysis on the topology architecture to obtain at least one attackable path includes the following steps: Based on historical data, obtain repair strategies for historical security vulnerabilities; Use historical security vulnerabilities to test the network nodes for a preset number of times. After each test, use the repair strategy of the historical security vulnerabilities to repair the network nodes; The number of times the network node correctly identifies historical security vulnerabilities is divided by a preset number to obtain an identification accuracy rate, and the identification accuracy rates of the network node relative to at least one historical security vulnerability are averaged to obtain an identification accuracy average; Use the defense formula to calculate the vulnerability recognition rate of the transmission path; When the vulnerability identification rate is lower than the preset value, the transmission path is considered as an attackable path; The defense formula is as follows: ; Among them, A is the vulnerability identification rate, i is the subscript, and n is the total number of network nodes in the transmission path. is the correct mean value of identification of the i-th network node in the transmission path.

[0023] Once the network nodes in the transmission path are unable to identify historical security vulnerabilities, they will not take defensive measures, which will cause vulnerabilities to occur. As a result, the transmission path where the network nodes are located will become abnormal due to the attack on the network nodes. The appearance of any network node in the transmission path will cause the transmission path to become abnormal. Therefore, when judging whether the transmission path is an attackable path, it is necessary to multiply the correct identification mean of all network nodes in the transmission path. The obtained vulnerability recognition rate can reflect whether the transmission path will be attacked by historical security vulnerabilities.

[0024] Reference Figure 4 As shown, performing correlation analysis on network nodes to obtain a correlation set of network nodes includes the following steps: The transmission path where the network node appears is used as the target transmission path; Taking the remaining network nodes different from the network node in the target transmission path as the target network nodes; Determine whether the network node is a necessary node for data transmission of the target network node. If so, add the target network node to the associated set of the network node. If not, do nothing. The initial state of the associated set of the network node is an empty set.

[0025] It should be noted that when a network node is abnormal, the network nodes in the target transmission path may not necessarily be abnormal, because the target transmission path may have other paths that do not pass through the abnormal network nodes. This is because the transmission paths are intertwined with each other and the transmission can be completed through other network nodes; The data transmission of the elements of the associated set must pass through the network nodes. Therefore, when an abnormality occurs in a network node, an abnormality will also occur in the elements of the associated set. Therefore, the total number of abnormal network nodes can be estimated based on this.

[0026] Reference Figure 5 As shown, based on the effects of historical security vulnerabilities, calculating the risk coefficient of historical security vulnerabilities includes the following steps: Based on historical data, obtain the data repair costs caused by historical security vulnerabilities, obtain the data damage amount of historical security vulnerabilities, obtain the vulnerability repairability rate of historical security vulnerabilities, and obtain the failure triggering rate of historical security vulnerabilities; Use the criticality formula to calculate the criticality coefficient of historical security vulnerabilities; The hazard formula is as follows: ; Among them, B is the risk coefficient of historical security vulnerabilities, a is the data repair cost, b is the amount of data destruction, c is the failure rate, and d is the vulnerability repair rate.

[0027] The criticality coefficient of historical security vulnerabilities is used to estimate the degree of criticality of historical security vulnerabilities. Based on this, we can determine which attack paths will be successfully attacked by network attacks based on the correspondence between historical security vulnerabilities and network attacks. Because the defense power of each attack path is different, we can then estimate the scale of the attack based on the attack paths that have been successfully attacked.

[0028] Reference Figure 6 As shown, forming attack features for historical security vulnerabilities includes the following steps: Based on the historical data, obtaining at least one historical attack that triggered the historical security vulnerability; Extract features of historical attacks and obtain at least one suspected feature; Based on historical data, the probability of triggering historical security vulnerabilities when suspected features appear is counted; When the trigger probability is greater than the preset probability, the suspected feature is used as the attack feature of the historical security vulnerability, where the preset probability is set based on empirical data.

[0029] Historical security vulnerabilities require triggering conditions, which are the various types of attacks that exist in the network. In order to identify the attacks that trigger historical security vulnerabilities, feature extraction is required. Therefore, the attack features corresponding to the historical security vulnerabilities are obtained. In order to avoid misidentification, the trigger probability is also counted to ensure that there is a correlation between the two. Therefore, network attacks can be matched with historical security vulnerabilities based on the attack features.

[0030] Reference Figure 7 As shown, forming a critical value for the attackable path includes the following steps: Obtain the value range of the risk coefficient of the historical security vulnerability and the value range of the high risk coefficient of the equally spaced share, and obtain at least one identification point; The historical security vulnerability with a risk factor equal to the value at the identification point is taken as the target historical security vulnerability; Summarize the attack features of the target's historical security vulnerabilities to obtain vulnerability-triggered attacks; Use vulnerability trigger attacks to attack the attackable path. When the attack triggers a vulnerability, the identification point is used as the target identification point. After the attack, the target historical security vulnerability repair strategy is used to repair the vulnerability. The minimum value of at least one target identification point is used as the danger threshold.

[0031] Since the composition of each attackable path is different, the threshold value triggered by the vulnerability is also different. Therefore, it is necessary to form a corresponding risk threshold for each attackable path.

[0032] Reference Figure 8 As shown, evaluating the attack scale of at least one network attack to obtain the overall predicted scale includes the following steps: Obtain at least one target attackable path, which satisfies that the risk coefficient of the historical security vulnerability corresponding to the network attack exceeds the risk critical value of the target attackable path; Obtaining and merging the associated sets corresponding to the network nodes through which at least one target attackable path passes, to obtain an abnormal node set; The number of elements in the abnormal node set is taken as the overall prediction scale.

[0033] The target attackable path is a path that can be successfully attacked. Therefore, all network nodes it passes through have the possibility of being successfully attacked. Therefore, it will also cause the elements in the associated sets corresponding to the network nodes that the target attackable path passes through to be abnormal. Therefore, the overall prediction scale can be combined.

[0034] Reference Fig. 9 As shown, obtaining the emergency repair speed of the network node and calculating the attack offset scale include the following steps: Obtain the network's emergency repair speed for network nodes. The emergency repair speed is the number of attacked network nodes repaired per unit time. Multiply the emergency repair speed by the preset time to get the attack offset scale.

[0035] The network itself has defense mechanisms such as anti-virus software. Network anomalies must be because the repair speed is lower than the attack speed. Since the overall prediction scale and attack offset scale are both statistical results within the preset time, the comparison between the two can be used as the basis for anomaly judgment.

[0036] A network security-based status assessment system, used to implement the network security-based status assessment method, comprising: A node analysis module, wherein the node analysis module obtains a topological framework of network operation, wherein the topological framework is composed of at least one network node and its connection relationship, performs a defense analysis on the topological framework, obtains at least one attackable path, wherein the attackable path is composed of network node connections, performs a correlation analysis on the network nodes, and obtains an associated set of network nodes; A vulnerability analysis module, wherein the vulnerability analysis module obtains at least one historical security vulnerability, calculates a risk factor of the historical security vulnerability based on the effect of the historical security vulnerability, and forms an attack feature for the historical security vulnerability; An attack analysis module, wherein the attack analysis module obtains at least one network attack within a preset time in the network operation environment, and matches the network attack with the attack characteristics of the historical security vulnerability with the historical security vulnerability; A numerical value forming module, wherein the numerical value forming module forms a critical value for the attackable path, and when the criticality coefficient is greater than the critical value, the historical security vulnerability corresponding to the criticality coefficient causes network damage to the attackable path; An attack prediction module, wherein the attack prediction module evaluates the attack scale of at least one network attack based on the danger threshold of the attackable path to obtain an overall predicted scale; A repair prediction module, wherein the repair prediction module obtains the emergency repair speed of the network node and calculates the attack offset scale; The state assessment module determines that the network security is in a normal state when the overall predicted scale does not exceed the attack offset scale; otherwise, the network security is in an abnormal state.

[0037] Furthermore, the present solution also proposes a storage medium on which a computer-readable program is stored, and when the computer-readable program is called, the above-mentioned network security-based status assessment method is executed.

[0038] It is understandable that the storage medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; an optical medium, such as a DVD; or a semiconductor medium, such as a solid state drive (SSD).

[0039] To sum up, the advantages of the present invention are: by setting up a node analysis module, a vulnerability analysis module, an attack analysis module, an attack prediction module and a repair prediction module, the transmission path can be analyzed according to the topological architecture of the network operation, and the characteristics of different security vulnerabilities can be combined to estimate the damage that may be caused by the security vulnerabilities, thereby estimating the impact of security vulnerabilities caused by network attacks in the network operation environment, and combining the network's own repair capabilities to make a final judgment, thereby obtaining an evaluation result that is more consistent with the actual situation, and the evaluation result has a strong reference value, and can issue an early warning at the initial moment of the abnormality, and then carry out targeted processing in a timely manner.

[0040] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A network security status assessment method, characterized in that: include: Acquire a topological framework of network operation, the topological framework is composed of at least one network node and its connection relationship, perform defense analysis on the topological framework, obtain at least one attackable path, the attackable path is composed of network node connections, perform correlation analysis on the network nodes, and obtain a correlation set of network nodes; Obtain at least one historical security vulnerability, calculate the risk coefficient of the historical security vulnerability based on the effect of the historical security vulnerability, and form an attack feature for the historical security vulnerability; Acquire at least one network attack within a preset time in the network operation environment, and match the network attack with the attack characteristics of the historical security vulnerability with the historical security vulnerability; A critical value of danger is formed for the attackable path, and when the danger coefficient is greater than the critical value, the historical security vulnerability corresponding to the danger coefficient causes network damage to the attackable path, wherein different attackable paths have different critical values ​​of danger; Based on the critical value of the attackable path, the attack scale of at least one network attack is evaluated to obtain an overall predicted scale, which is the attack scale within a preset time; Obtain the emergency repair speed of network nodes and calculate the attack offset scale; When the overall predicted scale does not exceed the attack offset scale, the network security is judged to be in a normal state; otherwise, the network security is judged to be in an abnormal state.

2. A network security-based status assessment method according to claim 1, characterized in that: The obtaining of the network operation topology architecture comprises the following steps: Acquire at least one network node used for data transmission when the network is running, and acquire at least one transmission path used for data transmission when the network is running; The network nodes that the transmission path passes through are matched with the transmission path, and the network nodes corresponding to the same transmission path are in a connected relationship; The correspondence between network nodes and transmission paths and the transmission paths are summarized to obtain the topological architecture of network operation.

3. A network security-based status assessment method according to claim 2, characterized in that: The performing of defense analysis on the topology architecture to obtain at least one attackable path comprises the following steps: Based on historical data, obtain repair strategies for historical security vulnerabilities; Use historical security vulnerabilities to test the network nodes for a preset number of times. After each test, use the repair strategy of the historical security vulnerabilities to repair the network nodes; The number of times the network node correctly identifies historical security vulnerabilities is divided by a preset number to obtain an identification accuracy rate, and the identification accuracy rates of the network node relative to at least one historical security vulnerability are averaged to obtain an identification accuracy average; Use the defense formula to calculate the vulnerability recognition rate of the transmission path; When the vulnerability identification rate is lower than the preset value, the transmission path is considered as an attackable path; The defense formula is as follows: ; Among them, A is the vulnerability identification rate, i is the subscript, and n is the total number of network nodes in the transmission path. is the correct mean value of identification of the i-th network node in the transmission path.

4. A network security-based status assessment method according to claim 3, characterized in that: The performing of correlation analysis on the network nodes to obtain a correlation set of the network nodes comprises the following steps: The transmission path where the network node appears is used as the target transmission path; Taking the remaining network nodes different from the network node in the target transmission path as the target network nodes; Determine whether the network node is a necessary node for data transmission of the target network node. If so, add the target network node to the associated set of the network node. If not, do nothing. The initial state of the associated set of the network node is an empty set.

5. A network security-based status assessment method according to claim 4, characterized in that: The calculation of the risk factor of the historical security vulnerability based on the effect of the historical security vulnerability includes the following steps: Based on historical data, obtain the data repair costs caused by historical security vulnerabilities, obtain the data damage amount of historical security vulnerabilities, obtain the vulnerability repairability rate of historical security vulnerabilities, and obtain the failure triggering rate of historical security vulnerabilities; Use the criticality formula to calculate the criticality coefficient of historical security vulnerabilities; The hazard formula is as follows: ; Among them, B is the risk coefficient of historical security vulnerabilities, a is the data repair cost, b is the amount of data destruction, c is the failure rate, and d is the vulnerability repair rate.

6. A method for network security-based status assessment according to claim 5, characterized in that: The forming of attack features for historical security vulnerabilities comprises the following steps: Based on the historical data, obtaining at least one historical attack that triggered the historical security vulnerability; Extract features of historical attacks and obtain at least one suspected feature; Based on historical data, the probability of triggering historical security vulnerabilities when suspected features appear is counted; When the trigger probability is greater than the preset probability, the suspected feature is used as the attack feature of the historical security vulnerability, where the preset probability is set based on empirical data.

7. A method for network security-based status assessment according to claim 6, characterized in that: The forming of a critical value of a risk for an attackable path comprises the following steps: Obtain the value range of the risk coefficient of the historical security vulnerability and the value range of the high risk coefficient of the equally spaced share, and obtain at least one identification point; The historical security vulnerability with a criticality coefficient equal to the value at the identification point is taken as the target historical security vulnerability; Summarize the attack features of the target's historical security vulnerabilities to obtain the vulnerability-triggered attacks; Use vulnerability trigger attacks to attack the attackable path. When the attack triggers a vulnerability, the identification point is used as the target identification point. After the attack, the target historical security vulnerability repair strategy is used to repair the vulnerability. The minimum value of at least one target identification point is used as the danger threshold.

8. A method for network security-based status assessment according to claim 7, characterized in that: The step of evaluating the attack scale of at least one network attack to obtain an overall predicted scale comprises the following steps: Obtain at least one target attackable path, which satisfies that the risk coefficient of the historical security vulnerability corresponding to the network attack exceeds the risk critical value of the target attackable path; Obtaining and merging the associated sets corresponding to the network nodes through which at least one target attackable path passes, to obtain an abnormal node set; The number of elements in the abnormal node set is taken as the overall prediction scale.

9. A method for network security-based status assessment according to claim 8, characterized in that: The step of obtaining the emergency repair speed of the network node and calculating the attack offset scale comprises the following steps: Obtain the network's emergency repair speed for network nodes. The emergency repair speed is the number of attacked network nodes repaired per unit time. Multiply the emergency repair speed by the preset time to get the attack offset scale.

10. A network security-based status assessment system, used to implement the network security-based status assessment method according to any one of claims 1 to 9, characterized in that: include: A node analysis module, wherein the node analysis module obtains a topological framework of network operation, wherein the topological framework is composed of at least one network node and its connection relationship, performs a defense analysis on the topological framework, obtains at least one attackable path, wherein the attackable path is composed of network node connections, performs a correlation analysis on the network nodes, and obtains an associated set of network nodes; A vulnerability analysis module, wherein the vulnerability analysis module obtains at least one historical security vulnerability, calculates a risk factor of the historical security vulnerability based on the effect of the historical security vulnerability, and forms an attack feature for the historical security vulnerability; An attack analysis module, wherein the attack analysis module obtains at least one network attack within a preset time in the network operation environment, and matches the network attack with the attack characteristics of the historical security vulnerability with the historical security vulnerability; A numerical value forming module, wherein the numerical value forming module forms a critical value for the attackable path, and when the criticality coefficient is greater than the critical value, the historical security vulnerability corresponding to the criticality coefficient causes network damage to the attackable path; An attack prediction module, wherein the attack prediction module evaluates the attack scale of at least one network attack based on the danger threshold of the attackable path to obtain an overall predicted scale; A repair prediction module, wherein the repair prediction module obtains the emergency repair speed of the network node and calculates the attack offset scale; The state assessment module determines that the network security is in a normal state when the overall predicted scale does not exceed the attack offset scale; otherwise, the network security is in an abnormal state.

Images