Network risk processing method and system based on atlas

Abstract

The invention relates to the technical field of computer networks, in particular to a network risk processing method and system based on a graph. The method comprises the following steps: performing network entity model construction on a target network to obtain a target network entity model; performing network entity graph modeling on the target network based on the target network entity model to obtain a network entity relationship graph; performing dynamic graph updating on the network entity relation graph to obtain an updated network entity relation graph; carrying out risk propagation source node determination on the updated network entity relation graph to obtain a risk propagation source node set; and performing global risk assessment on the target network according to the risk propagation source node set based on the updated network entity relationship graph to obtain a network global risk assessment result. According to the invention, the efficiency and accuracy of network risk assessment are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a graph-based network risk management method and system. Background Art

[0002] In the field of computer network technology, existing network risk assessment methods often rely on static network topology and simple vulnerability scanning technology, which cannot fully and dynamically reflect the risk status in the network. First, the static network topology cannot reflect the changes of devices in the network and the updates of communication paths in real time, resulting in a deviation between the risk assessment results and the actual situation. Second, simple vulnerability scanning technology can often only find known vulnerabilities, but is powerless against unknown or zero-day vulnerabilities, which limits the depth and breadth of risk assessment.

[0003] In addition, existing network risk assessment methods rarely consider the importance of each node in the network and their interdependence. In the network, the security of certain key nodes has a significant impact on the security status of the entire network, and simple risk assessment methods often ignore this point, resulting in the assessment results being unable to accurately reflect the true risk level of the network. At the same time, existing methods also lack effective identification and assessment of risk propagation paths, and are unable to predict the risk propagation trend and impact range in the network, making it difficult for network managers to take effective prevention and response measures. Summary of the invention

[0004] Based on this, it is necessary for the present invention to provide a graph-based network risk management method and system to solve at least one of the above technical problems.

[0005] To achieve the above purpose, a network risk management method based on graph includes the following steps:

[0006] Step S1: constructing a network entity model for the target network to obtain a target network entity model; modeling a network entity graph for the target network based on the target network entity model to obtain a network entity relationship graph;

[0007] Step S2: dynamically updating the network entity relationship graph to obtain an updated network entity relationship graph;

[0008] Step S3: determining the risk propagation source nodes of the updated network entity relationship graph to obtain a risk propagation source node set;

[0009] Step S4: Based on the updated network entity relationship graph, a global risk assessment is performed on the target network according to the risk propagation source node set to obtain a global risk assessment result of the network.

[0010] The present invention can capture the changes of devices in the network and the updates of communication paths in real time through the construction of network entity models and dynamic graph updates, ensuring that the risk assessment results are consistent with the actual situation of the network. This dynamic update mechanism makes the risk assessment no longer a static snapshot, but a dynamic view that can reflect the real-time status of the network, thereby improving the accuracy and reliability of risk assessment. By determining the risk propagation source node, not only can known vulnerabilities be identified, but also potential unknown vulnerabilities and zero-day vulnerabilities can be predicted and identified through the constructed network entity relationship graph. This method can cover network risks more comprehensively, deeply explore security vulnerabilities in the network, and enhance the depth and breadth of risk assessment. The present invention takes into account the importance of each node in the network and the dependencies between them. Through global risk assessment, it can accurately reflect the impact of the security of key nodes on the entire network. This analysis enables network managers to pay more attention to those nodes that are critical to network security, so as to take more targeted security measures. The present invention can identify and evaluate the propagation path of risks in the network, and predict the propagation trend and impact range of risks by determining the risk propagation source node set. In summary, the present invention improves the efficiency and accuracy of network risk assessment.

[0011] Preferably, the present invention further provides a graph-based network risk processing system for executing the graph-based network risk processing method as described above, the graph-based network risk processing system comprising:

[0012] A graph construction module is used to construct a network entity model of the target network to obtain a target network entity model; based on the target network entity model, a network entity graph model is constructed for the target network to obtain a network entity relationship graph;

[0013] A graph updating module, used for dynamically updating the network entity relationship graph to obtain an updated network entity relationship graph;

[0014] The transmission source node identification module is used to determine the risk transmission source nodes of the updated network entity relationship graph and obtain the risk transmission source node set;

[0015] The global risk assessment module is used to perform a global risk assessment on the target network based on the risk propagation source node set based on the updated network entity relationship graph to obtain the network global risk assessment result.

[0016] The present invention automatically completes the entire process from the construction of the network entity model to the global risk assessment through the coordinated work of the graph construction module, the graph update module, the propagation source node identification module and the global risk assessment module. This automation not only reduces manual intervention and reduces the error rate, but also greatly improves the speed and continuity of the assessment. The graph update module can monitor network changes in real time and update the network entity relationship graph, ensuring that the risk assessment is based on the latest network status. This real-time performance enables the system to quickly respond to emergencies in the network. The propagation source node identification module can effectively identify the source node of risk propagation by analyzing the network entity relationship graph, thereby deeply mining the potential risk points in the network. This enhances the system's ability to identify risk factors in a complex network environment and improves the depth and accuracy of risk assessment. The global risk assessment module comprehensively considers various risk factors in the network and the dependencies between nodes, providing a comprehensive network risk perspective. This comprehensiveness enables the system to assess risks at all levels in the network and provides network managers with richer risk information. The present invention can adapt to network environments of different scales and complexities, so that it can effectively perform risk assessment in a variety of network scenarios, showing good adaptability and extensibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Other features, objects and advantages of the present invention will become more apparent from the detailed description made with reference to the following drawings:

[0018] Figure 1 A schematic flow chart of the steps of a graph-based network risk processing method according to an embodiment is shown.

[0019] Figure 2 A schematic flow chart of detailed steps for mapping the relationships between physical nodes according to a target network communication path set in one embodiment is shown.

[0020] Figure 3 A detailed flowchart diagram of step S16 of an embodiment is shown. DETAILED DESCRIPTION

[0021] The technical method of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0022] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0023] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0024] To achieve this, please refer to Figures 1 to 3 The present invention provides a network risk processing method based on graph, comprising the following steps:

[0025] Step S1: constructing a network entity model for the target network to obtain a target network entity model; modeling a network entity graph for the target network based on the target network entity model to obtain a network entity relationship graph;

[0026] Step S2: dynamically updating the network entity relationship graph to obtain an updated network entity relationship graph;

[0027] Step S3: determining the risk propagation source nodes of the updated network entity relationship graph to obtain a risk propagation source node set;

[0028] Step S4: Based on the updated network entity relationship graph, a global risk assessment is performed on the target network according to the risk propagation source node set to obtain a global risk assessment result of the network.

[0029] In this embodiment, network scanning tools (such as Nmap) and configuration management database (CMDB) are used to collect device information in the target network, including device type, IP address, MAC address, open ports and services, etc., to build a network entity model. Then, a graph database (such as Neo4j) is used to store these entities, and a network entity map is established based on the connection relationship between entities. The nodes in the map represent network devices, and the edges represent the connections between them. Subsequently, real-time monitoring tools (such as Wireshark) and configuration change monitoring systems (such as Ansible Tower) are deployed to track dynamic changes in the network, such as the addition of new devices, configuration changes, etc. This information is used to dynamically update the network entity map to ensure that the map can reflect the current state of the network. By analyzing the updated map, risk assessment tools (such as vulnerability scanners and threat intelligence platforms) are used to identify potential risk propagation source nodes, and these nodes are assembled to form a risk propagation source node set. Finally, combined with the risk propagation source node set and the network entity relationship map, a risk assessment algorithm (such as DREAD or CVSS) is used to calculate the risk level of each node in the network, and a global risk assessment is performed based on these levels. Use data analysis tools (such as Python's Pandas library) to process and analyze data, calculate the proportion of nodes with different risk levels, and use this to determine the global risk level of the entire network. For example, classify the network risk level into low risk, medium-low risk, medium-high risk, high risk, or extremely high risk. In the end, a comprehensive global risk assessment result of the network is obtained.

[0030] Preferably, step S1 comprises the following steps:

[0031] Step S11: collecting network node information of the target network to obtain a network node basic data set; wherein the network node basic data set includes a number of network node basic data, and the network node basic data at least includes a network node ID, a network node MAC address, and a network node logical address;

[0032] Specifically, you can use a network scanning tool (such as Nmap or Wireshark) to perform a comprehensive scan of the target network to collect basic data of all active nodes in the network. This data includes the ID, MAC address, and logical address of each network node. The network node ID is the unique identifier of each device in the network, the MAC address is the hardware address of the network interface, and the logical address usually refers to the IP address. During the scan, the tool generates a data set containing this information, namely the network node basic data set. For example, if you use Nmap, you can run a command such as nmap-sP192.168.1.0 / 24 to scan all devices within the specified subnet range and collect their node information. The scan results will include information such as the IP address, MAC address, and host name of each device, which will be recorded in the network node basic data set.

[0033] Step S12: Collect historical network traffic of the target network to obtain a historical network traffic data set;

[0034] Specifically, network traffic analysis tools (such as Wireshark or SolarWinds NetFlowTraffic Analyzer) can be deployed to achieve this. These tools can capture data packets passing through the network interface and record their detailed information, including source address, destination address, port number, protocol type, etc. For example, you can use Wireshark to set up a port mirror on a network switch so that all traffic passing through the port will be recorded. After collecting enough data, Wireshark will generate a data set containing historical network traffic information, namely the historical network traffic data set.

[0035] Step S13: performing communication path statistics on the historical network traffic data set to obtain a target network communication path set; wherein the target network communication path set includes a plurality of target network communication paths;

[0036] Specifically, you can use network traffic analysis tools, such as SolarWinds NetFlow Traffic Analyzer or Wireshark, to perform communication path statistics. First, use these tools to import and analyze historical traffic data. For example, in Wireshark, load the captured traffic file and use filtering rules to identify specific communication paths. Set filtering rules, such as ip.addr==xxxx, to view the traffic of a specific IP address. By analyzing these flows, determine the direction of data flow in the network, including the source node, the destination node, and the path between them. Then, organize these communication path information into a set, namely the target network communication path set. This set contains multiple paths, each of which consists of a series of nodes and links connecting these nodes. For example, the communication path from the server (IP address is 192.168.1.1) to the database (IP address is 192.168.1.2), and the communication path from the database to multiple clients.

[0037] Step S14: construct entity nodes for the network node basic data set to obtain an entity node set;

[0038] Specifically, network automation and visualization tools such as CyberChef or NetworkX (a Python library) can be used to build entity nodes. First, import the network node basic data set into these tools. For example, using the NetworkX library in Python, create a graph object and treat each network node as a node in the graph. Use the node's IP address or MAC address as the node's identifier. Then, add labels or classifications to the nodes based on their attributes (such as device type, operating system, etc.). For example, all nodes belonging to the same subnet are labeled as the same category, or nodes with specific functions (such as servers, routers, etc.) are labeled as specific types. In this way, a collection of entity nodes containing all network nodes is built, each with detailed attributes and characteristics. For example, create a command as follows to create a node in NetworkX: G.add_node('192.168.1.1', type = 'server', os = 'Windows'). This will add a node of type server and operating system Windows to the graph. By performing similar operations for all nodes, a complete collection of entity nodes will eventually be obtained.

[0039] Step S15: mapping the relationship between nodes of the entity node set according to the target network communication path set to obtain an entity node relationship network;

[0040] Specifically, please refer to the sub-steps of step S15 for the detailed implementation process of this embodiment.

[0041] Step S16: Associating risk factors with the entity node relationship network to obtain a network entity relationship graph.

[0042] Specifically, please refer to the sub-steps of step S16 for the detailed implementation process of this embodiment.

[0043] The present invention provides raw data for network risk assessment by comprehensively collecting basic information and historical traffic data of network nodes. These data include not only static attributes of nodes, such as ID, MAC address and logical address, but also dynamic traffic information, so that the assessment results are more accurate. By analyzing historical traffic data and counting communication paths, it is helpful to deeply understand the structure of the network and the information flow pattern. This understanding is the key to identifying potential vulnerabilities of the network because it reveals how data propagates in the network and the key transmission paths. The construction of the entity node relationship network and the association of risk factors enable the present invention to identify risk propagation paths and key risk nodes in the network. The generation of a network entity relationship graph provides an intuitive view for network risk assessment. This graph can help managers quickly identify and understand risk points in the network, so as to formulate more effective risk mitigation measures.

[0044] Preferably, the mapping of the relationship between nodes of the entity node set according to the target network communication path set specifically includes the following steps:

[0045] Find any two entity nodes in the entity node set that have a communication path according to the target network communication path;

[0046] Determining the communication directionality between the two entity nodes according to the target network communication path; wherein the communication directionality is unidirectional or bidirectional;

[0047] Creating an edge between the two entity nodes according to the communication directionality, if one entity node is always a sender of data and the other node is a receiver, creating a directed edge for the two entity nodes, with the direction from the sending node to the receiving node;

[0048] If the communication directionality is bidirectional, creating a bidirectional edge for the two entity nodes;

[0049] The entity nodes in the entity node set are connected according to the directed edge or the bidirectional edge, and the communication protocol type and the maximum file transfer flow are marked on the directed edge or the bidirectional edge, so as to obtain an entity node relationship network.

[0050] The present invention can provide a more detailed network traffic analysis by distinguishing between unidirectional and bidirectional communications between entity nodes. This analysis helps to identify key transmission paths and potential single points of failure in the network, thereby providing a basis for network optimization and risk mitigation. By creating directed edges and bidirectional edges, and marking the communication protocol type and the maximum file transfer flow on the edges, the visualization of the network entity relationship network is made more intuitive and information-rich. By identifying the communication directionality and protocol type between entity nodes, security policies can be formulated more specifically. For example, for communication paths that use specific protocols or transmit large amounts of data, more stringent security monitoring and protection measures can be implemented. When a network fails, the present invention can help quickly identify the affected communication paths and nodes, thereby accelerating the fault diagnosis and recovery process. By analyzing the communication relationship between entity nodes, the present invention helps to identify abnormal traffic patterns, such as distributed denial of service (DDoS) attacks or other network attacks.

[0051] In this embodiment, Python programming language and NetworkX library are used to construct entity node relationship network. First, a set containing basic data of network nodes and a target network communication path set containing historical network traffic data are determined. A graph object G is created using the NetworkX library, and then any two entity nodes with communication paths in the entity node set are identified based on the communication path information in the historical network traffic data set. For example, if it is found that a node with an IP address of 192.168.1.2 often sends data to a node with an IP address of 192.168.1.3, these two IP addresses are added as nodes to the graph G. Next, analyze whether the communication between the two entity nodes is unidirectional or bidirectional. This can be determined by checking the records in the traffic data set. For example, if it is found that there are only packets from 192.168.1.2 to 192.168.1.3, and no reverse packets, then the communication directionality between the two nodes is determined to be unidirectional. According to the communication directionality, a directed edge is created between 192.168.1.2 and 192.168.1.3 to indicate the flow direction of the data. In NetworkX, you can use G.add_edge('192.168.1.2','192.168.1.3') to add this edge. If the communication is bidirectional, a bidirectional edge will be created, indicated by G.add_edge('192.168.1.2','192.168.1.3',bidirectional=True). After creating the edge, annotate the communication protocol type and the maximum flow rate of file transfer on the edge. This can be achieved through the NetworkX edge attributes. For example, if the communication protocol type is TCP and the maximum flow rate of file transfer is 10MB, you can set the edge attributes like this: G['192.168.1.2']['192.168.1.3']['protocol']='TCP' and G['192.168.1.2']['192.168.1.3']['max_flow']=10. Through the above steps, a physical node relationship network is constructed; it contains information such as the communication path between physical nodes, communication directionality, communication protocol type, and maximum file transfer flow. In NetworkX, this network can be displayed through visualization functions. For example, the networkx.draw() function can be used to draw the network as a graph; the node and edge information can be clearly displayed.

[0052] Preferably, step S16 comprises the following steps:

[0053] Step S161: collecting application information of network nodes according to the network node basic data set to obtain a number of node application information tables; wherein each node application information table corresponds to a network node;

[0054] Specifically, you can use asset management software for application information collection, such as Microsoft's SystemCenter Configuration Manager (SCCM) or open source solutions such as Open-AudIT, which are able to scan devices in the network and collect a list of installed software. For example, using SCCM, create a software inventory query that will traverse all devices in the network and record the applications installed on each device. This query will generate a report with details such as application name, version, publisher, and installation date. For each network node, this report will serve as a node application information table. During implementation, agent software needs to be installed on each node so that SCCM can communicate with it and collect data. The collected data will be organized into a table; each row corresponds to a network node and each column corresponds to the properties of an application.

[0055] Step S162: Summarize and remove duplicates from all node application information tables to obtain a summary application information table;

[0056] Specifically, you can use a database management system, such as Microsoft SQL Server or open source MySQL, to perform aggregation and deduplication. First, import the application information table of each node into the database to create a table; each row represents an application instance on a node. Then, use SQL queries to merge these tables and remove duplicate application records. The query returns a summarized application information table; it contains the name, highest version number, and number of installations for each unique application. In this way, you can get a clear view of the distribution of installed applications across the network, as well as outdated applications that need to be updated or patched. Finally, you get an accurate summarized application information table.

[0057] Step S163: determining the official website address of each application according to the summary application information table to obtain an application official website address set; wherein the application official website address set includes a plurality of application official website addresses;

[0058] Specifically, a custom script can be used to automatically determine the official website address of each application listed in the summary application information table. First, create a Python script that uses a list of application names and finds the official website of each application by calling an API (such as the MVPS API) or using web crawler technology. For example, use Python's requests library to send HTTP requests and the BeautifulSoup library to parse HTML pages to extract official website links. The script will iterate over each application name, build a search engine query (such as Google search), and then analyze the returned search result page to find the official website link. Once found, the script will associate this link with the corresponding application name and store it in the application official website address set. For example, for an application named "ExampleApp", the script builds a query string "ExampleApp official website", then uses the search engine API to obtain search results and extracts the official website link from it, and finally obtains the application official website address set; wherein the application official website address set contains several application official website addresses.

[0059] Step S164: collecting the latest version number of each application according to the application official website address set to obtain the latest version table of the application;

[0060] Specifically, the latest version number of each application can be collected by writing an automated script, which will traverse the set of official website addresses of the application and perform web crawler operations or API calls for each official website address to obtain the latest version information. For example, use Python's Scrapy framework to create a crawler that is specifically used to extract version number information from web pages with a specific structure. For each official website address, the crawler will simulate a browser access, parse the returned HTML content, and use XPath or CSS selectors to locate elements containing version numbers. Once the version number is found, it will be recorded and associated with the corresponding application name to form a table of the latest version of the application. In addition, if the official website provides an API interface, directly calling these APIs to obtain version information is more reliable and efficient than crawling HTML pages. In the end, a table containing each application and its latest version number is obtained.

[0061] Step S165: determine the vulnerability of each network node according to the node application information table and the latest application version table to obtain a node vulnerability information table;

[0062] Specifically, please refer to the sub-steps of step S165 for the detailed implementation process of this embodiment.

[0063] Step S166: Associating the vulnerability data in the node vulnerability information table with the corresponding entity nodes in the entity node relationship network to obtain a network entity relationship graph.

[0064] Specifically, the vulnerability data in the node vulnerability information table can be associated with the corresponding entity nodes in the entity node relationship network to obtain a comprehensive network entity relationship map. This map will show the nodes in the network, the connection relationships between them, and the vulnerability information existing on each node. Use a graph database such as Neo4j, which allows the storage of nodes, edges, and attributes associated with them. First, import the node vulnerability information table into the Neo4j database. This can be achieved by using Neo4j's CSV import tool or writing a custom script. For example, use Python's neo4j library to connect to the Neo4j database and execute Cypher query language commands to create nodes and relationships. The following is a specific embodiment:

[0065] 1. Use Python's neo4j library to connect to the Neo4j database.

[0066] 2. For each record in the node vulnerability information table, perform the following operations:

[0067] a. Check if the corresponding entity node already exists in the database (based on the node ID).

[0068] b. If the node exists, add the vulnerability data as attributes to the node.

[0069] c. If the node does not exist, create a new node and add the vulnerability data as attributes.

[0070] 3. Based on the existing node-to-node relationships (edges) in the entity node relationship network, associate the vulnerability data with these relationships. This can be achieved by adding vulnerability information to the attributes of the edges.

[0071] 4. For each node, create a relationship of type "HAS_VULNERABILITY" to connect the node with its vulnerability data. For example, the Cypher query looks like this:

[0072] MATCH(n:Node{id:'node_id'})

[0073] MATCH(v:Vulnerability{id:'vulnerability_id'})

[0074] MERGE(n)-[:HAS_VULNERABILITY]->(v);

[0075] This query will match nodes and vulnerabilities and then create a "HAS_VULNERABILITY" relationship between them.

[0076] 5. Repeat the above steps until all records in the node vulnerability information table have been processed.

[0077] Through this process, a complete network entity relationship map will be obtained; it includes nodes, connection relationships between nodes, and vulnerability information related to each node.

[0078] The present invention ensures data consistency and avoids interference of duplicate data on analysis results by aggregating and deduplicating node application information tables, thereby improving data quality and reliability. By collecting the latest version information and vulnerability data of the application, the vulnerability status of each node in the network can be timely understood, which is crucial for quickly responding to security threats and formulating repair strategies. By understanding the application version and vulnerability information of each network node, security resources can be reasonably allocated, and those nodes facing higher risks can be given priority, thereby more effectively utilizing limited security maintenance resources. By associating vulnerability data with physical nodes, network risk assessment not only stays at the network structure level, but also goes deep into the specific service and application level, which provides a more detailed perspective for network risk assessment. By integrating application information and vulnerability data, network managers can deploy security protection measures more specifically. For example, for nodes running old versions of applications known to have vulnerabilities, monitoring and protection can be strengthened.

[0079] Preferably, step S165 includes the following steps:

[0080] Traverse the node application information table and compare the currently used version number of each application with the corresponding latest version number in the latest application version table one by one;

[0081] If the currently used version number is inconsistent with the latest version number, the corresponding application is marked as a non-latest version; if the currently used version number is consistent with the latest version number, the corresponding application is marked as the latest version;

[0082] When the traversal is completed, the non-latest version list and the latest version list are obtained;

[0083] According to the application official website address set, known vulnerabilities of the currently used version of the application in the non-latest version list are collected to obtain a first vulnerability information set; wherein the first vulnerability information set includes a plurality of vulnerability entries, and the vulnerability entries at least include a vulnerability number, a vulnerability repair status, and an attack vector, and the attack vector is not limited to remote attack, local attack, service attack, client attack, injection attack, cross-site scripting attack, cross-site request forgery, operating system attack, password attack, wireless attack, and supply chain attack;

[0084] Performing a latest version security authentication check on the application in the latest version list to obtain a second security status set; wherein the second security status set includes a plurality of security entries, each security entry corresponding to an application;

[0085] The first vulnerability information set and the second security status set are aggregated to obtain a node vulnerability information table.

[0086] The present invention can accurately identify outdated applications by comparing the application version running on the node with the official latest version, so as to carry out vulnerability detection and repair in a targeted manner, which greatly improves the accuracy and efficiency of vulnerability detection. For applications that are not the latest version, known vulnerability information of the currently used version is collected, which helps to prevent and respond to potential security threats in advance, thereby strengthening the overall network security protection. By distinguishing between the latest version and the non-latest version of applications, resources can be allocated and repair priorities can be set more targeted, and applications that use outdated versions and contain known vulnerabilities can be given priority. The workload of manual operations is reduced through automated version comparison and vulnerability information collection, and network security threats can be responded to more quickly, thereby improving the efficiency of responding to threats. A comprehensive node vulnerability information table is generated by summarizing the vulnerability information of non-latest versions of applications and the security authentication inspection results of the latest version of applications. By integrating application version information and vulnerability data, a more detailed perspective is provided for network risk assessment, thereby improving the risk perception ability of the network, so that potential risk points can be discovered and processed in a timely manner.

[0087] In this embodiment, the node application information table is traversed and compared with the application latest version table: first, a database management system (such as MySQL) is used to store the node application information table and the application latest version table. Then, an SQL query is written to connect the two tables and compare the current version number of each application with the latest version number. For example, the SQL query is as follows:

[0088] SELECT A.app_name,A.version AS current_version,B.version AS latest_version

[0089] FROM node_app_table A

[0090] JOIN app_latest_version_table B ON A.app_name=B.app_name;

[0091] This query will return a result set; it contains the name, current version, and latest version of each application. Then use a scripting language (such as Python) to iterate over this result set and compare the version numbers. If the current version is not equal to the latest version, mark the application as a non-latest version; if they are equal, mark it as the latest version. In the Python script, create two lists based on the version comparison results: a non-latest version list and a latest version list. For example, if the current version of the application "ExampleApp" is 1.2 and the latest version is 1.5, then "ExampleApp" will be added to the non-latest version list. For each application in the non-latest version list, use the API of a vulnerability database (such as the National Vulnerability Database, NVD) to collect known vulnerability information of the currently used version. Write a Python script that uses the requests library to call the NVD API, passing in the application name and version number as parameters, and then parses the vulnerability data returned in JSON format. Collect the number, fix status, and attack vector of each vulnerability, and store this information in a database table called the first vulnerability information set. For applications in the latest version list, use the API provided by the application's official website or an online service (such as the VirusTotal API) to check the security of the latest version. Write a Python script that uses the requests library to call the APIs of these services, passing in the application name and the latest version number as parameters, and then collects the returned security status information. Store this information in a database table called the second security status set. Finally, merge the first vulnerability information set and the second security status set into a final node vulnerability information table. Use Python scripts and the pandas library to handle the merging of the two data sets, ensuring that the vulnerability information and security status of each application are correctly associated.

[0092] Preferably, the performing of the latest version security authentication check on the application in the latest version list specifically comprises the following steps:

[0093] Obtain the binary file of the application in the latest version list based on the device in the target network to obtain the binary file of the application;

[0094] Extract the digital signature of the application binary file to obtain the digital signature; the digital signature includes the publisher information, the signature hash value and the signature certificate;

[0095] Collect official release information of the application corresponding to the application binary file according to the application official website address set to obtain the official release information of the application. If the issuer information is consistent with the official release information of the application, mark the corresponding application as issuer verification passed; otherwise, mark the corresponding application as issuer inconsistent.

[0096] The issuer verification status is that the issuer verification is passed or the issuer is inconsistent;

[0097] Perform hash calculation on the application binary file to obtain the application hash value. If the application hash value is consistent with the signature hash value, the corresponding application is marked as not tampered with. Otherwise, the corresponding application is marked as tampered with or forged.

[0098] The document integrity status is that the document has not been tampered with or that the document has been tampered with or forged;

[0099] Extract the certificate validity range of the signature certificate to obtain the certificate validity range, obtain the current system time, and if the current system time is within the certificate validity range, mark the corresponding application as having passed the signature validity period, otherwise, mark the corresponding application as having expired the signature validity period;

[0100] The signature validity period passed or the signature validity period expired is used as the signature validity period status;

[0101] The application ID, publisher verification status, file integrity status and signature validity status are taken as a security entry. When each application in the latest version list executes the above steps, several security entries are obtained, and the several security entries are recorded as the second security status set.

[0102] The present invention effectively prevents the disguise and attack of malicious software and protects users from fraud and phishing threats by comparing the issuer information and the official release information. Hash calculation and digital signature verification ensure that the application has not been tampered with or forged since its release, maintains system security, and prevents malicious code injection and data leakage. By checking the validity period of the signature certificate, the timeliness of the application signature is ensured, and security vulnerabilities caused by expired certificates are reduced. In addition, summarizing the security status of all applications provides network managers with a comprehensive security view. Ultimately, these comprehensive measures enhance users' trust in the network environment, promote digital transformation and the adoption of new technologies, and lay a solid foundation for the long-term stability and secure operation of the network. In summary, the present invention significantly enhances the authenticity of the source of applications in the network, ensures the integrity and timeliness of the applications, and thus improves the system's anti-tampering ability and overall security.

[0103] In this embodiment, first, it is necessary to obtain the binary files of the applications in the latest version list from the device in the target network. This can be achieved by writing a script that uses a network protocol (such as FTP or HTTP) to download the binary file from the device. For example, if the application is stored on an HTTP server, use Python's requests library to send a GET request and save the response content. The script will traverse each application in the latest version list, build the corresponding URL, and download the binary file to local storage. Once the binary file of the application is available, the next step is to extract its digital signature. This is done using software tools with digital signature verification capabilities, such as Microsoft's SignTool (for Windows applications) or using open source libraries such as python-signature to parse the PE (Portable Executable) file format. These tools can extract publisher information, signature hash values, and signing certificates. Use Python's requests library to obtain official distribution information from the official website address of the application. You can access the official website or API, retrieve the publisher information of the application, and compare it with the publisher information extracted from the binary file. If the two are consistent, the application is marked as publisher verification passed; if they are inconsistent, it is marked as publisher inconsistent. Use a hash calculation tool (such as openssl or Python's hashlib library) to hash the downloaded binary file and compare it with the signed hash value in the digital signature. If the hash values ​​match, mark the application as the file has not been tampered with; if not, mark it as the file has been tampered with or forged. Use a certificate processing tool (such as openssl) to extract the validity range of the signing certificate and compare it with the current system time. If the current time is within the certificate validity period, mark the application as the signature validity period passed; if not, mark it as the signature validity period expired. Finally, summarize the application ID, issuer verification status, file integrity status, and signature validity period status into a security entry. Use Python scripts and the pandas library to organize this data and store it in a structured format, such as a CSV file or a database table. This security entry will be added to the second security status set, which contains the security status of each application in the latest version list.

[0104] Preferably, step S2 comprises the following steps:

[0105] Step S21: Monitor the target network traffic in real time to obtain a real-time network traffic data set;

[0106] Specifically, you can use network traffic monitoring tools such as Wireshark or SolarWinds NetworkPerformance Monitor. For example, using Wireshark, set up capture sessions on multiple key points in the network, such as routers, switches, or servers. By installing Wireshark's capture daemon tshark on these devices, you can capture passing data packets in real time. The captured traffic will include information such as source and destination IP addresses, port numbers, protocol types, and the amount of data transferred. This information will be recorded in real time and stored in a local or remote database to form a real-time network traffic data set. To ensure the integrity and accuracy of the data, you need to configure Wireshark to rotate log files regularly and set appropriate capture filters to avoid storing irrelevant data.

[0107] Step S22: Track the configuration changes of the target network to obtain a configuration change data set;

[0108] Specifically, this can be achieved using network configuration management and auditing tools such as Ansible, Puppet, or Chef, as well as professional network configuration auditing tools such as SolarWinds Network Configuration Manager. For example, using SolarWinds Network Configuration Manager, configuration information is automatically collected from network devices such as routers, switches, and firewalls on a regular basis. This tool can monitor configuration change events and record the configuration differences before and after the change. The configuration change data set will include the device name, the timestamp of the configuration change, the type of change (such as addition, deletion, or modification), the configuration content before and after the change, and the operator information who performed the change.

[0109] Step S23: performing data transmission path statistics on the real-time network traffic data set to obtain a real-time communication path set; wherein the real-time communication path set includes a plurality of real-time communication paths;

[0110] Specifically, this can be achieved using network traffic analysis tools such as Wireshark or SolarWinds NetFlowTraffic Analyzer. Taking Wireshark as an example, capture sessions can be set up at multiple key points in the network to monitor traffic in real time. The captured data will include information such as the source IP, destination IP, port number, and transport protocol of each data packet. Use Wireshark's filtering and statistics functions to analyze this data to identify active communication paths. For example, use Wireshark's "IO Graph" function to visualize traffic patterns and identify the paths with the largest traffic. You can also use Wireshark's "Follow TCP / UDP Stream" function to view data exchanges on specific communication paths. Through these analyses, real-time communication paths can be counted and recorded in a real-time communication path set.

[0111] Step S24: Obtain a target network communication path set;

[0112] Specifically, the target network communication path set obtained in step S13 may be obtained by consulting a database.

[0113] Step S25: Compare the real-time communication path set with the target network communication path set. If the paths in the real-time communication path set and the target network communication path set are the same, there is no need to update the communication path of the network entity relationship graph. Otherwise, obtain the paths that do not exist in the target network communication path set but exist in the real-time communication path set from the real-time communication path set as update path objects, and record them as the communication path update set.

[0114] Specifically, the real-time communication path set and the target network communication path set can be imported into the data processing software, for example, using Python and the Pandas library to operate the two data sets. First, read the real-time communication path set and the target network communication path set stored in CSV files, which contain the communication path information between devices in the network. In the Python environment, use the Pandas library to load the two CSV files into two DataFrame objects, namely df_realtime and df_target. Next, compare the path data in the two DataFrame objects using the functions provided by the Pandas library. Check whether each path in df_realtime already exists in df_target. This process involves checking whether the paths in the real-time communication path set have records in the target network communication path set. If not, these are considered to be new communication paths. Use the isin function of the Pandas library to determine whether the paths in df_realtime are already included in df_target. Through logical negation operations, filter out those paths that are not in df_target, which constitute the communication path update set and are stored in the new DataFrame object new_paths. If new_paths is not empty, it means that new communication paths are found. These paths need to be used as update path objects and recorded as a communication path update set.

[0115] Step S26: Perform device access detection on the configuration change data set. If no new device is connected, there is no need to update the entity node of the network entity relationship graph. If a new device is connected, extract the new device information from the configuration change data set to obtain a new device information set.

[0116] Specifically, you can use network configuration management tools, such as Ansible, which can monitor and track configuration changes of network devices. First, configure Ansible to scan network devices regularly and record any configuration changes. When Ansible detects a configuration change, set up a callback mechanism to trigger a custom script. This script will run automatically and start analyzing the configuration change data set to determine if there are any new devices connected to the network. This script checks the identification information of the new device, such as IP address, MAC address, and device type. Once the script identifies the newly connected devices, it collects the detailed information of these devices and stores them in an intermediate JSON file or directly in the database to form a new device information set.

[0117] Step S27: constructing entity nodes for the new device according to the new device information set to obtain a new entity node set;

[0118] Specifically, the new device information set can be analyzed to obtain detailed information about each new device, including their IP address, MAC address, and device type. Then, a graph database, such as Neo4j, is used to create new entity nodes. In this process, the database query language, such as Cypher, is used to check whether the corresponding device node already exists in the database. If a node for a new device does not exist, a new node is created and the corresponding properties, such as IP address, MAC address, and device type, are set for it.

[0119] Step S28: performing node configuration update, communication path update and entity node update on the network entity relationship graph according to the configuration change data set, the communication path update set and the new entity node set to obtain an updated network entity relationship graph.

[0120] Specifically, the configuration change data set can be analyzed to obtain the change information of the device configuration in the network. Then, the query language of the graph database is used to update the configuration information of the corresponding node in the graph. Next, the communication path update set is analyzed to obtain the newly added communication path information, and these paths are added or updated in the graph. Finally, according to the new entity node set created in step S27, these new nodes are added to the graph. In this way, an updated network entity relationship graph is obtained, which reflects the latest status in the network, including new devices, updated configurations, and communication paths.

[0121] The present invention can timely understand the current status of the network, including the data transmission path and the communication traffic pattern, through real-time traffic monitoring, so as to quickly respond to network anomalies or attacks. The network change management process is automated through configuration change tracking and device access detection, reducing the need for manual tracking and improving the efficiency and accuracy of network management. Through data transmission path statistics, traffic-intensive communication paths can be identified and optimized, so as to more effectively allocate network resources and improve network performance. By updating the network entity relationship map in real time, the network can quickly adapt to new device access and configuration changes, enhancing the network's adaptability to changes. By timely updating the network entity relationship map, potential security threats can be discovered and responded to in a timely manner, improving the overall security of the network.

[0122] Preferably, step S3 comprises the following steps:

[0123] Step S31: extracting node and path information from the updated network entity relationship graph to obtain a network node information set and a communication path information set; wherein the network node information set includes a number of network node information, the network node information at least includes node ID, device type, node function description, network node logical address, network node MAC address and device configuration, and the communication path information set includes a number of communication paths, the communication path at least includes communication path ID, source node, destination node, data flow direction and path communication status;

[0124] Specifically, a graph database query language, such as Cypher, can be used to extract node and path information. First, write a query to traverse all nodes in the graph and collect detailed information for each node, including node ID, device type, node function description, logical address, MAC address, and device configuration. This information is recorded in the network node information set. Next, execute another query to collect the communication paths between all nodes, including communication path ID, source node, destination node, data flow direction, and path communication status. This information is recorded in the communication path information set. In this way, detailed information on all nodes and paths in the network can be obtained.

[0125] Step S32: collecting historical vulnerability information of entity nodes in the updated network entity relationship graph to obtain a historical vulnerability information set; wherein the historical vulnerability information set includes a number of historical vulnerability information, and the historical vulnerability information at least includes a node ID, a vulnerability ID, a vulnerability level, a vulnerability description, a vulnerability discovery time, and a vulnerability repair status;

[0126] Specifically, vulnerability databases, such as the National Vulnerability Database (NVD), and graph database query languages, such as Cypher, can be used to perform this task. First, traverse all nodes in the graph, and for each node, query the vulnerability database to collect all known vulnerability information related to the node. This information includes node ID, vulnerability ID, vulnerability level, vulnerability description, vulnerability discovery time, and vulnerability repair status. Then, this information is recorded in a historical vulnerability information set. In order to ensure the accuracy and completeness of the information, automated tools, such as vulnerability scanners, are needed to assist in collecting vulnerability data. These tools can regularly scan devices in the network and compare the scan results with the vulnerability database to identify existing vulnerabilities. In this way, historical vulnerability information for each node in the network can be obtained.

[0127] Step S33: using a preset attack vector library to associate attack vectors with the network node information set to obtain an attack vector information set; wherein the attack vector information set includes a number of attack vector information, and the attack vector information includes an attack vector ID, an attack name, an attack impact degree, an affected node type, and a related vulnerability type;

[0128] Specifically, you can create or use an existing attack vector library that contains detailed information about various attack methods, such as SQL injection, cross-site scripting attacks, etc. Each attack vector has attributes such as a unique ID, name, impact, affected node type, and related vulnerability types. Use data analysis tools, such as Python with the Pandas library, to process the network node information set and the attack vector library. By writing a script, traverse each node in the network node information set and then match it with the entries in the attack vector library to determine which attack vectors will affect the node. For example, if a node runs web server software with a known vulnerability, this vulnerability will be associated with the related attack vectors in the attack vector library (such as cross-site scripting attacks). For each match, record the attack vector ID, attack name, attack impact, affected node type, and related vulnerability type to form an attack vector information set. This collection provides a detailed view of the types of attacks that each node in the network will face.

[0129] Step S34: performing attack vector matching on the attack vector information set according to the device configuration in the network node information set to obtain a node-related attack vector set; wherein the node-related attack vector set includes a plurality of node-related attack vectors, and the node-related attack vector includes a node ID and a related attack vector ID;

[0130] Specifically, the device configuration of each node in the network node information set can be analyzed, including information such as the operating system, open ports, and running services. Use a data analysis tool similar to step S33 to write a script that compares the configuration of each node with the attack vector in the attack vector information set to determine which attack vectors match the configuration of the node. For example, if a node runs an improperly configured database service, this service is matched with the relevant attack vector (such as SQL injection) in the attack vector library. For each matching attack vector, record the node ID and the relevant attack vector ID to form a node-related attack vector set. This set provides a list of specific attack types that each node in the network may potentially suffer, which is very useful for identifying high-risk nodes in the network and formulating targeted security measures. In this way, the potential attack threats faced by each node in the network can be accurately identified and recorded.

[0131] Step S35: Determine the importance of the network node according to the function description in the network node information set to obtain a node importance level set; wherein the node importance level set includes a plurality of node importance levels;

[0132] Specifically, a set of standards or rules can be defined to evaluate the importance of nodes, which are based on factors such as the business criticality of the nodes, the impact on network operations, and the sensitivity of data. Use a configuration management database (CMDB) or similar tools to store and analyze the functional description information of network nodes. By writing an automated script, such as using Python, iterate each node record in the network node information set, evaluate the functional description of each node according to predefined standards, and assign an importance level. For example, a server that carries critical business applications will be assigned a "high" importance level, while an ordinary workstation used for daily office work will be assigned a "low" importance level. After the evaluation is completed, the ID of each node and the corresponding importance level are recorded in the node importance level set.

[0133] Step S36: Use the CVSS scoring system to score the historical vulnerability information set to obtain a vulnerability risk score set; wherein the vulnerability risk score set includes the vulnerability ID, CVSS score and vulnerability risk level of each historical vulnerability;

[0134] Specifically, the Common Vulnerability Scoring System (CVSS) can be used to score each vulnerability in the historical vulnerability information set and obtain a vulnerability risk score set. CVSS is a method for providing a quantitative score for vulnerability severity that takes into account multiple aspects of the vulnerability, such as attack vectors, attack complexity, required permissions, etc. Use a vulnerability management tool, such as Nexpose or Qualys, which has built-in CVSS scoring capabilities and can automatically calculate CVSS scores for known vulnerabilities. First, import the historical vulnerability information set into the vulnerability management tool, and then the tool will calculate a CVSS score for each vulnerability. This score is a value from 0 to 10 that reflects the severity of the vulnerability. For each vulnerability, record the vulnerability ID, the calculated CVSS score, and the corresponding risk level (such as low, medium, and high). This information is organized into a vulnerability risk score set. For example, a vulnerability with a CVSS score of 7.5 will be rated as high risk. This score set provides the risk level of each known vulnerability in the network.

[0135] Step S37: Calculate the security risk score for each network node according to the node-related attack vector set, the node importance level set and the vulnerability risk score set to obtain a node risk score set; wherein the node risk score set includes a plurality of node risk scores;

[0136] Specifically, a security risk score can be calculated for each network node by comprehensively considering the set of node-related attack vectors, the set of node importance levels, and the set of vulnerability risk scores. This score will reflect the severity of the potential security threats faced by each node. First, use data analysis tools such as Python with the Pandas library to process these three data sets. Write a script that iterates over each network node and performs the following operations for each node:

[0137] 1. Obtain all attack vectors related to the node from the node-related attack vector set and evaluate the potential impact of these attack vectors.

[0138] 2. Obtain the importance level of the node from the node importance level set to determine its criticality in the network.

[0139] 3. Obtain the CVSS scores of all known vulnerabilities of the node from the vulnerability risk score set and calculate the average risk level of these vulnerabilities.

[0140] Combined with this information, a weighted scoring model is applied to calculate the security risk score of each node. This model gives higher weights to nodes of higher importance, because security incidents at critical nodes can lead to greater business impact. At the same time, the CVSS score of the vulnerability and the associated attack vector are also considered. Finally, the risk score of each node is recorded in the node risk score set, which contains detailed risk assessment information for all nodes in the network.

[0141] Step S38: Record the corresponding network nodes whose node risk scores are higher than the preset risk threshold as risk propagation source nodes, thereby obtaining a risk propagation source node set.

[0142] Specifically, network nodes with risk scores higher than a preset threshold can be identified and marked as risk propagation source nodes. These nodes are considered to be potential security risk points in the network, which will become targets of attackers or the starting point for the propagation of security threats. First, a threshold for the risk score is determined, which is set based on historical data, industry standards, or security policies. Then, using the node risk score set generated in the previous step, an automated script is written to compare the risk score of each node with this threshold. The script will iterate each record in the node risk score set to check whether the risk score exceeds the set threshold. For nodes that exceed the threshold, the script will mark them as risk propagation source nodes and record them in the risk propagation source node set. For example, if the set risk threshold is 8 points (out of 10 points), then any node with a risk score equal to or higher than 8 points will be considered to have high risk and will be added to the risk propagation source node set.

[0143] The present invention significantly enhances the ability to identify network risks by deeply analyzing the updated network entity relationship graph, and can identify and prioritize the protection of potential risk propagation source nodes in the network. By utilizing historical vulnerability data and attack vector libraries, a quantitative security risk score is provided for each network node, thereby improving the accuracy of risk assessment. In addition, by evaluating the importance and vulnerability risks of nodes, the allocation and priority setting of security resources are optimized to ensure that key nodes receive appropriate attention. The network's adaptability and flexibility to new threats and changes are enhanced through real-time updated network entity relationship graphs, while network security protection is strengthened, and potential security threats can be discovered and responded to in a timely manner. Finally, the summarized application and vulnerability information provides data support for the continuous improvement of the network.

[0144] Preferably, step S4 comprises the following steps:

[0145] Step S41: labeling the risk propagation source nodes of the updated network entity relationship graph according to the risk propagation source node set to obtain a labeled network entity relationship graph;

[0146] Specifically, the nodes in the risk propagation source node set can be queried through the query language of the graph database, such as Cypher. For each queried node, find the corresponding node in the updated network entity relationship graph and add a specific label or attribute to it, such as "risk propagation source", as well as the relevant risk score and reason. In this way, these high-risk nodes can be easily identified when viewing or analyzing in the graph. After completing these steps, a network entity relationship graph with risk propagation source nodes labeled is obtained.

[0147] Step S42: Based on the annotated network entity relationship graph, the IDs of all communication nodes that can transmit data through the communication path for each risk propagation source node are counted, and the logical distance between the communication node and the risk propagation source node is recorded to obtain a potential risk node statistical table; wherein the potential risk node statistical table contains a number of statistical entries, each of which includes the risk propagation source node ID, the potential risk node ID and the logical distance between nodes, and the logical distance between nodes is the number of hops between the risk propagation source node and the potential risk node;

[0148] Specifically, a query can be written to traverse each risk propagation source node, and then find all nodes that can communicate with it directly or indirectly along the communication path in the graph. For each communication node found, record its ID and calculate the logical distance between it and the risk propagation source node, that is, the number of hops between them. This number of hops can be determined by querying the edges in the graph, each edge represents a hop. All this information is organized into a potential risk node statistics table; each entry contains the risk propagation source node ID, the potential risk node ID, and the logical distance between them.

[0149] Step S43: determining the number of risk propagation source node connections for each potential risk node based on the potential risk node statistics table to obtain a risk propagation source node connection quantity set; wherein the risk propagation source node connection quantity set includes a number of risk propagation source node connection quantities;

[0150] Specifically, data analysis tools, such as Python with the Pandas library, can be used to process the potential risk node statistics table. Write a script that will read the statistics table and create a list for each risk propagation source node; it contains all the potential risk nodes directly connected to it. Then, the script calculates the length of each risk propagation source node list, which represents the number of potential risk nodes directly connected to the risk propagation source node. This connection quantity information is recorded in the risk propagation source node connection quantity set. For example, if risk propagation source node A is directly connected to nodes 1, 2, and 3, then the connection quantity of node A is 3. This connection quantity set will be used to assess the potential scope and intensity of risk propagation in the network.

[0151] Step S44: traverse the potential risk node statistical table, calculate the risk propagation influence of each potential risk node according to the risk propagation source node ID, the potential risk node ID, the logical distance between nodes and the risk propagation source node connection amount, and obtain a node risk propagation influence set; wherein the node risk propagation influence set includes several node risk propagation influences;

[0152] Specifically, the risk propagation influence of each potential risk node can be calculated based on the logical distance between the potential risk node and the risk propagation source node and the connection volume of the risk propagation source node. Use Python with the Pandas library to process this data and write a script to perform the following steps:

[0153] 1. Load the potential risk node statistics table and the risk propagation source node connection quantity set into Pandas DataFrame.

[0154] 2. For each record in the potential risk node statistics table, a formula is used to combine the logical distance and the number of connections to the risk propagation source node to calculate the risk propagation impact. This formula is as follows: In this formula, logical distance is used as an attenuation factor, and the influence of risk propagation decreases as the distance increases. The number of connections of a risk propagation source node reflects the potential influence of a node as a risk source. The more connections, the higher its influence.

[0155] 3. Apply this formula to calculate the risk propagation impact of each potential risk node and record it in the node risk propagation impact set.

[0156] 4. For example, suppose the number of connections of the risk propagation source node A is 5, and the logical distance between a potential risk node B and node A is 2 hops. According to the above formula, the risk propagation influence of node B is calculated as follows:

[0157] 5. Store the risk propagation influence of node B in the node risk propagation influence set.

[0158] 6. After completing the risk propagation impact calculation of all potential risk nodes, a detailed node risk propagation impact set is obtained, which contains the risk propagation impact score of each potential risk node in the network.

[0159] Step S45: performing statistics on the total number of communication nodes of the target network based on the updated network entity relationship graph to obtain the total number of communication nodes of the target network;

[0160] Specifically, you can use a graph database query language, such as Cypher, to query and update the network entity relationship graph. Write a query to count all the nodes in the graph, which represent devices in the network, such as servers, routers, switches, terminals, etc. Execute a simple Cypher query, such as MATCH(n)RETURN count(n), to get the total number of all nodes in the network. This query will return a number representing the number of all nodes in the network. Then, record this number as the total number of communication nodes in the target network.

[0161] Step S46: performing statistics on the total amount of potential risk nodes in the potential risk node statistics table to obtain the total amount of potential risk nodes, and determining the total amount of risk propagation source nodes in the risk propagation source node set to obtain the total amount of risk propagation source nodes;

[0162] Specifically, data analysis tools, such as Python with the Pandas library, can be used to process the potential risk node statistics table and the risk propagation source node set. For the potential risk node statistics table, write a script that will read the statistics table and count the number of entries in the table. This number represents the total number of all potential risk nodes in the network. Then, perform similar operations on the risk propagation source node set to calculate the number of risk propagation source nodes in the set. For example, if the potential risk node statistics table contains 300 records, record them as the total number of potential risk nodes. At the same time, if the risk propagation source node set contains 50 nodes, record them as the total number of risk propagation source nodes.

[0163] Step S47: Add the total number of potential risk nodes and the total number of risk propagation source nodes to obtain the total number of risk propagation nodes, and divide the total number of risk propagation nodes by the total number of target network communication nodes to obtain the risk propagation ratio;

[0164] Specifically, a spreadsheet software such as Microsoft Excel, or a data analysis tool such as Python with the Pandas library can be used to process the total number of potential risk nodes, the total number of risk propagation source nodes, and the total number of target network communication nodes. First, add the total number of potential risk nodes and the total number of risk propagation source nodes in Excel or Python to obtain the total number of risk propagation nodes. Then, divide this total number by the total number of network communication nodes obtained in the previous step to obtain the risk propagation ratio. For example, if the total number of potential risk nodes is 300, the total number of risk propagation source nodes is 50, and the total number of network communication nodes is 1000, then the risk propagation ratio will be (300+50) / 1000=0.35 or 35%.

[0165] Step S48: traverse the node risk propagation influence degree set, multiply each node risk propagation influence degree by the risk propagation ratio, and obtain a node risk propagation weight set; wherein the node risk propagation weight set includes a number of node risk propagation weights, and classify the potential risk nodes according to the node risk propagation weights and the preset risk level classification standard, and obtain a node risk level data set;

[0166] Specifically, the node risk propagation influence set can be loaded into a Pandas DataFrame. Then, iterate each record in the DataFrame, multiply the risk propagation influence of each node by the risk propagation ratio, and obtain the risk propagation weight of each node. For example, if the risk propagation influence of a node is 0.56 and the risk propagation ratio is 0.35, then the risk propagation weight of the node will be 0.56×0.35=0.196. Next, according to the preset risk level classification standard, the calculated risk propagation weight is mapped to different risk levels. For example, weights greater than 0.2 can be set as high risk, 0.1 to 0.2 as medium risk, and less than 0.1 as low risk. Finally, the risk propagation weight and corresponding risk level of each node are recorded in the node risk level dataset. This dataset provides the risk level of each node in the network.

[0167] Step S49: Based on the annotated network entity relationship graph, a risk propagation simulation is performed on the target network according to the node risk level data set to obtain a network risk propagation path set, a risk path reachability analysis is performed on the network risk propagation path set to obtain a high-risk path node set, a risk propagation intensity assessment is performed on the high-risk path node set to obtain a node risk intensity assessment result, and a multi-level risk accumulation analysis is performed on the node risk intensity assessment result to obtain a network global risk assessment result; wherein the network global risk assessment result is any one of low risk, medium-low risk, medium-high risk, high risk or extremely high risk.

[0168] Specifically, the GraphX ​​graph processing framework can be used in combination with the node risk level dataset to simulate the risk propagation of the network entity relationship graph. First, the node risk level dataset is imported into GraphX, and the risk level is marked for each node. Then, the risk propagation rules are defined. For example, when the risk propagates from a high-risk node to a low-risk node, the risk level is adjusted according to the connection relationship and communication protocol type between the nodes. Through simulation, a network risk propagation path set can be generated; it contains all potential propagation paths from the risk propagation source node to the potentially affected node. The NetworkX library is used to perform reachability analysis on the network risk propagation path set. The specific operation includes using the NetworkX shortest path algorithm (such as the Dijkstra algorithm) to determine the reachability of each risk propagation path. The nodes on each path are analyzed to determine which nodes are critical on the risk propagation path, that is, they are the nodes that must be passed through for risk propagation. These node sets are called high-risk path node sets. The Monte Carlo simulation method is used to evaluate the risk propagation intensity of the high-risk path node set. The risk propagation intensity of each node is evaluated by simulating the degree of impact on each high-risk node when different risk source nodes launch attacks. For example, for each high-risk node, 1,000 attack scenarios are simulated, the impact on the node in each attack is recorded, and then the average impact value is calculated as the risk intensity assessment result of the node. The analytic hierarchy process (AHP) is used to perform a multi-level risk accumulation analysis on the node risk intensity assessment results. First, the hierarchy of network risk assessment is defined, including the target layer (network global risk assessment results), the criterion layer (such as node risk intensity, node importance, network topology, etc.) and the scheme layer (risk assessment results of each node). Then, a pairwise comparison matrix is ​​constructed, and the weights of each layer are calculated after consistency verification. Finally, the risk assessment results of each node and the hierarchical weights are combined to perform a risk accumulation analysis to obtain the global risk assessment results of the network, such as low risk, medium-low risk, medium-high risk, high risk or extremely high risk. This process can be assisted by professional decision support software, such as Expert Choice.

[0169] The present invention significantly improves the accuracy of identifying network risks by accurately marking and analyzing risk propagation source nodes. At the same time, the generated labeled network entity relationship graph and statistical table intuitively display the network risk, and can quickly grasp the risk distribution and propagation path. In addition, by calculating the risk propagation impact and risk level, the present invention optimizes resource allocation, ensures that high-risk nodes are given priority, and effectively utilizes limited security resources. The network's adaptability and response speed to new threats are improved through real-time updated graphs and evaluation results. Global risk assessment can provide a comprehensive understanding of the network's security status, and detailed evaluation results support the formulation of risk mitigation strategies, so that effective prevention and response measures can be taken according to the severity and scope of the risk.

[0170] Preferably, the present invention further provides a graph-based network risk processing system for executing the graph-based network risk processing method as described above, the graph-based network risk processing system comprising:

[0171] A graph construction module is used to construct a network entity model of the target network to obtain a target network entity model; based on the target network entity model, a network entity graph model is constructed for the target network to obtain a network entity relationship graph;

[0172] A graph updating module, used for dynamically updating the network entity relationship graph to obtain an updated network entity relationship graph;

[0173] The transmission source node identification module is used to determine the risk transmission source nodes of the updated network entity relationship graph and obtain the risk transmission source node set;

[0174] The global risk assessment module is used to perform a global risk assessment on the target network based on the risk propagation source node set based on the updated network entity relationship graph to obtain the network global risk assessment result.

[0175] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0176] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A network risk management method based on graph, characterized in that: The following steps are involved: Step S1: constructing a network entity model for the target network to obtain a target network entity model; modeling a network entity graph for the target network based on the target network entity model to obtain a network entity relationship graph; Step S2: dynamically updating the network entity relationship graph to obtain an updated network entity relationship graph; Step S3: determining the risk propagation source nodes of the updated network entity relationship graph to obtain a risk propagation source node set; Step S4: Based on the updated network entity relationship graph, a global risk assessment is performed on the target network according to the risk propagation source node set to obtain a global risk assessment result of the network.

2. The graph-based network risk management method according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: collecting network node information of the target network to obtain a network node basic data set; wherein the network node basic data set includes a number of network node basic data, and the network node basic data at least includes a network node ID, a network node MAC address, and a network node logical address; Step S12: Collect historical network traffic of the target network to obtain a historical network traffic data set; Step S13: performing communication path statistics on the historical network traffic data set to obtain a target network communication path set; wherein the target network communication path set includes a plurality of target network communication paths; Step S14: construct entity nodes for the network node basic data set to obtain an entity node set; Step S15: mapping the relationship between nodes of the entity node set according to the target network communication path set to obtain an entity node relationship network; Step S16: Associating risk factors with the entity node relationship network to obtain a network entity relationship graph.

3. The graph-based network risk management method according to claim 2, characterized in that: The mapping of the relationship between nodes of the entity node set according to the target network communication path set specifically includes the following steps: Find any two entity nodes in the entity node set that have a communication path according to the target network communication path; Determining the communication directionality between the two entity nodes according to the target network communication path; wherein the communication directionality is unidirectional or bidirectional; Creating an edge between the two entity nodes according to the communication directionality, if one entity node is always a sender of data and the other node is a receiver, creating a directed edge for the two entity nodes, with the direction from the sending node to the receiving node; If the communication directionality is bidirectional, creating a bidirectional edge for the two entity nodes; The entity nodes in the entity node set are connected according to the directed edge or the bidirectional edge, and the communication protocol type and the maximum file transfer flow are marked on the directed edge or the bidirectional edge, so as to obtain an entity node relationship network.

4. The graph-based network risk management method according to claim 2, characterized in that: Step S16 includes the following steps: Step S161: collecting application information of network nodes according to the network node basic data set to obtain a number of node application information tables; wherein each node application information table corresponds to a network node; Step S162: Summarize and remove duplicates from all node application information tables to obtain a summary application information table; Step S163: determining the official website address of each application according to the summary application information table to obtain an application official website address set; wherein the application official website address set includes a plurality of application official website addresses; Step S164: collecting the latest version number of each application according to the application official website address set to obtain the latest version table of the application; Step S165: determine the vulnerability of each network node according to the node application information table and the latest application version table to obtain a node vulnerability information table; Step S166: Associating the vulnerability data in the node vulnerability information table with the corresponding entity nodes in the entity node relationship network to obtain a network entity relationship graph.

5. The graph-based network risk processing method according to claim 4 is characterized in that: Step S165 includes the following steps: Traverse the node application information table and compare the currently used version number of each application with the corresponding latest version number in the latest application version table one by one; If the currently used version number is inconsistent with the latest version number, the corresponding application is marked as a non-latest version; if the currently used version number is consistent with the latest version number, the corresponding application is marked as the latest version; When the traversal is completed, the non-latest version list and the latest version list are obtained; According to the application official website address set, known vulnerabilities of the currently used version of the application in the non-latest version list are collected to obtain a first vulnerability information set; wherein the first vulnerability information set includes a plurality of vulnerability entries, and the vulnerability entries at least include a vulnerability number, a vulnerability repair status, and an attack vector, and the attack vector is not limited to remote attack, local attack, service attack, client attack, injection attack, cross-site scripting attack, cross-site request forgery, operating system attack, password attack, wireless attack, and supply chain attack; Performing a latest version security authentication check on the application in the latest version list to obtain a second security status set; wherein the second security status set includes a plurality of security entries, each security entry corresponding to an application; The first vulnerability information set and the second security status set are aggregated to obtain a node vulnerability information table.

6. The graph-based network risk processing method according to claim 5 is characterized in that: The step of performing the latest version security authentication check on the application in the latest version list specifically includes the following steps: Obtain the binary file of the application in the latest version list based on the device in the target network to obtain the binary file of the application; Extract the digital signature of the application binary file to obtain the digital signature; the digital signature includes the publisher information, the signature hash value and the signature certificate; Collect official release information of the application corresponding to the application binary file according to the application official website address set to obtain the official release information of the application. If the issuer information is consistent with the official release information of the application, mark the corresponding application as issuer verification passed; otherwise, mark the corresponding application as issuer inconsistent. The issuer verification status is that the issuer verification is passed or the issuer is inconsistent; Perform hash calculation on the application binary file to obtain the application hash value. If the application hash value is consistent with the signature hash value, the corresponding application is marked as not tampered with. Otherwise, the corresponding application is marked as tampered with or forged. The document integrity status is that the document has not been tampered with or that the document has been tampered with or forged; Extract the certificate validity range of the signature certificate to obtain the certificate validity range, obtain the current system time, and if the current system time is within the certificate validity range, mark the corresponding application as having passed the signature validity period, otherwise, mark the corresponding application as having expired the signature validity period; The signature validity period passed or the signature validity period expired is used as the signature validity period status; The application ID, publisher verification status, file integrity status and signature validity status are taken as a security entry. When each application in the latest version list executes the above steps, several security entries are obtained, and the several security entries are recorded as the second security status set.

7. The graph-based network risk management method according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: Monitor the target network traffic in real time to obtain a real-time network traffic data set; Step S22: Track the configuration changes of the target network to obtain a configuration change data set; Step S23: performing data transmission path statistics on the real-time network traffic data set to obtain a real-time communication path set; wherein the real-time communication path set includes a plurality of real-time communication paths; Step S24: Obtain a target network communication path set; Step S25: Compare the real-time communication path set with the target network communication path set. If the paths in the real-time communication path set and the target network communication path set are the same, there is no need to update the communication path of the network entity relationship graph. Otherwise, obtain the paths that do not exist in the target network communication path set but exist in the real-time communication path set from the real-time communication path set as update path objects, and record them as the communication path update set. Step S26: Perform device access detection on the configuration change data set. If no new device is connected, there is no need to update the entity node of the network entity relationship graph. If a new device is connected, extract the new device information from the configuration change data set to obtain a new device information set. Step S27: constructing entity nodes for the new device according to the new device information set to obtain a new entity node set; Step S28: performing node configuration update, communication path update and entity node update on the network entity relationship graph according to the configuration change data set, the communication path update set and the new entity node set to obtain an updated network entity relationship graph.

8. The graph-based network risk management method according to claim 1, characterized in that: Step S3 includes the following steps: Step S31: extracting node and path information from the updated network entity relationship graph to obtain a network node information set and a communication path information set; wherein the network node information set includes a number of network node information, the network node information at least includes node ID, device type, node function description, network node logical address, network node MAC address and device configuration, and the communication path information set includes a number of communication paths, the communication path at least includes communication path ID, source node, destination node, data flow direction and path communication status; Step S32: collecting historical vulnerability information of entity nodes in the updated network entity relationship graph to obtain a historical vulnerability information set; wherein the historical vulnerability information set includes a number of historical vulnerability information, and the historical vulnerability information at least includes a node ID, a vulnerability ID, a vulnerability level, a vulnerability description, a vulnerability discovery time, and a vulnerability repair status; Step S33: using a preset attack vector library to associate attack vectors with the network node information set to obtain an attack vector information set; wherein the attack vector information set includes a number of attack vector information, and the attack vector information includes an attack vector ID, an attack name, an attack impact degree, an affected node type, and a related vulnerability type; Step S34: performing attack vector matching on the attack vector information set according to the device configuration in the network node information set to obtain a node-related attack vector set; wherein the node-related attack vector set includes a plurality of node-related attack vectors, and the node-related attack vector includes a node ID and a related attack vector ID; Step S35: Determine the importance of the network node according to the function description in the network node information set to obtain a node importance level set; wherein the node importance level set includes a plurality of node importance levels; Step S36: Use the CVSS scoring system to score the historical vulnerability information set to obtain a vulnerability risk score set; wherein the vulnerability risk score set includes the vulnerability ID, CVSS score and vulnerability risk level of each historical vulnerability; Step S37: Calculate the security risk score for each network node according to the node-related attack vector set, the node importance level set and the vulnerability risk score set to obtain a node risk score set; wherein the node risk score set includes a plurality of node risk scores; Step S38: Record the corresponding network nodes whose node risk scores are higher than the preset risk threshold as risk propagation source nodes, thereby obtaining a risk propagation source node set.

9. The graph-based network risk management method according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: labeling the risk propagation source nodes of the updated network entity relationship graph according to the risk propagation source node set to obtain a labeled network entity relationship graph; Step S42: Based on the annotated network entity relationship graph, the IDs of all communication nodes that can transmit data through the communication path for each risk propagation source node are counted, and the logical distance between the communication node and the risk propagation source node is recorded to obtain a potential risk node statistical table; wherein the potential risk node statistical table contains a number of statistical entries, each of which includes the risk propagation source node ID, the potential risk node ID and the logical distance between nodes, and the logical distance between nodes is the number of hops between the risk propagation source node and the potential risk node; Step S43: determining the number of risk propagation source node connections for each potential risk node based on the potential risk node statistics table to obtain a risk propagation source node connection quantity set; wherein the risk propagation source node connection quantity set includes a number of risk propagation source node connection quantities; Step S44: traverse the potential risk node statistical table, calculate the risk propagation influence of each potential risk node according to the risk propagation source node ID, the potential risk node ID, the logical distance between nodes and the risk propagation source node connection amount, and obtain a node risk propagation influence set; wherein the node risk propagation influence set includes several node risk propagation influences; Step S45: performing statistics on the total number of communication nodes of the target network based on the updated network entity relationship graph to obtain the total number of communication nodes of the target network; Step S46: performing statistics on the total amount of potential risk nodes in the potential risk node statistics table to obtain the total amount of potential risk nodes, and determining the total amount of risk propagation source nodes in the risk propagation source node set to obtain the total amount of risk propagation source nodes; Step S47: Add the total number of potential risk nodes and the total number of risk propagation source nodes to obtain the total number of risk propagation nodes, and divide the total number of risk propagation nodes by the total number of target network communication nodes to obtain the risk propagation ratio; Step S48: traverse the node risk propagation influence degree set, multiply each node risk propagation influence degree by the risk propagation ratio, and obtain a node risk propagation weight set; wherein the node risk propagation weight set includes a number of node risk propagation weights, and classify the potential risk nodes according to the node risk propagation weights and the preset risk level classification standard, and obtain a node risk level data set; Step S49: Based on the annotated network entity relationship graph, a risk propagation simulation is performed on the target network according to the node risk level data set to obtain a network risk propagation path set, a risk path reachability analysis is performed on the network risk propagation path set to obtain a high-risk path node set, a risk propagation intensity assessment is performed on the high-risk path node set to obtain a node risk intensity assessment result, and a multi-level risk accumulation analysis is performed on the node risk intensity assessment result to obtain a network global risk assessment result; wherein the network global risk assessment result is any one of low risk, medium-low risk, medium-high risk, high risk or extremely high risk.

10. A network risk management system based on graph, characterized in that: Used to execute the graph-based network risk processing method according to claim 1, the graph-based network risk processing system comprises: A graph construction module is used to construct a network entity model of the target network to obtain a target network entity model; based on the target network entity model, a network entity graph model is constructed for the target network to obtain a network entity relationship graph; A graph updating module, used for dynamically updating the network entity relationship graph to obtain an updated network entity relationship graph; The transmission source node identification module is used to determine the risk transmission source nodes of the updated network entity relationship graph and obtain the risk transmission source node set; The global risk assessment module is used to perform a global risk assessment on the target network based on the risk propagation source node set based on the updated network entity relationship graph to obtain the network global risk assessment result.

Images