Network security construction methods, devices, equipment, media and products

Abstract

The present invention relates to a network security construction method, device, equipment, medium and product, and belongs to the field of Internet technology. The method includes: obtaining the enterprise asset type of several network assets of the target enterprise, determining the target loss caused by the network attack event corresponding to each enterprise asset type, multiple network security protection products and the average price of multiple network security protection products, and forming an association table; obtaining the budget of the target enterprise, and according to the association table, determining several network security protection product combinations that meet the budget of the target enterprise; selecting the combination of several network security protection product combinations that can avoid the largest target loss as the optimal network security protection product combination. The method provided by the present application can select the network security protection product combination that obtains the maximum benefit within a limited budget, so that the cost and benefit are matched, thereby improving the benefits of network security construction.

Description

Technical Field

[0001] The present application belongs to the field of Internet technology, and specifically relates to a network security construction method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] In recent years, global corporate organizations have spent more than $190 billion on cybersecurity technologies, products, and services, a year-on-year increase of 12.7%. At the same time, more and more companies and security teams are exhausted. They have made the greatest efforts in enterprise security construction, but it is difficult to get the expected returns. The root cause is that the methods used by enterprises and security teams to build cybersecurity have poor benefits and poor adaptability. Summary of the invention

[0003] In view of this, the purpose of this application is to provide a network security construction method, device, electronic device, computer-readable storage medium and computer program product to improve the problems of poor efficiency and poor adaptability of current network security construction methods.

[0004] The embodiment of the present application is implemented as follows:

[0005] In a first aspect, an embodiment of the present application provides a network security construction method, including: obtaining the enterprise asset types of several network assets of a target enterprise, determining the target loss caused by the network attack events corresponding to each enterprise asset type, multiple network security protection products, and the average price of multiple network security protection products, and forming an association table; obtaining the budget of the target enterprise, and determining, based on the association table, several network security protection product combinations that meet the budget of the target enterprise, wherein each of the network security protection product combinations includes at least one enterprise asset type. Multiple network security protection products corresponding to the enterprise asset type; selecting the combination of the several network security protection product combinations that can avoid the largest target loss as the optimal network security protection product combination.

[0006] In the above embodiment, the network security protection product combination is selected according to the budget of the target enterprise and the target loss. Within the limited budget, the network security protection product combination that can avoid the maximum target loss can be selected, that is, the network security protection product combination that can obtain the maximum security protection benefit is selected, so that the cost and benefit are matched, thereby improving the efficiency of network security construction; and the combination of network security protection products can be dynamically adjusted according to the corporate asset type and budget of the target enterprise, thereby enhancing the adaptability of the network security construction method; in addition, it can also reduce the problem of wrong selection or multiple selection of network security protection products due to human factors, thereby improving the accuracy and scientificity of decision-making.

[0007] In combination with a possible implementation manner of the first aspect, the obtaining of the enterprise asset types of several network assets of the target enterprise includes: obtaining network asset data of the target enterprise; clustering the network asset data according to preset asset types to obtain the enterprise asset types of several network assets of the target enterprise.

[0008] In the above embodiment, by classifying the network asset data of the target enterprise, the type and distribution of the enterprise assets can be more accurately identified and understood, so that the network security protection product portfolio obtained according to the enterprise asset type is more in line with the needs of the target enterprise; accurate asset management helps to improve the rate of return on network security construction and significantly improve investment efficiency; and selecting corresponding network security protection products according to different enterprise asset types can enhance the adaptability of network security construction methods.

[0009] In combination with a possible implementation method of the first aspect, the target loss caused by the network attack incident corresponding to each enterprise asset type, multiple network security protection products, and the average price of multiple network security protection products are determined, and an association table is formed, including: obtaining information on multiple network attack cases, clustering and calculating the information on the network attack cases according to the asset type, obtaining the target loss caused by the network attack incident corresponding to each asset type, and saving it in a database; obtaining information on multiple network security protection products, clustering and calculating the information on the network security protection products according to the asset type, obtaining the average price of the network security protection products corresponding to each asset type, and saving it in the database; obtaining the corresponding target loss, network security protection product, and the average price of the network security protection product in the database according to the enterprise asset type of the target enterprise, and forming the association table.

[0010] In the above embodiment, through cluster analysis, network attack events corresponding to different asset types and corresponding network security protection products can be obtained, so as to make more reasonable resource allocation within a limited budget; and the target loss caused by the network attack events corresponding to each asset type and the average price of the network security protection products are also calculated at the same time, so that the target enterprise can obtain the association table belonging to the enterprise according to the enterprise asset type. Through the association table, the target enterprise can evaluate the input-output ratio of different network security protection products and select the network security protection product with the highest cost performance, thereby improving the efficiency of network security construction; in addition, by building a database, different enterprises can be allowed to flexibly adjust the combination of network security protection products according to their own asset types, thereby improving the applicability of the network security construction method.

[0011] In combination with a possible implementation method of the first aspect, the information of network attack cases is clustered and calculated according to asset type to obtain the target loss caused by the network attack event corresponding to each asset type, including: clustering the information of network attack cases according to asset type, and calculating the average loss, median loss, and mode loss caused by multiple network attack events corresponding to each asset type; calculating the average of the average loss, the median loss, and the mode loss corresponding to each asset type as the target loss.

[0012] In the above embodiment, by calculating the average loss, median loss, and mode loss caused by multiple network attack events corresponding to each asset type, and then taking the average of the three as the target loss, it is possible to evaluate the losses caused by multiple network attack events corresponding to each asset type from different angles, providing a more comprehensive loss assessment perspective; and to a certain extent, it can also reduce the impact of outliers on target losses, thereby improving the accuracy and scientificity of decision-making; at the same time, accurately evaluating the target losses caused by multiple network attack events corresponding to each asset type enables enterprises to more accurately predict and evaluate the return on investment when selecting network security protection products, thereby maximizing benefits.

[0013] In combination with a possible implementation manner of the first aspect, the information on the network attack case also includes at least one enterprise attribute information of the enterprise scale, the industry to which the enterprise belongs, the enterprise listing status, and the enterprise type. The method also includes: clustering and calculating the information on the network attack case according to the asset type and enterprise attribute information, obtaining multiple asset types corresponding to each enterprise attribute and target losses corresponding to the multiple asset types, and saving them in the database; obtaining the corresponding target losses, network security protection products, and the average price of network security protection products in the database according to the enterprise asset type and enterprise attribute information of the target enterprise, and forming an association table.

[0014] In the above embodiment, when establishing the database, in addition to considering the asset type, attention is also paid to at least one of the enterprise attribute information such as enterprise size, enterprise industry, enterprise listing status, and enterprise type, so that the target loss is more accurate, so that the target enterprise can more accurately evaluate the loss corresponding to each asset type when selecting network security protection products, thereby more accurately matching network security protection products and improving the efficiency of network security construction; and enabling enterprises to allocate resources more reasonably and improve resource utilization; in addition, when using the above database for network security construction, it can adapt to the unique needs of different enterprises and improve the flexibility and adaptability of network security construction methods.

[0015] In combination with a possible implementation manner of the first aspect, the association table includes the price of each network security protection product, and the method also includes: according to the enterprise budget corresponding to the optimal network security protection product combination, selecting the lowest-priced network security protection product from multiple network security protection products corresponding to each enterprise asset type in the optimal network security protection product combination to obtain a second network security protection product combination.

[0016] In the above embodiment, under the premise of meeting security needs, selecting the lowest-cost network security protection product can improve the efficiency of network security construction; and selecting the lowest-cost network security protection product within the budget can optimize resource allocation so that the security needs of key areas of the enterprise are met; at the same time, it allows the target enterprise to flexibly adjust the combination of network security protection products according to the budget, thereby enhancing the adaptability of the network security construction method to different budget situations.

[0017] In the second aspect, an embodiment of the present application provides a network security construction device, including: an acquisition module, used to obtain the enterprise asset types of several network assets of a target enterprise, determine the target loss caused by the network attack incident corresponding to each enterprise asset type, multiple network security protection products and the average price of multiple network security protection products, and form an association table; the acquisition module is also used to obtain the budget of the target enterprise; a determination module is used to determine several network security protection product combinations that meet the budget of the target enterprise according to the association table, wherein each of the network security protection product combinations includes at least one enterprise asset type. Multiple network security protection products corresponding to a type of enterprise asset; a selection module is used to select the combination of the several network security protection product combinations that can avoid the largest target loss as the optimal network security protection product combination.

[0018] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, the processor being connected to the memory; the memory being used to store programs; the processor being used to call the programs stored in the memory to execute the method provided in the above-mentioned first aspect embodiment and / or any possible implementation method in combination with the first aspect embodiment.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method provided by the above-mentioned first aspect embodiment and / or any possible implementation method in combination with the first aspect embodiment is executed.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it executes the method provided by the above-mentioned first aspect embodiment and / or any possible implementation method combined with the first aspect embodiment.

[0021] Other features and advantages of the present application will be described in the following description. The purpose and other advantages of the present application can be realized and obtained through the structures specifically pointed out in the written description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings. The above and other purposes, features and advantages of the present application will be more clearly shown in the drawings.

[0023] Figure 1 A flow chart of a network security construction method provided in an embodiment of the present application is shown.

[0024] Figure 2 A flow chart of another network security construction method provided in an embodiment of the present application is shown.

[0025] Figure 3 A module schematic diagram of a network security construction device provided in an embodiment of the present application is shown.

[0026] Figure 4 A schematic diagram showing the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The following embodiments can be used as examples to more clearly illustrate the technical solutions of the present application, and cannot be used to limit the scope of protection of the present application. It will be appreciated by those skilled in the art that, in the absence of conflict, the features in the following embodiments and embodiments can be combined with each other.

[0028] It should be noted that similar numbers and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of this application, relational terms such as "first", "second", etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0029] Furthermore, the term "and / or" in this application is merely a term used to describe the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone.

[0030] In the description of the embodiments of the present application, unless otherwise clearly specified or limited, the technical term "connection" may refer to a direct connection or an indirect connection through an intermediate medium.

[0031] The embodiment of the present application provides a network security construction method, which selects a network security protection product combination that can avoid the maximum target loss according to the budget of the target enterprise. That is, within a limited budget, a network security protection product combination that can obtain the maximum security protection benefit can be selected to match the cost and benefit, thereby improving the efficiency of network security construction; and the combination of network security protection products can be dynamically adjusted according to the corporate asset type and budget of the target enterprise, thereby enhancing the adaptability of the network security construction method.

[0032] Combine the following Figure 1 The flowchart shown in the figure illustrates a network security construction method provided by an embodiment of the present application. The method comprises the following steps:

[0033] Step S100: Obtain the enterprise asset types of several network assets of the target enterprise, determine the target loss caused by the network attack event corresponding to each enterprise asset type, multiple network security protection products and the average price of multiple network security protection products, and form an association table.

[0034] In one possible implementation, the specific process of obtaining the enterprise asset types of several network assets of the target enterprise includes: obtaining the network asset data of the target enterprise; clustering the network asset data according to preset asset types to obtain the enterprise asset types of several network assets of the target enterprise.

[0035] The preset asset types may include OA servers (Office Automation System, office automation servers), production servers, test servers, data servers, and the like.

[0036] For example, you can use open source asset scanning tools to detect the target enterprise's network assets, such as the target enterprise's publicly disclosed HTTP services (Hypertext Transfer Protoco service), EMAIL services (email services), FTP services (File Transfer Protocol service), etc., and obtain the target enterprise's network assets based on the scanned network assets. According to the preset asset types, the network asset data is clustered to obtain the enterprise asset types of several network assets of the target enterprise.

[0037] In step S100, the association table can be determined by the enterprise asset type of the target enterprise; or it can be determined by the enterprise asset type and enterprise attribute information of the target enterprise. The enterprise attribute information includes at least one of the enterprise attribute information of enterprise scale, enterprise industry, enterprise listing status, and enterprise type. Enterprise types include limited liability companies, joint stock companies, sole proprietorships, partnerships, cooperatives, and non-profit organizations.

[0038] Under one possible implementation method, the specific process of determining the association table through the enterprise asset type of the target enterprise includes: obtaining information on multiple network attack cases, clustering and calculating the information on the network attack cases according to the asset type, obtaining the target loss caused by the network attack event corresponding to each asset type, and saving it in a database; obtaining information on multiple network security protection products, clustering and calculating the information on the network security protection products according to the asset type, obtaining the average price of the network security protection products corresponding to each asset type, and saving it in the database; obtaining the corresponding target loss, network security protection product and the average price of the network security protection product in the database according to the enterprise asset type of the target enterprise, and forming an association table.

[0039] The information of the cyber attack case includes, but is not limited to, the type of assets attacked by the cyber attack case, the losses caused by the cyber attack case, and the event name of the cyber attack case. The asset type refers to all asset types in the database, including the enterprise asset type of the target enterprise. Clustering the information of the cyber attack case according to the asset type refers to clustering the information of the cyber attack case according to the type of assets attacked by the cyber attack case.

[0040] In the above embodiment, the target loss may be the average value of the losses caused by the network attack events corresponding to each asset type; or it may be the average value of the average loss, median loss, and mode loss caused by the network attack events corresponding to each asset type.

[0041] In one implementation mode, information on cyber attack cases is clustered and calculated according to asset types to obtain target losses caused by cyber attack events corresponding to each asset type, including: clustering information on cyber attack cases according to asset types, and calculating the average loss, median loss, and mode loss caused by multiple cyber attack events corresponding to each asset type; and calculating the average of the average loss, median loss, and mode loss corresponding to each asset type as the target loss.

[0042] For example, the cyber attack cases and losses corresponding to the asset type of production server are shown in Table 1 below:

[0043]

[0044] Then the average loss of the production server is: The median loss is The mode loss is 6872 (million yuan), and the final target loss is

[0045] In the above implementation, by taking the average of the average loss, median loss, and mode loss as the target loss, the losses caused by multiple network attack events corresponding to each asset type can be evaluated from different angles, providing a more comprehensive loss assessment perspective, thereby improving the accuracy and scientific nature of network security construction decisions; when selecting network security protection products, the return on investment can be more accurately estimated and evaluated, thereby maximizing benefits.

[0046] In the above embodiment, the network security protection products may come from different companies, and the network security protection products may protect the same asset type or different asset types. The information of the network security protection products includes but is not limited to the name of the network security protection product, the price of the network security protection product, and the asset type protected by the network security protection product. Clustering the information of the network security protection products according to the asset type refers to clustering the information of the network security protection products according to the asset type protected by the network security protection products.

[0047] In the above embodiment, the association table obtained according to the enterprise asset type of the target enterprise can be shown in Table 2:

[0048]

[0049] In one possible implementation, the specific process of determining the association table through the enterprise asset type and enterprise attribute information of the target enterprise includes: clustering and calculating the information of the network attack case according to the asset type and enterprise attribute information, obtaining multiple asset types corresponding to each enterprise attribute and target losses corresponding to the multiple asset types, and saving them in a database; obtaining the corresponding target losses, network security protection products and the average price of network security protection products in the database according to the enterprise asset type and enterprise attribute information of the target enterprise, and forming an association table.

[0050] In this implementation, the information of the cyber attack case also includes at least one of the following enterprise attribute information: enterprise size, enterprise industry, enterprise listing status, and enterprise type. If the enterprise attribute information is the enterprise type, then the association table determined by the enterprise asset type and enterprise attribute information of the target enterprise can be shown in Table 3:

[0051]

[0052] Step S200: Obtain the budget of the target enterprise, and determine several network security protection product combinations that meet the budget of the target enterprise according to the association table, wherein each network security protection product combination includes at least a plurality of network security protection products corresponding to one type of enterprise asset.

[0053] Continuing with the data in Table 2 as an example, if the target company's budget for network security construction this year is 700,000 yuan, then the network security protection product combinations that meet the target company's budget are: Combination 1: network security protection products corresponding to data servers + network security protection products corresponding to OA servers; Combination 2: network security protection products corresponding to production servers + network security protection products corresponding to OA servers.

[0054] Step S300: Select a combination of several network security protection product combinations that can avoid the greatest target loss as the optimal network security protection product combination.

[0055] The target enterprise's budget may be one or more. In one implementation, when the target enterprise's budget is one, the combination of several network security protection product combinations that can avoid the largest target loss is selected as the optimal network security protection product combination, that is, the combination of several network security protection product combinations that causes the largest target loss due to network attack cases is selected as the optimal network security protection product combination.

[0056] Continuing with the above example, the target loss that can be avoided by combination 1 is 151.47 million yuan, and the target loss that can be avoided by combination 2 is 137.67 million yuan. Because 151.47 million yuan is greater than 137.67 million yuan, combination 1 is selected as the optimal network security protection product combination.

[0057] Optionally, if there are two or more combinations that can avoid the largest target losses, the combination with the lowest average price of network security protection products is selected as the optimal network security protection product combination.

[0058] In one implementation, when the target enterprise has multiple budgets, several combinations of network security protection products that meet the target enterprise's budget are determined according to each budget of the target enterprise and the target enterprise's association table; and then the combination of network security protection products that can avoid the largest target loss is selected as the optimal network security protection product combination under each budget. The optimal network security protection product combination under each budget is selected according to the preset rules to obtain the optimal network security protection product combination.

[0059] Among them, the preset rules may include selecting the combination with the largest target loss that can be avoided, selecting the combination with the lowest budget, selecting the combination with the lowest average price of network security protection products, selecting the combination with the greatest benefit (i.e., the combination with the largest ratio of target loss that can be avoided to the average price of network security protection products), etc. The rules may be set according to the needs of the target enterprise.

[0060] In one implementation, the above steps 200 and 300 may be selected using a dynamic programming algorithm. The dynamic programming algorithm can improve algorithm efficiency by reducing redundant calculations and can quickly select the optimal network security protection product combination.

[0061] like Figure 2 As shown in the flowchart, the network security construction method provided by the embodiment of the present application may also include step S400: according to the enterprise budget corresponding to the optimal network security protection product combination, the network security protection product with the lowest price is selected from multiple network security protection products corresponding to each enterprise asset type in the optimal network security protection product combination to obtain a second network security protection product combination. The association table also includes the price of each network security protection product.

[0062] like Figure 3 As shown, the embodiment of the present application further provides a network security construction device 10 , which includes an acquisition module 11 , a determination module 12 and a selection module 13 .

[0063] The acquisition module 11 is used to obtain the enterprise asset types of several network assets of the target enterprise, determine the target loss caused by the network attack event corresponding to each enterprise asset type, multiple network security protection products and the average price of multiple network security protection products, and form an association table.

[0064] The acquisition module 11 is also used to acquire the budget of the target enterprise.

[0065] The determination module 12 is used to determine a number of network security protection product combinations that meet the budget of the target enterprise based on the association table, wherein each network security protection product combination includes at least a plurality of network security protection products corresponding to one type of enterprise assets.

[0066] The selection module 13 is used to select a combination of several network security protection product combinations that can avoid the greatest target loss as the optimal network security protection product combination.

[0067] In a possible implementation manner, the acquisition module 11 is further used to acquire network asset data of the target enterprise; cluster the network asset data according to preset asset types to obtain enterprise asset types of several network assets of the target enterprise.

[0068] In one possible implementation, the acquisition module 11 is specifically used to obtain information on multiple network attack cases, cluster and calculate the information on the network attack cases according to the asset type, obtain the target loss caused by the network attack event corresponding to each asset type, and save it in a database; obtain information on multiple network security protection products, cluster and calculate the information on the network security protection products according to the asset type, obtain the average price of the network security protection products corresponding to each asset type, and save it in the database accordingly; obtain the corresponding target loss, network security protection product and the average price of the network security protection product in the database according to the enterprise asset type of the target enterprise, and form an association table.

[0069] In one possible implementation, the acquisition module 11 is specifically used to cluster the information of network attack cases according to asset types, and calculate the average loss, median loss, and mode loss caused by multiple network attack events corresponding to each asset type; calculate the average of the average loss, median loss, and mode loss corresponding to each asset type as the target loss.

[0070] In one possible implementation, the acquisition module 11 is also used to cluster and calculate the information of network attack cases according to the asset type and enterprise attribute information, obtain multiple asset types corresponding to each enterprise attribute and target losses corresponding to multiple asset types, and save them in a database; obtain the corresponding target losses, network security protection products and the average price of network security protection products in the database according to the enterprise asset type and enterprise attribute information of the target enterprise, and form an association table.

[0071] In one possible implementation, the selection module 13 is also used to select the lowest-priced network security protection product from multiple network security protection products corresponding to each enterprise asset type in the optimal network security protection product portfolio based on the enterprise budget corresponding to the optimal network security protection product portfolio, so as to obtain a second network security protection product portfolio.

[0072] The network security construction device 10 provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0073] like Figure 4 As shown, Figure 4 The structure block diagram of an electronic device 20 provided in an embodiment of the present application is shown. The electronic device 20 includes: a processor 21 and a memory 22.

[0074] It should be noted that Figure 4 The components and structures of the electronic device 20 shown are merely exemplary and non-limiting. The electronic device may also have other components and structures as required.

[0075] The processor 21, the memory 22, and other components that may appear in the electronic device 20 are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, the processor 21, the memory 22, and other components that may appear may be electrically connected to each other via one or more communication buses or signal lines.

[0076] The memory 22 is used to store programs, for example, a program corresponding to the network security construction method mentioned above or a network security construction device mentioned above. Optionally, when the network security construction device is stored in the memory 22, the network security construction device includes at least one software function module that can be stored in the memory 22 in the form of software or firmware.

[0077] The processor 21 is used to execute executable modules stored in the memory 22, such as software function modules or computer programs included in the device for executing network security construction, so as to execute the above-mentioned network security construction method.

[0078] Of course, the method disclosed in any embodiment of the present application can be applied to the processor 21, or implemented by the processor 21.

[0079] An embodiment of the present application also provides a non-volatile computer-readable storage medium (hereinafter referred to as storage medium), on which a computer program is stored. When the computer program is run by a computer such as the above-mentioned electronic device 20, the method disclosed in any of the above-mentioned embodiments is executed.

[0080] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is run by a computer such as the electronic device 20 described above, the method disclosed in any of the embodiments shown above is executed.

[0081] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0082] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0083] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0084] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a computer-readable storage medium, including several instructions for enabling a computer device (which can be a personal computer, a laptop, a server, or an electronic device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0085] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network security construction method, characterized in that: include: Obtaining the enterprise asset types of several network assets of the target enterprise, determining the target loss caused by the network attack event corresponding to each enterprise asset type, multiple network security protection products, and the average price of the multiple network security protection products, and forming a correlation table; Obtaining the budget of the target enterprise, and determining, based on the association table, a plurality of network security protection product combinations that meet the budget of the target enterprise, wherein each of the network security protection product combinations includes at least a plurality of network security protection products corresponding to one type of enterprise assets; The combination of network security protection products that can avoid the greatest target loss is selected as the optimal network security protection product combination.

2. The method according to claim 1, characterized in that The enterprise asset types of the target enterprise's network assets include: Obtaining network asset data of the target enterprise; The network asset data is clustered according to preset asset types to obtain enterprise asset types of a number of network assets of the target enterprise.

3. The method according to claim 1, characterized in that: The target loss caused by the network attack event corresponding to each enterprise asset type, multiple network security protection products, and the average price of the multiple network security protection products are determined, and a correlation table is formed, including: Obtain information on multiple network attack cases, cluster and calculate the information on network attack cases according to asset types, obtain the target loss caused by the network attack events corresponding to each asset type, and save it in the database; Obtain information on multiple network security protection products, cluster and calculate the information on the network security protection products according to the asset type, obtain an average price of the network security protection products corresponding to each asset type, and save the corresponding information in the database; According to the enterprise asset type of the target enterprise, the corresponding target loss, network security protection product and the average price of the network security protection product are obtained in the database, and the association table is formed.

4. The method according to claim 3, characterized in that The information of the network attack cases is clustered and calculated according to the asset type to obtain the target loss caused by the network attack event corresponding to each asset type, including: Cluster the information of cyber attack cases according to asset type, and calculate the average loss, median loss, and mode loss caused by multiple cyber attack events corresponding to each asset type; The average of the average loss, the median loss, and the mode loss corresponding to each asset type is calculated as the target loss.

5. The method according to claim 3, characterized in that: The information of the network attack case also includes at least one of the following enterprise attribute information: enterprise size, industry to which the enterprise belongs, enterprise listing status, and enterprise type. The method further includes: Clustering and calculating the information of network attack cases according to asset types and enterprise attribute information, obtaining multiple asset types corresponding to each enterprise attribute and target losses corresponding to the multiple asset types, and storing them in the database; According to the enterprise asset type and enterprise attribute information of the target enterprise, the corresponding target loss, network security protection products and the average price of network security protection products are obtained in the database, and an associated table is formed.

6. The method according to claim 1, characterized in that The association table includes the price of each network security protection product, and the method further includes: According to the enterprise budget corresponding to the optimal network security protection product combination, the lowest-priced network security protection product is selected from multiple network security protection products corresponding to each enterprise asset type in the optimal network security protection product combination to obtain a second network security protection product combination.

7. A network security construction device, characterized in that: include: An acquisition module, used to acquire enterprise asset types of several network assets of a target enterprise, determine target losses caused by network attack events corresponding to each enterprise asset type, multiple network security protection products, and average prices of multiple network security protection products, and form a correlation table; The acquisition module is further used to acquire the budget of the target enterprise; A determination module, configured to determine, based on the association table, a plurality of network security protection product combinations that meet the budget of the target enterprise, wherein each of the network security protection product combinations includes at least a plurality of network security protection products corresponding to one type of enterprise assets; A selection module is used to select a combination of the several network security protection product combinations that can avoid the maximum target loss as the optimal network security protection product combination.

8. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is connected to the memory; The memory is used to store programs; The processor is used to call the program stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is performed.

Images