Security assessment method and device and storage medium

Abstract

The invention discloses a security assessment method and device and a storage medium, relates to the technical field of communication, and is used for improving the accuracy of assessing a to-be-assessed object. The method comprises the following steps: acquiring an attack instance suffered by a to-be-evaluated object and historical behavior information of the attack instance; the historical behavior information comprises the frequency of attack instance occurrence and / or the security event level caused by the attack instance; and determining a security assessment result of the to-be-assessed object according to the attack instance and the historical behavior information of the attack instance. The method and device are applied to the security assessment process.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security assessment method, device and storage medium. Background Art

[0002] With the rapid development of information technology, big data has become an important resource in today's society. However, the collection, storage, processing and transmission of big data are facing various security threats. These threats may not only lead to the leakage of corporate or personal information, but also have a serious impact on collective security.

[0003] In the related art, technicians identify and count current risk information, and based on the current risk information, evaluate the safety of the object to be evaluated through subjective judgment. However, the subjective judgment of technicians lacks objectivity and accuracy, and cannot accurately evaluate the safety of the object to be evaluated. Therefore, how to improve the accuracy of evaluating the object to be evaluated is a technical problem that still needs to be solved. Summary of the invention

[0004] The present application provides a security assessment method, device and storage medium for improving the accuracy of assessing an object to be assessed.

[0005] In order to achieve the above purpose, this application adopts the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides a security assessment method, wherein a security assessment device obtains attack instances suffered by an object to be assessed, as well as historical behavior information of the attack instances; the historical behavior information includes the frequency of occurrence of the attack instances and / or the level of security incidents caused by the attack instances; the security assessment device determines a security assessment result of the object to be assessed based on the attack instances and the historical behavior information of the attack instances.

[0007] In a possible implementation, the attack type of each attack instance in the attack instance is obtained; the risk assessment value of each attack instance is determined according to the attack type of the attack instance; the weight of the risk assessment value of the attack instance is determined according to the frequency of occurrence of the attack instance and / or the level of security incidents caused by the attack instance; the weight of the risk assessment value of the attack instance is negatively correlated with the frequency of occurrence of the attack instance; and the security assessment result of the object to be assessed is determined according to the risk assessment value of the attack instance and the weight of the risk assessment value of the attack instance.

[0008] In a possible implementation, user behavior characteristics of the object to be evaluated are obtained; the user behavior characteristics include abnormal behavior data; an abnormal behavior index is determined based on the abnormal behavior data; and a security assessment result of the object to be evaluated is determined based on the attack instance and the historical behavior information of the attack instance and the abnormal behavior index.

[0009] In a possible implementation, an abnormal behavior index is determined according to a relationship between abnormal behavior data and normal behavior data.

[0010] In a possible implementation, when the security assessment result of the object to be assessed is used to indicate that there is a security risk in the security of the object to be assessed, a data source feature of the attack instance is obtained; and the attack source is determined according to the data source feature of the attack instance.

[0011] In a possible implementation, the corresponding attack evidence of the attack instance is obtained; the attack evidence is used to record the data information of the attack instance; an attack evidence chain is constructed according to the attack evidence and the attack source; the attack evidence chain is used to represent the attack path of the attack instance; the traceability function of each evidence chain in the attack evidence chain is obtained; and the accuracy of the traceability analysis result of the attack source is determined according to the traceability function of each evidence chain in the attack evidence chain.

[0012] In a second aspect, the present application provides a security assessment device, comprising: an acquisition unit and a processing unit; the acquisition unit is used to obtain attack instances suffered by the object to be evaluated, and historical behavior information of the attack instances; the historical behavior information includes the frequency of occurrence of the attack instances and / or the level of security incidents caused by the attack instances; the processing unit is used to determine the security assessment result of the object to be evaluated based on the attack instances and the historical behavior information of the attack instances.

[0013] In a possible implementation, the acquisition unit is further used to obtain the attack type of each attack instance in the attack instance; the processing unit is further used to determine the risk assessment value of each attack instance according to the attack type of the attack instance; the processing unit is further used to determine the weight of the risk assessment value of the attack instance according to the frequency of occurrence of the attack instance and / or the level of security incidents caused by the attack instance; the weight of the risk assessment value of the attack instance is negatively correlated with the frequency of occurrence of the attack instance; the processing unit is further used to determine the security assessment result of the object to be evaluated according to the risk assessment value of the attack instance and the weight of the risk assessment value of the attack instance.

[0014] In a possible implementation, the acquisition unit is further used to acquire user behavior characteristics of the object to be evaluated; the user behavior characteristics include abnormal behavior data; the processing unit is further used to determine an abnormal behavior index based on the abnormal behavior data; the processing unit is further used to determine a security assessment result of the object to be evaluated based on the attack instance and the historical behavior information of the attack instance and the abnormal behavior index.

[0015] In a possible implementation, the processing unit is further configured to determine an abnormal behavior index according to a relationship between the abnormal behavior data and the normal behavior data.

[0016] In a possible implementation, when the security assessment result of the object to be assessed is used to indicate that there is a security risk in the security of the object to be assessed, the acquisition unit is further used to obtain the data source characteristics of the attack instance; the processing unit is further used to determine the attack source based on the data source characteristics of the attack instance.

[0017] In a possible implementation, the acquisition unit is further used to acquire the corresponding attack evidence of the attack instance; the attack evidence is used to record the data information of the attack instance; the processing unit is further used to construct an attack evidence chain based on the attack evidence and the attack source; the attack evidence chain is used to represent the attack path of the attack instance; the acquisition unit is further used to acquire the traceability function of each evidence chain in the attack evidence chain; the processing unit is further used to determine the accuracy of the traceability analysis result of the attack source based on the traceability function of each evidence chain in the attack evidence chain.

[0018] In a third aspect, the present application provides a security assessment device, which includes: a processor and a memory; wherein the memory is used to store computer execution instructions, and when the security assessment device is running, the processor executes the computer execution instructions stored in the memory to enable the security assessment device to perform the security assessment method described in the first aspect and any possible implementation of the first aspect.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions in the computer-readable storage medium are executed by a processor of a security assessment device, the security assessment device is enabled to perform the security assessment method described in the first aspect and any possible implementation of the first aspect.

[0020] In a fifth aspect, an embodiment of the present application provides a chip, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the security assessment method described in the above-mentioned first aspect and any possible implementation method of the first aspect.

[0021] In a sixth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the security assessment method described in the first aspect and any possible implementation of the first aspect.

[0022] These and other aspects of the present application will become more apparent from the following description.

[0023] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, considering the historical behavior information of the attack instance, the current behavior of the attack type can be predicted, and the frequency of the attack instance in the historical behavior information of the attack instance and the level of the security incident caused by the attack instance in the historical behavior information of the attack instance are both negatively correlated with the security of the object to be evaluated, so the security assessment device can accurately determine the security assessment result of the object to be evaluated based on the attack instance and the historical behavior information of the attack instance. Compared with the prior art, the security assessment device in the embodiment of the present application does not need to rely on the subjective judgment of relevant technical personnel to evaluate the security of the object to be evaluated, avoiding the staff's judgment affecting objectivity, resulting in misjudgment or missed judgment, and achieving the purpose of accurately evaluating the object to be evaluated. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A schematic diagram of the structure of a security assessment system provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the structure of a security assessment device provided in an embodiment of the present application;

[0027] Figure 3 A flowchart of a security assessment method provided in an embodiment of the present application;

[0028] Figure 4 A flowchart of another security assessment method provided in an embodiment of the present application;

[0029] Figure 5 A flowchart of another security assessment method provided in an embodiment of the present application;

[0030] Figure 6 A flowchart of another security assessment method provided in an embodiment of the present application;

[0031] Figure 7 A flowchart of another security assessment method provided in an embodiment of the present application;

[0032] Figure 8 A flowchart of another security assessment method provided in an embodiment of the present application;

[0033] Fig. 9 A schematic diagram of the structure of another security assessment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0035] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0036] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0037] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0038] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0039] With the rapid development of information technology, big data has become an important resource in today's society. However, the collection, storage, processing and transmission of big data are facing various security threats. These threats may not only lead to the leakage of corporate or personal information, but also have a serious impact on collective security.

[0040] In the related art, technicians identify and count current risk information, and based on the current risk information, evaluate the safety of the object to be evaluated through subjective judgment. However, the subjective judgment of technicians lacks objectivity and accuracy, and cannot accurately evaluate the safety of the object to be evaluated. Therefore, how to improve the accuracy of evaluating the object to be evaluated is a technical problem that still needs to be solved.

[0041] In order to solve the technical problems existing in the related art, the embodiments of the present application take into account the historical behavior information of the attack instance, and the current behavior of the attack type can be predicted, and the frequency of the attack instance in the historical behavior information of the attack instance and the level of the security incident caused by the attack instance in the historical behavior information of the attack instance are negatively correlated with the security of the object to be evaluated. Therefore, the security assessment device can accurately determine the security assessment result of the object to be evaluated based on the attack instance and the historical behavior information of the attack instance. Compared with the prior art, the security assessment device in the embodiments of the present application does not need to rely on the subjective judgment of relevant technical personnel to evaluate the security of the object to be evaluated, which avoids the staff's judgment affecting objectivity, resulting in misjudgment or missed judgment, and achieves the purpose of accurately evaluating the object to be evaluated.

[0042] Below, combined with the attached Figure 1 A security assessment system 10 provided in an embodiment of the present application is described in detail. Figure 1 As shown, the safety assessment system 10 includes: a safety assessment device 11 and an object to be assessed 12 .

[0043] The safety assessment device 11 may be deployed inside the object to be assessed 12 or outside the object to be assessed 12 .

[0044] The security assessment device 11 can obtain the attack instance suffered by the object to be assessed 12, and then obtain the historical behavior information of the attack instance. Subsequently, the security assessment device 11 can determine the security assessment result of the object to be assessed 12 by referring to the historical behavior information of the attack instance.

[0045] It should be noted that the security assessment device 11 is a device with wireless communication function, which can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted. It can also be deployed on the water surface (such as ships, etc.). It can also be deployed in the air (for example, on airplanes, balloons and satellites, etc.). User terminal equipment is also called mobile station (MS), terminal equipment (MT) and terminal equipment, etc., which is a device that provides voice and / or data connectivity to users. For example, terminal equipment includes handheld devices with wireless connection function, vehicle-mounted devices, etc. At present, the terminal device can be: a mobile phone, a tablet computer, a laptop computer, a PDA, a mobile internet device (MID), a wearable device (such as a smart watch, a smart bracelet, a pedometer, etc.), an in-vehicle device (such as a car, a bicycle, an electric car, an airplane, a ship, a train, a high-speed train, etc.), a virtual reality (VR) device, an augmented reality (AR) device, a wireless terminal device in industrial control, a smart home device (such as a refrigerator, a television, an air conditioner, an electric meter, etc.), an intelligent robot, a workshop device, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, or a wireless terminal device in a smart home, a flying device (such as an intelligent robot, a hot air balloon, a drone, an airplane), etc. In one possible application scenario of the present application, the safety assessment device 11 is a terminal device that often works on the ground, such as a vehicle-mounted device. In the present application, for the convenience of description, the chip deployed in the above-mentioned device, such as a system-on-a-chip (SOC), a baseband chip, etc., or other chips with communication functions can also be referred to as user terminal devices.

[0046] Optionally, the security assessment device 11 may be an embedded communication device or a user's handheld communication device, including a mobile phone, a tablet computer, etc.

[0047] As an example, in an embodiment of the present application, the safety assessment device 11 can also be a wearable device. Wearable devices can also be called wearable smart devices, which are a general term for wearable devices that use wearable technology to intelligently design and develop wearable devices for daily wear, such as glasses, gloves, watches, clothing and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and independent of smartphones to achieve complete or partial functions, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various types of smart bracelets and smart jewelry for vital sign monitoring.

[0048] Optionally, the physical device of the object to be evaluated 12 may be a server.

[0049] Optionally, the above-mentioned server can be a server in a server cluster (consisting of multiple servers), or a chip in the server, or a system on a chip in the server, or can be implemented by a virtual machine (VM) deployed on a physical machine, which is not limited in the embodiments of the present application.

[0050] The present application embodiment provides a security assessment device for executing the security assessment system provided by the present application embodiment. Figure 2 This is a schematic diagram of the structure of a security assessment device provided in an embodiment of the present application. Figure 2 As shown, the security assessment device 200 includes a processor 201, a communication line 202, and a communication interface 204, and may also include a memory 203. The processor 201, the memory 203 and the communication interface 204 may be connected via the communication line 202.

[0051] The processor 201 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

[0052] The communication link 202 may include a pathway for transmitting information between the above-mentioned components.

[0053] The communication interface 204 is used to communicate with other devices or communication networks, and can use any transceiver-like device, such as Ethernet, radio access network (RAN), WLAN, etc.

[0054] The memory 203 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to include or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0055] In one possible design, the memory 203 can exist independently of the processor 201, that is, the memory 203 can be a memory outside the processor 201. In this case, the memory 203 can be connected to the processor 201 through the communication line 202, and is used to store execution instructions or application code, and the processor 201 controls the execution to implement the security assessment method provided in the following embodiment of the present application. In another possible design, the memory 203 can also be integrated with the processor 201, that is, the memory 203 can be the internal memory of the processor 201, for example, the memory 203 is a high-speed cache, which can be used to temporarily store some data and instruction information.

[0056] As an implementation method, the processor 201 may include one or more CPUs, for example Figure 2 As another implementation, the security assessment device 200 may include multiple processors, such as Figure 2 As another implementation, the security assessment apparatus 200 may further include an output device 205 and an input device 206.

[0057] Below, combined with the attached Figure 3 The security assessment method provided in the embodiment of the present application is described in detail. Figure 3As shown, the safety assessment method includes S301-S302.

[0058] S301: The security assessment device obtains attack instances suffered by the object to be assessed and historical behavior information of the attack instances.

[0059] The historical behavior information includes the frequency of attack instances and / or the level of security incidents caused by the attack instances.

[0060] Optionally, the attack instance includes at least one of the following: a re-identification attack, a statistical inference attack, and a differential attack. The attack instance may be an attack event.

[0061] It should be explained that re-identification attack refers to the process of re-associating anonymized / de-identified data to the original personal information subject or a group of personal information subjects. Re-identification attack is a reverse operation of anonymization / de-identification. Statistical inference attack is an attack method that derives sensitive information based on one or more statistical results. Differential attack is an attack method that attacks cryptographic algorithms by comparing and analyzing the changes in plaintext with specific differences after encryption.

[0062] In a possible implementation, the security assessment device sends a first request message to the object to be assessed, receives a first request response message from the object to be assessed, and determines the attack instance suffered by the object to be assessed according to the data set in the first request response message. The security assessment device obtains historical behavior information of the attack instance from a historical database according to the attack instance suffered by the object to be assessed.

[0063] Optionally, the history database stores at least one attack instance and historical behavior information corresponding to the at least one attack instance.

[0064] It is understandable that the security assessment device obtains the attack instance suffered by the object to be assessed, and further obtains the historical behavior information of the attack instance, so that the security assessment device can refer to the historical behavior information of the attack instance to assess the impact of the attack instance on the object to be assessed.

[0065] S302: The security assessment device determines a security assessment result of the object to be assessed according to the attack instance and the historical behavior information of the attack instance.

[0066] In a possible implementation, the security assessment device determines a security assessment result of the object to be assessed according to a risk assessment function of each attack instance in a plurality of attack instances.

[0067] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, considering the historical behavior information of the attack instance, the current behavior of the attack type can be predicted, and the frequency of the attack instance in the historical behavior information of the attack instance and the level of the security incident caused by the attack instance in the historical behavior information of the attack instance are both negatively correlated with the security of the object to be evaluated, so the security assessment device can accurately determine the security assessment result of the object to be evaluated based on the attack instance and the historical behavior information of the attack instance. Compared with the prior art, the security assessment device in the embodiment of the present application does not need to rely on the subjective judgment of relevant technical personnel to evaluate the security of the object to be evaluated, avoiding the staff's judgment affecting objectivity, resulting in misjudgment or missed judgment, and achieving the purpose of accurately evaluating the object to be evaluated.

[0068] In one possible implementation, combining Figure 3 ,like Figure 4 As shown, S302, the process in which the security assessment device determines the security assessment result of the object to be assessed according to the attack instance and the historical behavior information of the attack instance can be specifically implemented through the following S401-S404.

[0069] S401. The security assessment device obtains the attack type of each attack instance in the attack instance.

[0070] Optionally, attack examples include: re-identification attack, statistical inference attack, and differential attack.

[0071] In a possible implementation, the security assessment device obtains data features corresponding to the attack instances, and determines the attack type of each attack instance in the attack instances based on the data features corresponding to the attack instances.

[0072] It can be understood that the security assessment device obtains the attack type of each attack instance in the attack instance, and then can determine the security assessment result of the object to be assessed based on different types of attack instances.

[0073] S402: The security assessment device determines a risk assessment value for each attack instance according to the attack type of the attack instance.

[0074] In a possible implementation, when the attack type of the attack instance is a re-identification attack, the security assessment device determines a re-identification attack risk assessment function based on the sensitivity of the data set and the quantity and quality of the personal identification information. The security assessment device determines a risk assessment value of the re-identification attack instance based on the re-identification attack risk assessment function.

[0075] It should be explained that the re-identification attack risk assessment function will analyze the possibility of an attacker using known personal identification data to relocate and identify specific personal privacy information.

[0076] In another possible implementation, when the attack type of the attack instance is a statistical inference attack, the security assessment device determines a statistical inference attack risk assessment function based on the statistical characteristics and correlation analysis of the data. The security assessment device determines the risk assessment value of the statistical inference attack instance based on the statistical inference attack risk assessment function.

[0077] It should be explained that the statistical inference attack function will evaluate the possibility of an attacker inferring sensitive information or private data by analyzing the statistical features in a large data set.

[0078] In another possible implementation, when the attack type of the attack instance is a differential attack, the security assessment device determines a differential attack risk assessment function according to the security, key length and complexity of the cryptographic algorithm. The security assessment device determines a risk assessment value of the differential attack instance according to the differential attack risk assessment function.

[0079] It should be explained that the differential attack function will analyze the possibility of an attacker using the chosen plaintext attack method of the block cipher to extract the key.

[0080] S403: The security assessment device determines a weight of a risk assessment value of an attack instance according to a frequency of occurrence of the attack instance and / or a level of a security incident caused by the attack instance.

[0081] Among them, the weight of the risk assessment value of the attack instance is negatively correlated with the frequency of the attack instance, and the weight of the risk assessment value of the attack instance is negatively correlated with the level of the security incident caused by the attack instance.

[0082] In a possible implementation, the security assessment device obtains the frequency of attack instances and a frequency threshold, and determines the weight of the risk assessment value of the attack instance according to the relationship between the frequency of attack instances and the frequency threshold.

[0083] In another possible implementation, the security assessment device obtains the security event level and level threshold caused by the attack instance, and determines the weight of the risk assessment value of the attack instance according to the relationship between the security event level and the level threshold caused by the attack instance.

[0084] In another possible implementation, the security assessment device obtains the frequency of attack instances, the level of security incidents caused by the attack instances, the frequency threshold and the level threshold, and determines the weight of the risk assessment value of the attack instance based on the relationship between the frequency of attack instances and the frequency threshold, and the relationship between the level of security incidents caused by the attack instances and the level threshold.

[0085] S404: The security assessment device determines a security assessment result of the object to be assessed according to the risk assessment value of the attack instance and the weight of the risk assessment value of the attack instance.

[0086] In a possible implementation, the security assessment result of the object to be assessed, the risk assessment value of the attack instance, and the weight of the risk assessment value of the attack instance satisfy the following formula:

[0087]

[0088] Where R(t) is the total risk value within time t, x i (s) is the re-identification attack instance, y i (s) is a statistical inference attack, z i (s) is a differential attack instance, f re-id (x i (s)) is the re-identification attack risk assessment function, f stat-inf (y i (s)) is the statistical inference attack risk assessment function, f diff-att (z i (s)) is the differential attack risk assessment function, α i (s) is the weight of the risk assessment value of the re-identification attack instance, β i (s) is the weight of the risk assessment value of the statistical inference attack instance, γ i (s) is the weight of the risk assessment value of the differential attack instance.

[0089] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, it is considered that the re-identification attack instance, the differential attack instance, and the differential attack instance are the most important attack instances in the attack force. In the embodiment of the present application, the security assessment device determines the weights of the risk assessment values ​​of the re-identification attack instance, the differential attack instance, and the differential attack instance according to the frequency of the attack instance and / or the level of the security incident caused by the attack instance. In this way, the security assessment device can determine the security assessment result of the object to be evaluated by re-identification attack instance, differential attack instance, function of differential attack instance and re-identification attack instance, differential attack instance, and risk assessment value weights of differential attack instance.

[0090] In one possible implementation, combining Figure 3 ,like Figure 5 As shown, S302, the process in which the security assessment device determines the security assessment result of the object to be assessed according to the attack instance and the historical behavior information of the attack instance can be specifically implemented through the following S501-S503.

[0091] S501: The security assessment device obtains user behavior characteristics of the object to be assessed.

[0092] Among them, user behavior characteristics include abnormal behavior data.

[0093] In a possible implementation, the security assessment device obtains user behavior characteristics of the object to be assessed from the recorded information.

[0094] Optionally, the record information includes at least one of the following: a user's login record, a user's operation record, and a user's query record.

[0095] It should be explained that abnormal behavior data includes behaviors that do not conform to normal operating patterns and frequently occurring erroneous operations.

[0096] S502: The security assessment device determines an abnormal behavior index based on the abnormal behavior data.

[0097] In a possible implementation, the security assessment device determines an abnormal behavior detection function according to a first preset algorithm, and then determines an abnormal behavior index according to the abnormal behavior data and the abnormal behavior detection function.

[0098] Optionally, the first preset algorithm includes at least one of the following: 3sigma criterion, Z-score method, box plot method, Grubbs hypothesis test, K-Nearest Neighbor (KNN) algorithm, Local Outlier Factor (LOF) algorithm, and support vector machine and Gaussian kernel function.

[0099] It should be explained that the abnormal behavior index is used to measure the significance of abnormal behavior in the object to be evaluated, and the security assessment device can determine the security assessment result of the object to be evaluated based on the significance of the abnormal behavior.

[0100] S503: The security assessment device determines a security assessment result of the object to be assessed according to the attack instance, the historical behavior information of the attack instance, and the abnormal behavior index.

[0101] In one possible implementation, the security assessment device determines a first score of the object to be assessed based on the attack instance and the historical behavior information of the attack instance; the security assessment device determines a second score based on the abnormal behavior index and the abnormal behavior threshold; the security assessment device determines a security assessment result of the object to be assessed based on the average of the first score and the second score.

[0102] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the influence of the abnormal behavior index on the security assessment result of the object to be assessed is taken into account. In the embodiment of the present application, the security assessment device determines the abnormal behavior index based on the abnormal behavior data. Furthermore, the security assessment device determines the security assessment result of the object to be assessed based on the attack instance and the historical behavior information of the attack instance and the abnormal behavior index, thereby improving the security assessment result of the object to be assessed.

[0103] In one possible implementation, combining Figure 5 ,like Figure 6As shown, S502, the process in which the security assessment device determines the abnormal behavior index according to the abnormal behavior data can be specifically implemented through the following S601.

[0104] S601. The security assessment device determines an abnormal behavior index according to a relationship between abnormal behavior data and normal behavior data.

[0105] Among them, user behavior characteristics also include normal behavior data.

[0106] In a possible implementation, the security assessment device determines a normal behavior detection function according to a second preset algorithm, and further determines an abnormal behavior index according to the normal behavior data, the normal behavior detection function, the abnormal behavior data, and the abnormal behavior detection function.

[0107] Optionally, the second preset algorithm includes a machine learning algorithm of a support vector machine.

[0108] Optionally, the abnormal behavior index, the abnormal behavior data, and the normal behavior data satisfy the following formula:

[0109]

[0110] Among them, A(t) is the abnormal behavior index within time t, λ is the attenuation factor, which means that the influence of abnormal behavior gradually weakens over time, t j is the time when the jth abnormal behavior occurs, g anomaly (u j (t)) is the abnormal behavior detection function, h norm (v k (t)) is the normal behavior detection function, which is used to compare and benchmark the results of abnormal behavior detection, and m is the total number of behavior features.

[0111] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the influence of normal behavior data on the abnormal behavior index is taken into consideration. The security assessment device in the embodiment of the present application determines the abnormal behavior index according to the relationship between the abnormal behavior data and the normal behavior data, and then according to the attack instance and the historical behavior information of the attack instance and the abnormal behavior index, the accuracy of the security assessment result of the object to be assessed can be improved.

[0112] In one possible implementation, combining Figure 3 ,like Figure 7 As shown, in S302, after the security assessment device determines the security assessment result of the object to be assessed according to the attack instance and the historical behavior information of the attack instance, the security assessment device traces the attack source. The process of the security assessment device tracing the attack source can be specifically implemented through the following S701-S702.

[0113] S701: When the security assessment result of the object to be assessed is used to indicate that there is a security risk in the security of the object to be assessed, the security assessment device obtains data source features of the attack instance.

[0114] Optionally, the data source feature includes at least one of the following: an Internet Protocol (IP) address of an attack source, an attack time, an attack type, an attack target, and an abnormal behavior pattern during the attack.

[0115] It needs to be explained that the attack source IP address is used to characterize the IP address from which the attacker launches the attack, the attack type is used to characterize the attack means or tools used by the attacker, the attack target is used to characterize the target system or application attacked by the attacker, and the abnormal behavior pattern during the attack is used to characterize the abnormal behavior pattern exhibited by the attacker during the attack.

[0116] In a possible implementation, the security assessment device obtains data source characteristics of the attack instance based on a privacy protection strategy.

[0117] It can be understood that the security assessment device generates a privacy protection strategy, and based on the privacy protection strategy, obtains the data source characteristics of the attack instance, so as to protect the user information.

[0118] Optionally, the security assessment device can evaluate the privacy protection effect according to the sensitivity function, the privacy protection strength function and the availability function after obtaining the data source characteristics of the attack instance based on the privacy protection strategy.

[0119] In a possible implementation, the privacy protection effect evaluation value and the sensitivity function, the privacy protection strength function, and the availability function satisfy the following formula:

[0120]

[0121] Among them, P(d) is the privacy protection effect evaluation value, which is used to measure the balance between the effectiveness of the privacy protection strategy and data availability; σ(d i ) is the data d i The sensitivity function indicates the sensitivity of the data; ρ privacy (d i ) is the data d i The privacy protection strength function represents the degree of protection of the data by the privacy protection strategy; ρ utility (d i ) is the data d i The availability function represents the availability of data under the privacy protection policy; a and b are the upper and lower limits of the data range; ε is a positive integer.

[0122] It should be explained that the sensitivity function can be based on factors such as data type, content, source, and potential risks; the privacy protection strength function should comprehensively consider factors such as data sensitivity, business needs, and laws and regulations. The availability function can be determined based on factors such as data integrity, accuracy, and interpretability.

[0123] For example, for data items containing personal privacy, their sensitivity can be set to be higher; while for public information or insignificant data items, their sensitivity can be set to be lower.

[0124] In another possible implementation, after the security assessment device evaluates the privacy protection effect, it generates a privacy protection optimization strategy according to the risk value of the object to be evaluated before using the privacy protection strategy and the risk value of the object to be evaluated after using the privacy protection strategy.

[0125] Optionally, the privacy protection optimization strategy, the risk value of the object to be evaluated before using the privacy protection strategy, and the risk value of the object to be evaluated after using the privacy protection strategy satisfy the following formula:

[0126] O(S)=max S∈S (∑ t∈T (λ t ·(R(t)-R′(t;S)))-μ·∑ d∈D (P(d)-P′(d;S)) 2 ) Formula 4

[0127] Among them, O(S) is the optimized value of the privacy protection strategy S, which is used to evaluate the optimization effect of different privacy protection strategies;

[0128] S is the set of all possible privacy protection strategies; T is the set of time points, indicating that the strategies are evaluated at different time points; λ t is the weight at time point t, indicating the importance of the evaluation results at different time points; R(t) is the risk value before applying strategy S at time point t; R′(t; S) is the risk value after applying strategy S at time point t; μ is the balance factor, which is used to balance the weight between risk reduction and privacy protection effect improvement; D is the set of data sets; P(d) and are the privacy protection effect evaluation values ​​before applying strategy S to data d, and P′(d; S) is the privacy protection effect evaluation value after applying strategy S to data d.

[0129] S702: The security assessment device determines the attack source according to the data source characteristics of the attack instance.

[0130] In one possible implementation, the security assessment device attacks the data source characteristics of the instance, determines the registration information of the IP address, the geographic location area and the attack device information, and then locates the attack source based on the registration information of the IP address, the geographic location area and the attack device information.

[0131] It should be explained that the security assessment device can obtain the domain name owner, contact information, and registrar by querying the registration information of the IP address through the WHOIS database. The security assessment device uses the IP Geolocation tool to locate the attacker's geographical location based on the IP address, which helps to determine the attacker's physical location and network environment. The security assessment device can also conduct a reverse penetration test on the attacker's IP address to further analyze the attacker's network architecture, operating system, open ports and other information, and then deeply understand the attacker's background and attack methods.

[0132] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, when the security assessment result of the object to be assessed is used to indicate that there is a security risk in the security of the object to be assessed, the security assessment device obtains the data source characteristics of the attack instance. Since the data source characteristics include at least one of the following: the attack source IP address, the attack time, the attack type, the attack target, and the abnormal behavior pattern during the attack, the security assessment device locates the attack source according to the data source characteristics of the attack instance, so as to further block the attack of the attack source.

[0133] In one possible implementation, combining Figure 7 ,like Figure 8 As shown, in S702, after the security assessment device determines the attack source according to the data source characteristics of the attack instance, the security assessment device determines the accuracy of the attack source tracing analysis result. The process of the security assessment device determining the accuracy of the attack source tracing analysis result can be specifically implemented through the following S801-S804.

[0134] S801. The security assessment device obtains attack evidence corresponding to the attack instance.

[0135] Among them, the attack evidence is used to record the data information of the attack instance.

[0136] Optionally, the attack evidence includes at least one of the following: log file evidence, network traffic evidence, physical device evidence, and malicious code evidence.

[0137] In a possible implementation, the security assessment device obtains log data in the network, preprocesses the log data, and obtains attack evidence corresponding to the attack instance from the preprocessed log data.

[0138] Optionally, preprocessing includes at least one of the following: data cleaning, format conversion, and time synchronization.

[0139] S802: The security assessment device constructs an attack evidence chain based on the attack evidence and the attack source.

[0140] Among them, the attack evidence chain is used to represent the attack path of the attack instance.

[0141] In a possible implementation, the security assessment device constructs an attack evidence chain according to the attack evidence, the attack source, and the relationship between the attack evidence.

[0142] Optionally, the relationship between the attack evidence includes at least one of the following: time sequence, causal relationship, and logical relationship.

[0143] S803: The security assessment device obtains the traceability function of each evidence chain in the attack evidence chain.

[0144] Optionally, the provenance function can be an algorithm or a model, and we do not limit this.

[0145] It needs to be explained that the traceability function can analyze factors such as the connection relationship between nodes and the information propagation path, so as to estimate the possibility of each node being a source node.

[0146] S804. The security assessment device determines the tracing analysis result of the attack source according to the tracing function of each evidence chain in the attack evidence chain.

[0147] In a possible implementation, the abnormal behavior index, the abnormal behavior data, and the normal behavior data satisfy the following formula:

[0148]

[0149] Where, T(r) is the comprehensive score of traceability analysis, which is used to evaluate the accuracy and completeness of traceability analysis; θ l is the weight of the lth traceability feature, φ l (r) is the performance of the lth traceability feature on evidence r, which is used to quantify the effectiveness of the feature, ω q is the weight of the qth evidence chain, ψ trace (q) is the traceability function of the qth evidence chain, p is the total number of traceability features, and r is the total number of evidence chains.

[0150] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the security assessment device constructs an attack evidence chain based on the attack evidence and the attack source, verifies the tracing analysis results of the attack source based on the tracing function of each evidence chain in the attack evidence chain, and improves the reliability of locating the attack source.

[0151] It can be seen that the technical solution provided by the embodiment of the present application is introduced above mainly from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should be easily aware that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0152] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.

[0153] like Fig. 9 The figure is a schematic diagram of the structure of a security assessment device provided in an embodiment of the present application. The security assessment device can be used to perform Figure 3 , Figure 4 , Figure 5 , Figure 6 , Figure 7 , Figure 8 The method of safety assessment is shown. Fig. 9 The safety assessment device 90 shown includes: an acquisition unit 901 and a processing unit 902 .

[0154] The acquisition unit 901 is used to obtain the attack instances suffered by the object to be evaluated, and the historical behavior information of the attack instances; the historical behavior information includes the frequency of occurrence of the attack instances and / or the level of security incidents caused by the attack instances; the processing unit 902 is used to determine the security assessment result of the object to be evaluated based on the attack instances and the historical behavior information of the attack instances.

[0155] Optionally, the acquisition unit 901 is also used to obtain the attack type of each attack instance in the attack instance; the processing unit 902 is also used to determine the risk assessment value of each attack instance according to the attack type of the attack instance; the processing unit 902 is also used to determine the weight of the risk assessment value of the attack instance according to the frequency of occurrence of the attack instance and / or the level of security incidents caused by the attack instance; the weight of the risk assessment value of the attack instance is negatively correlated with the frequency of occurrence of the attack instance; the processing unit 902 is also used to determine the security assessment result of the object to be evaluated based on the risk assessment value of the attack instance and the weight of the risk assessment value of the attack instance.

[0156] Optionally, the acquisition unit 901 is also used to obtain user behavior characteristics of the object to be evaluated; the user behavior characteristics include abnormal behavior data; the processing unit 902 is also used to determine the abnormal behavior index based on the abnormal behavior data; the processing unit 902 is also used to determine the security assessment result of the object to be evaluated based on the attack instance and the historical behavior information of the attack instance and the abnormal behavior index.

[0157] Optionally, the processing unit 902 is further configured to determine an abnormal behavior index according to a relationship between the abnormal behavior data and the normal behavior data.

[0158] Optionally, when the security assessment result of the object to be assessed is used to indicate that there is a security risk in the security of the object to be assessed, the acquisition unit 901 is further used to obtain the data source characteristics of the attack instance; the processing unit 902 is further used to determine the attack source based on the data source characteristics of the attack instance.

[0159] Optionally, the acquisition unit 901 is also used to obtain the corresponding attack evidence of the attack instance; the attack evidence is used to record the data information of the attack instance; the processing unit 902 is also used to construct an attack evidence chain based on the attack evidence and the attack source; the attack evidence chain is used to represent the attack path of the attack instance; the acquisition unit 901 is also used to obtain the traceability function of each evidence chain in the attack evidence chain; the processing unit 902 is also used to determine the accuracy of the traceability analysis result of the attack source based on the traceability function of each evidence chain in the attack evidence chain.

[0160] An embodiment of the present application also provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instruction to implement the security assessment method in the above method embodiment.

[0161] An embodiment of the present application provides a computer program product including instructions. When the instructions are executed on a computer, the computer is enabled to execute the security assessment method in the above method embodiment.

[0162] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, and a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any other form of computer-readable storage medium in a suitable combination of the above, or numerical values ​​in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an Application Specific Integrated Circuit (ASIC). In embodiments of the present invention, computer-readable storage media may be any tangible media that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0163] Since the apparatus, device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.

[0164] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A safety assessment method, characterized in that: The method comprises: Obtaining attack instances suffered by the object to be evaluated and historical behavior information of the attack instances; the historical behavior information includes the frequency of occurrence of the attack instances and / or the level of security incidents caused by the attack instances; A security assessment result of the object to be assessed is determined according to the attack instance and the historical behavior information of the attack instance.

2. The method according to claim 1, characterized in that Determining, based on the attack instance and the historical behavior information of the attack instance, that the security assessment result of the object to be assessed is safe includes: Obtaining the attack type of each attack instance in the attack instance; Determining a risk assessment value of each attack instance according to the attack type of the attack instance; Determine the weight of the risk assessment value of the attack instance according to the frequency of occurrence of the attack instance and / or the level of the security incident caused by the attack instance; the weight of the risk assessment value of the attack instance is negatively correlated with the frequency of occurrence of the attack instance; A security assessment result of the object to be assessed is determined according to the risk assessment value of the attack instance and the weight of the risk assessment value of the attack instance.

3. The method according to claim 1, characterized in that Determining, based on the attack instance and the historical behavior information of the attack instance, that the security assessment result of the object to be assessed is safe includes: Acquiring user behavior characteristics of the object to be evaluated; the user behavior characteristics include abnormal behavior data; Determining an abnormal behavior index according to the abnormal behavior data; A security assessment result of the object to be assessed is determined according to the attack instance, the historical behavior information of the attack instance, and the abnormal behavior index.

4. The method according to claim 3, characterized in that The user behavior characteristics also include normal behavior data, and determining the abnormal behavior index according to the abnormal behavior data includes: The abnormal behavior index is determined according to the relationship between the abnormal behavior data and the normal behavior data.

5. The method according to claim 1, characterized in that After determining that the security assessment result of the object to be assessed is safe according to the attack instance and the historical behavior information of the attack instance, the method further includes: When the security assessment result of the object to be assessed is used to indicate that there is a security risk to the security of the object to be assessed, obtaining a data source feature of the attack instance; An attack source is determined according to data source characteristics of the attack instance.

6. The method according to claim 5, characterized in that After determining the attack source according to the data source characteristics of the attack instance, the method further includes: Acquire attack evidence corresponding to the attack instance; the attack evidence is used to record data information of the attack instance; Constructing an attack evidence chain according to the attack evidence and the attack source; the attack evidence chain is used to represent the attack path of the attack instance; Obtaining the traceability function of each evidence chain in the attack evidence chain; According to the tracing function of each evidence chain in the attack evidence chain, the accuracy of the tracing analysis result of the attack source is determined.

7. A safety assessment device, characterized in that: The device comprises: an acquisition unit and a processing unit; The acquisition unit is used to acquire the attack instance suffered by the object to be evaluated, and the historical behavior information of the attack instance; the historical behavior information includes the frequency of occurrence of the attack instance and / or the security incident level caused by the attack instance; The processing unit is used to determine the security assessment result of the object to be assessed according to the attack instance and the historical behavior information of the attack instance.

8. A safety assessment device, characterized in that: include: A processor and a memory; wherein the memory is used to store computer-executable instructions, and when the security assessment device is running, the processor executes the computer-executable instructions stored in the memory, so that the security assessment device performs the security assessment method described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises instructions, which, when executed by a security assessment device, cause the computer to perform the security assessment method according to any one of claims 1 to 6.

10. A computer program product, comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the security assessment method according to any one of claims 1 to 6 is implemented.

Images