Optimized information security risk assessment system based on directed weighted graph
By introducing directed weighted graphs into the information security risk assessment system, building a directed risk weighted graph and calculating the optimized risk value, the overall and comprehensive problems of information security risk assessment in complex information systems are solved, and more accurate risk assessment and system security improvement are achieved.
Patent Information
- Application Number
- CN202411859387.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-17
- Publication Date
- 2025-04-11
AI Technical Summary
Existing information security risk assessment methods are difficult to conduct global and comprehensive risk optimization assessment in complex information systems with multi-network convergence, multi-service crossover and multi-data interaction.
Adopting an optimized information security risk assessment system based on directed weighted graphs, the original risk input module, the weighted graph knowledge base module, the risk-weighted graph construction module and the risk optimization calculation module are used to construct a directed risk weighted graph, and the optimization risk value of each risk indicator is calculated to finally determine the level of information security risk.
The global and comprehensive optimization evaluation of information security risks is achieved, and information security risks in complex systems can be more accurately identified and managed, thereby enhancing the security and stability of the system.
Smart Images
Figure CN119808148A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to an optimized information security risk assessment system based on a directed weighted graph. Background Art
[0002] Information security risk assessment is the activity of identifying, analyzing and evaluating the information security risks faced by the system. It is currently mainly based on GBT 20984-2022 "Information Security Technology Information Security Risk Assessment Method" (hereinafter referred to as the "traditional method"), and conducts analysis and evaluation from three aspects: assets, threats and vulnerabilities.
[0003] Traditional methods can make a relatively objective assessment of the risks that vulnerabilities bring to information systems. However, for complex information systems with multi-network integration, multi-business intersections and multi-data interactions, information security risks are not completely independent. They will be affected by many other factors. On the basis of risk assessment using traditional methods, it is necessary to start from a global perspective, comprehensively consider the impact between various risks and between risks and security measures, and continue to optimize the assessment of information security risks in order to draw more accurate risk assessment conclusions. Summary of the invention
[0004] The technical problem to be solved by the present invention is to provide an optimized information security risk assessment system based on a directed weighted graph in view of the deficiencies of the above-mentioned prior art, so as to realize the optimized assessment of information security risks.
[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: an optimized information security risk assessment system based on a directed weighted graph, comprising an original risk input module, a weighted graph knowledge base module, a risk weighted graph construction module and a risk optimization calculation module; the original risk input module collects a risk list established by a traditional risk assessment method; the risk list refers to a list of information security risks, including four items: indicator items, risk descriptions, risk values and risk levels; the weighted graph knowledge base module is used to establish a weighted data knowledge base that stores the mutual influence between the indicator items in the risk list; the risk weighted graph construction module constructs a risk directed weighted graph based on the risk list constructed by the original risk input module and the weight knowledge database established by the weighted graph knowledge base module; the risk optimization calculation module calculates the optimized risk value of each risk indicator based on the risk directed weighted graph, and calculates the final risk level according to the risk determination correspondence between the risk value and the risk level.
[0006] Preferably, the traditional risk assessment method refers to a method for conducting risk assessment based on three elements: assets, threats and vulnerabilities.
[0007] Preferably, the indicator items in the risk list are selected by the assessor according to different assessment bases; the risk description is a description of the actual risk problem situation corresponding to the indicator item; the risk value is a risk value obtained by assessing the corresponding risk of the indicator item based on the traditional risk assessment method; the risk level is the risk level of the indicator item determined according to the risk value;
[0008] Preferably, the risk level is divided into five levels: very high, high, medium, low and very low.
[0009] Preferably, the weight data knowledge base includes three parts: evaluation index items, associated index items and influence weights; the evaluation index items and associated index items are two different names for the index items in the original risk input module, and their index ranges are consistent with the index item ranges in the original risk input module; the influence weight represents the influence value of the associated index item on the evaluation index item; the same evaluation index item corresponds to one or more different associated index items, and the same associated index item corresponds to one or more different evaluation index items. The evaluation index item and the associated index item form a directed graph influence path, and the influence weight is the weight value of the path.
[0010] Preferably, the risk-weighted graph construction module takes the output of the original risk input module and the weighted graph knowledge base module as input, selects an evaluation indicator consistent with the indicator item content from the weighted graph knowledge base module as the end point based on the indicator item content of the original input module, and takes its corresponding associated indicator item as the starting point to form the edge of the risk directed weighted graph, and the impact weight is the weight value of the corresponding edge.
[0011] Preferably, the risk directed weighted graph adopts an adjacency list and is stored in a storage method that combines sequential allocation and chain allocation, wherein the three elements of indicator items, risk descriptions and risk values of the risk list established by the original risk input module are stored in a sequential allocation method; the three elements of associated indicator items, associated indicator item risk values and impact weights in the weight data knowledge base established by the weighted graph knowledge base module are stored in a chain allocation method.
[0012] Preferably, the risk directed weighted graph construction process is as follows:
[0013] s1: Read the risk list of the original risk input module, and store the indicator items, risk descriptions and risk values in the risk list into the adjacency table in a sequential allocation manner;
[0014] s2: Traverse the adjacency table of the risk directed weighted graph, take out the risk content one by one in order, including the indicator item, risk description and risk value as the current indicator item, risk description and risk value, and perform the following operations:
[0015] I obtains all associated indicator items and influence weights of the evaluation indicator items equal to the current indicator item from the weighted graph knowledge base module to form an associated indicator weight list;
[0016] II traverses the list of associated indicator weights one by one, takes the associated indicator items and impact weights as the current data, and performs the following operations:
[0017] a) For the case where the associated indicator is in the risk list of the original risk input module, the risk value corresponding to the risk list is taken out, and it is combined with the associated indicator item and the impact weight as the chain allocation node of the adjacency list, and saved in the chain storage structure of the adjacency list of the current data;
[0018] b) In case the associated indicator is not in the risk list of the original risk input module, the risk value of the current indicator item is set to -D, where D is the risk value threshold and -D is the risk value corresponding to no risk; the risk value is combined with the associated indicator item and the impact weight as an adjacency list chain allocation node and saved in the chain storage structure of the adjacency list of the current data.
[0019] Preferably, the risk optimization calculation module calculates the optimized risk value of each risk indicator based on the risk directed weighted graph adjacency table according to the following formula:
[0020]
[0021] Among them, υ0 is the risk value of the evaluation index recorded by the sequential nodes of the adjacency table of the risk directed weighted graph, n represents the number of associated indicators corresponding to the evaluation index, and a i represents the risk value of the i-th associated indicator corresponding to the evaluation indicator, ω i It represents the impact weight, f is the risk value after optimization calculation, when f<0, set f=0; when f>D, set f=D.
[0022] The beneficial effect of adopting the above technical solution is that: the present invention provides an optimized information security risk assessment system based on a directed weighted graph. On the basis of the assessment results calculated by the traditional method, two parameters, the impact path and the path weight, are introduced to establish a directed weighted graph of mutual influence for each risk, and the corresponding weight values are set, thereby optimizing the assessment of information security risks according to graph theory. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1 A structural block diagram of an optimized information security risk assessment system based on a directed weighted graph provided by an embodiment of the present invention;
[0024] Figure 2 A schematic diagram of a risk directed weighted graph structure provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0025] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.
[0026] This embodiment takes a certain system as an example, and uses the optimized information security risk assessment system based on directed weighted graph of the present invention to assess the information security risk of the system.
[0027] In this embodiment, an optimized information security risk assessment system based on a directed weighted graph is provided. Figure 1 As shown, it includes an original risk input module, a weighted graph knowledge base module, a risk weighted graph construction module and a risk optimization calculation module; the original risk input module collects the risk list established by the traditional risk assessment method; wherein the traditional risk assessment method refers to a method of conducting risk assessment based on the three elements of assets, threats and vulnerabilities. The risk list refers to a list of information security risks, including four items: indicator items, risk descriptions, risk values and risk levels. Among them, the indicator items are selected by the assessors according to different assessment bases; the risk description is a description of the actual risk problem corresponding to the indicator item; the risk value is a risk value obtained by assessing the corresponding risk of the indicator item based on the traditional risk assessment method; the risk level is the risk level of the indicator item determined according to the risk value; in this embodiment, the risk level is divided into five levels: very high, high, medium, low and very low; the specific risk level and the corresponding risk value are: when the risk value of an indicator item is greater than 4.5, the risk level of the indicator item is very high; when the risk value of an indicator item is greater than 3.5 and less than or equal to 4.5, the risk level of the indicator item is high; when the risk value of an indicator item is greater than 2 and less than or equal to 3.5, the risk level of the indicator item is medium; when the risk value of an indicator item is greater than 1 and less than or equal to 2, the risk level of the indicator item is low; when the risk value of an indicator item is greater than 0 and less than or equal to 1, the risk level of the indicator item is very low; when the risk value of an indicator item is 0, the indicator item has no risk.
[0028] In this embodiment, according to the traditional risk assessment method, the risk list established by the original risk input module is shown in Table 1;
[0029] Table 1 Risk list established by the original risk input module
[0030]
[0031] The weighted graph knowledge base module is used to establish a weight data knowledge base that stores the mutual influence between each indicator item in the risk list; the weight data knowledge base includes three parts: evaluation indicator item, associated indicator item and influence weight; evaluation indicator item and associated indicator item are two different names for indicator items in the original risk input module, and their indicator range is consistent with the indicator item range in the original risk input module; the influence weight represents the influence value of the associated indicator item on the evaluation indicator item, ranging from 0 to 0.5, 0.5 is the maximum weight influence, and 0 is no influence; the same evaluation indicator item corresponds to one or more different associated indicator items, and the same associated indicator item corresponds to one or more different evaluation indicator items. The evaluation indicator item and the associated indicator item form a directed graph influence path, and the influence weight is the weight value of the path.
[0032] In this embodiment, according to the mutual influence relationship between the indicators in the risk list, a weight data knowledge base is established as shown in Table 2:
[0033] Table 2 Weight data knowledge base
[0034]
[0035]
[0036] The risk weighted graph construction module constructs a risk directed weighted graph based on the risk list constructed by the original risk input module and the weight knowledge database established by the weighted graph knowledge base module; the specific structure of the impact path and impact weight relationship of the directed risk weighted graph is as follows: Figure 2 shown.
[0037] In this embodiment, the risk weighted graph construction module takes the output of the original risk input module and the weighted graph knowledge base module as input, selects the evaluation indicator consistent with the indicator item content from the weighted graph knowledge base module as the end point based on the indicator item content of the original input module, and takes its corresponding associated indicator item as the starting point to form the edge of the risk directed weighted graph, and the impact weight is the weight value of the corresponding edge.
[0038] In this embodiment, the risk directed weighted graph adopts an adjacency list and is stored in a storage method that combines sequential allocation and chain allocation. Among them, the three elements of indicator items, risk descriptions and risk values of the risk list established by the original risk input module are stored in a sequential allocation method; the three elements of associated indicator items, associated indicator item risk values and impact weights in the weight data knowledge base established by the weighted graph knowledge base module are stored in a chain allocation method.
[0039] The specific construction process of the risk directed weighted graph is as follows:
[0040] s1: Read the risk list of the original risk input module, and store the indicator items, risk descriptions and risk values in the risk list into the adjacency table in a sequential allocation manner;
[0041] s2: traverse the adjacency table of the risk directed weighted graph, take out the risk content one by one in order, including the indicator item, risk description and risk value as the current indicator item, risk description and risk value, and perform the following operations:
[0042] I obtains all associated indicator items and influence weights of the evaluation indicator items equal to the current indicator item from the weighted graph knowledge base module to form an associated indicator weight list;
[0043] II traverses the list of associated indicator weights one by one, takes the associated indicator items and impact weights as the current data, and performs the following operations:
[0044] a) For the case where the associated indicator is in the risk list of the original risk input module, the risk value corresponding to the risk list is taken out, and it is combined with the associated indicator item and the impact weight as the chain allocation node of the adjacency list, and saved in the chain storage structure of the adjacency list of the current data;
[0045] b) In case the associated indicator is not in the risk list of the original risk input module, the risk value of the current indicator item is set to -D, where D is the risk value threshold and -D is the risk value corresponding to no risk. In this embodiment, D is 5; it is combined with the associated indicator item and the impact weight as an adjacency list chain allocation node and saved in the chain storage structure of the adjacency list of the current data.
[0046] In this embodiment, according to the impact path and impact weight relationship structure of the directed risk weighted graph, the structure and data of the adjacency table of the constructed directed weighted graph are shown in Table 3:
[0047] Table 3 Adjacency list of directed weighted graph
[0048]
[0049] The risk optimization calculation module calculates the optimized risk value of each risk indicator based on the risk directed weighted graph, and calculates the final risk level according to the risk determination correspondence between the risk value and the risk level.
[0050] In this embodiment, the risk optimization calculation module calculates the optimized risk value of each risk indicator based on the risk directed weighted graph adjacency table according to the following formula:
[0051]
[0052] Among them, v0 is the risk value of the evaluation index recorded by the sequential node of the adjacency table of the risk directed weighted graph, n represents the number of associated indicators corresponding to the evaluation index, and ai represents the risk value of the i-th associated indicator corresponding to the evaluation indicator, ω i It represents the impact weight, f is the risk value after optimization calculation, when f<0, set f=0; when f>5, set f=5.
[0053] After the above steps, the optimized risk value is calculated for each risk indicator, and the risk level corresponding to the optimized risk indicator can be obtained based on the risk determination correspondence between the risk value and the risk level.
[0054] In this embodiment, the optimized risk table is shown in Table 4;
[0055] Table 4 Optimized risk table
[0056]
[0057]
[0058] This information will provide basic support for decision-making and help formulate more targeted risk response strategies. By combining traditional risk assessment methods with modern graph theory technology, this invention will provide a more optimized method for system risk analysis, helping organizations to effectively identify and manage potential risks, thereby enhancing the security and stability of the system.
[0059] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.
Claims
1. An optimized information security risk assessment system based on directed weighted graph, characterized in that: It includes an original risk input module, a weighted graph knowledge base module, a risk weighted graph construction module and a risk optimization calculation module; the original risk input module collects the risk list established by the traditional risk assessment method; the risk list refers to a list of information security risks, including indicator items, risk descriptions, risk values and risk levels; The weighted graph knowledge base module is used to establish a knowledge base of weight data that stores the mutual influence between the indicator items in the risk list; The risk weighted graph construction module constructs a risk directed weighted graph based on the risk list constructed by the original risk input module and the weight knowledge database established by the weighted graph knowledge base module; the risk optimization calculation module calculates the optimized risk value of each risk indicator based on the risk directed weighted graph, and calculates the final risk level based on the risk determination correspondence between the risk value and the risk level.
2. The optimized information security risk assessment system based on directed weighted graph according to claim 1, characterized in that: The traditional risk assessment method refers to a method of conducting risk assessment based on three elements: assets, threats and vulnerabilities.
3. The optimized information security risk assessment system based on directed weighted graph according to claim 1, characterized in that: The indicators in the risk list are selected by the assessor according to different assessment bases; Risk description is the description of the actual risk problem corresponding to the indicator item; The risk value is a risk value obtained by evaluating the corresponding risk of the indicator item based on the traditional risk assessment method; The risk level is the risk level of the indicator item determined based on the risk value.
4. The optimized information security risk assessment system based on directed weighted graph according to claim 1, characterized in that: The risk levels are divided into five levels: very high, high, medium, low and very low.
5. The optimized information security risk assessment system based on directed weighted graph according to claim 1, characterized in that: The weight data knowledge base includes three parts: evaluation index items, associated index items and impact weights; the evaluation index items and associated index items are two different names for the index items in the original risk input module, and their index ranges are consistent with the index item ranges in the original risk input module; the impact weight represents the impact value of the associated index item on the evaluation index item; the same evaluation index item corresponds to one or more different associated index items, and the same associated index item corresponds to one or more different evaluation index items. The evaluation index item and the associated index item form a directed graph impact path, and the impact weight is the weight value of the path.
6. The optimized information security risk assessment system based on directed weighted graph according to claim 5, characterized in that: The risk weighted graph construction module takes the output of the original risk input module and the weighted graph knowledge base module as input, selects the evaluation indicator consistent with the indicator item content from the weighted graph knowledge base module as the end point according to the indicator item content of the original input module, and takes its corresponding associated indicator item as the starting point to form the edge of the risk directed weighted graph, and the impact weight is the weight value of the corresponding edge.
7. The optimized information security risk assessment system based on directed weighted graph according to claim 6, characterized in that: The risk directed weighted graph adopts an adjacency list and is stored in a storage method that combines sequential allocation and chain allocation. Among them, the three elements of indicator items, risk descriptions and risk values of the risk list established by the original risk input module are stored in a sequential allocation method; the three elements of associated indicator items, associated indicator item risk values and impact weights in the weight data knowledge base established by the weighted graph knowledge base module are stored in a chain allocation method.
8. The optimized information security risk assessment system based on directed weighted graph according to claim 7, characterized in that: The risk directed weighted graph construction process is as follows: s1: Read the risk list of the original risk input module, and store the indicator items, risk descriptions and risk values in the risk list into the adjacency table in a sequential allocation manner; s2: traverse the adjacency table of the risk directed weighted graph, take out the risk content one by one in order, including the indicator item, risk description and risk value as the current indicator item, risk description and risk value, and perform the following operations: I obtains all associated indicator items and influence weights of the evaluation indicator items equal to the current indicator item from the weighted graph knowledge base module to form an associated indicator weight list; II traverses the list of associated indicator weights one by one, takes the associated indicator items and impact weights as the current data, and performs the following operations: a) For the case where the associated indicator is in the risk list of the original risk input module, the risk value corresponding to the risk list is taken out, and it is combined with the associated indicator item and the impact weight as the chain allocation node of the adjacency list, and saved in the chain storage structure of the adjacency list of the current data; b) If the associated indicator is not in the risk list of the original risk input module, the risk value of the current indicator item is set to -D, where D is the risk value threshold and -D is the risk value corresponding to no risk; The risk value is combined with the associated indicator item and the impact weight as a chain distribution node of the adjacency list, and is saved in the chain storage structure of the adjacency list of the current data.
9. The optimized information security risk assessment system based on directed weighted graph according to claim 8, characterized in that: The risk optimization calculation module calculates the optimized risk value of each risk indicator based on the risk directed weighted graph adjacency table according to the following formula: Among them, υ0 is the risk value of the evaluation index recorded by the sequential nodes of the adjacency table of the risk directed weighted graph, n represents the number of associated indicators corresponding to the evaluation index, and a i represents the risk value of the i-th associated indicator corresponding to the evaluation indicator, ω i It represents the impact weight, f is the risk value after optimization calculation, when f<0, set f=0; when f>D, set f=D.