Multi-dimensional quantitative evaluation method for network security vulnerabilities

Abstract

The invention discloses a multi-dimensional quantitative evaluation method for network security vulnerabilities, which comprises the following steps: single vulnerability completes vulnerability utilization factor quantification according to evaluation indexes of multiple dimensions, completes vulnerability influence factor quantification according to the influence after vulnerability utilization, completes weight factor quantification according to the service influence range of a vulnerability host, and performs multi-dimensional quantitative evaluation according to the weight factor quantification. Position factor quantification is completed according to the deployment position of the vulnerability host; calculating quantized data of a single vulnerability according to the quantized factors; and sorting the plurality of vulnerabilities according to the quantized values from large to small, and repairing or disposing the vulnerabilities according to the sequence. According to the method, factors such as vulnerability utilization difficulty, vulnerability utilization influence, vulnerability host business influence and deployment positions are considered, business characteristics of vulnerability hosts are fully considered, comprehensive quantitative evaluation of system vulnerabilities can be realized, quantitative reference is provided for vulnerability disposal or alleviation, and the efficiency of vulnerability disposal and management and control is improved.

Description

Technical Field

[0001] The present invention relates to vulnerability assessment and control in network security, and in particular to a multi-dimensional quantitative assessment method for network security vulnerabilities based on comprehensive analysis of business scenarios. Background Art

[0002] The continuous increase in new devices and applications such as the Internet of Things, cloud services, and mobile devices inevitably brings with it numerous vulnerabilities. The attack surface of various organizations is constantly increasing, and the cybersecurity threats they face are becoming increasingly severe. According to statistics from authoritative organizations such as CVE, the number of security vulnerabilities has nearly tripled in the past decade and is showing a trend of continued growth. Large enterprises face the dilemma of accumulating vulnerabilities in security governance, while the average time to fix vulnerabilities is increasing. Old vulnerabilities are not fixed, new vulnerabilities continue to emerge, and the huge and rapid accumulation of vulnerabilities has caused enterprises to bear a heavy vulnerability debt.

[0003] Traditional vulnerability management directly uses the evaluation standards of the Common Vulnerability Scoring System (CVSS), with the focus on eliminating serious vulnerabilities with high CVSS scores. However, the CVSS evaluation mechanism is limited to the technical threats of the vulnerability itself, which is out of touch with the actual situation of the enterprise being threatened. In this case, it is possible that the enterprise invests a lot of resources in vulnerability repair while paying for "non-existent threats", while the real threats may not be repaired in time and expose the vulnerabilities to attackers. How to complete the repair of high-risk vulnerabilities in a timely manner with limited time, manpower and material resources, and the objective quantitative evaluation of vulnerabilities has become the key. Summary of the invention

[0004] In order to solve the above-mentioned defects existing in the prior art, the purpose of the present invention is to provide a multi-dimensional quantitative assessment method for network security vulnerabilities, which adopts multi-dimensional indicators to quantify vulnerabilities and business scenarios, realizes a comprehensive dynamic evaluation of vulnerabilities, and provides a quantitative indicator reference for the subsequent effective disposal of vulnerabilities.

[0005] The present invention is achieved through the following technical solutions.

[0006] One aspect of the present invention provides a multi-dimensional quantitative evaluation method for network security vulnerabilities, comprising the following steps:

[0007] Quantify the exploitability factor of a single vulnerability based on multiple dimensions of evaluation indicators;

[0008] Complete the quantification of vulnerability impact factors based on the impact after vulnerability exploitation;

[0009] Complete the quantification of vulnerability host weight factors based on the business impact of the vulnerability host;

[0010] Complete the host deployment location factor quantification according to the deployment location of the vulnerable host;

[0011] Calculate the quantitative index of the vulnerability based on the vulnerability exploitation factor, vulnerability impact factor, vulnerability host weight factor, and vulnerability host deployment location factor;

[0012] Determine the order of handling multiple vulnerabilities based on the quantitative indicators of the vulnerabilities, and carry out vulnerability repair or handling in the order of handling.

[0013] Preferably, the vulnerability exploitation factor includes evaluation indicators of 11 dimensions of the vulnerability, quantitative indicators of the dependence of the vulnerability exploitation method on the environment, quantitative indicators of the dependence of the vulnerability exploitation on permissions, quantitative indicators of the effectiveness of the vulnerability exploitation code, quantitative indicators of the change of vulnerability exploitation configuration parameters, quantitative indicators of the vulnerability exploitation success rate, quantitative indicators of the timeliness of vulnerability exploitation feedback, quantitative indicators of the hiding ability of the vulnerability exploitation, quantitative indicators of the interaction requirements of the vulnerability exploitation, quantitative indicators of the impact on the host confidentiality after the vulnerability exploitation, quantitative indicators of the impact on the host integrity after the vulnerability exploitation, and quantitative indicators of the impact of the vulnerability exploitation on the availability of host components.

[0014] As a preference, the quantitative indicators of environmental dependence are divided into: vulnerability exploitation can be completed as long as the network is accessible, vulnerability exploitation can be completed by logging into the system through a remote desktop or a local user, and vulnerability exploitation can be completed only when direct contact with the device or system is completed to complete specific operations.

[0015] As a preference, the quantitative indicators of permission dependence are divided into: vulnerability exploitation can be completed without any permission, vulnerability exploitation can be completed with ordinary user permissions, and vulnerability exploitation can be completed with administrator permissions.

[0016] As a preference, the quantitative indicators of vulnerability exploit code effectiveness are divided into: the attack code is effective under any circumstances, the attack code is effective when it succeeds 3 or more times out of 5 executions, and the attack code needs to be modified each time before it becomes effective.

[0017] As a preference, the quantitative indicators of vulnerability exploit configuration parameter changes are divided into: configuration parameters that do not require modification of the business system are valid in any case, and configuration parameters that require modification of the business system are valid.

[0018] Preferably, the vulnerability exploitation success rate quantitative indicators are divided into: the attack is effective in any case, the attack is effective when it can succeed at least 3 times out of 5 executions, or the attack is effective when it can succeed at least 1 time but less than 3 times out of 5 executions.

[0019] As a preference, the quantitative indicators of vulnerability exploitation feedback time are divided into: attack effect feedback time ≤ 1 minute, 1 minute < feedback time ≤ 1 day, feedback time > 1 day.

[0020] As a preference, the quantitative indicators of vulnerability exploit hiding ability are divided into: the attack process will not be recognized by security equipment and most security configurations are invalid, the attack process will not be recognized by traditional security equipment and can be executed under conventional security configurations, the attack process will only not be recognized by specific security equipment and cannot be completed under most security configurations, and the attack process can only be carried out without security equipment.

[0021] As a preference, the quantitative index of vulnerability exploitation interaction requirement is divided into: the exploitation of the vulnerability does not require user interaction and requires user interaction.

[0022] As a preference, the quantitative indicators of the impact of host confidentiality after vulnerability exploitation are divided into: complete loss of confidentiality, certain loss of confidentiality, and no confidentiality loss of the affected components.

[0023] As a preference, the quantitative indicators of the impact on host integrity after vulnerability exploitation are divided into: host components are completely destroyed or protection is completely lost, data may be modified but the attacker cannot control the modification results or the modification amount is limited, and the integrity of the affected host components is not destroyed.

[0024] As a preference, the quantitative indicators of the impact of vulnerability exploitation on the availability of host components are divided into: complete loss of availability, performance degradation or interference with resource availability, and no disruption to the availability of the affected component.

[0025] Preferably, the vulnerability impact factor is quantified according to the impact after the vulnerability is exploited, including dividing the indicators into the first level of impact according to the impact on the business system after the vulnerability is exploited, which directly affects the control system, steals the core data of the system, and causes serious consequences; the second level of impact causes the main services to stop; or obtains the control authority of the server or workstation; or obtains core data such as important engineering data and production data; or affects the control of terminal equipment, and the expected impact is controllable; the third level of impact obtains other service permissions or sensitive data in the business system and steals terminal equipment data.

[0026] Preferably, the vulnerability host weight factor is quantified according to the business impact scope of the vulnerability host, including dividing the indicator into multi-production unit cross-domain control-level systems, single production unit-level systems, and production unit internal terminal systems according to the business impact scope of the vulnerability host.

[0027] Preferably, the host deployment location factor is quantified according to the deployment location of the vulnerable host, including dividing the indicator into the business system on the Internet side, the business system on the enterprise intranet and the physically isolated business system according to the security partition location where the vulnerable host is deployed.

[0028] Preferably, the multiple vulnerabilities are sorted from large to small according to the quantitative values.

[0029] The present invention adopts the above technical solution, which has the following beneficial effects:

[0030] Aiming at the deficiency of traditional vulnerability evaluation relying on Common Vulnerability Score System (CVSS) scoring, the method of the present invention comprehensively considers factors such as vulnerability exploitation difficulty, vulnerability exploitation impact, vulnerability host business impact and deployment location, fully considers the business characteristics of the vulnerability host, adopts the quantification method of vulnerability exploitation factor, and quantifies the vulnerability exploitation method according to the degree of dependence of the vulnerability exploitation method on the environment, the degree of dependence on permissions, the effectiveness of the exploitation code, the degree of dependence on configuration parameter changes, the vulnerability exploitation success rate, the timeliness of feedback after exploitation, the hiding ability of the exploitation method, the pre-requirement for interaction, and the impact on the confidentiality, integrity and availability of the host system after exploitation, so as to obtain the vulnerability exploitation quantification factor F. vul . It realizes a more comprehensive quantitative assessment of system vulnerabilities, provides a quantitative reference for vulnerability handling or mitigation, and improves the efficiency of vulnerability handling and control. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of the present application, and do not constitute an improper limitation of the present invention. In the drawings:

[0032] Figure 1 Flowchart for vulnerability quantitative assessment. DETAILED DESCRIPTION

[0033] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments. The exemplary embodiments and descriptions of the present invention are used to explain the present invention but are not intended to limit the present invention.

[0034] like Figure 1 As shown, an embodiment of the present invention provides a multi-dimensional quantitative assessment method for network security vulnerabilities based on comprehensive analysis of business scenarios, including quantifying vulnerability impact factors according to the impact after vulnerability exploitation, quantifying weight factors according to the business impact range of the vulnerability host, and quantifying location factors according to the deployment location of the vulnerability host; based on the above-mentioned quantitative factors, calculating the quantitative data of a single vulnerability; sorting multiple vulnerabilities from large to small according to the quantitative values, and carrying out vulnerability repair or mitigation work in this order.

[0035] The specific steps include:

[0036] Step S11, calculate vulnerability exploitation factor F vul .

[0037] E vul It is the quantitative value of a vulnerability. A single vulnerability completes the quantification of vulnerability exploitation factor according to the evaluation indicators of 11 dimensions. The quantitative calculation method includes the following steps:

[0038] Exploit Factor Fvul The calculation formula is as follows:

[0039]

[0040] Among them, F vk It is an evaluation index of 11 dimensions of vulnerabilities.

[0041] F v1 It is a quantitative indicator of the dependency of vulnerability exploitation on the environment. This indicator is divided into three levels:

[0042] 1) The attacker can complete the vulnerability exploitation process as long as the network is reachable;

[0043] 2) The attacker needs to log in to the system through remote desktop or local user to complete the vulnerability exploitation process;

[0044] 3) The attacker needs to directly access the device or system to complete specific operations to complete the vulnerability exploitation process.

[0045] Table 1F v1 Quantization value table

[0046] Serial number <![CDATA[F v1 Level]]> <![CDATA[F v1 Score]]> 1 Level 1 200 2 Level 2 100 3 Level 3 50

[0047] F v2 It is a quantitative indicator of the dependency of vulnerability exploits on permissions. The indicator is divided into three levels:

[0048] 1) The attacker does not need any permissions to exploit the vulnerability;

[0049] 2) An attacker only needs ordinary user privileges to exploit the vulnerability;

[0050] 3) An attacker needs administrator privileges to complete the exploit.

[0051] Table 2F v2 Quantization value table

[0052] Serial number <![CDATA[F v2 Level]]> <![CDATA[F v2 Score]]> 1 Level 1 200 2 Level 2 100 3 Level 3 50

[0053] F v3 It is a quantitative indicator of the effectiveness of vulnerability exploit code, which is divided into three levels:

[0054] 1) The attacker's attack code is effective in any case;

[0055] 2) The attacker's attack code is effective in most cases, where most means that it succeeds 3 or more times out of 5 times;

[0056] 3) The attacker’s attack code needs to be modified each time before it can take effect.

[0057] Table 3F v3 Quantization value table

[0058] Serial number <![CDATA[F v3 Level]]> <![CDATA[F v3 Score]]> 1 Level 1 50 2 Level 2 30 3 Level 3 20

[0059] F v4 It is a quantitative indicator of vulnerability exploit configuration parameter changes. The indicator is divided into three levels:

[0060] 1) The attacker does not need to modify the configuration parameters of the business system, and it is effective in any case;

[0061] 2) The attacker needs to modify the configuration parameters of the business system. The number of configuration items modified is ≤ 3 without affecting the normal operation of the business.

[0062] 3) The attacker needs to modify the default configuration parameters of the system and modify more than 3 configuration items without affecting the normal operation of the business.

[0063] The scores decrease according to the changes in the vulnerability exploit configuration parameters.

[0064] Table 4F v4 Quantization value table

[0065] Serial number <![CDATA[F v4 Level]]> <![CDATA[F v4 Score]]> 1 Level 1 50 2 Level 2 30 3 Level 3 10

[0066] F v5 It is a quantitative indicator of the success rate of vulnerability exploitation. The indicator is divided into three levels:

[0067] 1) The attack is effective in all circumstances;

[0068] 2) The attack is effective in most cases, where most means that it succeeds at least 3 times out of 5 times;

[0069] 3) The attack is effective in a minority of cases, where the number of successful cases means that the attack is successful at least once but less than three times out of five attempts.

[0070] Table 5F v5 Quantization value table

[0071] Serial number <![CDATA[F v5 Level]]> <![CDATA[F v5 Score<!-- 4 --> ]]> 1 Level 1 50 2 Level 2 30 3 Level 3 10

[0072] F v6 It is a quantitative indicator of vulnerability exploit feedback timeliness, which is divided into three levels:

[0073] 1) The attack effect feedback time is short, the feedback time is ≤ 1 minute;

[0074] 2) The attack effect feedback time is medium, 1 minute < feedback time ≤ 1 day;

[0075] 3) The feedback time of attack effect is long, and the feedback time is greater than 1 day.

[0076] Table 6F v6 Quantization value table

[0077] Serial number <![CDATA[F v6 Level]]> <![CDATA[F v6 Score]]> 1 Level 1 50 2 Level 2 30 3 Level 3 10

[0078] F v7 It is a quantitative indicator of vulnerability exploit hiding ability, which is divided into four levels:

[0079] 1) Strong hiding ability, the attack process will not be recognized by security equipment and most security configurations will be invalid;

[0080] 2) The hiding ability is moderate. The attack process will not be identified by traditional IDS, traffic audit and other security equipment and can be executed under conventional security configuration;

[0081] 3) The hiding ability is average. The attack process will not be recognized by certain security equipment and cannot be completed under most security configurations;

[0082] 4) No hiding capability, the attack process can only be carried out without security equipment.

[0083] Table 7F v7 Quantization value table

[0084] Serial number <![CDATA[F v7 Level]]> <![CDATA[F v7 Score]]> 1 Level 1 50 2 Level 2 30 3 Level 3 20 4 Level 4 10

[0085] F v8 It is a quantitative indicator of the interaction requirements for vulnerability exploitation. The indicator is divided into two levels:

[0086] 1) The exploitation of the vulnerability does not require user interaction, and the attacker can directly exploit the vulnerability;

[0087] 2) Exploitation of the vulnerability requires user interaction, and exploitation of the vulnerability requires users to make preparations in advance. For example, attackers can only exploit it when the administrator installs an application, clicks a link, or opens a document.

[0088] Table 8F v8 Quantization value table

[0089] Serial number <![CDATA[F v8 Level]]> <![CDATA[F v8 Score]]> 1 Level 1 50 2 Level 2 25

[0090] F v9 It is a quantitative indicator of the impact on host confidentiality after vulnerability exploitation. The indicator is divided into three levels:

[0091] 1) Confidentiality is completely lost, resulting in the leakage of resources in all affected components to the attacker. Although only certain restricted information can be obtained, the leaked information will have a direct and serious impact;

[0092] 2) There is a certain loss of confidentiality. The attacker can obtain certain restricted information, but the information obtained cannot be controlled or the amount or type of loss is limited. Information leakage will not cause direct and serious damage to the affected components;

[0093] 3) The affected components suffered no loss of confidentiality.

[0094] Table 9F v9 Quantization value table

[0095] Serial number <![CDATA[F v9 Level]]> <![CDATA[F v9 Score]]> 1 Level 1 100 2 Level 2 50 3 Level 3 0

[0096] F v10 It is a quantitative indicator of the impact on host integrity after the vulnerability is exploited. This indicator is divided into three levels:

[0097] 1) High integrity impact, the host component is completely destroyed or protection is completely lost, resulting in direct and serious consequences. For example, the attacker can modify any file protected by the affected component;

[0098] 2) Low integrity impact: data may be modified, but the attacker cannot control the results of the modification, or the modification is limited. The modification of data will not bring direct and serious consequences to the affected components;

[0099] 3) The integrity of the affected host components is not compromised.

[0100] Table 10F v1 Quantization value table

[0101] Serial number <![CDATA[F v10 Level]]> <![CDATA[F v10 Score]]> 1 Level 1 100 2 Level 2 50 3 Level 3 0

[0102] F v11 It is a quantitative indicator of the impact of vulnerability exploitation on the availability of host components. The indicator is divided into three levels:

[0103] 1) Availability is severely impacted, with complete loss of availability. The affected component cannot provide services to legitimate users. The damage is continuous or long-term, bringing direct and serious consequences to the attacked component.

[0104] 2) Low availability impact, performance degradation or resource availability disruption. Even if the vulnerability is exploited multiple times, the attacker cannot completely deny service to legitimate users, and overall there are no direct, severe consequences for the attacked component;

[0105] 3) The availability of the affected components is not compromised.

[0106] Table 11F v11 Quantization value table

[0107] Serial number <![CDATA[F v11 Level]]> <![CDATA[F v11 Score]]> 1 Level 1 100 2 Level 2 50 3 Level 3 0

[0108] Step S12: Calculate vulnerability impact factor F eff .

[0109] This indicator is divided into three levels according to the impact on the business system after the vulnerability is exploited.

[0110] 1) Impact level 1, directly affecting the control system, stealing the core data of the system, causing serious consequences;

[0111] 2) Impact on the second level, resulting in the suspension of major services; or obtaining control of servers and workstations; or obtaining core data such as important engineering data and production data; or affecting the control of terminal equipment. The expected impact is controllable;

[0112] 3) Impact level 3: Obtaining other service permissions or sensitive data in the business system and stealing terminal device data.

[0113] Table 12F eff Quantization coefficient table

[0114] Serial number <![CDATA[F eff Level]]> <![CDATA[F eff Coefficient]]> 1 Level 1 5 2 Level 2 2 3 Level 3 1

[0115] Step S13: Calculate the vulnerability host weight factor F wei .

[0116] This indicator is divided into three levels according to the business impact scope of the vulnerability host.

[0117] 1) Multi-production unit cross-domain control level system;

[0118] 2) Single production unit level system;

[0119] 3) Terminal system inside the production unit.

[0120] Table 13F wei Quantization coefficient table

[0121] Serial number <![CDATA[F wei Level]]> <![CDATA[F wei Coefficient]]> 1 Level 1 3 2 Level 2 2 3 Level 3 1

[0122] Step S14: Calculate the vulnerability host deployment location factor F loc .

[0123] This indicator is divided into three levels according to the security partition location where the vulnerability host is deployed.

[0124] 1) Business system on the Internet side;

[0125] 2)Business system of the enterprise intranet;

[0126] 3) Physically isolated business systems.

[0127] Table 13F loc Quantization coefficient table

[0128] Serial number <![CDATA[F loc Level]]> <![CDATA[F loc Coefficient]]> 1 Level 1 5 2 Level 2 2 3 Level 3 1

[0129] Step S15: Calculate the quantitative index E of the vulnerability based on the vulnerability exploitation factor, vulnerability impact factor, vulnerability host weight factor and vulnerability host deployment location factor vul .

[0130] E vul =F vul *F eff *F wei *F loc

[0131] Among them, F vul is the vulnerability exploitation factor, F eff is the vulnerability impact factor, F wei is the vulnerability host weight factor, F loc Deploy location factors for vulnerable hosts.

[0132] Step 16: Utilize factor E based on the vulnerability's quantitative indicators vul Determine the order in which to address multiple vulnerabilities.

[0133] Multiple vulnerabilities according to E vul Sort the vulnerabilities from large to small, and repair or resolve them in sequence according to the sorting.

[0134] Since the devices and environments related to the vulnerabilities are changing dynamically, if one factor changes, the quantitative calculation will be performed again to dynamically reflect the changes in the network security situation.

[0135] The method of the present invention is further illustrated by a specific embodiment below.

[0136] The following vulnerabilities were found in the two business systems:

[0137] (a) CNVD-2016-03894 (Siemens SIMATIC S7-300 CPU Denial of Service Vulnerability). The host business system of this vulnerability is S7 PLC, which is deployed in the safe production area. A one-way isolation device is deployed at the boundary of the safe area, and the security protection strength is close to physical isolation.

[0138] (b) CVE-2023-0027 (Sensitive Data Leakage of Modbus TCP Server AOI of Rockwell Automation). The host business system of this vulnerability is a PLC demonstration system, which is deployed in the Internet zone and has a firewall deployed at the boundary with logical isolation capabilities.

[0139] A quantitative assessment is conducted on the two vulnerabilities respectively.

[0140] The quantitative assessment of CNVD-2016-03894 vulnerability is as follows:

[0141]

[0142] F eff : The controller service is stopped and the quantization index is 2.

[0143] F wei : The business system belongs to the terminal-level system, and the quantitative index is 1.

[0144] F loc : Physical isolation system, the quantitative index is 1.

[0145] E vul =F vul *F eff *F wei *F loc =770*2*1*1=1440.

[0146] The quantitative assessment of CNVD-2016-03894 vulnerability is as follows:

[0147]

[0148] F eff : Does not directly affect the operation of the control system, and the quantitative index is 1.

[0149] F wei : The business system belongs to the terminal-level system, and the quantitative index is 1.

[0150] F loc : Enterprise intranet system, the quantitative index is 2.

[0151] E vul =F vul *F eff *F wei *F loc =620*1*1*5=3100.

[0152] The two vulnerabilities are sorted from large to small according to the quantitative value. The score of vulnerability 2 (3100) is greater than the score of vulnerability 1 (1440), so vulnerability 2 is given priority when it is repaired.

[0153] It can be seen from the above embodiments that the present invention comprehensively considers factors such as the difficulty of vulnerability exploitation, the impact of vulnerability exploitation, the business impact of the vulnerability host and the deployment location, and fully considers the business characteristics of the vulnerability host. It can achieve a more comprehensive quantitative assessment of system vulnerabilities, provide a quantitative reference for vulnerability handling or mitigation, and improve the efficiency of vulnerability handling and control.

[0154] The present invention is not limited to the above-mentioned embodiments. On the basis of the technical solution disclosed in the present invention, technicians in this field can make some substitutions and deformations to some technical features therein according to the disclosed technical content without creative labor, and these substitutions and deformations are all within the protection scope of the present invention.

Claims

1. A multi-dimensional quantitative evaluation method for network security vulnerabilities, characterized in that: include: Quantify the exploitability factor of a single vulnerability based on evaluation indicators in multiple dimensions; Complete the quantification of vulnerability impact factors based on the impact after vulnerability exploitation; Complete the quantification of vulnerability host weight factors based on the business impact of the vulnerability host; Complete the host deployment location factor quantification according to the deployment location of the vulnerable host; Calculate the quantitative index of the vulnerability based on the vulnerability exploitation factor, vulnerability impact factor, vulnerability host weight factor, and vulnerability host deployment location factor; Determine the order of handling multiple vulnerabilities based on the quantitative indicators of the vulnerabilities, and carry out vulnerability repair or handling in the order of handling.

2. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 1 is characterized in that: Exploit Factor F vul The calculation formula is as follows: Among them, F vk is the evaluation index of the x dimensions of the vulnerability, x≥11.

3. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 1 is characterized in that: The evaluation indicators of multiple dimensions include evaluation indicators of 11 dimensions: Quantitative indicators of vulnerability exploitation method's dependence on environment, quantitative indicators of vulnerability exploitation's dependence on permissions, quantitative indicators of vulnerability exploitation code effectiveness, quantitative indicators of vulnerability exploitation configuration parameter change, quantitative indicators of vulnerability exploitation success rate, quantitative indicators of vulnerability exploitation feedback timeliness, quantitative indicators of vulnerability exploitation hiding ability, quantitative indicators of vulnerability exploitation interaction requirements, quantitative indicators of the impact on host confidentiality after vulnerability exploitation, quantitative indicators of the impact on host integrity after vulnerability exploitation, and quantitative indicators of the impact of vulnerability exploitation on host component availability.

4. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 3 is characterized in that: The quantitative indicators of environmental dependence are divided into: vulnerability exploitation can be completed as long as the network is accessible, vulnerability exploitation can be completed through remote desktop or local user login system, and vulnerability exploitation can be completed only after direct contact with the device or system to complete specific operations; The quantitative indicators of permission dependence are divided into: vulnerability exploitation can be completed without any permission, vulnerability exploitation can be completed with ordinary user permissions, and vulnerability exploitation can be completed with administrator permissions; The quantitative indicators of vulnerability exploit code effectiveness are as follows: the attack code is effective in all cases, the attack code is effective when it succeeds 3 or more times out of 5 executions, and the attack code needs to be modified each time before it can take effect; The quantitative indicators of vulnerability exploit configuration parameter changes are divided into: configuration parameters that do not require modification of the business system are valid in any case, and configuration parameters that require modification of the business system are valid; The quantitative indicators of vulnerability exploitation success rate are divided into: the attack is effective in all cases, the attack is effective when it succeeds at least 3 times out of 5 executions, or the attack is effective when it succeeds at least 1 time but less than 3 times out of 5 executions; The quantitative indicators of vulnerability exploit feedback time are divided into: attack effect feedback time ≤ 1 minute, 1 minute < feedback time ≤ 1 day, feedback time > 1 day; The quantitative indicators of vulnerability exploit hiding ability are divided into: the attack process will not be recognized by security equipment and most security configurations are invalid; the attack process will not be recognized by traditional security equipment and can be executed under conventional security configurations; the attack process will only not be recognized by specific security equipment and cannot be completed under most security configurations; the attack process can only be carried out without security equipment; The quantitative indicators of vulnerability exploit interaction requirements are divided into: exploitation of the vulnerability does not require user interaction, and exploitation of the vulnerability requires user interaction; The quantitative indicators of the impact of host confidentiality after vulnerability exploitation are divided into: complete loss of confidentiality, certain loss of confidentiality, and no loss of confidentiality of the affected component; The quantitative indicators of the impact on host integrity after the vulnerability is exploited are divided into: the host component is completely destroyed or the protection is completely lost, the data may be modified but the attacker cannot control the modification results or the modification amount is limited, and the integrity of the affected host component is not destroyed; The quantitative indicators of the impact of vulnerability exploitation on the availability of host components are divided into: complete loss of availability, performance degradation or interference with resource availability, and no disruption to the availability of the affected components.

5. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 1 is characterized in that: The vulnerability impact factor is quantified based on the impact after the vulnerability is exploited. This includes dividing the indicators into level one, which directly affects the control system and steals the core data of the system, causing serious consequences; level two, which causes the main services to stop; or obtains control rights to servers and workstations; or obtains core data such as important engineering data and production data; or affects terminal device control, and the expected impact is controllable; level three, which obtains other service permissions or sensitive data in the business system and steals terminal device data.

6. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 1 is characterized in that: The vulnerability host weight factor is quantified based on the business impact scope of the vulnerability host, including dividing the indicator into multi-production unit cross-domain management and control level systems, single production unit level systems and production unit internal terminal systems based on the business impact scope of the vulnerability host.

7. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 1 is characterized in that: The host deployment location factor is quantified based on the deployment location of the vulnerable host, including dividing the indicators into business systems on the Internet side, business systems on the enterprise intranet, and business systems that are physically isolated based on the security partition location where the vulnerable host is deployed.

8. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 1 is characterized in that: Calculate the vulnerability quantitative index E according to the vulnerability exploitation factor, vulnerability impact factor, vulnerability host weight factor and vulnerability host deployment location factor. vul : E vul =F vul *F eff *F wei *F loc Among them, F vul is the vulnerability exploitation factor, F eff is the vulnerability impact factor, F wei is the vulnerability host weight factor, F loc Deploy locality factors for vulnerable hosts.

9. The multi-dimensional quantitative evaluation method for network security vulnerabilities according to claim 1 is characterized in that: Multiple vulnerabilities are sorted from large to small according to the quantitative value.

Images