Risk level assessment method, electronic equipment, storage medium and program product

Abstract

The invention provides a risk level evaluation method, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring an influence level and an attack feasibility level evaluated by target network assets in a conceptual design stage; performing a virtual simulation test on the target network asset in the simulation test environment to obtain a simulation test result; and evaluating the security risk level of the target network asset according to the simulation test result, the influence level and the attack feasibility level. A virtual simulation test is carried out on a real target network asset in a simulation test environment, and the security risk level of the target network asset is evaluated according to a simulation test result and the influence level and the attack feasibility level evaluated in the conceptual design stage. Dependence on expert experience and intuition and subjectivity of manual judgment are effectively reduced, the influence of subjective deviation on the safety risk level is reduced, and therefore the accuracy of evaluating the safety risk level is improved.

Description

Technical Field

[0001] The present application relates to the technical field of automobile information security, and in particular to a risk level assessment method, electronic equipment, storage medium and program product. Background Art

[0002] At present, automobile manufacturers usually conduct cybersecurity risk threat assessments for the entire vehicle / components / business at the conceptual stage. There are also practices of conducting information security threat assessments from the perspective of the entire vehicle / business in the later stages of vehicle development to determine the level of information security risk and provide technical support for the subsequent application of security protection technologies. In the specific practice process, it was found that these traditional methods often rely on expert experience and intuition to score, which is prone to introduce subjective bias. Different experts make different assessments based on different backgrounds and knowledge, resulting in a lack of consistency in the assessment of security risk levels. For some complex attack paths or damage scenarios, it is difficult to fully capture their complexity through simple qualitative descriptions, which affects the accuracy of assessing security risk levels. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a risk level assessment method, electronic device, storage medium and program product, which are used to improve the problem of low accuracy of security risk levels.

[0004] The embodiment of the present application provides a risk level assessment method, including: obtaining the impact level and attack feasibility level of the target network asset assessed in the conceptual design stage; performing a virtual simulation test on the target network asset in a simulation test environment to obtain the simulation test results; and evaluating the security risk level of the target network asset according to the simulation test results, the impact level, and the attack feasibility level. In the implementation process of the above scheme, by performing a virtual simulation test on the real target network asset in the simulation test environment, the simulation test results of the simulated target network asset are obtained, and the security risk level of the target network asset is evaluated according to the simulation test results, the impact level and the attack feasibility level assessed in the conceptual design stage, which effectively reduces the reliance on expert experience and intuition and the subjectivity of human judgment, and reduces the impact of subjective bias on the security risk level, so that the final security risk level is closer to the actual situation, thereby improving the accuracy of evaluating the security risk level.

[0005] Optionally, in an embodiment of the present application, before performing a virtual simulation test on the target network asset in the simulation test environment, it also includes: simulating and building the target network asset according to the target threat scenario in the threat scenario library to obtain a simulation test environment. In the implementation process of the above scheme, by performing simulation and building based on the specific threat scenario in the threat scenario library, it is ensured that the simulation test environment reflects the intentions and technical means of potential attackers as realistically as possible, which makes the test results closer to the actual situation, reduces the errors caused by environmental differences, and thus improves the accuracy of assessing the security risk level.

[0006] Optionally, in an embodiment of the present application, after the target network asset is subjected to a virtual simulation test in a simulation test environment, it also includes: determining whether the virtual simulation attack on the target network asset is successful; if so, performing damage identification on the target network asset in the simulation test environment, obtaining a simulated damage scenario, and determining the attack feasibility score and impact score of the target network asset in the simulation test environment according to the simulated damage scenario. In the implementation process of the above scheme, the impact level and attack feasibility level obtained in the initial conceptual design stage are verified and corrected through actual simulation test results, reducing the errors that may be caused by assumptions or theoretical models, and adjusting the evaluation parameters in real time according to the specific circumstances of the simulated damage scenario to ensure that the evaluation results are closer to the actual situation, avoiding the limitations of the static evaluation method, and thus improving the accuracy of evaluating the security risk level.

[0007] Optionally, in an embodiment of the present application, the attack feasibility score of the target network asset in the simulation test environment is determined according to the simulated damage scenario, including: performing attack analysis on the simulated damage scenario to obtain the attack path of the target network asset in the simulation test environment; performing attack feasibility assessment on the attack path to obtain the attack feasibility score. In the implementation process of the above scheme, the detailed simulated damage scenario and the actual attack path are used for evaluation, which reduces the errors that may be caused by assumptions or theoretical models, making the evaluation results closer to the actual situation, thereby improving the accuracy of evaluating the security risk level.

[0008] Optionally, in an embodiment of the present application, after determining whether the virtual simulation attack on the target network asset is successful, it also includes: if the virtual simulation attack on the target network asset fails, the target network asset is protected and identified in the simulation test environment to obtain the security protection result of the target network asset. In the implementation process of the above scheme, the attack feasibility score is adjusted in real time according to the specific attack path and simulation test results to ensure that the evaluation results reflect the latest threats and technical trends. By analyzing the unsuccessful attack attempts in the simulation test, it can be confirmed that the existing protection measures (such as firewalls, intrusion detection systems, etc.) are indeed effective, ensuring that these successful defense strategies are incorporated into the final design and deployment, so as to verify the effectiveness of the existing protection measures and reduce unnecessary rework and waste of resources.

[0009] Optionally, in an embodiment of the present application, the security risk level of the target network asset is evaluated according to the simulation test results, the impact level and the attack feasibility level, including: using the impact score in the simulation test results to correct the impact level to obtain the corrected impact level; using the attack feasibility score in the simulation test results to correct the attack feasibility level to obtain the corrected attack feasibility level; determining the security risk level according to the security protection results, the corrected impact level and the corrected attack feasibility level. In the implementation process of the above scheme, the impact level and the attack feasibility level obtained in the initial conceptual design stage are corrected by the specific impact score and the attack feasibility score in the simulation test results, which reduces the errors that may be caused by assumptions or theoretical models, and the security risk level is determined by using the security protection results, the corrected impact level and the corrected attack feasibility level, so that the results are closer to the actual situation, thereby improving the accuracy of evaluating the security risk level. Further, through the comprehensive evaluation of the corrected impact level and the attack feasibility level, the risk points can be accurately located, and more targeted suggestions can be provided for security design, ensuring that resources are concentrated in the most needed places and improving the overall security level.

[0010] Optionally, in an embodiment of the present application, the security risk level of the target network asset is evaluated based on the simulation test results, the impact level and the attack feasibility level, including: using the impact score in the simulation test results to correct the impact level to obtain a corrected impact level; using the attack feasibility score in the simulation test results to correct the attack feasibility level to obtain a corrected attack feasibility level; determining the security risk level based on the corrected impact level and the corrected attack feasibility level. In the implementation process of the above scheme, the impact level and the attack feasibility level obtained in the initial conceptual design stage are corrected by the specific impact score and the attack feasibility score in the simulation test results, which reduces the errors that may be caused by assumptions or theoretical models, and the security risk level is determined using the corrected impact level and the corrected attack feasibility level, so that the result is closer to the actual situation, thereby improving the accuracy of evaluating the security risk level.

[0011] The embodiment of the present application also provides a risk level assessment device, including: an assessment level acquisition module, used to obtain the impact level and attack feasibility level of the target network assets assessed in the conceptual design stage; a test result acquisition module, used to perform virtual simulation testing on the target network assets in a simulation test environment to obtain simulation test results; a risk level assessment module, used to assess the security risk level of the target network assets based on the simulation test results, impact level and attack feasibility level.

[0012] Optionally, in an embodiment of the present application, the risk level assessment device further includes: a simulation environment construction module, which is used to simulate and build the target network assets according to the target threat scenario in the threat scenario library to obtain a simulation test environment.

[0013] Optionally, in an embodiment of the present application, the risk level assessment device also includes: a test result judgment module, used to judge whether the virtual simulation attack on the target network asset is successful; an asset score determination module, used to identify damage to the target network asset in a simulation test environment if the virtual simulation attack on the target network asset is successful, obtain a simulation damage scenario, and determine the attack feasibility score and impact score of the target network asset in the simulation test environment based on the simulation damage scenario.

[0014] Optionally, in an embodiment of the present application, the asset score determination module includes: an attack path acquisition sub-module, which uses an attack analysis on a simulated damage scenario to obtain an attack path of the target network asset in a simulated test environment; and an attack feasibility assessment sub-module, which is used to perform an attack feasibility assessment on the attack path to obtain an attack feasibility score.

[0015] Optionally, in an embodiment of the present application, the risk level assessment device also includes: an asset protection identification module, which is used to identify the protection of the target network assets in a simulation test environment if the virtual simulation attack on the target network assets fails, and obtain the security protection results of the target network assets.

[0016] Optionally, in an embodiment of the present application, the risk level assessment module includes: an impact level correction submodule, which is used to correct the impact level using the impact score in the simulation test results to obtain a corrected impact level; an attack feasibility correction submodule, which is used to correct the attack feasibility level using the attack feasibility score in the simulation test results to obtain a corrected attack feasibility level; and a security risk determination submodule, which is used to determine the security risk level based on the security protection results, the corrected impact level and the corrected attack feasibility level.

[0017] Optionally, in an embodiment of the present application, the risk level assessment module includes: an impact level acquisition sub-module, which is used to correct the impact level using the impact score in the simulation test results to obtain a corrected impact level; an attack level acquisition sub-module, which is used to correct the attack feasibility level using the attack feasibility score in the simulation test results to obtain a corrected attack feasibility level; and a security level determination sub-module, which is used to determine the security risk level based on the corrected impact level and the corrected attack feasibility level.

[0018] An embodiment of the present application further provides an electronic device, including: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the machine-readable instructions execute the method described above when executed by the processor.

[0019] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described above is executed.

[0020] The embodiment of the present application also provides a computer program product, including: a computer program or a computer instruction, and the computer program or the computer instruction executes the method described above when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0022] Figure 1A schematic diagram of a process flow of a risk level assessment method provided by an embodiment of the present application is shown;

[0023] Figure 2 A schematic diagram of a process for jointly determining a security risk level in a conceptual design phase and a simulation test verification phase provided in an embodiment of the present application is shown;

[0024] Figure 3 A schematic diagram of the process of virtual simulation testing and grade correction provided by an embodiment of the present application is shown;

[0025] Figure 4 A schematic diagram of the structure of a risk level assessment device provided in an embodiment of the present application is shown;

[0026] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] To make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. It should be understood that the drawings in the embodiment of the present application only serve the purpose of explanation and description, and are not used to limit the protection scope of the embodiment of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in the embodiment of the present application shows the operation implemented according to some embodiments of the embodiment of the present application. It should be understood that the operation of the flowchart can be implemented out of order, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the embodiment of the present application, or remove one or more operations from the flowchart.

[0028] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all embodiments. The components of the embodiments of the present application described and shown in the drawings generally here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the embodiments of the present application claimed, but merely represents the selected embodiments of the embodiments of the present application.

[0029] It is understandable that the "first" and "second" in the embodiments of the present application are used to distinguish similar objects. Those skilled in the art will understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not necessarily limit the difference. In the description of the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that there may be three relationships, such as A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the related objects before and after are in an "or" relationship. The term "multiple" refers to more than two (including two), and similarly, "multiple groups" refers to more than two groups (including two groups).

[0030] It should be noted that the risk level assessment method provided in the embodiment of the present application can be executed by an electronic device, where the electronic device refers to a device terminal or server with the function of executing a computer program, such as a smart phone, a personal computer, a tablet computer, a personal digital assistant or a mobile Internet device. A server refers to a device that provides computing services through a network, such as an x86 server and a non-x86 server, and a non-x86 server includes a mainframe, a minicomputer and a UNIX server.

[0031] The following is an example of an application scenario in which the risk level assessment method is applicable: After conducting a cybersecurity risk threat assessment of the entire vehicle / components / business in the conceptual stage, or after conducting an information security threat assessment from the perspective of the entire vehicle / business in the later stage of vehicle development, automobile manufacturers can use the risk level assessment method to assess the security risk level of the target network assets again. Specifically, the security risk level of the target network assets is assessed based on the simulation test results, the impact level assessed in the conceptual design stage, and the attack feasibility level, so as to reduce reliance on expert experience and intuition and the subjectivity of human judgment, reduce the impact of subjective bias on the security risk level, and thereby make the final security risk level closer to the actual situation.

[0032] See also Figure 1 The flowchart of the risk level assessment method provided by the embodiment of the present application is shown; the main idea of ​​the risk level assessment method is to evaluate the security risk level of the target network assets by combining the simulation test results obtained by virtual simulation testing of real target network assets in a simulation test environment with the impact level and attack feasibility level assessed in the conceptual design stage, which effectively reduces the reliance on expert experience and intuition and the subjectivity of human judgment, reduces the impact of subjective bias on the security risk level, and thus improves the accuracy of assessing the security risk level. The implementation methods of the above risk level assessment method may include:

[0033] Step S110: Obtain the impact level and attack feasibility level of the target network asset evaluated in the conceptual design phase.

[0034] Target network assets refer to target network assets that need to be assessed for risk level, which can be network assets in intelligent and connected vehicles (ICV) or network assets in enterprise local area networks.

[0035] An implementation example of the above step S110 is as follows: in the conceptual design stage of the target network assets, the target network assets are identified from the entire vehicle and system objects through the Threat Analysisi and Risk Assessment (TARA) methodology, and the network security attributes corresponding to the assets are determined. Among them, the above TARA methodology is an international standard that defines an automotive network security framework. TARA mainly identifies network security risks by identifying automotive network assets, analyzing the impact of potential security threats, and comprehensively considering factors such as the feasibility of threat attacks and the impact of hazards. Then, the target network assets and network security attributes are evaluated to obtain the impact level and attack feasibility level of the target network assets, and the impact level and attack feasibility level of the target network assets are stored in a file system or database. Finally, the impact level and attack feasibility level of the target network asset evaluated in the conceptual design stage can be read from the file system or database.

[0036] Specifically, the above-mentioned evaluation of the target network assets and network security attributes to obtain the impact level and attack feasibility level of the target network assets may include: evaluating the impact level of the target network assets in the damage scenario from the network security attributes of the four dimensions of security, financial, operational and privacy. Among them, the above-mentioned impact levels may include: severe, major, moderate, and negligible. The above-mentioned security dimension mainly evaluates the impact of the attack on the operational safety of the vehicle, such as the possible traffic accidents or life dangers. The above-mentioned financial dimension mainly estimates the economic impacts such as the repair cost, potential fines, and increased insurance claims. The above-mentioned operational dimension mainly considers the impact on the daily operation efficiency of the vehicle and the availability of services. The above-mentioned privacy dimension mainly measures the risk of personal data leakage and its impact on user privacy. The above-mentioned attack feasibility level can be obtained by analyzing the possible implementation path of the threat scenario of the target network assets. For example, the analysis can be based on historical experience such as known vulnerabilities, attack cases, and vulnerability analysis results. The threat scenario describes the possible reasons for the destruction of the target network assets, such as tampering with the vehicle location information to cause the integrity of the location information to be lost, thereby causing abnormal autonomous driving functions. It is understandable that one attack path or multiple attack paths can be analyzed from a threat scenario of a target network asset, and the Common Vulnerability Scoring System (CVSS) in the TARA methodology is used to evaluate the feasibility of the relevant attack paths of the target network asset from network security attributes such as attack vectors, attack complexity, permission requirements, and user interactions, thereby obtaining the attack feasibility level of the target network asset. Among them, the above-mentioned CVSS is a standardized framework in the TARA methodology, which is used to quantify the impact of software security vulnerabilities. It provides a scoring system based on multiple indicators (such as attack vectors, attack complexity, required permissions, etc.) to help organizations evaluate and prioritize security vulnerabilities. CVSS is mainly used to evaluate the severity of a single vulnerability and provide a static score.

[0037] Step S120: Perform a virtual simulation test on the target network asset in a simulation test environment to obtain a simulation test result.

[0038] A simulation testing environment (STE) is a virtualized platform that simulates real-world conditions to perform security testing on target network assets without affecting the actual system. The environment can accurately reproduce the architecture, configuration, and operating status of the target system and support the execution of various attack scenarios to verify the security of the system.

[0039] See also Figure 2The illustrated schematic diagram of the process of jointly determining the security risk level in the conceptual design phase and the simulation test verification phase provided by the embodiment of the present application; on the left side of the figure, in the conceptual design phase, the threat scenario of the target network asset and the attack path under the threat scenario are analyzed from a logical level, so as to analyze the attack feasibility level and the impact level of the target network asset under the damage scenario according to the attack path under the threat scenario. On the right side of the figure is the simulation test verification phase, specifically, a virtual simulation test is performed on the target network asset in a simulation test environment to obtain the simulation test results. It is understandable that this virtual simulation test can simulate various complex attack scenarios in a virtual environment, including multi-stage attacks, cross-system collaborative attacks, etc., to ensure that the evaluation covers a wide range and in-depth, so the simulation test results can provide specific and quantifiable evidence, so that the evaluation results are closer to the actual situation, avoiding errors that may be caused by assumptions or theoretical models.

[0040] Step S130: Evaluate the security risk level of the target network assets according to the simulation test results, the impact level and the attack feasibility level.

[0041] It can be understood that the simulation test results can be used to further correct the impact level of the target network assets in the damage scenario, and can also be used to further correct the attack feasibility level in the threat scenario. The specific correction process will be described in detail below.

[0042] In the process of implementing the above scheme, a virtual simulation test is performed on the real target network assets in a simulation test environment to obtain the simulation test results of the simulated target network assets, and the security risk level of the target network assets is evaluated based on the simulation test results, the impact level and the attack feasibility level evaluated in the conceptual design stage. In other words, when evaluating the security risk level, not only the impact level and the attack feasibility level are considered, but also the simulation test results of the simulated target network assets are additionally considered. This simulation test result is likely to find the deficiencies in the evaluation theory in the conceptual design stage, thereby reducing the reliance on expert experience and intuition and the subjectivity of human judgment, and reducing the impact of subjective bias on the security risk level, so that the final security risk level is closer to the actual situation, thereby improving the accuracy of the security risk level evaluation.

[0043] As an optional implementation of the above step S120, before performing a virtual simulation test on the target network asset in the simulation test environment, a simulation test environment may also be built. This implementation may include:

[0044] Step S121: simulating and building target network assets according to target threat scenarios in the threat scenario library to obtain a simulation test environment.

[0045] Threat Scenario Library (TSL) refers to a database that stores threat scenarios. This threat scenario library has accumulated a large amount of historical data, industry reports and research papers, and contains rich threat intelligence. The above threat scenario library provides a set of standardized terms and descriptions, allowing different departments (such as design, engineering, and security teams) to communicate and collaborate based on a common language and standards, reducing misunderstandings and information asymmetry.

[0046] It is understandable that by selecting specific target threat scenarios from the threat scenario library, resources can be concentrated on testing those issues that pose the greatest threat to business or user security, avoiding the need to divert attention to low-risk issues. As new threat intelligence and technology develop, the threat scenario library can be continuously updated to ensure that the simulation test environment always reflects the latest threat situation and maintains the timeliness and effectiveness of the assessment system.

[0047] The implementation method of the above step S121 is, for example: a simulation test environment can be built according to the threat scenario library in the TARA methodology. Specifically, assuming that the target threat scenario in the threat scenario library is "the tampered vehicle speed information is sent to the gateway (GateWay, GW)", the network assets in the intelligent connected car are simulated and built in the target threat scenario to obtain a simulation test environment. Usually complex attacks may involve interactions between multiple system components. By simulating the construction of a simulation test environment for the target network assets, these interactive behaviors and attack paths can be more accurately reproduced, thereby better verifying the effectiveness of defense measures. Simulation testing can perform comprehensive safety testing without affecting the actual vehicle, avoiding the risks and high costs that may be brought about by physical testing.

[0048] See also Figure 3 The process diagram of virtual simulation test and level correction provided by the embodiment of the present application is shown; as an optional implementation of the above step S120, after the target network asset is subjected to virtual simulation test in the simulation test environment, it also includes:

[0049] Step S122: Determine whether the virtual simulation attack on the target network asset is successful.

[0050] Step S123: If the virtual simulation attack on the target network asset is successful, damage identification is performed on the target network asset in the simulation test environment to obtain a simulated damage scenario, and the attack feasibility score and impact score of the target network asset in the simulation test environment are determined based on the simulated damage scenario.

[0051] An implementation example of the above steps S122 to S123 is as follows: the electronic device can determine whether the virtual simulation attack on the target network asset is successful through an executable program. If the virtual simulation attack on the target network asset is successful, damage to the target network asset is identified in a simulation test environment to obtain a simulated damage scenario.

[0052] It can be understood that after obtaining the simulated damage scenario, the simulated damage scenario of the target network asset can be scored from an example table of the TARA methodology below, thereby obtaining the attack feasibility score and impact score of the target network asset in the simulated test environment.

[0053]

[0054] Among them, the impact score is obtained by experts scoring according to the four dimensions of security (S), finance (F), operation (O) and privacy (P) in the above table, while the attack feasibility score is obtained by scoring using the Common Vulnerability Scoring System (CVSS) in the TARA methodology.

[0055] It is understandable that since the above-mentioned attack feasibility score and impact score are obtained by scoring the simulated damage scenarios of the target network assets, through detailed damage identification, we can have a deeper understanding of the specific path and consequences of a successful attack, and discover those hidden threats that are difficult to capture in static assessments. Furthermore, the simulated damage scenarios of the target network assets can simulate and verify complex multi-stage attacks and cross-system collaborative attacks, ensuring that the assessment covers a wide range and depth, and improving the overall security of the system. Therefore, this scoring method is closer to the actual scenario, thus reducing the reliance on expert experience and intuition and the subjectivity of human judgment, and reducing the impact of subjective bias on the security risk level, so that the final security risk level obtained is closer to the actual situation, thereby improving the accuracy of assessing the security risk level.

[0056] As an optional implementation of the above step S123, an implementation of determining the attack feasibility score of the target network asset in the simulation test environment according to the simulation damage scenario may include:

[0057] Step S123a: Perform attack analysis on the simulated damage scenario to obtain the attack path of the target network asset in the simulated test environment.

[0058] Step S123b: Perform an attack feasibility assessment on the attack path to obtain an attack feasibility score.

[0059] The implementation method of the above steps S123a to S123b is, for example: using the Common Vulnerability Scoring System (CVSS) in the TARA methodology to perform attack analysis on the simulated damage scenario, obtain the attack path of the target network assets in the simulated test environment, help identify potential vulnerabilities in the design, and take preventive measures in advance. Then, the attack feasibility of the attack path can be evaluated according to the STRIDE model (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of service, Elevation of privilege) in the above table to obtain an attack feasibility score, and evaluate the feasibility of the attack path from multiple dimensions. For each attack path, not only the indicators in the CVSS standard are considered, but also the threat types in the STRIDE model are combined to provide a more comprehensive attack feasibility assessment. For example, evaluate whether the attacker needs specific permissions (such as administrator permissions) and the possible consequences of a successful attack (such as information leakage, service interruption, etc.).

[0060] In the implementation of the above solution, by applying CVSS to the specific attack path in the simulation test environment, not only the severity of a single vulnerability can be evaluated, but also the feasibility and impact of the entire attack chain can be evaluated. This extension enables CVSS to more comprehensively reflect the true situation of the attack. Further combined with the simulation test results, all steps from the initial contact point to the final damage are identified, and the corresponding CVSS score is assigned to each step, including the assessment of the security of each intermediate node, so that the overall attack path can be evaluated more accurately.

[0061] As an optional implementation of the above step S120, after determining whether the virtual simulation attack on the target network asset is successful, the following steps are further included:

[0062] Step S124: If the virtual simulation attack on the target network asset fails, protection identification is performed on the target network asset in the simulation test environment to obtain a security protection result for the target network asset.

[0063] An example of an implementation method of the above step S124 is: assuming that the target threat scenario in the threat scenario library is "the tampered vehicle speed information is sent to the gateway", if the virtual simulation attack on the target network asset fails, then in the simulation test environment, the target network asset is protected and identified according to the design of the gateway to obtain the security protection result of the target network asset. Among them, if the target threat scenario in the threat scenario library is "the tampered vehicle speed information is sent to the gateway", then the security protection result here can be the protection strategy installed on the gateway. Optionally, after obtaining the security protection result, the successful protection strategy can also be analyzed to ensure that these effective defense measures are incorporated into the final design, which not only verifies the effectiveness of the existing protection measures, but also provides a valuable reference for future security designs.

[0064] As a first optional implementation of the above step S130, the implementation of evaluating the security risk level of the target network asset according to the simulation test results, the impact level and the attack feasibility level may include:

[0065] Step S131: Correct the impact level using the impact score in the simulation test result to obtain a corrected impact level.

[0066] For example, in the implementation of the above step S131, assuming that the impact level assessed in the conceptual design phase is slight, and the impact score in the simulation test result is 3, indicating a medium impact, the impact level can be corrected using the impact score in the simulation test result, and the corrected impact level can be medium instead of slight. The impact level can include slight, medium, and severe, and the impact score can include 1, 2, 3, 4, and 5, etc.

[0067] Step S132: Correct the attack feasibility level using the attack feasibility score in the simulation test result to obtain a corrected attack feasibility level.

[0068] For example, in the implementation of the above step S132, assuming that the attack feasibility level evaluated in the conceptual design phase is high, and the attack feasibility score in the simulation test result is 3, indicating medium attack feasibility, the attack feasibility level can be corrected using the attack feasibility score in the simulation test result, and the corrected attack feasibility level can be medium instead of high. Among them, the attack feasibility level can include: low, medium and high, and the attack feasibility score can include: 1, 2, 3, 4 and 5, etc.

[0069] Step S133: Determine the security risk level according to the security protection result, the corrected impact level and the corrected attack feasibility level.

[0070] For example, in the implementation of the above step S133, if the security protection result is "protection policy installed", and the impact level after correction is medium, and the attack feasibility level after correction is medium, then the security risk level can be determined as medium. Optionally, based on the corrected evaluation results, resources can be reasonably allocated to prioritize those issues that pose the greatest threat to business or user security, avoiding resource dispersion.

[0071] As a second optional implementation of the above step S130, the implementation of evaluating the security risk level of the target network asset according to the simulation test results, the impact level and the attack feasibility level may include:

[0072] Step S134: Correct the impact level using the impact score in the simulation test result to obtain a corrected impact level.

[0073] For example, in the implementation of the above step S134, assuming that the impact level assessed in the conceptual design phase is slight, and the impact score in the simulation test result is 3, indicating a medium impact, the impact level can be corrected using the impact score in the simulation test result, and the corrected impact level can be medium instead of slight. The impact level can include slight, medium, and severe, and the impact score can include 1, 2, 3, 4, and 5, etc.

[0074] Step S135: Correct the attack feasibility level using the attack feasibility score in the simulation test result to obtain a corrected attack feasibility level.

[0075] For example, in the implementation of the above step S135, assuming that the attack feasibility level evaluated in the conceptual design phase is high, and the attack feasibility score in the simulation test result is 3, indicating medium attack feasibility, the attack feasibility level can be corrected using the attack feasibility score in the simulation test result, and the corrected attack feasibility level can be medium instead of high. Among them, the attack feasibility level can include: low, medium and high, and the attack feasibility score can include: 1, 2, 3, 4 and 5, etc.

[0076] Step S136: Determine the security risk level according to the corrected impact level and the corrected attack feasibility level.

[0077] The implementation method of the above step S136 is, for example: assuming that the impact level after correction is medium, and the attack feasibility level after correction is medium, then the security risk level can be determined as medium.

[0078] See also Figure 4 The structure diagram of the risk level assessment device provided in the embodiment of the present application is shown; the embodiment of the present application provides a risk level assessment device 200, including:

[0079] The evaluation level acquisition module 210 is used to acquire the impact level and attack feasibility level of the target network asset evaluated in the conceptual design phase.

[0080] The test result obtaining module 220 is used to perform a virtual simulation test on the target network assets in a simulation test environment to obtain a simulation test result.

[0081] The risk level assessment module 230 is used to assess the security risk level of the target network assets according to the simulation test results, the impact level and the attack feasibility level.

[0082] As an optional implementation of the above device, the risk level assessment device further includes:

[0083] The simulation environment building module is used to simulate and build the target network assets according to the target threat scenario in the threat scenario library to obtain a simulation test environment.

[0084] As an optional implementation of the above device, the risk level assessment device further includes:

[0085] The test result judgment module is used to judge whether the virtual simulation attack on the target network asset is successful.

[0086] The asset score determination module is used to identify damage to the target network assets in the simulation test environment if the virtual simulation attack on the target network assets is successful, obtain the simulation damage scenario, and determine the attack feasibility score and impact score of the target network assets in the simulation test environment based on the simulation damage scenario.

[0087] As an optional implementation of the above device, the asset score determination module includes:

[0088] The attack path acquisition submodule uses an attack analysis on the simulated damage scenario to obtain the attack path of the target network assets in the simulated test environment.

[0089] The attack feasibility assessment submodule is used to assess the attack feasibility of the attack path and obtain an attack feasibility score.

[0090] As an optional implementation of the above device, the risk level assessment device further includes:

[0091] The asset protection identification module is used to identify the target network assets in a simulation test environment if the virtual simulation attack on the target network assets fails, and obtain the security protection results of the target network assets.

[0092] As an optional implementation of the above device, the risk level assessment module includes:

[0093] The impact level correction submodule is used to correct the impact level using the impact score in the simulation test result to obtain the corrected impact level.

[0094] The attack feasibility correction submodule is used to correct the attack feasibility level using the attack feasibility score in the simulation test result to obtain the corrected attack feasibility level.

[0095] The security risk determination submodule is used to determine the security risk level based on the security protection results, the corrected impact level and the corrected attack feasibility level.

[0096] As an optional implementation of the above device, the risk level assessment module includes:

[0097] The impact level obtaining submodule is used to correct the impact level using the impact score in the simulation test result to obtain the corrected impact level.

[0098] The attack level acquisition submodule is used to correct the attack feasibility level using the attack feasibility score in the simulation test result to obtain the corrected attack feasibility level.

[0099] The security level determination submodule is used to determine the security risk level according to the corrected impact level and the corrected attack feasibility level.

[0100] It should be understood that the device corresponds to the above-mentioned risk level assessment method embodiment and can perform the various steps involved in the above-mentioned method embodiment. The specific functions of the device can be found in the above description, and the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the device.

[0101] See also Figure 5 The electronic device 300 provided in the embodiment of the present application includes: a processor 310 and a memory 320, wherein the memory 320 stores machine-readable instructions executable by the processor 310, and when the machine-readable instructions are executed by the processor 310, the above method is executed.

[0102] The embodiment of the present application also provides a computer-readable storage medium 330, on which a computer program is stored, and the computer program is executed by the processor 310 to execute the above method. The computer-readable storage medium 330 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk.

[0103] The embodiment of the present application also provides a computer program product, including: a computer program or a computer instruction, and the computer program or the computer instruction executes the method described above when executed by a processor.

[0104] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0105] In several embodiments provided by the embodiments of the present application, it should be understood that the disclosed device and method can also be implemented in other ways. The device embodiments described above are only schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible implementation architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a part of a module, a program segment or a code, and a part of a module, a program segment or a code includes one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also be different from the order of occurrence marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which is mainly determined by the functions involved.

[0106] In addition, each functional module of each embodiment in the embodiment of the present application can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part. In addition, in the description of this specification, the description of reference terms "one embodiment", "some embodiments", "example", "specific example", "some examples", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of the present application. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples without contradiction.

[0107] The above description is only an optional implementation manner of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the embodiments of the present application, which should be covered within the protection scope of the embodiments of the present application.

Claims

1. A risk level assessment method, characterized in that: include: Obtain the impact level and attack feasibility level of the target network assets assessed during the conceptual design phase; Performing a virtual simulation test on the target network asset in a simulation test environment to obtain a simulation test result; The security risk level of the target network asset is evaluated according to the simulation test result, the impact level and the attack feasibility level.

2. The method according to claim 1, characterized in that Before performing a virtual simulation test on the target network asset in the simulation test environment, the method further includes: The target network assets are simulated and built according to the target threat scenario in the threat scenario library to obtain the simulation test environment.

3. The method according to claim 1, characterized in that After performing a virtual simulation test on the target network asset in the simulation test environment, the method further includes: Determining whether the virtual simulation attack on the target network asset is successful; If so, damage identification is performed on the target network asset in the simulation test environment to obtain a simulated damage scenario, and the attack feasibility score and impact score of the target network asset in the simulation test environment are determined based on the simulated damage scenario.

4. The method according to claim 3, characterized in that Determining the attack feasibility score of the target network asset in the simulation test environment according to the simulation damage scenario includes: Performing attack analysis on the simulated damage scenario to obtain an attack path of the target network asset in the simulated test environment; An attack feasibility assessment is performed on the attack path to obtain the attack feasibility score.

5. The method according to claim 3, characterized in that: After determining whether the virtual simulation attack on the target network asset is successful, the method further includes: If the virtual simulation attack on the target network asset fails, protection identification is performed on the target network asset in the simulation test environment to obtain a security protection result for the target network asset.

6. The method according to claim 5, characterized in that The evaluating the security risk level of the target network asset according to the simulation test result, the impact level and the attack feasibility level includes: Correcting the impact level using the impact score in the simulation test result to obtain a corrected impact level; Correcting the attack feasibility level using the attack feasibility score in the simulation test result to obtain a corrected attack feasibility level; The security risk level is determined according to the security protection result, the corrected impact level and the corrected attack feasibility level.

7. The method according to claim 3, characterized in that The evaluating the security risk level of the target network asset according to the simulation test result, the impact level and the attack feasibility level includes: Correcting the impact level using the impact score in the simulation test result to obtain a corrected impact level; Correcting the attack feasibility level using the attack feasibility score in the simulation test result to obtain a corrected attack feasibility level; The security risk level is determined according to the corrected impact level and the corrected attack feasibility level.

8. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the machine-readable instructions are executed by the processor to perform any method according to claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is executed.

10. A computer program product, characterized in that include: A computer program or a computer instruction, wherein when the computer program or the computer instruction is executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images