Network security vulnerability assessment method and device based on general vulnerability scoring system

Abstract

The invention relates to a network security vulnerability assessment method and device based on a general vulnerability scoring system. The method comprises the following steps: sending protocol fuzz test data to a to-be-tested object to receive abnormal information returned by the to-be-tested object; classifying the abnormal information, and taking the abnormal information of the same abnormal information type as the abnormal information of the same abnormal information set; assigning each abnormal information set to obtain values of each abnormal information set in different influence factors; based on a mapping relationship between the influence factors and measurement indexes in a general vulnerability scoring system, mapping values of each abnormal information set in different influence factors into values corresponding to different measurement indexes; and calculating values corresponding to different measurement indexes of each abnormal information set to obtain an evaluation score corresponding to each abnormal information set, and obtaining a network security vulnerability evaluation result. By adopting the method, the accuracy and the efficiency of evaluating the network security vulnerabilities can be improved.

Description

Technical Field

[0001] The present application relates to the field of security testing technology, and in particular to a network security vulnerability assessment method and device based on a universal vulnerability scoring system. Background Art

[0002] In the field of security testing technology, abnormal information is generated through a protocol fuzzy testing method, and security detection is performed on the device under test based on the abnormal information.

[0003] However, in traditional protocol fuzz testing methods, testers are required to conduct subjective, one-by-one evaluations based on the response information returned by the device under test, so as to obtain the evaluation results of the device under test in the protocol fuzz testing. As a result, the accuracy and efficiency of evaluating network security vulnerabilities are reduced. Summary of the invention

[0004] Based on this, it is necessary to provide a network security vulnerability assessment method, apparatus, computer equipment and computer-readable storage medium based on a universal vulnerability scoring system to address the above technical problems, so as to improve the accuracy and efficiency of network security vulnerability assessment.

[0005] In a first aspect, the present application provides a network security vulnerability assessment method based on a universal vulnerability scoring system, comprising: Based on the protocol fuzzy testing technology, generate protocol fuzzy testing data corresponding to the object to be tested, send the protocol fuzzy testing data to the object to be tested, and receive abnormal information returned by the object to be tested based on the protocol fuzzy testing data; Classifying the abnormal information according to preset abnormal information types, and treating abnormal information of the same abnormal information type as abnormal information in the same abnormal information set; Assigning values ​​to each abnormal information set according to a preset impact factor, and obtaining the value of each abnormal information set in different impact factors; Based on the mapping relationship between the impact factor and the measurement indicator in the universal vulnerability scoring system, the value of each abnormal information set in different impact factors is mapped to the value corresponding to the different measurement indicator in the universal vulnerability scoring system; Based on the score calculation method of the common vulnerability scoring system, the values ​​corresponding to different measurement indicators of each abnormal information set in the common vulnerability scoring system are calculated to obtain the evaluation scores corresponding to each abnormal information set, and the network security vulnerability evaluation results corresponding to the object to be tested are obtained based on the evaluation scores corresponding to each abnormal information set.

[0006] In a second aspect, the present application also provides a network security vulnerability assessment device based on a universal vulnerability scoring system, comprising: A testing module, for generating protocol fuzzy test data corresponding to the object to be tested based on the protocol fuzzy test technology, sending the protocol fuzzy test data to the object to be tested, so as to receive abnormal information returned by the object to be tested based on the protocol fuzzy test data; A classification module, used to classify the abnormal information according to preset abnormal information types, and to classify abnormal information of the same abnormal information type as abnormal information in the same abnormal information set; An assignment module is used to assign values ​​to each abnormal information set according to a preset impact factor, and obtain the value of each abnormal information set in different impact factors; A mapping module, configured to map the values ​​of each abnormal information set in different impact factors to values ​​corresponding to different measurement indicators in the common vulnerability scoring system based on the mapping relationship between the impact factors and the measurement indicators in the common vulnerability scoring system; An evaluation module is used to calculate the values ​​corresponding to different measurement indicators of each abnormal information set in the common vulnerability scoring system based on the score calculation method of the common vulnerability scoring system, obtain the evaluation scores corresponding to each abnormal information set, and obtain the network security vulnerability evaluation results corresponding to the object to be tested based on the evaluation scores corresponding to each abnormal information set.

[0007] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the above steps when executing the computer program.

[0008] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the above steps when executed by a processor.

[0009] The network security vulnerability assessment method, device, computer equipment and computer-readable storage medium based on the universal vulnerability scoring system firstly perform protocol fuzz testing on the test object based on the protocol fuzz testing technology to obtain abnormal information, then classify the abnormal information to obtain the same abnormal information set corresponding to the same abnormal information type, and realize batch processing and high efficiency at the information set level; secondly, assign values ​​to each abnormal information set according to the preset impact factor to obtain the value of each abnormal information set in different impact factors, and then based on the pre-set and reusable mapping relationship between the impact factor and the measurement indicator in the universal vulnerability scoring system, efficiently and generalizedly map the value of each abnormal information set in the non-standardized impact factor to the value corresponding to the standardized measurement indicator; finally, based on the score calculation method of the universal vulnerability scoring system, obtain the evaluation score corresponding to each abnormal information set, so as to efficiently and accurately obtain the network security vulnerability assessment result corresponding to the test object. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0011] Figure 1 A schematic diagram of a process of a network security vulnerability assessment method based on a universal vulnerability scoring system in one embodiment; Figure 2 It is a structural block diagram of a network security vulnerability assessment device based on a universal vulnerability scoring system in one embodiment. DETAILED DESCRIPTION

[0012] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0013] In one embodiment, Figure 1 As shown, a network security vulnerability assessment method based on a universal vulnerability scoring system is provided. This embodiment uses the method applied to a server as an example. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps S101 to S105.

[0014] Step S101, based on the protocol fuzzy testing technology, generate protocol fuzzy testing data corresponding to the object to be tested, send the protocol fuzzy testing data to the object to be tested, and receive abnormal information returned by the object to be tested based on the protocol fuzzy testing data.

[0015] Among them, the Common Vulnerability Scoring System (CVSS) represents an industry-wide standardized framework for evaluating and quantifying the severity of vulnerabilities in software, hardware, and network systems.

[0016] Among them, protocol fuzz testing technology refers to a testing method that tests whether there are loopholes or abnormal behaviors in the implementation of the communication protocol by the target device or system by sending abnormal or illegally constructed protocol data.

[0017] The protocol fuzz test data refers to the test data sent to the object to be tested, which is presented in an abnormal or non-standard form, such as randomized data, overlong fields, values ​​that do not conform to protocol specifications, boundary values, etc., and is used to verify the ability of the object to be tested to handle abnormal inputs. The object to be tested refers to the target device or system selected for testing, which is used to verify its performance and security during the protocol fuzz testing process.

[0018] Among them, the exception information refers to the response information returned or the behavior exhibited by the object to be tested after receiving the protocol fuzz test data, such as normal response, error code, crash log, connection interruption or no response, etc. It is used to evaluate whether the object to be tested can correctly handle abnormal input and discover potential vulnerabilities or defects.

[0019] Step S102: classify the abnormal information according to the preset abnormal information type, and take the abnormal information of the same abnormal information type as the abnormal information in the same abnormal information set.

[0020] Step S103, assigning values ​​to each abnormal information set according to preset impact factors, to obtain the value of each abnormal information set in different impact factors.

[0021] Among them, the exception information type represents the category after the captured exception information is classified according to specific rules. For example, the type of the exception information can be determined according to the source or cause of the exception information (such as protocol field exception, data format error, input boundary overflow, etc.), or according to the form of the exception information (such as error code, crash log, communication failure record, etc.).

[0022] Among them, the impact factor represents a measurement dimension that quantifies the degree of impact on the security of different sets of abnormal information, which may include different measurement dimensions such as exploitability, impact scope, confidentiality impact, integrity impact and availability impact; among them, exploitability is used to describe the difficulty of using the anomaly to carry out an attack, the impact scope is used to describe whether the anomaly only affects the object to be tested or affects other related systems or networks, the confidentiality impact is used to describe whether the anomaly destroys the accuracy or integrity of the data, and the availability impact is used to describe whether the anomaly affects the normal operation of the object to be tested.

[0023] Exemplarily, each abnormal information set is assigned a value according to multiple impact factors, and the values ​​of each abnormal information set in five dimensions, namely, availability, impact range, confidentiality impact, integrity impact, and availability impact, are obtained. The assignment of impact factors can be realized through historical vulnerability analysis or automated tool calculation; for example, historical vulnerability records similar to the current abnormality in the vulnerability database are analyzed, and the values ​​of the current abnormal information corresponding to each impact factor are inferred based on the values ​​of the historical vulnerability records corresponding to each impact factor; for another example, the abnormal information can be processed according to a pre-trained machine learning model, and the values ​​of the current abnormal information corresponding to each impact factor can be automatically analyzed.

[0024] Step S104 , based on the mapping relationship between the impact factor and the measurement indicator in the general vulnerability scoring system, the values ​​of each abnormal information set in different impact factors are mapped to values ​​corresponding to different measurement indicators in the general vulnerability scoring system.

[0025] Among them, the measurement indicators in the Common Vulnerability Scoring System represent the measurement dimensions set based on the standardized framework of the Common Vulnerability Scoring System to quantify the security impact of abnormal information, which may include different measurement dimensions such as exploitability, scope of impact, confidentiality impact, integrity impact and availability impact; among them, the measurement dimensions of the measurement indicators match the measurement dimensions of the impact factors.

[0026] Exemplarily, the impact factors defined based on specific scenarios or specific tools are compared with the standardized metrics in the common vulnerability scoring system to convert the non-standardized values ​​of each abnormal information set in different impact factors into input values ​​in a form supported by the common vulnerability scoring system.

[0027] Optionally, in the mapping relationship between the impact factor and the measurement indicator in the common vulnerability scoring system, by aligning the meaning and scoring range between the impact factor and the measurement indicator, it is ensured that the impact factor and the measurement indicator are consistent in definition and quantification method, thereby ensuring that the quantification results of the abnormal information can be accurately integrated into the scoring system corresponding to the common vulnerability scoring system.

[0028] Step S105, based on the score calculation method of the common vulnerability scoring system, calculate the values ​​corresponding to different measurement indicators of each abnormal information set in the common vulnerability scoring system to obtain the evaluation scores corresponding to each abnormal information set, and obtain the network security vulnerability evaluation results corresponding to the object to be tested based on the evaluation scores corresponding to each abnormal information set.

[0029] The score calculation method of the Common Vulnerability Scoring System represents a data analysis method that standardizes and quantifies the impact of security vulnerabilities based on metrics and metric values ​​in the standardized framework of the Common Vulnerability Scoring System.

[0030] The evaluation score represents a quantitative evaluation result corresponding to a specified abnormal information set calculated based on the measurement indicator and the value of the measurement indicator.

[0031] Among them, the network security vulnerability assessment result represents the final result based on the comprehensive assessment scores of all abnormal information sets, which comprehensively describes the overall risk level of the test object in terms of network security vulnerabilities.

[0032] Exemplarily, in a certain abnormal information set, the values ​​corresponding to the five measurement indicators of the abnormal information set are analyzed by means of a score calculation method to obtain an evaluation score corresponding to the abnormal information set. Based on this, the evaluation scores corresponding to each abnormal information set are obtained, and then the evaluation scores corresponding to each abnormal information set are integrated to obtain the network security vulnerability assessment result corresponding to the object to be tested.

[0033] Optionally, the network security vulnerability assessment result may be expressed in the form of a numerical score, for example, by any numerical value between 0 and 1; the network security vulnerability assessment result may also be expressed in the form of a risk level, for example, by "low risk", "medium risk", "high risk" or "serious risk"; further, an association between the numerical score and the risk level may be established so as to freely express and convert the network security vulnerability assessment result according to the numerical score representation and the risk level representation.

[0034] In the above-mentioned network security vulnerability assessment method based on the universal vulnerability scoring system, firstly, a protocol fuzzy test is performed on the test object based on the protocol fuzzy testing technology to obtain abnormal information, and then the abnormal information is classified to obtain the same abnormal information set corresponding to the same abnormal information type, so as to realize batch processing and high efficiency at the information set level; secondly, each abnormal information set is assigned a value according to a preset influencing factor to obtain the value of each abnormal information set in different influencing factors, and then based on the pre-set and reusable mapping relationship between the influencing factor and the measurement indicator in the universal vulnerability scoring system, the value of each abnormal information set in the non-standardized influencing factor is efficiently and generalized mapped to the value corresponding to the standardized measurement indicator; finally, based on the score calculation method of the universal vulnerability scoring system, the evaluation score corresponding to each abnormal information set is obtained, so as to efficiently and accurately obtain the network security vulnerability assessment result corresponding to the test object.

[0035] In an exemplary embodiment, the abnormal information is classified according to preset abnormal information types, and the abnormal information of the same abnormal information type is used as the abnormal information in the same abnormal information set, including steps S201 to S202.

[0036] Step S201 : acquiring configuration information of the object to be tested, performing data feature analysis on each abnormal information based on the configuration information, and obtaining feature information corresponding to each abnormal information.

[0037] The configuration information refers to the relevant information describing the system configuration and operating environment of the test object, such as communication protocol type, protocol field definition, field length limit, parameter format specification, port configuration, version information, authentication mechanism, etc.

[0038] Among them, the feature information represents the key attributes or data features associated with the configuration information extracted from the exception information, such as field features such as field value, type, length, whether it exceeds the boundary, protocol features such as protocol version, undefined field, format not meeting the standard, behavioral features such as whether it causes crashes, delays, connection interruptions, and context features such as the time when the exception occurred and the request path.

[0039] Exemplarily, data feature analysis can be performed on the obtained exception information based on the configuration information through a data analysis tool or a custom script, that is, the core content of the exception information is extracted as the feature information of the exception information. These feature information can be represented by numerical data (such as field length = 256), string data (such as field content = "undefined field") or Boolean data (such as whether the disconnection is triggered).

[0040] Optionally, a data parsing tool refers to a tool used to analyze protocol data packets, log files or other types of abnormal data, such as a network protocol analysis tool, a log parsing tool, a regular expression, etc.; a custom script refers to a script written based on a specific abnormal information analysis scenario, which can sequentially implement various process steps such as determining the source of abnormal information, reading data, parsing field characteristics, and recording characteristics.

[0041] Step S202, based on the multiple judgment conditions and key characteristic elements corresponding to the pre-constructed classification rule set, feature identification is performed on the feature information corresponding to each abnormal information, the abnormal information type corresponding to each abnormal information is determined, and the abnormal information of the same abnormal information type is taken as the abnormal information in the same abnormal information set.

[0042] Among them, the classification rule set represents a rule base built based on empirical knowledge and data training, which is used to determine the type of abnormal information; multiple judgment conditions represent a combination of multiple specific conditional logics in the classification rule set, such as a combination of "and" and "or" logics, which is used to determine whether the abnormal information belongs to a certain category based on the feature information; key feature elements represent the core attributes or data characteristics used to match multiple judgment conditions and serve as the input basis for rule judgment.

[0043] Exemplarily, the classification rule set defines characteristic patterns of various types of abnormal information. For example, field overflow can be manifested as a field length exceeding the expected range, and data format errors can be manifested as field values ​​that do not comply with protocol specifications, etc. Each rule in the classification rule set is composed of a number of characteristic elements and judgment conditions, which are used to match and judge the characteristics of abnormal information.

[0044] Exemplarily, first, the corresponding key characteristic elements are matched to the characteristic information obtained by parsing, and the judgment conditions in the classification rule set are applied one by one to obtain the abnormal information type to which the abnormal information corresponding to the characteristic information belongs. For example: the characteristic information of a certain abnormal information indicates that its field length (i.e., the key characteristic element) is 1024 bytes, and the protocol stipulates that the maximum length is 256 bytes. At this time, the abnormal information can be judged as a "field overflow exception" (i.e., the abnormal information type) based on the out-of-range rule of the field length (i.e., the judgment condition).

[0045] Furthermore, in the classification process, in order to improve accuracy, the abnormal information type to which the abnormal information corresponding to the characteristic information belongs can be judged by combining multiple judgment conditions. For example, when judging whether a certain abnormal information belongs to "authentication failure exception", it is possible to comprehensively consider whether the error code is related to authentication, whether the log contains authentication information, whether the user operation involves a login request, etc. After the classification is completed, the abnormal information of the same abnormal information type is classified into the same abnormal information set. For example, all abnormal information corresponding to the abnormality caused by field overflow is classified into the "field overflow abnormality set", and all abnormal information corresponding to the abnormality caused by unauthorized access is classified into the "unauthorized access abnormality set".

[0046] In this embodiment, feature information is obtained by performing feature analysis on the abnormal information based on the configuration information of the object to be tested, so as to comprehensively and accurately identify the abnormal information type to which each abnormal information belongs based on multiple judgment conditions and key characteristic elements corresponding to the classification rule set at the data feature level, thereby achieving efficient classification and integration of abnormal information.

[0047] In an exemplary embodiment, each abnormal information set is assigned a value according to a preset impact factor to obtain the value of each abnormal information set in different impact factors, including step S301 to step S302.

[0048] Step S301, obtaining the value assignment intervals corresponding to the predetermined impact factors, wherein the same impact factor corresponds to at least two value assignment intervals, and different value assignment intervals of the same impact factor correspond to different risk impact degrees of the abnormal information set corresponding to the same impact factor.

[0049] Exemplarily, each impact factor is divided into several assignment intervals. In the multiple assignment intervals corresponding to a certain impact factor, each assignment interval represents the risk impact degree of the impact factor from no impact to full impact. For example, the "confidentiality impact" impact factor can correspond to three numerical intervals of "0 to 0.4 (excluding 0.4)", "0.4 to 0.7 (excluding 0.7)", and "0.7 to 1.0", among which the numerical interval of "0 to 0.4 (excluding 0.4)" represents low risk (almost no sensitive information leakage), "0.4 to 0.7 (excluding 0.7)" represents medium risk (sensitive information within a limited range may be leaked), and "0.7 to 1.0" represents high risk (serious leakage of key data).

[0050] Optionally, the boundaries of the assignment intervals corresponding to each influencing factor may be consistent, or different interval boundaries may be adaptively determined and the assignment intervals may be divided according to different risk impact levels such as low risk, medium risk, and high risk corresponding to each influencing factor.

[0051] Step S302 : Based on the data features corresponding to each abnormal information set, assign values ​​to each abnormal information set in the value intervals corresponding to different impact factors, so as to obtain the values ​​of each abnormal information set in different impact factors.

[0052] The data feature may represent the collectively expressed feature information extracted and integrated from the abnormal information set, and is used to comprehensively and uniformly describe the source, behavior, pattern and potential impact of each abnormal information in the abnormal information set.

[0053] Exemplarily, by analyzing each abnormal information in the abnormal information set, common points are extracted, such as similar trigger conditions, response modes or impact ranges, and integrated to obtain data features corresponding to the abnormal information set. That is, not only the independent characteristics of a single abnormal information are focused on, but also the common features are extracted in the set dimension, so as to achieve effective analysis and assignment of the abnormal information as a whole.

[0054] Exemplarily, according to the data features corresponding to a certain abnormal information set, the abnormal information set is mapped to the assignment intervals corresponding to different impact factors. For example, for confidentiality impact, if the data features of the abnormal information set indicate that sensitive data (such as user passwords or private information) may be leaked, and such leakage does not require high authority or complex operations, then the abnormal information set can be assigned to the assignment interval corresponding to high risk in confidentiality impact; for availability impact, if the data features of the abnormal information set indicate that the abnormality will cause service interruption, but special conditions are required to trigger it, then the abnormal information set can be assigned to the assignment interval corresponding to low risk in availability impact. Based on this, a set of assignment results is generated for each abnormal information set, indicating the specific values ​​of any abnormal information set on various impact factors such as availability, impact range, confidentiality impact, integrity impact, and availability impact.

[0055] In this embodiment, on the one hand, based on the different risk impact degrees corresponding to the influencing factors, the assignment intervals corresponding to different risk impact degrees of different influencing factors are determined, so that the complex risk assessment process is made more systematic and standardized through the division of the assignment intervals; on the other hand, based on the data features corresponding to the abnormal information set, the abnormal information set is assigned values ​​in different influencing factors respectively, so as to achieve effective analysis and assignment of the abnormal information as a whole in the dimension of the set features.

[0056] In an exemplary embodiment, based on the mapping relationship between impact factors and measurement indicators in the common vulnerability scoring system, the values ​​of each abnormal information set in different impact factors are mapped to values ​​corresponding to different measurement indicators in the common vulnerability scoring system, including steps S401 to S403.

[0057] Step S401 : determining the measurement indicators that match the respective impact factors based on the mapping relationship between the respective impact factors and the respective measurement indicators in the general vulnerability scoring system.

[0058] Exemplarily, based on the consistency between the influencing factors and the measurement indicators in terms of definition, scope, and evaluation objectives, a mapping relationship between each influencing factor and each measurement indicator is constructed to determine the measurement indicators that match each influencing factor in the mapping relationship; wherein, the consistency of definition indicates the conceptual similarity or similarity between the influencing factors and the measurement indicators, the consistency of scope indicates the alignability of the numerical representation ranges of the influencing factors and the measurement indicators, and the consistency of evaluation objectives indicates that the influencing factors and the measurement indicators correspond to the same risk assessment objectives.

[0059] Step S402 : Based on the semantic relationship between different values ​​of the same impact factor and different values ​​of the matching measurement indicator, determine the mapping relationship between the value of each impact factor and the value of the matching measurement indicator.

[0060] Exemplarily, the value of the impact factor is usually a continuous number, and different values ​​express different risk impact levels. Based on this, the value of the impact factor is semantically analyzed. For example, for the impact factor belonging to confidentiality impact, the value range is any continuous number from 0 to 0.1. If 0, 0.5, and 1.0 are selected respectively, then 0 represents the semantic information corresponding to the low risk impact level of "no impact", 0.5 represents the semantic information corresponding to the medium risk impact level of "limited data leakage", and 1.0 represents the semantic information corresponding to the high risk impact level of "complete data leakage".

[0061] Furthermore, the values ​​of the metrics of the Common Vulnerability Scoring System are usually expressed as discrete, standardized numerical weights. These numerical weights are used to reflect the specific impact of each metric on the severity of the vulnerability and can be directly applied to the scoring calculation formula of the Common Vulnerability Scoring System. Based on this, the values ​​of the metrics of the Common Vulnerability Scoring System are semantically analyzed. For example, for the metric belonging to confidentiality impact, None represents the semantic information of "no data leakage risk at all", Low represents the semantic information of "partial data leakage but limited impact", and High represents the semantic information of "significant leakage of critical data".

[0062] Furthermore, a semantic relationship analysis is performed on the values ​​of the influencing factors and the values ​​of the matching measurement indicators, so as to align the values ​​of the influencing factors and the values ​​of the matching measurement indicators on a semantically consistent dimension to determine the mapping relationship between the values ​​of each influencing factor and the values ​​of the matching measurement indicators.

[0063] Step S403 , based on the mapping relationship between the values ​​of each impact factor and the values ​​of the matching measurement indicator, the values ​​of each abnormal information set in different impact factors are mapped item by item to the values ​​corresponding to the matching measurement indicators in the general vulnerability scoring system.

[0064] Exemplarily, the specific values ​​of each abnormal information set on different impact factors are read, and according to the mapping relationship between the impact factor value and the matching measurement indicator value, the impact factor value is converted into the measurement indicator value one by one. For example, if the impact factor value of an abnormal information set on confidentiality impact is 0.8, then according to the mapping relationship, it is converted into the value of the measurement indicator High of the confidentiality impact of the common vulnerability scoring system. Through this item-by-item mapping operation, the impact factor data of all abnormal information sets are finally uniformly converted into the standardized value of the measurement indicator of the common vulnerability scoring system.

[0065] In this embodiment, after determining the measurement indicators that match each influencing factor, the mapping relationship between the value of each influencing factor and the value of the matching measurement indicator is determined in the semantically consistent dimension. Based on this mapping relationship, the values ​​of each abnormal information set in different influencing factors are efficiently and accurately mapped item by item to the value corresponding to the matching measurement indicator in the common vulnerability scoring system, thereby achieving efficient data conversion and standardized expression.

[0066] In an exemplary embodiment, the values ​​of each abnormal information set in different impact factors are mapped item by item to the values ​​corresponding to the matching measurement indicators in the universal vulnerability scoring system, including steps S501 to S503.

[0067] Step S501 : Map the values ​​of each abnormal information set in different impact factors to initial values ​​corresponding to the matching measurement indicators in the general vulnerability scoring system.

[0068] Step S502: Based on the communication network corresponding to the device to be detected, a first correction factor corresponding to the time metric determined based on the communication network and a second correction factor corresponding to the environment metric determined based on the communication network are obtained.

[0069] Among them, the communication network refers to the network environment where the object to be tested is located, including attribute information such as the connection method between devices, data transmission characteristics, security protection mechanism, and network topology structure.

[0070] Among them, the first correction factor represents a dynamic adjustment value in a time dimension. It adjusts the initial value of the measurement indicator according to the time-related characteristics of the security vulnerability in the communication network (such as the feasibility and maturity of the security vulnerability exploitation at different stages, whether there are repair measures, the timeliness and propagation scope of the attack, etc.) so that the value of the measurement indicator is more in line with the actual risk status of the current security vulnerability in the time dimension.

[0071] Among them, the second correction factor represents a dynamic adjustment value of an environmental dimension, which adjusts the initial value of the measurement indicator according to the environmental-related characteristics of the security vulnerability in the communication network (such as business requirements of specific business scenarios, network isolation, network protection capabilities, etc.) so that the value of the measurement indicator is more in line with the actual risk status of the current security vulnerability in the environmental dimension.

[0072] Step S503: Based on the first correction factor and the second correction factor, the initial values ​​corresponding to the respective abnormal information sets are corrected to obtain the values ​​corresponding to the different measurement indicators of the respective abnormal information sets in the general vulnerability scoring system.

[0073] Exemplarily, the first correction factor and the second correction factor may be combined to obtain a linear superposition model or a nonlinear superposition model to serve as a calculation formula for correcting an initial value corresponding to the measurement indicator.

[0074] For example, in the measurement index of confidentiality impact, if the security vulnerability is easy to obtain, the value of the measurement index is adjusted upward according to the first correction factor; if the security vulnerability has been fully repaired, the value of the measurement index is adjusted downward according to the first correction factor. Furthermore, if the security vulnerability affects the key business system, the value of the measurement index is adjusted upward according to the second correction factor; if the security vulnerability is limited to the test environment or isolated network, the value of the measurement index is adjusted downward according to the second correction factor.

[0075] In this embodiment, the initial value corresponding to the measurement indicator is dynamically corrected based on the correction factor, so that the value corresponding to the measurement indicator that is more in line with the actual risk status is comprehensively obtained in the time dimension and the environmental dimension, ensuring the accuracy and reliability of the network security vulnerability assessment results, and making the network security vulnerability assessment results fit the actual application scenario.

[0076] In an exemplary embodiment, based on the mapping relationship between each impact factor and each measurement indicator in the universal vulnerability scoring system, before determining the measurement indicator that matches each impact factor, the method further includes steps S601 and S602.

[0077] Step S601: If there is a target impact factor that is not matched to a corresponding measurement indicator in the general vulnerability scoring system, the target impact factor is split into measurement granularities to obtain measurement features of the target impact factor.

[0078] Among them, the measurement granularity refers to the degree of refinement of the division and description of the impact factor; the measurement feature refers to the specific attributes or variables extracted from the impact factor, which are used to describe the core characteristics and evaluation dimensions of the impact factor.

[0079] Exemplarily, a target impact factor is detected that cannot be directly matched to a corresponding measurement indicator in the common vulnerability scoring system. For example, the target impact factor is some customized security assessment indicator or system-specific risk description, and its definition or scope exceeds the standard measurement indicator system of the common vulnerability scoring system.

[0080] Exemplarily, the target impact factor is split at a metric granularity to decompose the complex target impact factor into more specific and detailed metric features, wherein the metric granularity splitting process includes analyzing the definition of the target impact factor, the value range, and the core features such as the security attributes it describes. For example, an impact factor represents "the impact of user authentication on vulnerability exploitation", but the common vulnerability scoring system does not directly provide such measurement indicators. Then, by splitting the metric granularity of the impact factor, the impact factor is decomposed into two finer-grained measurement features of "authority requirements" and "user interaction requirements", which makes it easier to align with the measurement indicators in the common vulnerability scoring system.

[0081] Step S602: Based on the measurement characteristics of the target impact factor, the target impact factor is matched to an approximate measurement indicator in the general vulnerability scoring system, and a mapping relationship between the target impact factor and the approximate measurement indicator is constructed.

[0082] Exemplarily, by analyzing the semantic relevance, scope overlap, and similarity of evaluation targets between the measurement features and the measurement indicators of the common vulnerability scoring system, the measurement indicators that approximately match the target impact factor in the common vulnerability scoring system are determined in multiple dimensions; wherein the semantic relevance indicates the degree of similarity between the measurement features of the target impact factor and the measurement indicators of the common vulnerability scoring system in terms of descriptive content and security attributes; the scope overlap indicates the degree of similarity between the value range of the target impact factor to which the measurement features belong and the value range of the measurement indicators of the common vulnerability scoring system; the similarity of evaluation targets indicates the degree of similarity between the measurement features of the target impact factor and the measurement indicators of the common vulnerability scoring system in terms of evaluation direction and actual use.

[0083] In this embodiment, the target influencing factors that cannot be directly matched with the measurement indicators are split at the level of measurement granularity, and approximately matched to the measurement indicators of the common vulnerability scoring system at the level of measurement characteristics, thereby ensuring that all influencing factors can participate in the quantitative assessment of security vulnerabilities, thereby enhancing the comprehensiveness and adaptability of security vulnerability assessment.

[0084] In an exemplary embodiment, obtaining a network security vulnerability assessment result corresponding to the object to be tested based on the assessment scores corresponding to each abnormal information set includes steps S701 to S703.

[0085] Step S701: Arrange the evaluation scores corresponding to the respective abnormal information sets in order to obtain a sorting result, and obtain a first evaluation result corresponding to the object to be tested according to the sorting result.

[0086] Exemplarily, each exception information set is arranged in order from high to low according to the evaluation score, and the priority corresponding to each exception information set is determined according to the arrangement order corresponding to different exception information sets, that is, the higher the evaluation score of the exception information set, the higher the priority corresponding to it; based on this, the first evaluation result obtained according to the sorting result can be used for priority management of security vulnerability assessment, so as to focus on high-risk issues corresponding to the object to be tested.

[0087] Step S702, performing aggregation analysis on the evaluation scores corresponding to the respective abnormal information sets according to the data feature similarity of the abnormal information sets to obtain an aggregation result, and obtaining a second evaluation result corresponding to the object to be tested according to the aggregation result.

[0088] Exemplarily, the similarity of data features of abnormal information sets reflects the similarity of different abnormal information sets in terms of trigger conditions, impact scope, evaluation targets, etc., by performing aggregate analysis on the similarity of data features of abnormal information sets, for example, calculating similarity scores by vectorized features, so as to group abnormal information sets with high similarity scores, and then performing statistics and analysis on the evaluation scores of each aggregated abnormal information set, for example, calculating the average, maximum or weighted value of the evaluation scores to evaluate the overall risk of each abnormal information set; based on this, the second evaluation result can be used for macro-analysis of security vulnerability assessment, so as to facilitate the identification of security issues with common or aggregated risks in the objects to be tested.

[0089] Step S703: merge the first evaluation result and the second evaluation result to obtain a network security vulnerability evaluation result corresponding to the object to be tested.

[0090] Exemplarily, the first assessment result may reflect the security vulnerabilities that need to be repaired with the highest priority in the object to be tested, while the second assessment result may reflect the potential aggregated risks. The first assessment result and the second assessment result are integrated to form a final network security vulnerability assessment result, which can be presented as a multi-level assessment report, including a list of high-risk vulnerabilities, an aggregated risk distribution map, and a quantitative score of the overall security status.

[0091] In this embodiment, the first evaluation result obtained by the sorting process and the second evaluation result obtained by the aggregation process are fused to integrate information from different perspectives, focusing on both single high-risk vulnerabilities and considering the distribution and trends of overall security risks, thereby generating a more comprehensive and reliable network security vulnerability assessment result.

[0092] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0093] Based on the same inventive concept, the embodiment of the present application also provides a network security vulnerability assessment device based on a universal vulnerability scoring system for implementing the network security vulnerability assessment method based on a universal vulnerability scoring system involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more network security vulnerability assessment devices based on a universal vulnerability scoring system provided below can refer to the limitations of the network security vulnerability assessment method based on a universal vulnerability scoring system above, and will not be repeated here.

[0094] In an exemplary embodiment, Figure 2 As shown, a network security vulnerability assessment device based on a general vulnerability scoring system is provided, comprising: a testing module 201, a classification module 202, an assignment module 203, a mapping module 204 and an assessment module 205, wherein: The testing module 201 is used to generate protocol fuzzy test data corresponding to the object to be tested based on the protocol fuzzy test technology, send the protocol fuzzy test data to the object to be tested, and receive abnormal information returned by the object to be tested based on the protocol fuzzy test data; A classification module 202, used to classify the abnormal information according to a preset abnormal information type, and to classify the abnormal information of the same abnormal information type as the abnormal information in the same abnormal information set; The assignment module 203 is used to assign values ​​to each abnormal information set according to a preset impact factor, and obtain the value of each abnormal information set in different impact factors; A mapping module 204, configured to map the values ​​of each abnormal information set in different impact factors to values ​​corresponding to different measurement indicators in the common vulnerability scoring system based on the mapping relationship between the impact factors and the measurement indicators in the common vulnerability scoring system; The evaluation module 205 is used to calculate the values ​​corresponding to different measurement indicators of each abnormal information set in the general vulnerability scoring system based on the score calculation method of the general vulnerability scoring system, obtain the evaluation scores corresponding to each abnormal information set, and obtain the network security vulnerability evaluation results corresponding to the object to be tested based on the evaluation scores corresponding to each abnormal information set. In an exemplary embodiment, In an exemplary embodiment, the classification module 202 is also used to: obtain configuration information of the object to be tested, perform data feature analysis on each abnormal information based on the configuration information, and obtain feature information corresponding to each abnormal information; based on the multiple judgment conditions and key feature elements corresponding to the pre-constructed classification rule set, perform feature identification on the feature information corresponding to each abnormal information, determine the abnormal information type corresponding to each abnormal information, and use the abnormal information of the same abnormal information type as the abnormal information in the same abnormal information set.

[0095] In an exemplary embodiment, the assignment module 203 is also used to: obtain the assignment intervals corresponding to each predetermined influencing factor, the same influencing factor corresponds to at least two assignment intervals, and different assignment intervals of the same influencing factor correspond to different risk impact degrees of the abnormal information set corresponding to the same influencing factor; based on the data features corresponding to each abnormal information set, assign values ​​to the assignment intervals corresponding to different influencing factors for each abnormal information set to obtain the values ​​of each abnormal information set in different influencing factors.

[0096] In an exemplary embodiment, the mapping module 204 is also used to: determine the measurement indicators that match each influencing factor based on the mapping relationship between each influencing factor and each measurement indicator in the common vulnerability scoring system; determine the mapping relationship between the value of each influencing factor and the value of the matching measurement indicator based on the semantic relationship between different values ​​of the same influencing factor and different values ​​of the matching measurement indicator; and map the values ​​of each abnormal information set in different influencing factors to the values ​​corresponding to the matching measurement indicators in the common vulnerability scoring system one by one based on the mapping relationship between the value of each influencing factor and the value of the matching measurement indicator.

[0097] In an exemplary embodiment, the mapping module 204 is also used to: map the values ​​of each abnormal information set in different influencing factors to the initial values ​​corresponding to the measurement indicators matched in the general vulnerability scoring system item by item; based on the communication network corresponding to the device to be detected, obtain a first correction factor corresponding to the time measurement determined based on the communication network and a second correction factor corresponding to the environment measurement determined based on the communication network; based on the first correction factor and the second correction factor, correct the initial values ​​corresponding to each abnormal information set, and obtain the values ​​corresponding to different measurement indicators of each abnormal information set in the general vulnerability scoring system.

[0098] In an exemplary embodiment, the mapping module 204 is also used to: if there is a target impact factor that is not matched to a corresponding measurement indicator in the common vulnerability scoring system, the target impact factor is split at a measurement granularity to obtain a measurement feature of the target impact factor; based on the measurement feature of the target impact factor, the target impact factor is matched to an approximate measurement indicator in the common vulnerability scoring system, and a mapping relationship between the target impact factor and the approximate measurement indicator is constructed.

[0099] In an exemplary embodiment, the evaluation module 205 is also used to: arrange the evaluation scores corresponding to each abnormal information set in order to obtain a sorting result, and obtain a first evaluation result corresponding to the object to be tested based on the sorting result; aggregate and analyze the evaluation scores corresponding to each abnormal information set according to the data feature similarity of the abnormal information set to obtain an aggregate result, and obtain a second evaluation result corresponding to the object to be tested based on the aggregate result; merge the first evaluation result and the second evaluation result to obtain a network security vulnerability evaluation result corresponding to the object to be tested.

[0100] Each module in the network security vulnerability assessment device based on the universal vulnerability scoring system can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0101] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in any of the above embodiments when executing the computer program.

[0102] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in any of the above embodiments are implemented.

[0103] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0104] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0105] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network security vulnerability assessment method based on a universal vulnerability scoring system, characterized in that: The method comprises: Based on the protocol fuzzy testing technology, generate protocol fuzzy testing data corresponding to the object to be tested, send the protocol fuzzy testing data to the object to be tested, and receive abnormal information returned by the object to be tested based on the protocol fuzzy testing data; Classifying the abnormal information according to preset abnormal information types, and treating abnormal information of the same abnormal information type as abnormal information in the same abnormal information set; Assigning values ​​to each abnormal information set according to a preset impact factor, and obtaining the value of each abnormal information set in different impact factors; Based on the mapping relationship between the impact factor and the measurement indicator in the universal vulnerability scoring system, the value of each abnormal information set in different impact factors is mapped to the value corresponding to the different measurement indicator in the universal vulnerability scoring system; Based on the score calculation method of the common vulnerability scoring system, the values ​​corresponding to different measurement indicators of each abnormal information set in the common vulnerability scoring system are calculated to obtain the evaluation scores corresponding to each abnormal information set, and the network security vulnerability evaluation results corresponding to the object to be tested are obtained based on the evaluation scores corresponding to each abnormal information set.

2. The method according to claim 1, characterized in that The classifying the abnormal information according to the preset abnormal information type and taking the abnormal information of the same abnormal information type as the abnormal information in the same abnormal information set includes: Acquire the configuration information of the object to be tested, and perform data feature analysis on each abnormal information based on the configuration information to obtain feature information corresponding to each abnormal information; Based on the multiple judgment conditions and key characteristic elements corresponding to the pre-constructed classification rule set, feature identification is performed on the characteristic information corresponding to each abnormal information, the abnormal information type corresponding to each abnormal information is determined, and the abnormal information of the same abnormal information type is regarded as the abnormal information in the same abnormal information set.

3. The method according to claim 1, characterized in that The step of assigning values ​​to each abnormal information set according to a preset impact factor to obtain the value of each abnormal information set in different impact factors includes: Obtaining the assignment intervals corresponding to the predetermined influencing factors, wherein the same influencing factor corresponds to at least two assignment intervals, and different assignment intervals of the same influencing factor correspond to different risk impact degrees of the abnormal information set corresponding to the same influencing factor; Based on the data features corresponding to each abnormal information set, each abnormal information set is assigned a value in an assignment interval corresponding to different impact factors, so as to obtain the value of each abnormal information set in different impact factors.

4. The method according to claim 1, characterized in that: The mapping relationship between the impact factor and the measurement indicator in the universal vulnerability scoring system, mapping the value of each abnormal information set in different impact factors to the value corresponding to the different measurement indicator in the universal vulnerability scoring system, includes: Based on the mapping relationship between each impact factor and each measurement indicator in the common vulnerability scoring system, determine the measurement indicator that matches each impact factor; Based on the semantic relationship between different values ​​of the same impact factor and different values ​​of the matching measurement indicator, determining the mapping relationship between the value of each impact factor and the value of the matching measurement indicator; Based on the mapping relationship between the values ​​of each impact factor and the values ​​of the matching measurement indicator, the values ​​of each abnormal information set in different impact factors are mapped item by item to the values ​​corresponding to the matching measurement indicator in the universal vulnerability scoring system.

5. The method according to claim 4, characterized in that The mapping of the values ​​of each abnormal information set in different impact factors to the values ​​corresponding to the matching measurement indicators in the universal vulnerability scoring system includes: Mapping the values ​​of each abnormal information set in different impact factors to the initial values ​​corresponding to the matching measurement indicators in the universal vulnerability scoring system one by one; Based on a communication network corresponding to the device to be detected, obtaining a first correction factor corresponding to a time metric determined based on the communication network and a second correction factor corresponding to an environment metric determined based on the communication network; Based on the first correction factor and the second correction factor, initial values ​​corresponding to each abnormal information set are corrected to obtain values ​​corresponding to different measurement indicators of each abnormal information set in the universal vulnerability scoring system.

6. The method according to claim 4, characterized in that Before determining the measurement indicators that match the respective influencing factors based on the mapping relationship between the respective influencing factors and the respective measurement indicators in the universal vulnerability scoring system, the method further includes: If there is a target impact factor that is not matched to a corresponding measurement indicator in the universal vulnerability scoring system, the target impact factor is split into measurement granularity to obtain a measurement feature of the target impact factor; Based on the measurement characteristics of the target impact factor, the target impact factor is matched to an approximate measurement indicator in the universal vulnerability scoring system, and a mapping relationship between the target impact factor and the approximate measurement indicator is constructed.

7. The method according to claim 1, characterized in that The obtaining of the network security vulnerability assessment result corresponding to the object to be tested based on the assessment scores corresponding to each abnormal information set includes: Arrange the evaluation scores corresponding to the respective abnormal information sets in order to obtain a sorting result, and obtain a first evaluation result corresponding to the object to be tested according to the sorting result; Aggregate and analyze the evaluation scores corresponding to each abnormal information set according to the data feature similarity of the abnormal information set to obtain an aggregate result, and obtain a second evaluation result corresponding to the object to be tested according to the aggregate result; The first assessment result and the second assessment result are integrated to obtain a network security vulnerability assessment result corresponding to the object to be tested.

8. A network security vulnerability assessment device based on a universal vulnerability scoring system, characterized in that: The device comprises: A testing module, for generating protocol fuzzy test data corresponding to the object to be tested based on the protocol fuzzy test technology, sending the protocol fuzzy test data to the object to be tested, so as to receive abnormal information returned by the object to be tested based on the protocol fuzzy test data; A classification module, used to classify the abnormal information according to preset abnormal information types, and to classify abnormal information of the same abnormal information type as abnormal information in the same abnormal information set; An assignment module is used to assign values ​​to each abnormal information set according to a preset impact factor, and obtain the value of each abnormal information set in different impact factors; A mapping module, configured to map the values ​​of each abnormal information set in different impact factors to values ​​corresponding to different measurement indicators in the common vulnerability scoring system based on the mapping relationship between the impact factors and the measurement indicators in the common vulnerability scoring system; An evaluation module is used to calculate the values ​​corresponding to different measurement indicators of each abnormal information set in the common vulnerability scoring system based on the score calculation method of the common vulnerability scoring system, obtain the evaluation scores corresponding to each abnormal information set, and obtain the network security vulnerability evaluation results corresponding to the object to be tested based on the evaluation scores corresponding to each abnormal information set.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images