Security assessment method and system for network security product

Abstract

The invention relates to the technical field of product assessment, in particular to a security assessment method and system for a network security product, and the method comprises the steps: constructing a multi-layer security index system, and obtaining the index information of the network security product according to the security index system; generating an index evaluation vector of a corresponding level according to a relationship between adjacent levels of the index and the index information; in each hierarchy, calculating the similarity between the index evaluation vector and a preset index baseline in sequence from low to high, taking the calculated similarity of the low-hierarchy index as a corresponding high-hierarchy index evaluation vector element, forming a high-hierarchy index evaluation vector, progressively advancing to the upper layer step by step, and outputting the final similarity; the system comprises a safety index system construction module, a comparison baseline construction module, an information acquisition module and a safety comparison evaluation module. According to the method, layer-by-layer evaluation is realized by adopting an index aggregation mode, an objective and quantifiable evaluation result is obtained, and the safety between products can be distinguished.

Description

Technical Field

[0001] The present invention relates to the technical field of product evaluation, and more particularly to a security evaluation method and system for a network security product. Background Art

[0002] Network security products are tools used to protect network infrastructure from threats such as unauthorized access. With the expansion of the network security market, there are many network security products of the same type. Therefore, the selection of network security products needs to take into account multiple factors. Building a security index system to compare and evaluate network security products has become an important means of selection.

[0003] As network security products become more mature and product security indicators become more complex, the existing network security product security indicator aggregation method is usually for the selector to determine the weight and scoring rules of each security indicator based on its own needs and market research. It is relatively subjective and it is difficult to obtain quantifiable evaluation data. When evaluating many products, it is often difficult to make detailed comparisons and obtain accurate evaluation results.

[0004] Therefore, how to achieve objective and quantifiable evaluation, realize more refined comparison, and evaluate the best product under many indicators and when product performance is similar is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0005] In view of this, the present invention provides a security assessment method and system for network security products, which adopts the indicator aggregation method to realize level-by-level assessment, obtain objective and quantifiable assessment results, and help to distinguish the security between products.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A security assessment method for a network security product comprises the following steps:

[0008] Construct a multi-level security indicator system and obtain indicator information of network security products based on the security indicator system.

[0009] An indicator evaluation vector of a corresponding level is generated according to the relationship between adjacent levels of the indicator and the indicator information.

[0010] In each level, the similarity between the indicator evaluation vector and the preset indicator baseline is calculated from low to high. The similarity of the low-level indicators is used as the element of the corresponding high-level indicator evaluation vector to form a high-level indicator evaluation vector, and the evaluation is gradually carried out to the upper level to output the final similarity as the evaluation result.

[0011] Preferably, the similarity is obtained by weighting the vector distance using the ratio of the vector modulus length as the weight.

[0012] Preferably, the similarity calculation formula is:

[0013]

[0014] in, The i-th indicator of the n-1th level of the t-th product is the high level of the n-th level indicator; Representation and Indicator related Multidimensional vector of layer indicators; Characterization and Indicator related A multidimensional vector of layer alignment baselines.

[0015] Preferably, the indicator baseline includes indicator vectors corresponding to dimensions at each level.

[0016] Preferably, the safety index system includes a quantitative assessment layer, a capability element layer, a core capability layer and an assessment result layer from low to high;

[0017] The evaluation result layer is used to perform a final evaluation based on the core capability evaluation vector and generate an evaluation result; wherein the core capability evaluation vector is composed of various functional indicators in the capability element layer. The core capability layer includes security functions, security performance and self-security; the core capability layer generates a three-dimensional vector corresponding to the security functions, the security performance and the self-security through evaluation to obtain the core capability evaluation vector. The capability element layer includes a variety of functional indicators corresponding to the security functions, the security performance and the self-security respectively; the quantitative evaluation layer includes quantifiable indicator parameters corresponding to various functional indicators.

[0018] Preferably, in the safety indicator system, by constructing a mapping, low-level indicators are mapped to corresponding high-level indicators, thereby achieving level-by-level evaluation.

[0019] A security assessment system for network security products, comprising:

[0020] A safety indicator system construction module, a comparison baseline construction module, an information collection module and a safety comparison and evaluation module; the safety performance indicator system construction module, the comparison baseline construction module and the information collection module are respectively connected to the safety comparison and evaluation module.

[0021] Preferably, the security indicator system construction module is used to configure indicators at each level, and to construct a mapping relationship between adjacent levels to construct a security indicator system. The comparison baseline construction module is used to set corresponding baseline vectors for each level; the information collection module is used to collect basic security parameters of security products; the security comparison evaluation module is used to collect corresponding data in the basic security parameters according to the security indicator system, and to generate the lowest level indicator evaluation vector through quantification; and to perform similarity evaluation based on the lowest level indicator evaluation vector and the baseline vector of the corresponding level in turn, and obtain the similarity of the highest level indicator as the final evaluation result.

[0022] Preferably, the security comparison and evaluation module adopts the following calculation method when performing similarity evaluation:

[0023]

[0024] in, The i-th indicator of the n-1th level of the t-th product is the high level of the n-th level indicator; Representation and Indicator related Multidimensional vector of layer indicators; Characterization and Indicator related A multidimensional vector of layer alignment baselines.

[0025] Preferably, it also includes a sorting output module, which is used to obtain final evaluation results corresponding to multiple products, and output them after sorting.

[0026] It can be seen from the above technical solution that, compared with the prior art, the present invention discloses a security assessment method and system for network security products, which adopts the indicator aggregation method to realize the hierarchical assessment, obtains objective and quantifiable assessment results, and helps to distinguish the security between products; introduces the weight coefficient in the vector direction to improve the similarity calculation method, avoids the cumulative amplification effect in the indicator aggregation mode, and thus distinguishes the security of different products more finely. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0028] Figure 1 A schematic diagram of a security assessment method for a network security product provided in an embodiment of the present invention.

[0029] Figure 2 Schematic diagram of an evaluation process based on similarity calculation in an embodiment of the present invention.

[0030] Figure 3 A schematic diagram of the structure of a security assessment system for a network security product provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] Example 1

[0033] like Figure 1 The embodiment of the present invention discloses a method for evaluating the security of a network security product, comprising the following steps:

[0034] S1: Construct a multi-level security indicator system and obtain indicator information of network security products based on the security indicator system.

[0035] S2: Generate an indicator evaluation vector of a corresponding level according to the relationship between adjacent levels of the indicator and the indicator information.

[0036] S3: In each level, the similarity between the indicator evaluation vector and the preset indicator baseline is calculated from low to high. The similarity of the low-level indicators is used as the element of the corresponding high-level indicator evaluation vector, and the high-level and indicator evaluation vectors are formed. The evaluation is gradually carried out to the upper level, and the final similarity is output as the evaluation result.

[0037] Among them, the indicator baseline is composed of multiple vectors, each vector corresponds to a level in the security indicator system, and the dimension of the vector is consistent with the dimension of the indicator evaluation vector of the corresponding level.

[0038] In this embodiment, after constructing a security indicator system according to actual needs, the corresponding basic indicators are collected and converted into vectors to obtain the bottom-level indicator data; on the basis of the bottom-level data, a similarity comparison is performed with the indicator baseline corresponding to the bottom level, and the obtained similarity is used as a higher-level indicator data. At the same time, a higher-level indicator evaluation vector is formed according to the mapping in the security indicator system, and a similarity comparison is performed with the higher-level indicator baseline, and so on, to achieve aggregation from low-level to high-level indicators, and output the highest level of similarity as the evaluation result of the current product.

[0039] In this embodiment, the basic indicators corresponding to multiple products can be calculated through the similarity calculation of the indicator aggregation mode to obtain the evaluation results of the corresponding products, and the security strength of each product can be confirmed through sorting.

[0040] In order to further implement the above technical solution, the calculation formula of similarity is as follows:

[0041]

[0042] in, The i-th indicator of the n-1th level of the t-th product is the high level of the n-th level indicator; Representation and Indicator related Multidimensional vector of layer indicators; Characterization and Indicator related A multidimensional vector of layer alignment baselines.

[0043] The specific process of using the similarity calculation formula to evaluate security is as follows: Figure 2 As shown, the Tanimoto similarity between the low-level security indicators and the comparative baseline is calculated from bottom to top to obtain the high-level network security product security indicators until the comparison result indicators are obtained. .

[0044] In this embodiment, the present invention introduces the modulus length ratio on the basis of the classic Tanimoto similarity, so that the comparison of the high level will not be affected by the lower level in the bottom-up aggregation process, eliminating the cumulative amplification effect in the aggregation process. When the indicators of the tested network security products are similar, more refined distinction can be achieved, avoiding the difficulty of effective distinction when the performance indicators are close when aggregated to a high level. Among them, the cumulative amplification effect refers to the phenomenon that in the multi-level similarity calculation process, the subtle directional similarity deviation of the low level will be gradually amplified as the levels are superimposed, causing the high-level results to tend to extreme values ​​(1 or 0), thereby covering up the real differences.

[0045] In order to further implement the above technical solutions, the safety indicator system includes a quantitative assessment layer, a capability element layer, a core capability layer and an assessment result layer from low to high.

[0046] The evaluation result layer is used to conduct the final evaluation based on the core capability evaluation vector and generate the evaluation results; the core capability evaluation vector is composed of various functional indicators in the capability element layer; the core capability layer includes safety functions, safety performance and inherent safety; the core capability layer generates a three-dimensional vector corresponding to safety functions, safety performance and inherent safety through evaluation to obtain the core capability evaluation vector; the capability element layer includes a variety of functional indicators corresponding to safety functions, safety performance and inherent safety respectively; the quantitative evaluation layer includes quantifiable indicator parameters corresponding to various functional indicators.

[0047] Exemplarily, the capability element layer indicators include information acquisition, vulnerability scanning, scan configuration, and scan result analysis; among them, information acquisition, as a high-level indicator, is composed of three low-level indicators in the quantitative evaluation layer: port scanning, port protocol analysis, and operating system information.

[0048] The indicators in the quantitative evaluation layer are the lowest-level indicators in the security indicator system. The corresponding indicator data are obtained through data collection. Due to the mapping relationship between information acquisition and port scanning, port protocol analysis, and operating system information, the indicator data of port scanning, port protocol analysis, and operating system information are constructed into a three-dimensional indicator evaluation vector. By analogy, multiple indicator evaluation vectors corresponding to information acquisition, vulnerability scanning, scanning configuration, and scanning result analysis are generated in the quantitative evaluation layer.

[0049] After the quantitative evaluation layer generates the indicator evaluation vector, the next step is the similarity comparison process. In the preset indicator baseline, each multidimensional indicator evaluation vector in the quantitative evaluation layer has a corresponding baseline vector, and the dimensions of the two are consistent. The baseline vector is obtained by forming a vector of a specific dimension from multiple baseline values ​​in the quantitative evaluation layer according to the preset inter-layer mapping relationship. After the similarity calculation, each indicator evaluation vector corresponds to a similarity comparison value as the high-level and indicator corresponding to the indicator evaluation vector.

[0050] Similarly, at the capability element layer, the capability element layer is used as a low-level indicator. According to its mapping relationship with the high-level indicators, the indicator evaluation vector of the corresponding dimension is generated and participates in the baseline comparison to generate the comparison results. The comparison results of the core capability evaluation layer are generated, and so on, to obtain the evaluation results of the highest level.

[0051] In this embodiment, the expression of the safety index system is:

[0052]

[0053] Among them, S is the safety indicator system. is a mapping algorithm for mapping low-level indicators to obtain high-level indicators and realizing combined calculation of high-level indicators. In this embodiment, the improved Tanimoto similarity method is used to realize the mapping; is the indicator level index, ; It is the comparison result layer; The core capability layer; The capability element layer; It is the quantitative assessment layer; For the Tier A safety evaluation indicator.

[0054] Compare to baseline The construction expression is:

[0055]

[0056] in, It is the baseline for the comparison result layer; It is the baseline of the core security capability layer; It is the baseline of security capability element layer; The baseline of the security quantitative assessment layer is obtained by the security tester by comparing the content of the test outline file. The security baselines of the comparison result layer, core capability layer, and capability element layer are standardized and set to 1. The specific formula is as follows:

[0057]

[0058] Furthermore, the security tester completes the security test activities according to the comparison test outline document to form a security test report. The information collection module collects and extracts the test results of the security quantitative evaluation layer indicators of all tested network security products in turn according to the security indicator system to form a security test result data set, as shown in the following formula:

[0059]

[0060] in, In order to quantify the measured data of indicators in the evaluation layer, the matrix represents 41 basic measured data corresponding to products from 1 to t.

[0061] For network security products, test results that exceed the security baseline need to be truncated and preprocessed before the comparison result indicator calculation is performed, as shown below:

[0062]

[0063] in, For the The first network security product tested The test results of the security quantitative evaluation layer indicators. For the products participating in the evaluation, some indicators have reached or even exceeded the requirements of the comparison baseline due to factors such as the improvement of technical level. Although this reflects the positive results of the product, since the product evaluation focuses on the satisfaction of the indicator system, the part of the indicator that exceeds the baseline is not included in the evaluation scope. Therefore, before implementing the evaluation indicator calculation, the security quantitative evaluation layer indicators need to be preprocessed, and the indicators that exceed the comparison baseline need to be truncated. (For example, if the "vulnerability detection accuracy" indicator requires 80%, then among the products participating in the evaluation, if the indicator is greater than 80, the value will be 80, and if it is less than 80, it will remain unchanged).

[0064] Example 2

[0065] like Figure 3 Based on the same inventive concept, an embodiment of the present invention discloses a security assessment system for a network security product, including a security indicator system construction module, a comparison baseline construction module, an information collection module and a security comparison and evaluation module; the security performance indicator system construction module, the comparison baseline construction module and the information collection module are respectively connected to the security comparison and evaluation module.

[0066] The security indicator system construction module is used to configure indicators at each level, build a mapping relationship between adjacent levels, and build a security indicator system; the comparison baseline construction module is used to set the corresponding baseline vector for each level; the information collection module is used to collect the basic security parameters of security products; the security comparison and evaluation module is used to collect corresponding data in the basic security parameters according to the security indicator system, and generate the lowest level indicator evaluation vector through quantification; it is used to perform similarity evaluation based on the lowest level indicator evaluation vector and the baseline vector of the corresponding level in turn, and obtain the similarity of the highest level indicator as the final evaluation result.

[0067] In order to further implement the above technical solution, a sorting output module is also included, and the sorting output module is used to obtain the final evaluation results corresponding to multiple products, and output them after sorting.

[0068] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0069] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for evaluating the security of a network security product, characterized in that: The following steps are involved: Construct a multi-level security indicator system and obtain indicator information of network security products based on the security indicator system; Generate an indicator evaluation vector of a corresponding level according to the relationship between adjacent levels of the indicator and the indicator information; In each level, the similarity between the indicator evaluation vector and the preset indicator baseline is calculated from low to high, wherein the similarity of the low-level indicators is calculated as the corresponding high-level indicator evaluation vector element, and the high-level indicator evaluation vector is composed, and the evaluation is gradually performed upward, and the final similarity is output as the evaluation result.

2. A method for evaluating the security of a network security product according to claim 1, characterized in that: The similarity is obtained by weighting the vector distance using the ratio of the vector modulus length as the weight.

3. A method for evaluating the security of a network security product according to claim 1 or 2, characterized in that: The similarity calculation formula is: ； in, The i-th indicator of the n-1th level of the t-th product is the high level of the n-th level indicator; Representation and Indicator related Multidimensional vector of layer indicators; Characterization and Indicator related A multidimensional vector of layer alignment baselines.

4. The method for evaluating the security of a network security product according to claim 2, characterized in that: The indicator baseline includes a plurality of indicator vectors corresponding to each level.

5. The method for evaluating the security of a network security product according to claim 1, characterized in that: The safety indicator system includes a quantitative assessment layer, a capability element layer, a core capability layer and an assessment result layer from low to high; The evaluation result layer is used to perform a final evaluation based on the core capability evaluation vector to generate an evaluation result; wherein the core capability evaluation vector is composed of various functional indicators in the capability element layer; The core capability layer includes security functions, security performance and self-security; the core capability layer generates a three-dimensional vector corresponding to the security functions, the security performance and the self-security through evaluation to obtain the core capability evaluation vector; The capability element layer includes a plurality of functional indicators corresponding to the security function, the security performance and the self-security respectively; The quantitative evaluation layer includes quantifiable indicator parameters corresponding to various functional indicators.

6. A method for evaluating the security of a network security product according to claim 1 or 5, characterized in that: In the safety indicator system, by constructing a mapping, the similarity of the low-level indicators is mapped to the corresponding high-level indicators, thereby achieving level-by-level evaluation.

7. A security assessment system for network security products, characterized in that: include: Safety indicator system construction module, comparison baseline construction module, information collection module and safety comparison evaluation module; The safety performance indicator system construction module, the comparison baseline construction module and the information collection module are respectively connected to the safety comparison and evaluation module.

8. A security assessment system for network security products according to claim 7, characterized in that: The safety indicator system construction module is used to configure indicators at each level and to build a mapping relationship between adjacent levels to construct a safety indicator system; The comparison baseline construction module is used to set corresponding baseline vectors for each level; The information collection module is used to collect basic safety parameters of safety products; The security comparison and evaluation module is used to collect corresponding data in the basic security parameters according to the security indicator system, and generate the lowest-level indicator evaluation vector through quantification; it is used to perform similarity evaluation based on the lowest-level indicator evaluation vector and the baseline vector of the corresponding level in turn, and obtain the similarity of the highest-level indicator as the final evaluation result.

9. A security assessment system for a network security product according to claim 7 or 8, characterized in that: The security comparison and evaluation module uses the following calculation method when performing similarity evaluation: ； in, The i-th indicator of the n-1th level of the t-th product is the high level of the n-th level indicator; Representation and Indicator related Multidimensional vector of layer indicators; Characterization and Indicator related A multidimensional vector of layer alignment baselines.

10. A security assessment system for network security products according to claim 7, characterized in that: It also includes a sorting output module, which is used to obtain final evaluation results corresponding to multiple products, and output them after sorting.

Images