Network security vulnerability assessment method and system

Abstract

The invention provides a network security vulnerability assessment method and system, and relates to the technical field of network security, and the method comprises the steps: obtaining multi-source heterogeneous data through a data reading cluster, the multi-source heterogeneous data being data used for indicating network security information; a plurality of data transmission channels are adopted to transmit the multi-source heterogeneous data to a plurality of data analysis models, a plurality of analysis data sets are obtained, each data analysis model corresponds to one data transmission channel, and each data analysis model corresponds to one analysis data set; and generating a vulnerability analysis report according to the data analysis demand and at least one analysis data set in the plurality of analysis data sets, and determining a network security vulnerability assessment result according to the vulnerability analysis report. The problem that an existing network security vulnerability assessment method is low in reliability is solved, and the reliability of network security vulnerability assessment is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security vulnerability assessment method and system. Background Art

[0002] In the construction of the operation network, due to the combination of hardware deployment, system vulnerabilities, software design, security strategies and other factors, there are inevitably some weak links or loopholes in the operation network, which may be exploited by attackers to cause threats (that is, network security vulnerability refers to the potential loopholes or weaknesses in the network system). Assessing the defensive vulnerability of the operation network can discover the system's vulnerabilities and weak links before an attack on the operation network occurs, which is an effective way to effectively reduce the systemic risk of the operation network and improve security.

[0003] In the related technologies, when conducting network security vulnerability assessment, a single relatively simple assessment method based on security standards, security equipment, or vulnerability detection is usually adopted. In addition, the existing defense security information based on different network security equipment manufacturers will also have different data formats, so there is no way to take into account multiple aspects of data. However, this method is too single, resulting in low reliability of the assessment results of network security vulnerability assessment, and there is no way to fully reflect the security risks existing in the system.

[0004] To address the low reliability of existing network security vulnerability assessment methods, no effective technical solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a network security vulnerability assessment method and system to at least solve the problem of low reliability of existing network security vulnerability assessment methods.

[0006] According to one aspect of an embodiment of the present application, a network security vulnerability assessment method is provided, including: acquiring multi-source heterogeneous data through a data reading cluster, wherein the multi-source heterogeneous data is data used to indicate network security information; using multiple data transmission channels to transmit the multi-source heterogeneous data to multiple data analysis models to obtain multiple analysis data sets, wherein each data analysis model corresponds to a data transmission channel, and each data analysis model corresponds to an analysis data set; generating a vulnerability analysis report according to data analysis requirements and at least one analysis data set among the multiple analysis data sets, and determining a network security vulnerability assessment result according to the vulnerability analysis report.

[0007] According to another aspect of an embodiment of the present application, a network security vulnerability assessment system is also provided, including: a data acquisition unit, used to acquire multi-source heterogeneous data through a data reading cluster, and use multiple data transmission channels to transmit the multi-source heterogeneous data to multiple data analysis models, wherein the multi-source heterogeneous data is data used to indicate network security information; a vulnerability model detection unit, used to use multiple data analysis models to analyze the input multi-source heterogeneous data to obtain multiple analysis data sets, wherein each data analysis model corresponds to a data transmission channel, and each data analysis model corresponds to an analysis data set; a vulnerability analysis reporting unit, used to generate a vulnerability analysis report according to data analysis requirements and at least one analysis data set of the multiple analysis data sets, and determine the network security vulnerability assessment result according to the vulnerability analysis report.

[0008] Optionally, the vulnerability model detection unit includes a classification subunit, which is used to classify multi-source heterogeneous data to obtain multiple reference data sets indicating different categories of network security information, wherein each reference data set corresponds to a category of network security information, and each reference data set includes multiple reference data subsets; a first acquisition subunit, which is used to acquire multiple data analysis models, and acquire the data set to be analyzed corresponding to each data analysis model from the multiple reference data subsets included in the multiple reference data sets, wherein the multiple data analysis models include: a security vulnerability detection analysis model, a device status management detection analysis model, and a device configuration defect detection analysis model; a transmission subunit, which is used to use the data transmission channels corresponding to each of the multiple data analysis models to transmit the data set to be analyzed corresponding to each data analysis model to the multiple data analysis models, respectively, to obtain multiple analysis data sets output by the multiple data analysis models.

[0009] Optionally, the transmission subunit includes a first acquisition module, used to acquire a first data set to be analyzed corresponding to the security vulnerability detection analysis model; a feature extraction module, used to perform feature extraction on the first data subset and the second data subset respectively, to obtain a first feature set corresponding to the first data subset, and a second feature set corresponding to the second data subset, wherein the first data set to be analyzed includes a first feature set and a second feature set, wherein the first data subset is used to indicate asset data, and the second data subset is used to indicate vulnerability data; a standardization module, used to perform data standardization on the second feature set to obtain a standardized feature set; a matching module, used to match the first feature set and the standardized feature set to obtain an analysis data set corresponding to the security vulnerability detection analysis model.

[0010] Optionally, the transmission subunit further includes: a second acquisition module, used to acquire a second data set to be analyzed corresponding to the device status management detection and analysis model, wherein the second data set to be analyzed includes a first data subset, a third data subset, and a fourth data subset; a classification module, used to perform grade classification on the first data subset to obtain a graded data set; a comparison module, used to perform threshold comparison on the data in the third data subset to obtain a state abnormality data set, wherein the third data subset is used to indicate the device status; a third acquisition module, used to acquire multiple topological paths corresponding to the fourth data subset, and determine the influencing device data set corresponding to the fourth data subset based on the multiple topological paths, wherein the fourth data subset is used to indicate the network connection relationship between multiple devices; a first evaluation module, used to perform a first evaluation based on the graded data set, the state abnormality data set, and the influencing device data set to obtain an analysis data set corresponding to the device status management detection and analysis model.

[0011] Optionally, the transmission subunit further includes a fourth acquisition module, used to acquire a third data set to be analyzed corresponding to the device configuration defect detection and analysis model, wherein the third data set to be analyzed includes a fifth data subset and a sixth data subset; a policy verification module, used to perform a policy verification on the fifth data subset to obtain a verification data set, wherein the fifth data subset is used to indicate device configuration information corresponding to each of a plurality of devices, and the policy verification is used to verify whether the device configuration information complies with preset configuration requirements; a risk assessment module, used to perform a risk assessment on the fifth data subset to obtain a risk assessment data set, wherein the fifth data set is used to indicate data with security threats; and a second assessment module, used to perform a second assessment based on the verification data set and the risk assessment data set to obtain an analysis data set corresponding to the device configuration defect detection and analysis model.

[0012] Optionally, the vulnerability analysis report unit includes a second acquisition subunit, used to obtain data analysis requirements; a third acquisition subunit, used to obtain a report template according to the data analysis requirements, and obtain at least one analysis data set from multiple analysis data sets; a mapping subunit, used to map multiple data in at least one analysis data set to specified positions in the report template respectively to obtain a vulnerability analysis report.

[0013] Optionally, the network security vulnerability assessment system further includes a data storage unit for storing the plurality of reference data sets, the plurality of analysis data sets and the vulnerability analysis report in preset designated storage locations respectively.

[0014] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the above network security vulnerability assessment method.

[0015] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the network security vulnerability assessment method as described above.

[0016] Compared with the prior art, the technical solution provided by the embodiment of the present application may have the following beneficial effects:

[0017] Through the above network security vulnerability assessment method, the above manner solves the problem of low reliability of the existing network security vulnerability assessment method and improves the reliability of the network security vulnerability assessment method. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a schematic structural diagram of an optional network security vulnerability assessment system according to the present invention;

[0020] Figure 2 is a flow chart of an optional network security vulnerability assessment method according to the present invention;

[0021] Figure 3 is a schematic diagram of another optional network security vulnerability assessment method according to the present invention;

[0022] Figure 4 It is a schematic diagram of another optional network security vulnerability assessment method according to the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only embodiments of a part of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application. The content of this specification should not be construed as a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. Moreover, the system embodiments described above are merely schematic, in which the modules and units described as separate components may or may not be physically separated, that is, they may be located on one network unit, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0026] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] Regarding the problem of network security vulnerability analysis, the existing network security vulnerability assessment methods have the problem of difficulty in comprehensively assessing vulnerabilities from the perspective of the entire operating network, and therefore have the problem of low reliability when evaluating from a single perspective.

[0028] In order to solve the above problems, the embodiment of the present application provides a relatively simple evaluation method compared to those based on security standards, security equipment, vulnerability detection, etc., namely, the above-mentioned network security vulnerability evaluation method. This method quantitatively evaluates the operational network security vulnerability based on multiple security models in the vulnerability model detection unit, which can more comprehensively reflect the security risks existing in the system, and can discover unknown attack modes and system vulnerabilities, which is conducive to a comprehensive evaluation of network security vulnerabilities, thereby improving the reliability of network security vulnerability evaluation. As an optional implementation, the above-mentioned network security vulnerability evaluation method can be, but is not limited to, applied to Figure 1The network security vulnerability assessment system 100 shown in FIG. 1 is composed of a data collection unit 102 (also referred to as a data collection subsystem), a vulnerability model detection unit 104 (also referred to as a vulnerability model detection subsystem), a vulnerability analysis and reporting unit 106 (also referred to as a vulnerability analysis and reporting subsystem), and a data storage unit 108. Figure 1 As shown, the data acquisition unit 102, the vulnerability model detection unit 104, and the vulnerability analysis report unit 106 are all connected to the data storage unit 108, the data acquisition unit 102 is connected to the vulnerability model detection unit 104, and the vulnerability analysis report unit 106 is connected to the vulnerability model detection unit 104. The connection may be a connection through a network, and the network may include but is not limited to: a wired network, a wireless network, wherein the wired network includes: a local area network, a metropolitan area network and a wide area network, and the wireless network includes: Bluetooth, WIFI and other networks that realize wireless communication.

[0029] According to one aspect of an embodiment of the present invention, the network security vulnerability assessment system 100 may also perform the following steps: the data acquisition unit 102 acquires multi-source heterogeneous data through a data reading cluster, and uses multiple data transmission channels to transmit the multi-source heterogeneous data to multiple data analysis models, wherein the multi-source heterogeneous data is data used to indicate network security information; the vulnerability model detection unit 104 uses multiple data analysis models to analyze the input multi-source heterogeneous data to obtain multiple analysis data sets, wherein each data analysis model corresponds to a data transmission channel, and each data analysis model corresponds to an analysis data set; the vulnerability analysis reporting unit 106 generates a vulnerability analysis report according to the data analysis requirements and at least one analysis data set of the multiple analysis data sets, and determines the network security vulnerability assessment result according to the vulnerability analysis report.

[0030] It should be noted that the data acquisition unit 102 is also used to roughly classify the read multi-source heterogeneous data, and transmit the roughly classified multi-source heterogeneous data to the vulnerability model detection unit 104; the vulnerability model detection unit 104 is also used to provide comprehensive vulnerability detection analysis model (i.e., multiple data analysis models) management, and perform in-depth processing on different categories of defense security information, and use the data analysis model to obtain the data set (i.e., multiple analysis data sets) required by the operational network vulnerability assessment subsystem (i.e., vulnerability analysis report unit 106); the vulnerability analysis report unit 106 is also used to configure the vulnerability score metric value, and output the vulnerability analysis report according to different dimensions. The data storage unit 108 is used to store the collected data, the model-processed data, and the finally generated analysis report, that is, the data storage unit 108 is used to store the following different categories of standardized defense security information, analysis process information, and evaluation report files.

[0031] In the above embodiment of the present invention, the above network security vulnerability assessment method is adopted to comprehensively assess network security from multiple aspects, thereby solving the problem of low reliability of existing network security vulnerability assessment methods and improving the reliability of network security vulnerability assessment methods.

[0032] The above is only an example and is not limited in this embodiment.

[0033] As an optional implementation, please refer to Figure 2 , which shows a flow chart of a network security vulnerability assessment method provided by an embodiment of the present application. The execution subject of each step of the method may be the network security vulnerability assessment system 100 introduced above. The method is described in detail below. The method may include at least one of the following steps (S202 to S206):

[0034] S202, acquiring multi-source heterogeneous data through a data reading cluster, wherein the multi-source heterogeneous data is data used to indicate network security information;

[0035] S204, using multiple data transmission channels to transmit the multi-source heterogeneous data to multiple data analysis models, to obtain multiple analysis data sets, wherein each data analysis model corresponds to a data transmission channel, and each data analysis model corresponds to an analysis data set;

[0036] S206, generating a vulnerability analysis report according to the data analysis requirements and at least one analysis data set among the multiple analysis data sets, and determining a network security vulnerability assessment result according to the vulnerability analysis report.

[0037] The operation of acquiring multi-source heterogeneous data through a data reading cluster in S202 can be understood, but not limited to, as using multiple data reading clusters (multiple data reading clusters included in the data acquisition unit 102) to read data from multiple data sources within a configured set time window (i.e., data acquired within a period of time, such as within 24 hours or within a month), each data reading cluster can correspond to one or more data sources, each data reading cluster adopts a management node-work node architecture, i.e., a total node-sub-node total node architecture, which is equivalent to a terminal managing multiple acquisition tools (i.e., data reading clusters), these tools are distributed, the management node is responsible for managing the working node and the status of the cluster, and the working node is a data reading node. Multi-source heterogeneous data is data of different structures, types, or formats read from multiple data sources, and the multi-source heterogeneous data includes asset data, vulnerability data, and security situation data from multiple different data sources, and the asset data, vulnerability data, and security situation data from multiple different data sources have the same or different formats. That is, multi-source heterogeneous data can be understood as distributed data (some are directly collected from the database, and some are directly transmitted from the network transmission interface), which are all flow data, log data or security alarm data. These data can then be put into a pool according to the channel corresponding to the data source, and the data in this pool is multi-source heterogeneous data. Network security vulnerabilities include any one or more of the following: vulnerability and asset association vulnerability, security equipment configuration / status vulnerability, risk level vulnerability, asset vulnerability distribution, etc.

[0038] The operation in S202 above can be understood as, but not limited to, a data collection operation. When collecting data, various security information to be collected can be defined according to data needs (i.e., what kind of data to be collected can be defined in advance before collection) and a data collection strategy can be formulated (i.e., whether to collect data once at a certain interval or directly collect data). The data collection operation includes obtaining defense security information from multiple data sources using a variety of different reading methods, including but not limited to interfaces, logs, databases, and other methods.

[0039] The data acquisition method in S202 above realizes unified access to multi-source heterogeneous defense security information; the defense security information after access is classified and processed through a coarse classification platform; the efficiency of subsequent data processing is improved to ensure the timeliness of data access.

[0040] The multiple data analysis models in S204 are used to analyze the data of the input model. Each data analysis model has different data analysis logic, and each data analysis model corresponds to a data transmission channel. Figure 1The data collection unit 102 shown can transmit different types of network security information (i.e., multi-source heterogeneous data) to the network security information server through different data transmission channels. Figure 1 The various data analysis models in the vulnerability model detection unit 104 shown, that is, what kind of data each data analysis model needs, can be obtained from the asset data, vulnerability data or security data (i.e., multi-source heterogeneous data) according to the needs, and what kind of data is needed can be obtained. Therefore, each data analysis model corresponds to a data transmission channel, and the data in the analysis data set finally output by each data analysis model can be directly mapped to the data in the report template. By directly mapping each data in the analysis data set to a fixed position in the report template, the analysis report can be directly obtained (at most a simple time or statistical operation). The operation in S204 can be understood, but not limited to, as obtaining the input data required by each data analysis model according to multiple data analysis models, and calling the respective processing algorithms of each data analysis model, outputting the analysis and evaluation results (i.e., using multiple data analysis models (also called vulnerability analysis models), through association, analysis, evaluation and other processing, outputting the data set required for the vulnerability analysis report), and writing the data set of the evaluation results to the database.

[0041] Through the in-depth analysis of multi-source heterogeneous data by multiple data analysis models in S204, the output of defense security assessment data set is carried out using vulnerability and asset association vulnerability analysis model, security device configuration / status vulnerability analysis model, risk level vulnerability analysis model, and asset vulnerability distribution analysis model.

[0042] The data analysis requirements in S206 can be understood, but not limited to, as what kind of vulnerability analysis report is needed. Then, a target report template (i.e., the report template described below) can be determined from multiple preset report templates according to the data analysis requirements, and then at least one analysis data set among multiple analysis data sets can be mapped to the target report template to obtain a vulnerability analysis report. The vulnerability analysis report is a report that combines text and images. The network security vulnerability assessment results can be the results that can be directly obtained based on the results shown in the vulnerability analysis report. The vulnerability analysis report provides multiple types of reports such as vulnerability development trends, vulnerability distribution, vulnerability scoring, vulnerability impact domain analysis, and comprehensive security analysis. The operation in S206 can be understood, but not limited to, as obtaining the assessment result data sets (i.e., multiple analysis data sets) of multiple vulnerability analysis models, putting them into a data resource pool, and then according to the report requirements, retrieving the data required for the report from the data resource pool, and providing assessment reports such as vulnerability development trends, vulnerability distribution, vulnerability scoring, impact analysis, and comprehensive security reports (automatically generating various types of analysis reports).

[0043] The process in the above S206 includes: obtaining data analysis requirements; obtaining a report template according to the data analysis requirements, and obtaining at least one analysis data set from multiple analysis data sets; and mapping multiple data in the at least one analysis data set to designated locations in the report template to obtain a vulnerability analysis report.

[0044] By setting the assessment type and assessment weight, not only a multi-dimensional and comprehensive assessment of network vulnerability is achieved, but also when security data information and network structure change, the relevant configuration information can be easily modified to adapt to changes in various network states.

[0045] It should be noted that the network security vulnerability assessment method also includes: storing multiple reference data sets, multiple analysis data sets and vulnerability analysis reports in preset designated storage locations respectively, that is, after obtaining multi-source heterogeneous data, the multi-source heterogeneous data will be stored in a storage location corresponding to the multi-source heterogeneous data; after classifying the multi-source heterogeneous data to obtain multiple reference data sets, the multiple reference data sets will be stored in storage locations corresponding to the multiple reference data sets; after obtaining multiple analysis data sets output by multiple data analysis models, the multiple analysis data sets will be stored in storage locations corresponding to the analysis data sets; after generating a vulnerability analysis report, the vulnerability analysis report will also be stored in a storage location corresponding to the vulnerability analysis report.

[0046] Through the above implementation of the present application, the above network security vulnerability assessment method can be used to comprehensively assess network security from multiple aspects, solving the problem of low reliability of existing network security vulnerability assessment methods and improving the reliability of network security vulnerability assessment methods. At the same time, using the above implementation, the network security vulnerability of the operating network can be comprehensively assessed.

[0047] As an optional implementation, multiple data transmission channels are used to transmit multi-source heterogeneous data to multiple data analysis models to obtain multiple analysis data sets, including:

[0048] S1, classifying multi-source heterogeneous data to obtain multiple reference data sets for indicating different categories of network security information, wherein each reference data set corresponds to a category of network security information, and each reference data set includes multiple reference data subsets;

[0049] S2, obtaining a plurality of data analysis models, and obtaining a data set to be analyzed corresponding to each data analysis model from a plurality of reference data subsets included in the plurality of reference data sets, wherein the plurality of data analysis models include: a security vulnerability detection analysis model, a device status management detection analysis model, and a device configuration defect detection analysis model;

[0050] S3, using data transmission channels corresponding to the multiple data analysis models, respectively transmitting the data sets to be analyzed corresponding to each data analysis model to the multiple data analysis models, to obtain multiple analysis data sets output by the multiple data analysis models.

[0051] The classification operation in S1 (i.e., rough classification, which may be performed according to a pre-defined data processing strategy) may be understood as follows, but is not limited to: Figure 1 After collecting multi-source heterogeneous data, the data collection unit 102 in the network security vulnerability assessment system 100 shown will first classify the multi-source heterogeneous data, that is, roughly classify the network security information of multiple different data sources read by the data reading cluster according to the vulnerability data source assets, vulnerability data types, log content formats, etc. in the multi-source heterogeneous data, and obtain network security information of different categories. In the rough classification, not only can the network security information of large categories be obtained, but also each large category can be classified into small categories. That is, it can be understood that what is obtained is standardized defense security information of different categories.

[0052] For example, coarse classification can be performed on multi-source heterogeneous data through the log content format and type of network devices, security devices, business systems, and terminal applications to obtain different categories of defense security information, including device status data, device configuration, port data, system status, vulnerability intelligence (vulnerability intelligence is classified according to the vulnerability library. According to CVE, CNNVD, and CNVD, vulnerability attribute elements include vulnerability name, level, type, vulnerability description, vulnerability repair suggestion, risk value, reference information), device configuration, threat situation, and other data.

[0053] The operation in S1 can be understood as, but is not limited to, dividing the collected traffic data and log data into the following Figure 3 ( Figure 3 The various data shown are only a specific application example, that is, the classified data is not only Figure 3 The data shown in the figure are not limited to the data input into each data analysis model. Figure 3The data in the model shown) include asset data, vulnerability data and security data (multiple reference data sets). Among the security data, 1) device configuration data mainly refers to the device's security configuration method or strategy, which may include: account management strategy, password strategy, remote authorization strategy, MAC address binding, authentication method, ACL strategy, VPN strategy, etc.; 2) security threat data mainly refers to the attacks on the nodes that make up the operating network. The main data elements include attack methods (worms / viruses / trojans, etc.), attacked target IPs, attacked URLs, attack alarm information, attack exploitation tools, etc.; 3) device operation status mainly refers to the operation status of each component of the device, including CPU occupancy, memory occupancy, log buffer status, network service port status, etc.; 4) security situation data refers to the data output by the available external vulnerability detection system, mainly including vulnerability risk quantification, vulnerability type, security status of protection software, and port development status. And the subcategories included in each major category will also be classified, such as Figure 3 ( Figure 3 The data sets listed in are all the security data that the system can obtain, and they are constantly accumulated. When the user needs to form an analysis report, all three analysis models will be called, and the roughly divided data sets will be input into all three models as needed, and the output data will be stored in the database for analysis report subsystem calls) in the asset data shown in the network data, security data, business system and terminal application data; CNNVD (China National Information Security Vulnerability Database), CNVD (National Information Security Vulnerability Sharing Platform) and CVE (Common Vulnerabilities & Exposures, Common Vulnerabilities and Exposures, CVE can be understood as a dictionary table that gives a common name to widely recognized information security vulnerabilities or weaknesses that have been exposed); device configuration data, security threat data, device operation status and security situation data (multiple reference data subsets) in security data.

[0054] The multiple data analysis models in S2 are data analysis models that are pre-trained using training samples and can accurately analyze data. The operation of obtaining the data set to be analyzed in S2 can be understood, but not limited to, as obtaining the data set to be analyzed corresponding to each different data analysis model from the multiple reference data subsets included in each of the multiple reference data sets, that is, the data set to be analyzed includes at least one reference data subset from the multiple reference data subsets included in each of the multiple reference data sets. The multiple data analysis models include: Figure 3 The security vulnerability detection and analysis model, device status management detection and analysis model, and device configuration defect detection and analysis model are shown.

[0055] For the convenience of description, the multiple reference data subsets included in each of the above-mentioned multiple reference data sets will be referred to as all reference data subsets in the following. It should be noted that before all reference data subsets are input into different data analysis models according to the needs of different data analysis models, all reference data subsets will be deep processed. The deep processing is used to process the data in all reference data subsets according to the data processing requirements of different data analysis models, and process the reference data subsets required by different data analysis models into standard data (i.e., data that can be read by the corresponding data analysis model).

[0056] like Figure 3 The security vulnerability detection analysis model, device status management detection analysis model, and device configuration defect detection analysis model shown all correspond to an input, which can be but is not limited to being understood as a database input algorithm. The database input algorithm corresponds to the above-mentioned process of obtaining the data set to be analyzed corresponding to each data analysis model from all reference data subsets, that is, the input corresponding to the security vulnerability detection analysis model is used to filter the data set to be analyzed corresponding to the security vulnerability detection analysis model from all reference data subsets, the input corresponding to the device status management detection analysis model is used to filter the data set to be analyzed corresponding to the device status management detection analysis model from all reference data subsets, and the input corresponding to the device configuration defect detection analysis model is used to filter the data set to be analyzed corresponding to the device configuration defect detection analysis model from all reference data subsets. Figure 3 The order of input and the above-mentioned deep processing can be: first perform deep processing on all reference data subsets, and then perform data screening using the above-mentioned database input algorithm; or first perform data screening using the database input algorithm, and then perform deep processing on the screened data. In short, the data that is finally input into the multiple data analysis models is the data in the data analysis models that can be directly corresponding after the two operations of the database input algorithm and the deep processing.

[0057] The above-mentioned deep processing includes any one or more of the following: data format conversion (also known as data type conversion, converting the data type into the type of data required by the data analysis model, such as converting int type data into double type data), data verification (verifying the legitimacy of the data itself, such as entering a contact information or ID number. If even the number of digits in the data is incorrect, then it is not a legal data that can be used), dictionary conversion (can be understood as but not limited to converting the format of the data content into a standard format. For example, if multiple types of data are in the same row, dictionary conversion can convert multiple types of data into one type of data in each row), and data distribution (sending data to each model).

[0058] It should be noted that the model types of the above-mentioned multiple data analysis models may be the same or different. The model types include regression models, classification models, clustering models, time series models, deep learning models, etc., and the above-mentioned multiple analysis models are any one of the above-mentioned model types.

[0059] Each data analysis model corresponds to a data transmission channel. In the above S3, each data set to be analyzed is transmitted to multiple data analysis models according to the data transmission channel corresponding to each data analysis model (which can be understood but not limited to reading the corresponding standardized defense security information according to different categories of vulnerability detection analysis models). Then, multiple data analysis models carry out analysis according to the model rules corresponding to each data analysis model. Finally, each data analysis model outputs the data set required for the vulnerability assessment report of the operating network, i.e., the above multiple analysis data sets (also referred to as vulnerability assessment data sets). After that, different types of vulnerability assessment reports (i.e., the above vulnerability analysis reports) can be output according to the analysis data sets.

[0060] Through the above implementation of the present application, in order to solve the problems caused by the different formats of the existing defense security information based on different network security equipment manufacturers, this example provides an operational network defense vulnerability assessment method and system. Based on this solution, the defense security information generated by various types of equipment can be unified into the system, and the necessary data processing capabilities can be provided. Through multiple types of vulnerability detection and analysis models, a defense vulnerability assessment report for the operational network is formed. At the same time, the above implementation can also be used to conduct a comprehensive assessment of the network security vulnerability of the operational network, thereby improving the reliability of the assessment. In addition, the above implementation realizes the setting and management of various configuration information, policy information, and asset information (i.e., the above-mentioned multi-source heterogeneous data), so that adaptive assessments can be easily made when the network status changes.

[0061] The operational network being evaluated is often huge in scale, has more elements, and requires more dimensions and data than the vulnerability of a single target or target group in the past. In particular, the operational network defense status is often in dynamic change. It is necessary not only to analyze the security status of the operational network at a certain event section, but also to conduct dynamic vulnerability assessment in the two dimensions of time and space, and reflect it in the analysis algorithms of each model. Figure 3 The analysis operations performed in each data analysis model are described in detail:

[0062] As an optional implementation, the above-mentioned data set to be analyzed corresponding to each data analysis model is transmitted to multiple data analysis models respectively, and multiple analysis data sets output by multiple data analysis models are obtained, including: S1, obtaining the first data set to be analyzed corresponding to the security vulnerability detection analysis model; S2, performing feature extraction on the first data subset and the second data subset respectively, to obtain a first feature set corresponding to the first data subset, and a second feature set corresponding to the second data subset, wherein the first data set to be analyzed includes a first feature set and a second feature set, wherein the first data subset is used to indicate asset data, and the second data subset is used to indicate vulnerability data; S3, performing data standardization on the second feature set to obtain a standardized feature set; S4, matching the first feature set and the standardized feature set to obtain the analysis data set corresponding to the security vulnerability detection analysis model.

[0063] The above S1 to S4 can be understood, but not limited to, as specific analysis operations performed by the above security vulnerability detection and analysis model on the input data. The above first data subset can be understood, but not limited to, as follows Figure 3 The asset data shown in FIG. 1 includes multiple reference data subsets, and the second data subset can be understood as but not limited to the following: Figure 3 The first data set to be analyzed includes asset data and multiple reference data subsets in vulnerability intelligence. After obtaining the first data set to be analyzed, the security vulnerability detection and analysis model first extracts features from the first data set to be analyzed (i.e., S2 above), thereby obtaining a first feature set (e.g., Figure 3 The asset data feature set shown) and the second feature set (such as Figure 3 Then, S2 is executed to standardize the data and obtain a standardized feature set (such as Figure 3 It should be noted that before data standardization, the second feature set is also subjected to field case conversion. Field case conversion can be understood as follows: Generally, in file upload scenarios, especially web file uploads, case conversion is used to evade detection, thereby gaining control of the device and system. Therefore, the field case conversion performed here is to detect such means of evading detection, thereby performing accurate detection.

[0064] The matching in S4 above is as follows Figure 3As shown in the asset feature-vulnerability fuzzy matching, this matching process mainly extracts the asset data (i.e., the data in the above-mentioned multi-source heterogeneous data) obtained by various detection methods and transmitted to the above-mentioned network security vulnerability assessment system, and matches it with the vulnerability associated objects and vulnerability descriptions released by CVE, CNNVD, and CNVD to obtain possible vulnerabilities in the asset data. For example, there is a CVE-2019-0708 vulnerability in the Windows Server 2008 R2 version of the server. This vulnerability can cause attackers to obtain remote operation permissions for servers installed with the Windows Server 2008 R2 version of the operating system. Therefore, all servers in the operating network that are installed with the above-mentioned version of the operating system are subject to corresponding security risks. After the above S1 to S4, the analysis data set corresponding to the security vulnerability detection analysis model can be obtained (i.e., Figure 3 The set of assets associated with the vulnerability shown).

[0065] The above security vulnerability detection and analysis model mainly includes the analysis of data on the use methods, targets and vulnerability asset attributes. The use methods include malicious emails, phishing attacks, mobile media, etc. The targets include codes, protocols, etc. Vulnerability assets include vulnerability unknown, vulnerability category, vulnerability cause, CVSS score, vulnerability level, impact range, release time, severity, etc. The value range of the vulnerability CVSS score refers to each CVE vulnerability condition in the CVE database from 0 to 10. The higher the CVSS score, the higher the degree of harm to the network or system. However, for unknown vulnerabilities, it should also be considered to be grouped and stored according to their characteristics. Finally, the vulnerability is associated with the asset distribution.

[0066] Through the above implementation of the present application, the security vulnerability detection analysis model is used to analyze the first data set to be analyzed, thereby obtaining an analysis data set corresponding to the security vulnerability detection analysis model.

[0067] As an optional implementation, the above-mentioned data set to be analyzed corresponding to each data analysis model is transmitted to multiple data analysis models respectively, and multiple analysis data sets output by multiple data analysis models are obtained, including: S1, obtaining the second data set to be analyzed corresponding to the equipment status management detection analysis model, the second data set to be analyzed includes a first data subset, a third data subset, and a fourth data subset; S2, classifying the first data subset into levels to obtain a level data set; S3, performing threshold comparison on the data in the third data subset to obtain a state abnormality data set, wherein the third data subset is used to indicate the equipment status; S4, obtaining multiple topological paths corresponding to the fourth data subset, and determining the influencing device data set corresponding to the fourth data subset based on the multiple topological paths, wherein the fourth data subset is used to indicate the network connection relationship between multiple devices; S5, performing a first evaluation based on the level data set, the state abnormality data set, and the influencing device data set to obtain the analysis data set corresponding to the equipment status management detection analysis model.

[0068] The above S1 to S5 can be understood, but not limited to, as specific analysis operations performed by the above device status management detection and analysis model on the input data, such as Figure 3 As shown, the second data set to be analyzed includes an asset data set (the first data subset), a device status data set (the third data subset) and a network topology data set (the fourth data subset), and then the first data subset is classified by asset level (i.e., the above-mentioned level classification). Asset data Asset data mainly refers to the basic attributes of various types of software and hardware objects being evaluated in the operating network, such as network equipment, security equipment and other hardware asset attributes mainly include: asset name, asset type (hardware / software), asset brand, asset model, asset IP, equipment survival status (online / offline), open ports, startup services, etc. The asset attributes of business systems, terminal applications and other software mainly include: system / application name, asset type (hardware / software), identity authentication, communication port, access control, interface call type, database selection type, architecture type, middleware, etc.

[0069] The above asset classification mainly uses the impact and attention of information assets for comprehensive evaluation. It can be classified according to preset classification rules (or according to expert experience), and the levels can be divided into: Severe: severe impact on network operation / key assets / equipment / business system; High risk: greater impact on network operation / key assets / equipment / business system; Medium risk: generally severe impact on network operation / key assets / equipment / business system; Low risk: less impact on network operation / key assets / equipment / business system; Minor: extremely small impact on network operation / key assets / equipment / business system. After the above classification, the level data set (such as Figure 3The asset importance level data set shown in FIG. 1 ). That is, the above-mentioned asset level classification can be understood as, but not limited to, the classification of asset data according to importance.

[0070] The threshold comparison in the above S3 can be understood, but not limited to, as comparing the state value of the device state with the preset state value. For example, if the CPU occupancy rate is higher than a certain value (for example, the CPU occupancy rate of the device for daily business generally does not exceed 90%), the device state is judged to be abnormal if it exceeds the value, thereby obtaining a state abnormality data set. The process of obtaining multiple topological paths in the above S4 (that is, what devices the entire operating network needs to pass through during the communication process, such as routers, business terminals, and business terminals will be connected to servers. If a terminal is at risk, the server connected to this terminal will also be at risk, but if a small LAN is not connected to another small LAN, then the risky small LAN will not affect the other small LAN) can be understood, but not limited to, as follows Figure 3 The process of the topological path part shown in FIG. 1 is implemented by a topological path algorithm. The topological path algorithm can traverse the network topology graph to obtain the possible propagation range of a security threat. The process of obtaining multiple topological paths in S4 is as follows: Figure 4 As shown, assuming that the interconnection between devices 401, 402, 403 and 404 is carried out through the operation network 1, and the interconnection between devices 405, 406, 407 and 408 is carried out through the operation network 2, and assuming that the operation network 1 is at risk and the operation network 2 is not at risk, then the devices connected through the operation network 1 are likely to be at risk, that is, Figure 4 Devices 401, 402, 403 and 404 shown will be affected devices, while devices 405, 406, 407 and 408 will not be affected. Then the affected device data set includes devices 401, 402, 403 and 404. The above process of determining the affected device data set based on multiple topological paths can be understood, but not limited to, as traversing the network topology map (i.e., the topology map composed of multiple devices connected to the operating network) (it can also be understood as traversing multiple topological paths), so as to derive the possible spread range of a security threat. Afterwards, a first evaluation can be performed based on the data sets obtained in S2 to S4 ( Figure 3 The equipment status and distribution evaluation shown in the figure) is used to obtain the analysis data set corresponding to the equipment status management detection and analysis model ( Figure 3 The first evaluation result set shown).

[0071] Device status management detection and analysis model: includes the device mainly including asset attribute data set, device status and network topology. Asset attributes include host, software, operating system, IP address, port, etc. Device status includes communication status, access status, business continuity status, etc. Topology information includes gateway, network, node, route, etc.

[0072] Through the above-mentioned implementation modes of the present application, by adopting the above-mentioned implementation modes, an analysis data set related to the device status can be accurately obtained, thereby ensuring the analysis in terms of the device status.

[0073] As an optional implementation, the above-mentioned data set to be analyzed corresponding to each data analysis model is transmitted to multiple data analysis models respectively, and multiple analysis data sets output by multiple data analysis models are obtained, including: S1, obtaining a third data set to be analyzed corresponding to the equipment configuration defect detection analysis model, wherein the third data set to be analyzed includes a fifth data subset and a sixth data subset; S2, performing a policy check on the fifth data subset to obtain a verification data set, wherein the fifth data subset is used to indicate the device configuration information corresponding to each of the multiple devices, and the policy check is used to verify whether the device configuration information meets the preset configuration requirements; S3, performing a risk assessment on the fifth data subset to obtain a risk assessment data set, wherein the fifth data set is used to indicate data that poses a security threat; S4, performing a second assessment based on the verification data set and the risk assessment data set to obtain an analysis data set corresponding to the equipment configuration defect detection analysis model.

[0074] The operations in S1 to S4 above can be understood, but not limited to, as follows: Figure 3 The specific analysis process of the equipment configuration defect detection analysis model shown in FIG. 1 on the input data, the fifth data subset in S1 above can be understood as but not limited to the following: Figure 3 The device configuration data set shown, the sixth data subset can be understood as but not limited to: Figure 3 The security threat data set shown in FIG. 1 is a device configuration defect detection and analysis model, including a policy verification algorithm (the above-mentioned policy verification) and a risk impact domain assessment algorithm (the above-mentioned risk assessment). The policy verification can automatically verify the security policy data of the operating network terminal, the security protection equipment in the network, etc., evaluate the compliance of the security policy, detect the abnormal conditions in the security policy configuration, and give an assessment conclusion; the risk impact domain assessment algorithm can evaluate the potential risk impact domain through policy relevance. The second assessment in S4 is as follows: Figure 3 The device policy configuration defects and impact domain assessment shown in the figure, the analysis result set obtained is as follows Figure 3 The second evaluation result set is shown.

[0075] It should be noted that if Figure 3The report output shown can be understood as, but is not limited to, the input of data output by multiple data analysis models into Figure 1 The vulnerability analysis reporting unit 106 shown is used to generate a vulnerability analysis report, such as Figure 3 The storage output shown is used to store the data output by multiple data analysis models into the data storage unit for storage.

[0076] Through the above-mentioned implementation modes of the present application, by adopting the above-mentioned implementation modes, it is possible to accurately obtain an analysis data set related to the device configuration information, thereby ensuring analysis in terms of the device status.

[0077] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0078] According to another aspect of an embodiment of the present invention, there is also provided an electronic device for implementing the above-mentioned network security vulnerability assessment method, and the electronic device may be a terminal device or a server. This embodiment is illustrated by taking the electronic device as a terminal device as an example. The electronic device includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executable by at least one processor, and the computer program is executed by at least one processor so that the at least one processor performs the steps in any one of the above-mentioned method embodiments. Optionally, in this embodiment, the above-mentioned electronic device may be located in at least one network device among a plurality of network devices of a computer network. Optionally, in this embodiment, the above-mentioned processor may be configured to execute each step in the above-mentioned network security vulnerability assessment method through a computer program.

[0079] Optionally, it can be understood by those skilled in the art that the structure of the electronic device described above is only for illustration, and the electronic device may also be a terminal device such as a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, and a mobile Internet device (Mobile Internet Devices, MID), PAD, etc. The above description does not limit the structure of the above electronic device. For example, the electronic device may also include more or less components (such as a network interface, etc.) than the above description, or have a configuration different from the above description. Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the network security vulnerability assessment method and system in the embodiment of the present invention, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above network security vulnerability assessment method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The memory may be specifically but not limited to being used to store information involved in the above network security vulnerability assessment method.

[0080] Optionally, the transmission device is used to receive or send data via a network. Specific examples of the network may include wired networks and wireless networks. In one example, the transmission device includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device is a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly. In addition, the electronic device also includes: a display and a connection bus, which is used to connect the various module components in the electronic device.

[0081] In other embodiments, the terminal device or server may be a node in a distributed system, and the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. Among them, the nodes may form a peer-to-peer (P2P, Peer To Peer) network, and any form of computing device, such as a server, terminal and other electronic devices, may become a node in the blockchain system by joining the peer-to-peer network.

[0082] According to one aspect of the present application, a computer program product is provided, the computer program product comprising a computer program / instruction, the computer program / instruction comprising a program code for executing a network security vulnerability assessment method. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium. When the computer program is executed by a central processing unit, various functions provided by the embodiments of the present application are executed.

[0083] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0084] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned network security vulnerability assessment method.

[0085] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for executing the network security vulnerability assessment method.

[0086] Those skilled in the art can understand that the implementation of all or part of the processes in the above method embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the process of the above method embodiment. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FM), a hard disk (HDD), or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory. If the integrated unit in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in the above computer-readable storage medium. Based on such understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which may be personal computers, servers, or network devices, etc.) to perform all or part of the steps of the above methods of various embodiments of the present invention. In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0087] In several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of the above units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms. The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit in each embodiment of the present invention can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0088] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network security vulnerability assessment method, applied to a network security vulnerability assessment system, characterized in that: include: Acquire multi-source heterogeneous data through a data reading cluster, wherein the multi-source heterogeneous data is data used to indicate network security information; Using multiple data transmission channels to transmit the multi-source heterogeneous data to multiple data analysis models to obtain multiple analysis data sets, wherein each data analysis model corresponds to a data transmission channel, and each data analysis model corresponds to an analysis data set; A vulnerability analysis report is generated according to data analysis requirements and at least one of the multiple analysis data sets, and a network security vulnerability assessment result is determined according to the vulnerability analysis report.

2. The method according to claim 1, characterized in that The multi-source heterogeneous data are transmitted to multiple data analysis models using multiple data transmission channels to obtain multiple analysis data sets, including: Classifying the multi-source heterogeneous data to obtain a plurality of reference data sets for indicating different categories of network security information, wherein each of the reference data sets corresponds to a category of network security information, and each of the reference data sets includes a plurality of reference data subsets; Acquire a plurality of the data analysis models, and acquire a data set to be analyzed corresponding to each of the data analysis models from a plurality of reference data subsets included in the plurality of reference data sets, wherein the plurality of data analysis models include: a security vulnerability detection analysis model, a device status management detection analysis model, and a device configuration defect detection analysis model; The data transmission channels corresponding to the multiple data analysis models are used to transmit the data sets to be analyzed corresponding to each data analysis model to the multiple data analysis models, so as to obtain multiple analysis data sets output by the multiple data analysis models.

3. The method according to claim 2, characterized in that The data set to be analyzed corresponding to each data analysis model is transmitted to the multiple data analysis models respectively to obtain multiple analysis data sets output by the multiple data analysis models, including: Obtaining a first data set to be analyzed corresponding to the security vulnerability detection and analysis model; Performing feature extraction on the first data subset and the second data subset respectively to obtain a first feature set corresponding to the first data subset and a second feature set corresponding to the second data subset, wherein the first data set to be analyzed includes the first feature set and the second feature set, wherein the first data subset is used to indicate asset data, and the second data subset is used to indicate vulnerability data; Performing data standardization on the second feature set to obtain a standardized feature set; The first feature set and the standardized feature set are matched to obtain an analysis data set corresponding to the security vulnerability detection analysis model.

4. The method according to claim 3, characterized in that The data set to be analyzed corresponding to each data analysis model is transmitted to the multiple data analysis models respectively to obtain multiple analysis data sets output by the multiple data analysis models, including: Acquire a second data set to be analyzed corresponding to the device status management detection and analysis model, wherein the second data set to be analyzed includes the first data subset, the third data subset, and the fourth data subset; performing grade classification on the first data subset to obtain a graded data set; Performing a threshold comparison on the data in the third data subset to obtain a state abnormality data set, wherein the third data subset is used to indicate the state of the device; Acquire multiple topological paths corresponding to the fourth data subset, and determine the influencing device data set corresponding to the fourth data subset according to the multiple topological paths, wherein the fourth data subset is used to indicate the network connection relationship between the multiple devices; A first evaluation is performed based on the level data set, the abnormal state data set, and the impact device data set to obtain an analysis data set corresponding to the device state management detection and analysis model.

5. The method according to claim 2, characterized in that: The data set to be analyzed corresponding to each data analysis model is transmitted to the multiple data analysis models respectively to obtain multiple analysis data sets output by the multiple data analysis models, including: Acquire a third data set to be analyzed corresponding to the equipment configuration defect detection and analysis model, wherein the third data set to be analyzed includes a fifth data subset and a sixth data subset; Performing a policy check on the fifth data subset to obtain a check data set, wherein the fifth data subset is used to indicate device configuration information corresponding to each of the plurality of devices, and the policy check is used to verify whether the device configuration information meets a preset configuration requirement; Performing risk assessment on the fifth data subset to obtain a risk assessment data set, wherein the fifth data set is used to indicate data that has security threats; A second assessment is performed based on the verification data set and the risk assessment data set to obtain an analysis data set corresponding to the equipment configuration defect detection analysis model.

6. The method according to claim 1, characterized in that Generating a vulnerability analysis report according to a data analysis requirement and at least one of the plurality of analysis data sets includes: Obtaining the data analysis requirements; Acquire a report template according to the data analysis requirement, and acquire at least one analysis data set from multiple analysis data sets; The plurality of data in at least one of the analysis data sets are respectively mapped to designated positions in the report template to obtain the vulnerability analysis report.

7. The method according to claim 2, characterized in that: Also includes: The plurality of reference data sets, the plurality of analysis data sets and the vulnerability analysis report are stored in preset designated storage locations respectively.

8. A network security vulnerability assessment system, characterized in that: include: A data acquisition unit, used for acquiring multi-source heterogeneous data through a data reading cluster, and transmitting the multi-source heterogeneous data to multiple data analysis models using multiple data transmission channels, wherein the multi-source heterogeneous data is data for indicating network security information; A vulnerability model detection unit, configured to analyze the input multi-source heterogeneous data using multiple data analysis models to obtain multiple analysis data sets, wherein each data analysis model corresponds to a data transmission channel, and each data analysis model corresponds to an analysis data set; The vulnerability analysis reporting unit is used to generate a vulnerability analysis report according to data analysis requirements and at least one of the multiple analysis data sets, and determine a network security vulnerability assessment result according to the vulnerability analysis report.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the network security vulnerability assessment method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the network security vulnerability assessment method described in any one of claims 1-7.

Images