Network asset evaluation method and device, electronic equipment, storage medium and program

Abstract

The embodiment of the invention discloses a network asset evaluation method and device, electronic equipment, a storage medium and a program, and the method comprises the steps: obtaining a target evaluation asset of a target network; automatically extracting asset dependency relationships of the target assessment assets at different levels; and performing risk assessment on the target assessment assets of the target network according to the asset dependency relationship of the target assessment assets at different levels. According to the embodiment of the invention, automatic, comprehensive and accurate network asset assessment can be realized, and the security management and risk prevention and control capabilities of the network assets are further improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a network asset evaluation method, device, electronic device, storage medium and program. Background Art

[0002] In today's complex network environment, enterprises and service providers are facing increasingly severe network security challenges. With the rapid development of information technology, the number and types of information technology assets owned by enterprises continue to grow, and the dependencies between these assets are becoming more and more complex. Therefore, effective asset management is crucial to ensure the continuous operation of the business and effectively resist security threats.

[0003] At present, traditional asset management tools often rely on manual input to count and track assets. They can record detailed information about assets, such as hardware configuration, software version, and IP (Internet Protocol) address, etc. At the same time, network-based dependency mapping tools can use network scanning and traffic analysis techniques to build network topology maps, and then build network-level dependencies.

[0004] In the process of implementing the present invention, the inventors found that the existing technology has the following defects: when facing a large-scale and constantly changing network environment, the existing asset management tools often require a lot of manual operations and are difficult to adapt to the rapidly changing network environment. At the same time, the existing dependency mapping tools mainly focus on asset dependencies at the network level, which makes it difficult to quickly and accurately identify affected assets and potential business risks when facing security incidents. Summary of the invention

[0005] The embodiments of the present invention provide a network asset evaluation method, device, electronic device, storage medium and program, which can realize automatic, comprehensive and accurate network asset evaluation, thereby improving the security management and risk prevention and control capabilities of network assets.

[0006] According to one aspect of the present invention, there is provided a method for evaluating network assets, comprising:

[0007] Acquire target assessment assets of target network;

[0008] Automatically extract asset dependencies of the target assessment assets at different levels;

[0009] A risk assessment is performed on the target assessment assets of the target network according to asset dependencies of the target assessment assets at different levels.

[0010] According to another aspect of the present invention, there is provided a network asset evaluation device, comprising:

[0011] A target assessment asset acquisition module is used to acquire target assessment assets of a target network;

[0012] An asset dependency acquisition module is used to automatically extract asset dependencies of the target assessment assets at different levels;

[0013] The risk assessment module is used to perform risk assessment on the target assessment assets of the target network according to asset dependencies of the target assessment assets at different levels.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network asset evaluation method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network asset evaluation method described in any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the network asset evaluation method according to any embodiment of the present invention is implemented.

[0020] The embodiments of the present invention obtain the target assessment assets of the target network and automatically extract the asset dependencies of the target assessment assets at different levels, so as to perform risk assessment on the target assessment assets of the target network according to the asset dependencies of the target assessment assets at different levels. This solves the problems of the existing network asset assessment methods being insufficient in terms of dependency mapping accuracy and risk assessment comprehensiveness, and can achieve automated, comprehensive and accurate network asset assessment, thereby improving the security management and risk prevention and control capabilities of network assets.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a network asset evaluation method provided in Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of a network asset evaluation method provided in Embodiment 2 of the present invention;

[0025] Figure 3 It is a schematic diagram of a network asset evaluation device provided by Embodiment 3 of the present invention;

[0026] Figure 4 A schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the term "target" and the like in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1This is a flowchart of a network asset evaluation method provided by the first embodiment of the present invention. This embodiment is applicable to the situation where network assets are evaluated based on asset dependencies at different levels. The method can be executed by a network asset evaluation device, which can be implemented by software and / or hardware and can generally be integrated in an electronic device. The electronic device can be a terminal device or a server device. As long as it can execute the network asset evaluation method, the embodiment of the present invention does not limit the specific device type of the electronic device. Accordingly, Figure 1 As shown, the method includes the following operations:

[0031] S110. Obtain target assessment assets of the target network.

[0032] Among them, the target network can be a network to be subject to asset assessment. The target assessment assets can be various resources and information in the target network that need to be risk assessed. Exemplarily, the target assessment assets can include but are not limited to hardware assets, software assets, and data assets, etc. The embodiment of the present invention does not limit the specific asset types included in the target assessment assets. Hardware assets can be various physical devices used in the target network, such as servers, workstations, network devices, storage devices, and printers. Software assets can be software resources in the target network, such as operating systems, applications, database management systems, and middleware. Data assets can be data resources owned or controlled by an enterprise or organization that can bring economic benefits to the enterprise or organization, such as data stored in a database, file system, cloud storage, or other media.

[0033] In an embodiment of the present invention, in order to implement the evaluation of network assets, the network to be evaluated can first be determined as the target network, and further, the target evaluation assets in the target network can be obtained as reference data for determining the asset dependencies in the target network.

[0034] S120. Automatically extract asset dependencies of the target assessment asset at different levels.

[0035] Among them, asset dependencies can be dependencies between target evaluation assets of the target network, one party to the other in terms of function realization, data interaction, and operation support. Exemplarily, asset dependencies can include but are not limited to network layer dependencies and application service layer dependencies, etc., and the embodiments of the present invention do not limit the specific content included in asset dependencies. Network layer dependencies can be interdependencies between different network functions, protocols or components in the network layer of the target network. Application service layer dependencies can be interdependencies between various application service components, modules or functions in the application service layer of the target network.

[0036] Accordingly, after obtaining the target evaluation assets in the target network, the communication traffic and data interaction between the target evaluation assets can be automatically analyzed based on the asset relationship mapping tool, so that the asset dependency relationships of the target evaluation assets at different levels can be determined based on the communication traffic and data interaction between the target evaluation assets. By automatically extracting the asset dependency relationships of the target evaluation assets at different levels based on the target evaluation assets, a complex asset dependency network can be comprehensively and accurately constructed, avoiding errors and omissions caused by manual input or static configuration in traditional asset management methods.

[0037] S130: Perform risk assessment on the target assessment assets of the target network according to asset dependencies of the target assessment assets at different levels.

[0038] Accordingly, after automatically extracting the asset dependencies of the target assessment assets at different levels, the target assessment assets can be risk assessed based on the asset dependencies at different levels. By comprehensively analyzing the risks of the target assessment assets in the target network, the impact of asset dependencies at different levels on the target network can be clarified, so that when facing security incidents, the risks that may be brought by asset dependencies can be quantitatively analyzed, and the affected assets and potential business risks can be quickly and accurately identified based on the fully mapped dependencies at different levels between assets, so that effective security measures can be taken to ensure the safe and stable operation of the target network.

[0039] It can be seen that the above technical solution can accurately construct a complete asset dependency relationship in the target network by automatically extracting the asset dependency relationships of the target evaluation assets at different levels, thereby improving the accuracy of asset dependency relationships in complex network environments. Furthermore, risk assessment of the target evaluation assets of the target network based on the asset dependency relationships of the target evaluation assets at different levels can timely discover potential risks in the target network and help decision makers formulate targeted response strategies.

[0040] The embodiments of the present invention obtain the target assessment assets of the target network and automatically extract the asset dependencies of the target assessment assets at different levels, so as to perform risk assessment on the target assessment assets of the target network according to the asset dependencies of the target assessment assets at different levels. This solves the problems of the existing network asset assessment methods being insufficient in terms of dependency mapping accuracy and risk assessment comprehensiveness, and can achieve automated, comprehensive and accurate network asset assessment, thereby improving the security management and risk prevention and control capabilities of network assets.

[0041] Embodiment 2

[0042] Figure 2It is a flow chart of a network asset evaluation method provided in Example 2 of the present invention. This embodiment is concretized based on the above embodiment. In this embodiment, multiple specific optional implementation methods are provided for automatically extracting asset dependencies of target evaluation assets at different levels, and performing risk evaluation on target evaluation assets of the target network according to the asset dependencies of target evaluation assets at different levels. At the same time, optional implementation operations after risk evaluation on target evaluation assets of the target network are also provided.

[0043] Correspondingly, such as Figure 2 As shown, the method of this embodiment may include:

[0044] S210: Obtain target assessment assets of the target network.

[0045] S220: Automatically scan the network environment of the target network to obtain network layer dependencies of the target assessment assets in the target network.

[0046] In an embodiment of the present invention, after obtaining the target evaluation assets of the target network, the network environment of the target network can be automatically scanned to obtain the network layer dependencies of the target evaluation assets. Exemplarily, the network layer dependencies can be determined based on the physical or logical network topology in the target network.

[0047] S230: parse and / or monitor the application layer information and network service information of the target network to obtain the application service layer dependency of the target assessment asset in the target network.

[0048] Among them, application layer information can be various data and information transmitted and processed in the application layer of the target network. Exemplarily, application layer information can include but is not limited to application layer protocol information, application program data, and application layer security information, etc. The embodiment of the present invention does not limit the specific information type included in the application layer information. Network service information can be various services and functions provided by the target network, which allow different devices and users to exchange information, share resources and collaborate in the target network environment. Exemplarily, network service information can include but is not limited to file transfer protocol, email service, and dynamic host configuration protocol, etc. The embodiment of the present invention does not limit the specific content included in the network service information.

[0049] Specifically, after obtaining the target evaluation assets of the target network, the application layer information and network service information of the target network may be parsed and / or monitored to obtain the application service layer dependency of the target evaluation assets in the target network.

[0050] In a specific example, assuming that the target network is an e-commerce website, the above technical solution can not only identify the network connection between the web (Web, web page) server and the database server based on the automated extraction technology, but also identify the dependencies such as the front-end application of the e-commerce website depends on the back-end application programming interface (Application Programming Interface, API) service, the back-end API service depends on a specific version of the database service, and the order processing service needs to call the identity authentication service to confirm the user identity, so as to conduct a risk assessment of the target network based on the above dependencies and improve the accuracy of the risk assessment of the target network.

[0051] In an optional embodiment of the present invention, the parsing and / or monitoring of the application layer information and network service information of the target network to obtain the application service layer dependency of the target assessment asset in the target network may include: parsing the application layer protocol of the target network to determine the communication mode between different application layer services in the target network, and establishing the application service layer dependency of the target assessment asset according to the communication mode between different application layer services in the target network; automatically detecting the application service of the target network, and establishing the application service layer dependency of the target assessment asset according to the service attribute information of the application service; parsing the network traffic data of the target network, and identifying the application service layer dependency of the target assessment asset according to the parsing result of the network traffic data; monitoring the API calls inside the application in the target network to obtain the application service layer dependency of the target assessment asset; and / or parsing the configuration file of the application in the target network, and establishing the application service layer dependency of the target assessment asset according to the parsing result of the configuration file.

[0052] Among them, the application layer protocol may be a protocol used by the application layer in the target network protocol stack, which is used to define the way of communication and data exchange between applications. Exemplarily, the application layer protocol may include but is not limited to HTTP (HyperText Transfer Protocol), FTP (File Transfer Protocol) and IMAP (Internet Message Access Protocol), etc., and the embodiment of the present invention does not limit the specific protocol types included in the application layer protocol. The communication mode between different application layer services may be a way for various application services to exchange information with each other in the application layer of the target network. Exemplarily, the communication mode between different application layer services may include but is not limited to the request-response mode, the publish-subscribe mode and the peer-to-peer mode, etc., and the embodiment of the present invention does not limit the specific mode types included in the communication mode between different application layer services. The application service layer dependency relationship may be the relationship of mutual association and interdependence between different application services in the application service layer. Exemplarily, the application service layer dependency relationship may include but is not limited to functional dependency, data dependency and state dependency, etc., and the embodiment of the present invention does not limit the specific dependency types included in the application service layer dependency relationship. The service attribute information of the application service may be data information used to describe the static characteristics and dynamic behavior of the application service. Exemplarily, the service attribute information of the application service may include but is not limited to the service name, service version, service interface, and routing template, etc., and the embodiment of the present invention does not limit the specific information type included in the service attribute information of the application service. Network traffic data may be a collection of relevant information such as data packets transmitted through network connections in the target network. Network traffic data may include but is not limited to data volume, data flow direction, and transmission rate, etc., and the embodiment of the present invention does not limit the specific data content included in the network traffic data. The parsing result of the network traffic data may be the result obtained after analyzing, processing, and interpreting the network traffic data. The API call inside the application may be a process in which different modules, components, or functional parts communicate and interact through predefined interfaces in the code structure of an application. The configuration file of the application may be a file for storing various parameters, settings, and options required for the application to run. Exemplarily, the configuration file of the application may include but is not limited to database connection information, server-related configuration, and function parameter settings, etc., and the embodiment of the present invention does not limit the specific content included in the configuration file of the application. The parsing result of the configuration file may be specific information obtained after reading, analyzing, and processing the configuration file of the application through a specific parsing tool or method.

[0053] In an embodiment of the present invention, in the process of parsing and / or monitoring the application layer information and network service information of the target network to obtain the application service layer dependency of the target evaluation asset in the target network, the communication mode between different application layer services in the target network can be determined by parsing the application layer protocol of the target network, and the application service layer dependency of the target evaluation asset can be established according to the communication mode between different application layer services in the target network. For example, the HTTP protocol of the target network can be parsed by deep packet inspection technology, and the data in the request and response can be analyzed to determine the dependency between network services.

[0054] Optionally, the service attribute information of the application service can be determined by automatically detecting the application service of the target network, and the application service layer dependency of the target assessment asset can be established based on the service attribute information of the application service. For example, it is possible to determine which applications depend on a specific database service by scanning open ports and service fingerprinting.

[0055] Optionally, the network traffic data of the target network may be parsed to determine the parsing result of the network traffic data, and the application service layer dependency of the target assessment asset may be identified based on the parsing result of the network traffic data. For example, database query traffic may be monitored to determine which application services are using a specific database.

[0056] Optionally, you can also monitor the API calls within the application in the target network to obtain the application service layer dependencies of the target assessment asset. For example, you can monitor the API calls of the application through instrumentation technology to understand which external services it depends on.

[0057] Optionally, the configuration file of the application in the target network can be parsed to determine the parsing result of the configuration file, and the application service layer dependency of the target assessment asset can be established based on the parsing result of the configuration file. For example, the backend service and database on which the network application depends can be identified by analyzing the configuration file of the network application.

[0058] It should be noted that in the process of parsing and / or monitoring the application layer information and network service information of the target network to obtain the application service layer dependencies of the target evaluation assets in the target network, at least one of the above methods can be adopted to determine the application service layer dependencies of the target evaluation assets in the target network.

[0059] In an optional embodiment of the present invention, after the automatic extraction of the asset dependencies of the target assessment assets at different levels, it may also include: creating an asset dependency graph of the target network according to the asset dependencies of the target assessment assets at different levels; performing simulated attacks and / or practical verification on the asset dependency graph of the target network to determine the accuracy of the asset dependencies in the asset dependency graph; and adjusting the asset dependency graph when it is determined that erroneous dependencies exist in the asset dependency graph.

[0060] Among them, the asset dependency graph can show the interdependence between assets at different levels in the form of an interaction graph. The simulated attack can be a simulated real attack on the target assessment asset of the target network in a controllable environment. The practical verification can be to verify the accuracy of the asset dependency in the asset dependency graph through actual operation.

[0061] In an embodiment of the present invention, after automatically extracting the asset dependencies of the target evaluation assets at different levels, an asset dependency graph of the target network can be created based on the asset dependencies of the target evaluation assets at different levels, so as to clearly sort out and display the mutual dependencies between the various target evaluation assets in a graph-based form. In a specific example, after automatically extracting the asset dependencies of the target evaluation assets at different levels, an asset relationship dependency model of the target assets can be established based on database technology. Furthermore, the target evaluation assets can be used as nodes of the asset dependency graph, and the dependencies between the target evaluation assets can be used as edges of the asset dependency graph to create an asset dependency graph of the target network.

[0062] After obtaining the asset dependency graph of the target network, simulated attacks can be performed on the asset dependency graph of the target network, such as penetration testing and vulnerability exploitation testing of the target network based on the asset dependency graph of the target network. Optionally, the asset dependency graph of the target network can also be verified by practical operations, such as system configuration changes, application deployment, and hardware device replacement of the target network based on the asset dependency graph of the target network. Simulated attacks and / or practical verification of the asset dependency graph of the target network can determine the accuracy of the asset dependency relationships in the asset dependency graph. When it is determined that the dependency relationships in the asset dependency graph are correct, the target assessment assets of the target network can be directly risk assessed based on the asset dependency relationships; when it is determined that there are incorrect dependencies in the asset dependency graph, the asset dependency graph is adjusted, and then the target assessment assets of the target network are risk assessed based on the accurate asset dependency relationships.

[0063] S240: Perform risk assessment on the target assessment assets of the target network according to asset dependencies of the target assessment assets at different levels.

[0064] In an optional embodiment of the present invention, the risk assessment of the target assessment assets of the target network based on the asset dependencies of the target assessment assets at different levels may include: assessing the attack risks of the target assessment assets of the target network at the network layer and the application service layer based on the asset dependencies of the target assessment assets at different levels; automatically identifying the service dependency risks of the target assessment assets based on the application service layer dependencies in the asset dependencies; automatically scanning the application security vulnerabilities of the target assessment assets based on the application service layer dependencies in the asset dependencies; assessing the economic loss risks of application service failures based on the application service layer dependencies in the asset dependencies; and / or monitoring the activities of the application service layer of the target network in real time based on the application service layer dependencies in the asset dependencies to identify abnormal activity behaviors.

[0065] Among them, attack risk can be the risk of being attacked faced by the network layer and various application services in the target network. Service dependency risk can be the risk caused to other application services that rely on these application services when one or more of the dependent services fail, degrade in performance, have security vulnerabilities or other abnormal conditions due to the interdependence between various application services in the target network. Application security vulnerabilities can be weaknesses generated during the design, development, configuration or maintenance of the application, which may be exploited by attackers, resulting in security risks. The economic loss risk of application service failure can be the possibility of direct and indirect economic losses to the enterprise or organization due to the failure of the application service. Abnormal activity behavior can be the activities of users, devices or programs in the target network that do not conform to normal operating modes, expected behavior patterns or established rules.

[0066] In an embodiment of the present invention, in the process of performing risk assessment on the target assessment assets of the target network according to the asset dependencies of the target assessment assets at different levels, the attack risks of the target assessment assets of the target network at the network layer and the application service layer can be assessed according to the asset dependencies of the target assessment assets at different levels, so that the attack risks of the target assessment assets at the network layer and the application service layer can be identified. In a specific example, the attack risks at the network layer may include but are not limited to distributed denial of service attacks, IP spoofing attacks, and network sniffing attacks. The attack risks at the application service layer may include but are not limited to cross-script attacks and SQL (Structured Query Language) injection attacks.

[0067] Optionally, the service dependency risks of the target assessment assets may be automatically identified based on the application service layer dependencies in the asset dependencies, thereby identifying the service dependency risks of the target assessment assets.

[0068] Optionally, the application security vulnerabilities of the target assessment assets can be automatically scanned based on the application service layer dependencies in the asset dependencies, so that the application security vulnerabilities of the target assessment assets can be identified.

[0069] Optionally, the economic loss risk of application service failure can be evaluated based on the application service layer dependency in the asset dependency, so as to identify the economic loss risk of application service failure.

[0070] Optionally, the activities of the application service layer of the target network can be monitored in real time based on the application service layer dependencies in the asset dependencies, so as to identify abnormal activities of the application service layer, such as abnormal network connections, use of non-standard network protocols, and abnormal use of application functions.

[0071] It should be noted that, in the process of conducting risk assessment on the target assessment assets of the target network based on the asset dependencies of the target assessment assets at different levels, at least one of the above-mentioned risk assessment methods can be selected to conduct risk assessment on the target assessment assets of the target network, thereby obtaining the risk assessment results of the target assessment assets of the target network.

[0072] In a specific example, after identifying each risk factor of the target assessment asset of the target network, each risk factor can be quantitatively scored, for example, using a scoring system of 1-10, where the higher the score, the greater the impact of the risk factor on the target network. After quantitatively scoring each risk factor, a weight can be assigned to each risk factor based on factors such as the degree of impact of each risk factor on the target network, the likelihood of occurrence, and the value of the target assessment asset. Further, the score of each risk factor can be multiplied by its corresponding weight to obtain a weighted score of each risk factor, so that the weighted scores of each risk factor can be added to obtain the risk value of the target network. Exemplarily, assuming that the risk factors include vulnerabilities, improper configurations, and abnormal behaviors, wherein the weight of vulnerabilities is 0.5, the weight of improper configurations is 0.3, and the weight of abnormal behaviors is 0.2. The embodiment of the present invention does not limit the specific value of the weight of each risk factor, as long as the sum of the weights of each risk factor is 1. When the vulnerability score is 8, the improper configuration score is 5, and the abnormal behavior score is 3, the risk value of the target network can be (8*0.5)+(5*0.3)+(3*0.2)=6.1. After calculating the risk value of the target network, the risk level of the target network can be divided according to the risk value of the target network. Exemplarily, if the risk value of the target network is lower than 3, the risk level of the target network can be low risk; if the risk value of the target network is not lower than 3 and not higher than 6, the risk level of the target network can be medium risk; if the risk value of the target network is higher than 6, the risk level of the target network can be high risk. The embodiment of the present invention does not limit the specific division of the risk level of the target network.

[0073] S250: Generate a risk assessment report according to the risk assessment results of the target assessment assets of the target network.

[0074] The risk assessment result of the target assessment asset may be a conclusion obtained after assessing the risks faced by the target assessment asset. The risk assessment report may be a document generated based on the risk assessment result of the target assessment asset, recording the process, method, results and related recommendations of the risk assessment of the target assessment asset.

[0075] Specifically, after risk assessment is performed on the target assessment assets of the target network according to the asset dependencies of the target assessment assets at different levels, a risk assessment result of the target assessment assets can be obtained. Further, a risk assessment report can be generated according to the risk assessment result of the target assessment assets of the target network.

[0076] In a specific example, when evaluating the target assessment assets of the target network, assuming that the risk level of the target network is found to be high risk and the risk factor is that there is a vulnerability in the web server configuration file, the risk assessment report may include not only the process, method and results of the risk assessment of the target assessment assets, but also recommended measures to deal with the risks, such as repairing security vulnerabilities in the web server configuration files and strengthening the monitoring of the web servers.

[0077] S260. Monitor the real-time indicator status of the target assessment asset at different levels according to the asset dependency relationships of the target assessment asset at different levels, and issue a risk warning when it is determined that the real-time indicator status of the target assessment asset at different levels is abnormal.

[0078] The real-time indicator status may be the status of security events and performance indicators of the target assessment asset monitored and analyzed in real time from multiple levels when the target assessment asset is subjected to risk assessment. For example, the real-time indicator status may include, but is not limited to, the number and type of security events, the number and level of security vulnerabilities, and configuration compliance, etc. The embodiment of the present invention does not limit the specific content of the real-time indicator status.

[0079] Specifically, during the operation of the target network, the target assessment assets in the target network can be continuously collected and analyzed to ensure timely discovery of changes in the target assessment assets in the target network and the relationships between assets, thus achieving dynamic updates of asset dependencies and risk assessment results. Furthermore, the real-time indicator status of the target assessment assets at different levels can be monitored based on the asset dependencies at different levels of the target assessment assets, and when it is determined that the real-time indicator status of the target assessment assets at different levels is abnormal, a risk warning is sent to the operation and maintenance team of the target network, and a risk reminder is issued.

[0080] Optionally, when it is determined that the real-time indicator status of the target assessment assets at different levels is abnormal, the affected assets can be isolated from the target network to prevent the risk from spreading; repair scripts can be automatically executed or patches can be applied to repair specific risks; security policies and rules can also be updated based on the abnormal factual indicator status to enhance the defense capabilities of the target network.

[0081] Optionally, standard interfaces and adapters for interacting with each target network can be provided and a unified data exchange format can be defined, thereby ensuring accurate transmission of information and enabling seamless integration with the enterprise's existing network infrastructure and security management system.

[0082] The embodiment of the present invention obtains the target evaluation assets of the target network, and further, automatically scans the network environment of the target network, obtains the network layer dependencies of the target evaluation assets in the target network, and parses and monitors the application layer information and network service information of the target network, and obtains the application service layer dependencies of the target evaluation assets in the target network, so that the target evaluation assets of the target network can be risk evaluated according to the asset dependencies of the target evaluation assets at different levels. A risk assessment report can also be generated according to the risk assessment results of the target evaluation assets of the target network, and the real-time indicator status of the target evaluation assets at different levels can be monitored according to the asset dependencies of the target evaluation assets at different levels, and when it is determined that the real-time indicator status of the target evaluation assets at different levels is abnormal, a risk warning is issued, which solves the problem that the existing network asset evaluation method is insufficient in terms of dependency mapping accuracy and risk assessment comprehensiveness, and can realize automated, comprehensive and accurate network asset evaluation, thereby improving the security management and risk prevention and control capabilities of network assets.

[0083] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0084] It should be noted that any arrangement and combination of the technical features in the above embodiments also falls within the protection scope of the present invention.

[0085] Embodiment 3

[0086] Figure 3 is a schematic diagram of a network asset evaluation device provided by Embodiment 3 of the present invention, such as Figure 3 As shown, the device includes: a target assessment asset acquisition module 310, an asset dependency acquisition module 320 and a risk assessment module 330, wherein:

[0087] The target assessment asset acquisition module 310 is used to acquire the target assessment assets of the target network.

[0088] The asset dependency acquisition module 320 is used to automatically extract the asset dependencies of the target assessment assets at different levels.

[0089] The risk assessment module 330 is used to perform risk assessment on the target assessment assets of the target network according to asset dependencies of the target assessment assets at different levels.

[0090] The embodiments of the present invention obtain the target assessment assets of the target network and automatically extract the asset dependencies of the target assessment assets at different levels, so as to perform risk assessment on the target assessment assets of the target network according to the asset dependencies of the target assessment assets at different levels. This solves the problems of the existing network asset assessment methods being insufficient in terms of dependency mapping accuracy and risk assessment comprehensiveness, and can achieve automated, comprehensive and accurate network asset assessment, thereby improving the security management and risk prevention and control capabilities of network assets.

[0091] Optionally, the asset dependencies may include network layer dependencies and application service layer dependencies.

[0092] Optionally, the asset dependency acquisition module 320 is specifically used to: automatically scan the network environment of the target network to obtain the network layer dependencies of the target evaluation assets in the target network; parse and / or monitor the application layer information and network service information of the target network to obtain the application service layer dependencies of the target evaluation assets in the target network.

[0093] Optionally, the asset dependency acquisition module 320 is also used to: parse the application layer protocol of the target network, determine the communication mode between different application layer services in the target network, and establish the application service layer dependency of the target assessment asset according to the communication mode between different application layer services in the target network; automatically detect the application services of the target network, and establish the application service layer dependency of the target assessment asset according to the service attribute information of the application services; parse the network traffic data of the target network, and identify the application service layer dependency of the target assessment asset according to the parsed results of the network traffic data; monitor the API calls within the application in the target network to obtain the application service layer dependency of the target assessment asset; and / or parse the configuration file of the application in the target network, and establish the application service layer dependency of the target assessment asset according to the parsed results of the configuration file.

[0094] Optionally, the above-mentioned device also includes an asset dependency graph determination module, which is specifically used to: create an asset dependency graph of the target network according to the asset dependencies at different levels of the target assessment assets; perform simulated attacks and / or practical verification on the asset dependency graph of the target network to determine the accuracy of the asset dependencies in the asset dependency graph; and adjust the asset dependency graph when it is determined that the asset dependency graph has erroneous dependencies.

[0095] Optionally, the risk assessment module 330 is specifically used to: assess the attack risks of the target assessment assets at the network layer and the application service layer of the target network according to the asset dependencies of the target assessment assets at different levels; automatically identify the service dependency risks of the target assessment assets according to the application service layer dependencies in the asset dependencies; automatically scan the application security vulnerabilities of the target assessment assets according to the application service layer dependencies in the asset dependencies; assess the economic loss risks of application service failures according to the application service layer dependencies in the asset dependencies; and / or monitor the activities of the application service layer of the target network in real time according to the application service layer dependencies in the asset dependencies to identify abnormal activity behaviors.

[0096] Optionally, the above-mentioned device also includes a real-time monitoring and risk warning module, which is specifically used to: generate a risk assessment report based on the risk assessment results of the target assessment assets of the target network; monitor the real-time indicator status of the target assessment assets at different levels according to the asset dependencies of the target assessment assets at different levels, and issue a risk warning when it is determined that the real-time indicator status of the target assessment assets at different levels is abnormal.

[0097] The network asset evaluation device can execute the network asset evaluation method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not described in detail in this embodiment, please refer to the network asset evaluation method provided by any embodiment of the present invention.

[0098] Since the network asset evaluation device introduced above is a device that can execute the network asset evaluation method in the embodiment of the present invention, based on the network asset evaluation method introduced in the embodiment of the present invention, the technical personnel of the field can understand the specific implementation of the network asset evaluation device of the present embodiment and its various variations, so how the network asset evaluation device implements the network asset evaluation method in the embodiment of the present invention is not described in detail here. As long as the technical personnel of the field implement the device used by the network asset evaluation method in the embodiment of the present invention, it belongs to the scope of protection of this application.

[0099] Embodiment 4

[0100] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0101] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0102] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0103] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for evaluating network assets.

[0104] In some embodiments, the network asset evaluation method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network asset evaluation method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the network asset evaluation method in any other appropriate manner (e.g., by means of firmware).

[0105] Optionally, the network asset assessment method may include: acquiring target assessment assets of the target network; automatically extracting asset dependencies of the target assessment assets at different levels; and performing risk assessment on the target assessment assets of the target network based on the asset dependencies of the target assessment assets at different levels.

[0106] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0107] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0108] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0109] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0110] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0111] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0112] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0113] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for evaluating network assets, characterized in that: include: Acquire target assessment assets of target network; Automatically extract asset dependencies of the target assessment assets at different levels; A risk assessment is performed on the target assessment assets of the target network according to asset dependencies of the target assessment assets at different levels.

2. The method according to claim 1, characterized in that The asset dependency relationship includes a network layer dependency relationship and an application service layer dependency relationship; The automatic extraction of asset dependencies of the target assessment asset at different levels includes: Automatically scan the network environment of the target network to obtain the network layer dependency of the target assessment asset in the target network; The application layer information and network service information of the target network are parsed and / or monitored to obtain the application service layer dependency of the target assessment asset in the target network.

3. The method according to claim 2, characterized in that The parsing and / or monitoring of the application layer information and network service information of the target network to obtain the application service layer dependency of the target assessment asset in the target network includes: Parsing the application layer protocol of the target network, determining the communication mode between different application layer services in the target network, and establishing the application service layer dependency of the target assessment asset according to the communication mode between different application layer services in the target network; Automatically detect the application services of the target network, and establish the application service layer dependency of the target assessment asset according to the service attribute information of the application services; Parsing the network traffic data of the target network, and identifying the application service layer dependency of the target assessment asset according to the parsing result of the network traffic data; Monitor the application programming interface API calls within the application in the target network to obtain the application service layer dependency of the target assessment asset; and / or The configuration file of the application program in the target network is parsed, and the application service layer dependency of the target assessment asset is established according to the parsing result of the configuration file.

4. The method according to claim 1, characterized in that: After automatically extracting the asset dependencies of the target evaluation asset at different levels, the method further includes: Creating an asset dependency graph of the target network according to asset dependencies at different levels of the target assessment assets; Performing simulated attacks and / or actual operation verification on the asset dependency graph of the target network to determine the accuracy of the asset dependency relationships in the asset dependency graph; When it is determined that the asset dependency graph has an erroneous dependency, the asset dependency graph is adjusted.

5. The method according to claim 1, characterized in that The risk assessment of the target assessment assets of the target network according to the asset dependencies of the target assessment assets at different levels includes: Assess the attack risk of the target assessment assets of the target network at the network layer and the application service layer according to the asset dependencies of the target assessment assets at different levels; Automatically identify the service dependency risk of the target assessment asset according to the application service layer dependency in the asset dependency; Automatically scan the application security vulnerabilities of the target assessment assets according to the application service layer dependency in the asset dependency; Assessing the economic loss risk of application service failure based on the application service layer dependency in the asset dependency; and / or The activities of the application service layer of the target network are monitored in real time according to the application service layer dependency in the asset dependency, and abnormal activity behaviors are identified.

6. The method according to claim 1, characterized in that After performing risk assessment on the target assessment assets of the target network according to the asset dependencies of the target assessment assets at different levels, the method further includes: generating a risk assessment report based on the risk assessment results of the target assessment assets of the target network; The real-time indicator status of the target evaluation assets at different levels is monitored according to the asset dependency relationships of the target evaluation assets at different levels, and a risk warning is issued when it is determined that the real-time indicator status of the target evaluation assets at different levels is abnormal.

7. A network asset evaluation device, characterized in that: include: A target assessment asset acquisition module is used to acquire target assessment assets of a target network; An asset dependency acquisition module, used to automatically extract asset dependencies of the target assessment assets at different levels; The risk assessment module is used to perform risk assessment on the target assessment assets of the target network according to asset dependencies of the target assessment assets at different levels.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network asset evaluation method described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network asset evaluation method described in any one of claims 1-6 when executed.

10. A computer program product comprising a computer program / instructions, wherein: When the computer program / instructions are executed by a processor, the network asset evaluation method according to any one of claims 1 to 6 is implemented.

Images