Risk assessment method and device for network assets

Abstract

The invention relates to the technical field of information security, and discloses a risk assessment method and device for network assets. The method comprises the following steps: acquiring alarm data from a plurality of network assets; determining a threat degree score of each threat subject according to the alarm data; according to the threat degree score of each threat subject and the weight of each threat subject corresponding to a first network asset in the plurality of network assets, determining a first risk score that the first network asset is attacked; determining a second risk score that the first network asset is attacked according to a general vulnerability scoring system (CVSS) score of each vulnerability in the first network asset, the dynamic risk score and the number of vulnerabilities of the first network asset; and according to the first risk score and the second risk score, determining a risk score that the first network asset is attacked. Thus, according to the alarm data of the plurality of network assets, risk assessment is performed in combination with the threat subject and the network assets, and the accuracy of identifying potential risks can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method and device for risk assessment of network assets. Background Art

[0002] In recent years, with the large-scale development of new technologies and applications such as cloud computing, big data, the Internet of Things, industrial Internet, and artificial intelligence, and the continuous improvement of informatization, different network assets are facing various security threats. Traditional risk assessment methods usually rely on fixed rules and preset models for risk assessment, which is inadequate in the face of complex and changing network environments. Static methods are difficult to detect abnormal activities occurring in real time, and cannot adapt to the rapid changes in system structure and external threats. In addition, the results of risk assessment often lack quantitative indicators, making it difficult to provide clear guidance for decision makers.

[0003] Therefore, how to conduct risk assessment on network assets in a complex and ever-changing network environment still needs further research. Summary of the invention

[0004] The embodiments of the present application provide a method and device for risk assessment of network assets, which converts complex alarm data into intuitive risk scores through quantitative analysis, thereby implementing risk assessment of network assets and providing effective decision support for subsequent policy adjustments.

[0005] In a first aspect, an embodiment of the present application provides a risk assessment method for network assets, the method comprising: obtaining alarm data from multiple network assets, the alarm data of the multiple network assets being used to indicate at least one threat subject attacking the multiple network assets; determining a threat degree score of each threat subject in the at least one threat subject based on the alarm data; determining a first risk score of the first network asset being attacked based on the threat degree score of each threat subject and the weight of each threat subject corresponding to a first network asset in the multiple network assets; determining a second risk score of the first network asset being attacked based on a Common Vulnerability Scoring System CVSS score of each vulnerability in at least one vulnerability of the first network asset, a dynamic risk score, and the number of vulnerabilities of the first network asset; and determining a risk score of the first network asset being attacked based on the first risk score and the second risk score.

[0006] By adopting the above method, a variety of relevant alarm logs are obtained from multiple network assets, and risk assessment is performed from the two perspectives of threat subject and network assets, which can improve the accuracy of identifying potential risks; the risk of network assets is quantified based on the first risk score and the second risk score to obtain the risk score of the network assets, so as to provide effective decision support for subsequent strategy adjustments.

[0007] In an optional embodiment, determining the threat level score of each threat subject in the at least one threat subject according to the alarm data includes: determining the alarm type popularity score, focus score and time dispersion score of each threat subject according to the alarm data, the alarm type popularity score is used to evaluate the popularity of the attack method of the threat subject, the focus score is used to evaluate the concentration of the threat subject's attack and the importance of the target domain to which the network assets attacked by the threat subject belong, and the time dispersion score is used to evaluate the time span of the threat subject's attack;

[0008] Determine the threat level score of each threat subject based on the alarm type popularity score, focus score and time dispersion score of each threat subject

[0009] By adopting the above method, a comprehensive analysis of the threat level of the threat subject is conducted from multiple dimensions, including the alarm type popularity score, focus score, and time dispersion score, which helps to further improve the accuracy of the first network asset risk assessment.

[0010] In an optional embodiment, the alarm type popularity score satisfies the following formula: in, is the missed scanning ratio of the i-th threat subject in the at least one threat subject within the preset first time interval j, D is the total number of alarms generated by the i-th threat subject using attacks in the at least one threat subject within the preset first time interval j, E is the reciprocal of the number of threat subjects using hot attacks in the preset first time interval j, ∝ is the is the adjustment coefficient of , and β is the adjustment coefficient of E.

[0011] In an optional embodiment, the concentration score satisfies the following formula: Among them, H i is the distribution density of the ith threat subject in the at least one threat subject threatening the target domain within the preset first time interval j, W k is the importance of the target domain, γ is the i The adjustment factor, δ is the W k The adjustment factor.

[0012] In an optional embodiment, the time dispersion score satisfies the following formula: Among them, A i (j) is the number of alarms of the i-th threat subject among the at least one threat subject within the preset first time interval j, A i(j, g) is the number of alarms of the i-th threat subject among the at least one threat subject within a preset second time interval g, the second time interval g belongs to the first time interval j, and ε is a decay exponent.

[0013] In an optional embodiment, determining the risk score of the first network asset being attacked according to the first risk score and the second risk score includes: determining the risk score of the first network asset being attacked according to the following formula: in, A first risk score for the first network asset being attacked, ω , 1 is the weight corresponding to the first risk score, A second risk score for the first network asset being attacked, ω , 2 is the weight corresponding to the second risk score.

[0014] In a second aspect, an embodiment of the present application provides a risk assessment device for network assets, the device comprising:

[0015] An acquisition unit, configured to acquire alarm data from a plurality of network assets, wherein the alarm data of the plurality of network assets is used to indicate at least one threat subject that attacks the plurality of network assets;

[0016] A determination unit is used to determine, based on the alarm data, a threat level score of each threat subject in the at least one threat subject; determine a first risk score of the first network asset being attacked based on the threat level score of each threat subject and the weight of each threat subject corresponding to a first network asset in the multiple network assets; determine a second risk score of the first network asset being attacked based on a CVSS score, a dynamic risk score of each vulnerability in at least one vulnerability of the first network asset, and the number of vulnerabilities of the first network asset; and determine a risk score of the first network asset being attacked based on the first risk score and the second risk score.

[0017] In an optional embodiment, the determination unit is specifically used to determine the alarm type popularity score, focus score and time dispersion score of each threat subject based on the alarm data, the alarm type popularity score is used to evaluate the popularity of the threat subject's attack method, the focus score is used to evaluate the concentration of the threat subject's attack and the importance of the target domain to which the network assets attacked by the threat subject belong, and the time dispersion score is used to evaluate the time span of the threat subject's attack; determine the threat level score of each threat subject based on the alarm type popularity score, focus score and time dispersion score of each threat subject.

[0018] In an optional embodiment, the alarm type popularity score satisfies the following formula: in, is the missed scanning ratio of the i-th threat subject in the at least one threat subject within the preset first time interval j, D is the total number of alarms generated by the i-th threat subject using attacks in the at least one threat subject within the preset first time interval j, E is the reciprocal of the number of threat subjects using hot attacks in the preset first time interval j, ∝ is the is the adjustment coefficient of , and β is the adjustment coefficient of E.

[0019] In an optional embodiment, the concentration score satisfies the following formula: Among them, H i is the distribution density of the ith threat subject in the at least one threat subject threatening the target domain within the preset first time interval j, W k is the importance of the target domain, γ is the i The adjustment factor, δ is the W k The adjustment factor.

[0020] In an optional embodiment, the time dispersion score satisfies the following formula: Among them, A i (j) is the number of alarms of the i-th threat subject among the at least one threat subject within the preset first time interval j, A i (j, g) is the number of alarms of the i-th threat subject among the at least one threat subject within a preset second time interval g, the second time interval g belongs to the first time interval j, and ε is a decay exponent.

[0021] In an optional embodiment, the processing unit is further configured to determine a risk score of the first network asset being attacked according to the following formula: in, A first risk score for the first network asset being attacked, ω , 1 is the weight corresponding to the first risk score, A second risk score for the first network asset being attacked, ω , 2 is the weight corresponding to the second risk score.

[0022] In a third aspect, an embodiment of the present invention provides an anomaly detection device for network log data, comprising: a memory for storing a computer program; and a processor for executing the method described in the first aspect according to the obtained program when executing the computer program stored in the memory.

[0023] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when a computer reads and executes the computer program, the method described in the first aspect above is executed.

[0024] In a fifth aspect, an embodiment of the present invention provides a computer program product. When a computer reads and executes the computer program product, the method described in the first aspect is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0026] Figure 1 A flowchart corresponding to a network asset risk assessment method provided in an embodiment of the present application;

[0027] Figure 2 A flowchart corresponding to a network asset risk assessment method provided in an embodiment of the present application;

[0028] Figure 3 An architectural diagram of a network asset risk assessment method provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of the structure of a network asset risk assessment device provided in an embodiment of the present application;

[0030] Figure 5 A schematic diagram of the structure of a network asset risk assessment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] Based on the exemplary embodiments shown in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. In addition, although the disclosure in this application is introduced according to one or several exemplary examples, it should be understood that each aspect of these disclosures can also constitute a complete technical solution separately.

[0033] It should be understood that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, for example, they can be implemented according to an order other than those given in the diagrams or descriptions of the embodiments of this application.

[0034] In recent years, with the large-scale development of new technologies and applications such as cloud computing, big data, the Internet of Things, industrial Internet, and artificial intelligence, and the continuous improvement of informatization, different network assets are facing various security threats.

[0035] Traditional risk assessment methods are usually based on rule matching and statistical analysis. Due to the static and subjective nature of the rules, they cannot adapt to the ever-changing attack patterns, resulting in high false alarm rates and explosion rates. Risk assessment strategies based on static rules cannot provide a methodology from qualitative to quantitative, and there is a long delay.

[0036] Based on this, an embodiment of the present application provides a risk assessment method for network assets. This method is based on the alarm data of multiple network assets and combines the threat subject and network assets to perform risk assessment. This can effectively improve the accuracy of identifying potential risks. Through quantitative analysis, complex alarm data can be converted into intuitive risk scores, so as to provide effective decision-making support for subsequent strategy adjustments.

[0037] Figure 1 This is a flowchart corresponding to a network asset risk assessment method provided in an embodiment of the present application. The method can be executed by a network asset risk assessment device (referred to as a risk assessment device), which can be any of a plurality of network assets, or can also be an independently deployed device, wherein the network asset can be a network device, a network security device, a data security device, a server, a terminal, and other devices, which are not specifically limited here. Figure 1 As shown, the method includes:

[0038] Step 101: The risk assessment device obtains alarm data from multiple network assets.

[0039] Here, network assets may be network devices, network security devices, data security devices, servers, terminal devices and other assets, but are not limited thereto. Alarm data of multiple network assets are used to indicate at least one threat subject that attacks multiple network assets, wherein the threat subject may be malicious network attack organizations or individuals of different levels, including national-level, large, organized groups, small organizations and individuals, etc.

[0040] Exemplarily, the risk assessment device collects information related to alarms from multiple network assets, processes the collected information related to alarms into a unified data format, and obtains alarm data from multiple network assets. Here, the information related to alarms includes at least one of the following information: network traffic logs, intrusion detection system (IDS) alarm information, system scan reports, user behavior logs, operational security monitoring data, etc. The risk assessment device can collect information related to alarms in a variety of ways, and can collect information related to alarms from multiple network assets through a protocol analyzer and a log collection tool; the risk assessment device can process the information related to alarms into a unified data format in a variety of ways, and can use a noise algorithm to filter out noise data, identify, correct or delete inaccurate, incomplete, duplicate or invalid information in the alarm-related information, which is not specifically limited here.

[0041] Step 102: The risk assessment device determines a threat level score of each threat subject in at least one threat subject according to the alarm data.

[0042] Exemplarily, the risk assessment device determines the alarm type popularity score, focus score and time dispersion score of each threat subject based on the alarm data, and determines the threat score of each threat subject based on the alarm type popularity score, focus score and time dispersion score of each threat subject, wherein the alarm type popularity score is used to evaluate the popularity of the threat subject's attack method, the focus score is used to evaluate the concentration of the threat subject's attack and the importance of the target domain to which the network assets attacked by the threat subject belong, and the time dispersion score is used to evaluate the time span of the threat subject's attack.

[0043] Figure 2 The flowchart corresponding to the determination of the threat level score of each threat subject provided in the embodiment of the present application is as follows: Figure 2 As shown, the specific steps are as follows:

[0044] Step 201: The risk assessment device determines the alarm type popularity score of each threat subject based on the alarm data.

[0045] Specifically, the specific steps for determining the alarm type popularity score of each threat subject are as follows:

[0046] Step 2011, determining the missed scanning ratio of each threat subject.

[0047] For example, the calculation formula for the missed scan ratio of each threat subject is shown in formula (1):

[0048]

[0049] in, Threaten is the sum of the number of alarms for the ith threat subject that meets the characteristics of all machine scan misses within the preset first time interval j. ic The sum of the number of alarms for the ith threat subject that meets the characteristics of the cth machine's missed scan behavior; is the sum of the number of times the i-th threat subject is attacked within the preset first time interval j.

[0050] Step 2012: Determine the alarm type popularity score of each threat subject according to the missed scanning ratio of each threat subject and the popularity of the attack method adopted by each threat subject.

[0051] Exemplarily, the popularity of the attack method adopted by each threat subject may be determined by counting the number of threat subjects using the attack method within a preset first time interval.

[0052] The calculation formula for the alarm type popularity score of each threat subject is shown in formula (2):

[0053]

[0054] in, is the missed scanning ratio of the i-th threat subject in the at least one threat subject within the preset first time interval j, D is the total number of alarms generated by the i-th threat subject using attacks in the at least one threat subject within the preset first time interval j, E is the reciprocal of the number of threat subjects using hot attacks in the preset first time interval j, ∝ is the Adjustment factor to balance the missed scan ratio The contribution to the popularity score, β is the adjustment coefficient of E, which is used to balance the contribution of popularity E to the popularity score.

[0055] Step 202: The risk assessment device determines the concentration score of each threat subject based on the alarm data.

[0056] Specifically, the risk assessment device determines the focus score of each threat subject according to the distribution density of the threat subject's threat target domain and the importance of the target domain to which the attack network asset belongs, wherein the distribution density of the threat subject's threat target domain satisfies the following formula:

[0057]

[0058] Wherein, Threaten(i,k,t) is the number of attacks by the ith threat subject on the k target domains at time point t within the preset first time interval j. Each asset belongs to at least one target domain. is the total number of times the ith threat subject attacks network assets within the preset first time interval j, is the probability distribution of the ith threat subject in the k target domains, H i It is entropy, which is used to measure the uniformity of the distribution of threat entities' threat target domains.

[0059] At this time, the calculation formula for the focus score of each threat subject is shown in formula (3):

[0060]

[0061] Among them, H i is the distribution density of the target domain threatened by the ith threat subject in the at least one threat subject within the preset first time interval j, W k is the importance of the target domain. When the threat subject focuses more on attacking fixed network assets, the importance of the target domain to which the asset belongs is higher. γ is H i The adjustment factor is used to balance the impact of the uniformity of the distribution of the threat subject’s threat target domain on the focus score. δ is W k The adjustment factor is used to balance the impact of the importance of the target domain on the focus score.

[0062] Step 203: The risk assessment device determines the time dispersion score of each threat subject based on the alarm data.

[0063] Specifically, the specific steps for determining the time dispersion score of each threat subject are as follows:

[0064] Step 2031: Count the number of alarms of each threat subject within a preset first time interval.

[0065] Step 2032: Count the number of alarms issued by each threat subject within a preset second time interval.

[0066] According to step 2031 and step 2032, the time dispersion score of each threat subject is determined, and the time dispersion score of the i-th threat subject satisfies the following formula:

[0067]

[0068] in, a i(d) is the number of alarms from the ith threat subject on the dth day in the preset first time interval j days, A i (j) is the total number of alarms of the i-th threat subject among at least one threat subject within the preset first time interval j; a i (d,h) is the number of alarms from the ith threat subject at the gth hour on the dth day of the preset first time interval j days, and the number of alarms from the ith threat subject. i (j,g) is the total number of alarms of the i-th threat subject in at least one threat subject within the preset second time interval g, the second time interval g belongs to the first time interval j, ε is the decay exponent, ε can be β·θ, θ is the number of penalties added for each day of backtracking within the first time interval, and the value is set in [0-1], β is the weight for adjusting different moments, the earlier the attack, the smaller the corresponding weight setting, and the value is set in [0-1].

[0069] Exemplarily, the time dispersion score of each threat subject may also include a period adjustment factor P, which is used to reduce the time dispersion score of periodic attacks. In this case, the time dispersion score of the i-th threat subject is

[0070] Step 204: The risk assessment device determines the threat level score of each threat subject based on the alarm type popularity score, concentration score and time dispersion score of each threat subject.

[0071] For example, the risk assessment device scores the popularity determined in step 201. Step 202 determines the concentration score and the time dispersion score determined in step 203 The weighted average is used to obtain the threat level score of each threat subject. The calculation formula for the threat level score of the ith threat subject is shown in formula (5):

[0072]

[0073] in, and Yes and The standardization can be obtained by using Z-score, ω1 is The corresponding weight, ω2, is The corresponding weight, ω3, is The corresponding weight.

[0074] Step 103: Determine a first risk score of the first network asset being attacked according to the threat level score of each threat subject and the weight of each threat subject corresponding to the first network asset among the multiple network assets.

[0075] For example, the risk assessment device scores each threat subject according to its threat level Y i The weight of each threat subject corresponding to the first network asset determines the first risk score of the first network asset being attacked. The calculation formula of the first risk score is shown in formula (6):

[0076]

[0077] Among them, Y i Score the threat level of the ith threat subject among I threat subjects, is the weight of the i-th threat subject corresponding to the first network asset.

[0078] Step 104, determining a second risk score of the first network asset being attacked according to a common vulnerability scoring system (CVSS) score of each vulnerability in at least one vulnerability of the first network asset, the dynamic risk score, and the number of vulnerabilities of the first network asset.

[0079] Exemplarily, for the first network asset, the risk assessment device quantifies the risk of the first asset being attacked according to the expected risk of each related vulnerability.

[0080] Specifically, according to the CVSS score of each vulnerability in the at least one vulnerability of the first network asset, the dynamic risk score, and the number of vulnerabilities of the first network asset, a second risk score of the first network asset being attacked is determined, and the quantitative formula of the second risk score is as follows:

[0081]

[0082] Among them, VS m is the CVSS score of the mth vulnerability among the M vulnerabilities of the first network asset, is the dynamic risk score of the mth vulnerability among the M vulnerabilities of the first network asset, is the impact factor of all threat entities that use the mth attack on the first network asset.

[0083] It is determined based on the threat subject's attack frequency, attack success rate, and historical attack behavior. The calculation formula is as follows:

[0084]

[0085] Among them, F i is the attack frequency of the ith threat subject attacking the first network asset, S iThe success rate of the attack launched by the ith threat subject on the first network asset, G i is the number of historical attacks of the ith threat subject.

[0086] Step 105: Determine a risk score of the first network asset being attacked according to the first risk score and the second risk score.

[0087] Exemplarily, the risk score of the first network asset being attacked is determined according to the following formula:

[0088]

[0089] in, is the first risk score of the first network asset being attacked, ω , 1 is the weight corresponding to the first risk score, The second risk score of the first network asset being attacked, ω , 2 is the weight corresponding to the second risk score. The weights corresponding to the first risk score and the second risk score can be determined based on historical data analysis and expert opinions, and are not specifically limited here.

[0090] Exemplarily, based on the risk score of the first network asset being attacked and the threshold of the risk level determined above, the risk level of the first network asset is determined, which can be used to adjust security policies, resource allocation, risk avoidance, etc., wherein the risk level can be divided into four levels: critical, high risk, medium risk and low risk, and each level corresponds to a threshold, which is different. For example, if the risk score of the first network asset is greater than or equal to the first threshold, the risk level of the first network asset is critical; if the risk score of the first network asset is greater than or equal to the second threshold and less than the first threshold, the risk level of the first network asset is high risk; if the risk score of the first network asset is greater than or equal to the third threshold and less than the second threshold, the risk level of the first network asset is medium risk; if the risk score of the first network asset is greater than or equal to the fourth threshold and less than the third threshold, the risk level of the first network asset is low risk. Among them, the number of risk levels and the corresponding thresholds can be determined according to actual conditions, and no specific limitation is made here.

[0091] Using the above method, such as Figure 3As shown, obtaining multiple related alarm logs from multiple network assets and uniformly formatting the data can ensure data consistency while ensuring data diversity; combining the two perspectives of threat subject and network asset for risk assessment can improve the accuracy of identifying potential risks; comprehensively analyzing the threat degree of the threat subject from three dimensions: alarm type popularity score, focus score, and time discreteness score; determining the first risk score of the network asset being attacked based on the threat degree score of the threat subject and the weight of each threat subject corresponding to the network asset; determining the second risk score of the network asset being attacked based on the vulnerability-related information of the network asset; quantifying the risk of the network asset based on the first risk score and the second risk score to obtain the risk score of the network asset, so as to provide effective decision support for subsequent policy adjustments.

[0092] Based on the same technical concept, the embodiment of the present application also provides a network asset risk assessment device 4000, Figure 4 A schematic diagram of the structure of a network asset risk assessment device provided in an embodiment of the present application, such as Figure 4 As shown, the device 4000 includes:

[0093] An acquisition unit 401 is used to acquire alarm data from a plurality of network assets, where the alarm data of the plurality of network assets is used to indicate at least one threat subject that attacks the plurality of network assets;

[0094] The determination unit 402 is used to determine the threat level score of each threat subject in the at least one threat subject according to the alarm data; determine a first risk score of the first network asset being attacked according to the threat level score of each threat subject and the weight of each threat subject corresponding to the first network asset in the multiple network assets; determine a second risk score of the first network asset being attacked according to the CVSS score, the dynamic risk score of each vulnerability in at least one vulnerability of the first network asset, and the number of vulnerabilities of the first network asset; and determine the risk score of the first network asset being attacked according to the first risk score and the second risk score.

[0095] Optionally, the determination unit 402 is specifically used to determine the alarm type popularity score, focus score and time dispersion score of each threat subject based on the alarm data, the alarm type popularity score is used to evaluate the popularity of the threat subject's attack method, the focus score is used to evaluate the concentration of the threat subject's attack and the importance of the target domain to which the network assets attacked by the threat subject belong, and the time dispersion score is used to evaluate the time span of the threat subject's attack; determine the threat level score of each threat subject based on the alarm type popularity score, focus score and time dispersion score of each threat subject.

[0096] Optionally, the alarm type popularity score satisfies the following formula: in, is the missed scanning ratio of the i-th threat subject in the at least one threat subject within the preset first time interval j, D is the total number of alarms generated by the i-th threat subject using attacks in the at least one threat subject within the preset first time interval j, E is the reciprocal of the number of threat subjects using hot attacks in the preset first time interval j, ∝ is the is the adjustment coefficient of , and β is the adjustment coefficient of E.

[0097] Optionally, the concentration score satisfies the following formula: Among them, H i is the distribution density of the ith threat subject in the at least one threat subject threatening the target domain within the preset first time interval j, W k is the importance of the target domain, γ is the i The adjustment factor, δ is the W k The adjustment factor.

[0098] Optionally, the time dispersion score satisfies the following formula: Among them, A i (j) is the number of alarms of the i-th threat subject among the at least one threat subject within the preset first time interval j, A i (j, g) is the number of alarms of the i-th threat subject among the at least one threat subject within a preset second time interval g, the second time interval g belongs to the first time interval j, and ε is a decay exponent.

[0099] Optionally, the processing unit is further configured to determine a risk score of the first network asset being attacked according to the following formula: in, A first risk score for the first network asset being attacked, ω , 1 is the weight corresponding to the first risk score, A second risk score for the first network asset being attacked, ω , 2 is the weight corresponding to the second risk score.

[0100] Based on the same technical concept, Figure 5 A schematic diagram of a structure of a device 5000 provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the device 5000 includes at least one processor 501 and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 For example, the processor 501 and the memory 502 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc. In the embodiment of the present invention, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can implement the steps of the above-mentioned network asset risk assessment method by executing the instructions stored in the memory 502.

[0101] The processor 501 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and perform resource settings by running or executing instructions stored in the memory 502 and calling data stored in the memory 502. Optionally, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0102] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0103] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (RAM), a static random access memory (SRAM), a programmable read only memory (PROM), a read only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic memory, a disk, an optical disk, and the like. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0104] Based on the same technical concept, an embodiment of the present invention provides a computer-readable storage medium, in which a computer program is stored. The computer program is executed by a processor to implement the above-mentioned network asset risk assessment method.

[0105] Based on the same technical concept, various aspects of the network asset risk assessment method provided by the present application can also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the network asset risk assessment method according to various exemplary embodiments of the present application described above in this specification.

[0106] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0107] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0108] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0109] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0111] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network asset risk assessment method, characterized in that: The method comprises: Acquire alarm data from a plurality of network assets, wherein the alarm data of the plurality of network assets is used to indicate at least one threat subject attacking the plurality of network assets; Determining a threat level score of each threat subject in the at least one threat subject according to the alarm data; Determine a first risk score of the first network asset being attacked according to the threat degree score of each threat subject and the weight of each threat subject corresponding to a first network asset among the multiple network assets; determining a second risk score for the first network asset being attacked based on a Common Vulnerability Scoring System (CVSS) score of each vulnerability in at least one vulnerability of the first network asset, a dynamic risk score, and the number of vulnerabilities of the first network asset; A risk score of the first network asset being attacked is determined according to the first risk score and the second risk score.

2. The method according to claim 1, characterized in that Determining a threat level score of each threat subject in the at least one threat subject according to the alarm data includes: According to the alarm data, determine the alarm type popularity score, focus score and time dispersion score of each threat subject, the alarm type popularity score is used to evaluate the popularity of the attack method of the threat subject, the focus score is used to evaluate the concentration of the threat subject's attack and the importance of the target domain to which the network assets attacked by the threat subject belong, and the time dispersion score is used to evaluate the time span of the threat subject's attack; The threat level score of each threat subject is determined according to the alarm type popularity score, focus score and time dispersion score of each threat subject.

3. The method according to claim 2, characterized in that The alarm type popularity score satisfies the following formula: in, is the missed scanning ratio of the i-th threat subject in the at least one threat subject within the preset first time interval j, D is the total number of alarms generated by the i-th threat subject using attacks in the at least one threat subject within the preset first time interval j, E is the reciprocal of the number of threat subjects using hot attacks in the preset first time interval j, ∝ is the is the adjustment coefficient of , and β is the adjustment coefficient of E.

4. The method according to claim 2, characterized in that: The concentration score satisfies the following formula: Among them, H i is the distribution density of the ith threat subject in the at least one threat subject threatening the target domain within the preset first time interval j, W k is the importance of the target domain, γ is the i The adjustment factor, δ is the W k The adjustment factor.

5. The method according to claim 2, characterized in that: The time dispersion score satisfies the following formula: Among them, A i (j) is the number of alarms of the i-th threat subject among the at least one threat subject within the preset first time interval j, A i (j, g) is the number of alarms of the i-th threat subject among the at least one threat subject within a preset second time interval g, the second time interval g belongs to the first time interval j, and ε is a decay exponent.

6. The method according to claim 1, characterized in that Determining, according to the first risk score and the second risk score, a risk score of the first network asset being attacked, including: The risk score of the first network asset being attacked is determined according to the following formula: in, A first risk score for the first network asset being attacked, ω , 1 is the weight corresponding to the first risk score, A second risk score for the first network asset being attacked, ω , 2 is the weight corresponding to the second risk score.

7. A risk assessment device for network assets, characterized in that: The device comprises: An acquisition unit, configured to acquire alarm data from a plurality of network assets, wherein the alarm data of the plurality of network assets is used to indicate at least one threat subject that attacks the plurality of network assets; A determination unit is used to determine, based on the alarm data, a threat level score of each threat subject in the at least one threat subject; determine a first risk score of the first network asset being attacked based on the threat level score of each threat subject and the weight of each threat subject corresponding to a first network asset in the multiple network assets; determine a second risk score of the first network asset being attacked based on a CVSS score, a dynamic risk score of each vulnerability in at least one vulnerability of the first network asset, and the number of vulnerabilities of the first network asset; and determine a risk score of the first network asset being attacked based on the first risk score and the second risk score.

8. A risk assessment device for network assets, characterized in that: The device comprises: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of claims 1-6 according to the obtained program instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a computer, the method according to any one of claims 1 to 6 is executed.

10. A computer program product, characterized in that The computer program product comprises a computer program code, which causes any one of claims 1 to 6 to be performed when the computer program code is run on a computer.

Images