Asset vulnerability assessment method and device, equipment and storage medium

Abstract

The invention discloses an asset vulnerability assessment method and device, equipment and a storage medium. The asset vulnerability assessment method comprises the steps of collecting vulnerability data of assets from a data source; acquiring sample vulnerability data and to-be-evaluated vulnerability data according to the vulnerability data; determining a vulnerability evaluation formula according to the sample vulnerability data, the vulnerability evaluation formula including vulnerability attribute information, asset attribute information, and a corresponding relationship between the shortest attack path and a vulnerability score; and evaluating the to-be-evaluated vulnerability data according to the vulnerability evaluation formula to obtain an evaluation result. When the vulnerability data is collected, not only the attribute information of the vulnerability is included, but also the attribute information of the resource corresponding to the vulnerability is included, so that the omnibearing data information of the vulnerability is obtained, and evaluation is performed according to the vulnerability evaluation formula including the shortest attack path when vulnerability evaluation is performed, so that the evaluation result is more accurate, and the vulnerability evaluation efficiency is improved. And the real security condition of the business environment can be reflected more accurately.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an asset vulnerability assessment method, device, equipment and storage medium. Background Art

[0002] Vulnerability priority assessment technology is a key link in the field of information security technology. Vulnerability priority assessment can help enterprises or organizations determine which security vulnerabilities need immediate attention and repair. Effective vulnerability assessment methods can help security teams with limited resources focus on the vulnerabilities that are most likely to be exploited and have the greatest impact.

[0003] Currently, the Common Vulnerability Scoring System (CVSS) or the Exploit Prediction Scoring System (EPSS) is usually used to evaluate vulnerabilities.

[0004] Traditional CVSS, EPSS or a combination of the two only evaluates vulnerabilities based on the attributes of the vulnerability itself. However, in actual scenarios, the impact of the vulnerability is also affected by the environment, such as the resources targeted by the vulnerability and the attack path taken by the attacker to attack the resources through the vulnerability. In the existing technology, only referring to the attributes of the vulnerability itself will cause inaccurate evaluation results, which cannot truly reflect the actual security situation of the business environment. Summary of the invention

[0005] The present invention provides an asset vulnerability assessment method to achieve accurate asset vulnerability assessment.

[0006] According to a first aspect of the present invention, there is provided an asset vulnerability assessment method, comprising: collecting vulnerability data of an asset from a data source, wherein the vulnerability data comprises vulnerability attribute information and asset attribute information of an asset corresponding to the vulnerability;

[0007] Acquire sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data;

[0008] Determine a vulnerability assessment formula according to the sample vulnerability data, wherein the vulnerability assessment formula includes the corresponding relationship between the vulnerability attribute information, the asset attribute information, the shortest attack path and the vulnerability score;

[0009] The vulnerability data to be evaluated is evaluated according to the vulnerability evaluation formula to obtain an evaluation result.

[0010] According to another aspect of the present invention, there is provided an asset vulnerability assessment device, comprising: a vulnerability data collection module, for collecting vulnerability data of assets from a data source, wherein the vulnerability data includes vulnerability attribute information and asset attribute information of assets corresponding to the vulnerability;

[0011] A vulnerability data screening module, used to obtain sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data;

[0012] A vulnerability assessment formula determination module, used to determine a vulnerability assessment formula based on the sample vulnerability data, wherein the vulnerability assessment formula includes the corresponding relationship between the vulnerability attribute information, the asset attribute information, the shortest attack path and the vulnerability score;

[0013] The evaluation module is used to evaluate the vulnerability data to be evaluated according to the vulnerability evaluation formula to obtain an evaluation result.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention, when collecting vulnerability data, not only includes the attribute information of the vulnerability itself, but also includes the attribute information of the resources corresponding to the vulnerability, so as to obtain comprehensive data information of the vulnerability, and when performing vulnerability assessment, the assessment is performed according to the vulnerability assessment formula including the shortest attack path, so that the assessment result is more accurate and can more accurately reflect the actual security situation of the business environment.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of an asset vulnerability assessment method provided according to Embodiment 1 of the present invention;

[0023] Figure 2 is a schematic diagram of the structure of an asset network topology diagram provided according to Embodiment 1 of the present invention;

[0024] Figure 3 is a schematic diagram of the structure of an asset network directed graph provided according to the first embodiment of the present invention;

[0025] Figure 4 is a flow chart of an asset vulnerability assessment method provided according to Embodiment 2 of the present invention;

[0026] Figure 5 is a comparison chart of the mean and median of vulnerability repair time provided by Embodiment 2 of the present invention;

[0027] Figure 6 is a diagram showing the relationship between vulnerability scores and repair time provided in the second embodiment of the present invention;

[0028] Figure 7 is a vulnerability repair progress curve diagram provided according to the second embodiment of the present invention;

[0029] Figure 8 is a curve chart of the success rate and time of vulnerability repair prediction provided by the second embodiment of the present invention;

[0030] Fig. 9 This is a schematic diagram of the structure of an asset vulnerability assessment device provided according to Embodiment 3 of the present invention;

[0031] Fig.10 It is a schematic diagram of the structure of an electronic device provided by Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] Embodiment 1

[0035] Figure 1 A flowchart of a model detection method is provided for the first embodiment of the present invention. This embodiment is applicable to the case where a model is detected based on a model detection request. The method can be executed by a model detection device, which can be implemented in the form of hardware and / or software. Figure 1 As shown, the method includes:

[0036] Step S101, collecting vulnerability data of assets from a data source.

[0037] Optionally, vulnerability data of assets is collected from a data source, including: obtaining asset attribute information from an asset management platform, wherein the asset attribute information includes an asset importance score, an asset network topology map, and a score for the region and business system where the asset is located; obtaining first-category vulnerability attribute information from a general vulnerability scoring system, wherein the first-category vulnerability attribute information includes a vulnerability number and a first-category vulnerability severity score; obtaining second-category vulnerability attribute information from a predictive scoring system, wherein the second-category vulnerability attribute information includes a vulnerability number, a second-category vulnerability severity score, and a score for the likelihood of the vulnerability being exploited.

[0038] Specifically, in this embodiment, when vulnerability data is collected from a data source, the collected vulnerability data includes vulnerability attribute information and asset attribute information of the asset corresponding to the vulnerability, that is, the collected vulnerability data not only includes information about the vulnerability itself but also includes information about the asset corresponding to the vulnerability, so that the collected vulnerability data is more comprehensive. In addition, the data sources involved in this embodiment include multiple, such as an asset management platform, a universal vulnerability scoring system CVSS, and a vulnerability exploitation prediction scoring system EPSS, etc. Of course, this embodiment is only an example, and the specific type of the data source is not limited. And the asset management platform is mainly used to obtain asset attribute information, such as asset importance scores, asset network topology maps, and asset location areas and business system scores; and the vulnerability attribute information mainly involves two data sources, CVSS and EPSS, for example, from CVSS, the vulnerability number and the first type of vulnerability severity score are mainly obtained, and from EPSS, the vulnerability number, the second type of vulnerability severity score and the possibility score of the vulnerability being exploited are mainly obtained. Of course, this embodiment is only an example, and the specific information content obtained from each data source is not limited. As long as the information associated with the vulnerability can be obtained, it is within the scope of protection of this application.

[0039] Step S102: acquiring sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data.

[0040] Optionally, sample vulnerability data and vulnerability data to be evaluated are obtained based on the vulnerability data, including: randomly screening the vulnerability data according to a pre-configured sample ratio to obtain filtered vulnerability data; receiving user scores for the filtered vulnerability data, and adding the scores to the filtered vulnerability data to obtain sample vulnerability data; and using the remaining vulnerability data after screening as the vulnerability data to be evaluated.

[0041] Specifically, in this embodiment, after the vulnerability data is obtained, the sample data will be screened according to the pre-configured sample ratio. For example, if 100 vulnerability data are collected and the sample ratio is 3%, three vulnerability data are randomly screened out as the screened vulnerability data, and the user's score for the above three screened vulnerability data is received, and the user's score is added to the screened vulnerability data to obtain three sample vulnerability data. Of course, this embodiment is only an example for illustration, and does not limit the sample ratio and the specific values ​​of the obtained sample vulnerability data.

[0042] It should be noted that the reason why a small amount of sample vulnerability data is obtained in this implementation is because the data on EPSS is updated every day. If only machine learning is used for scoring, the dynamic nature of EPSS cannot be reflected in the model unless the model is retrained every day. In order to avoid the problem of repeated training caused by the use of models, sample vulnerability data will be used to determine the vulnerability assessment formula in the implementation of this application. Since the formula is fixed and the data is dynamic, it is only necessary to regenerate the score based on the daily data in the future.

[0043] Step S103: determining a vulnerability assessment formula according to the sample vulnerability data.

[0044] Optionally, a vulnerability assessment formula is determined based on the sample vulnerability data, including: determining initial weights corresponding to vulnerability attribute information and asset attribute information respectively using linear regression based on the sample vulnerability data; optimizing and adjusting the initial weights using a random forest algorithm to obtain final weights; and determining a vulnerability assessment formula based on the final weights corresponding to each vulnerability attribute information and asset attribute information.

[0045] Specifically, in this implementation, a scoring formula is initially constructed, as shown in the following formula (1):

[0046] Total_score=SP_score*(R score *A1+EPSS score *A2+Percentile score *A3

[0047] +CIA score *A4+F score *A5)(1)

[0048] Among them, Total_score represents the evaluation score, SP_score represents the score corresponding to the shortest attack path, and R score Indicates the severity score of the first category of vulnerabilities obtained by CVSS, EPSS score Indicates the severity score of the second type of vulnerability obtained by EPSS, Percentile score Indicates the probability score of the vulnerability being exploited obtained by EPSS, CIA score Indicates the score of the region and business system where the asset is located, F scoreRepresents the asset importance score, where A1 to A5 represent the weights corresponding to each attribute information. Since A1 to A5 are unknown quantities in the initially constructed scoring formula, the initial weights corresponding to each variable, such as asset attribute information and vulnerability attribute information, can be determined by linear regression based on the sample data vulnerability data, and the initial weights can be optimized and adjusted using the random forest algorithm to obtain the final weights corresponding to each variable.

[0049] Specifically, linear regression is a common machine learning method, which is usually used to establish a linear relationship model between features and target variables. In the linear regression model, it is assumed that there is a linear relationship between the input features and the output results, and the initial weight of the feature is determined by minimizing the error between the predicted value and the true value. Since the initial weight determined by linear regression alone is not stable enough, the random forest algorithm is used for further adjustment. Among them, random forest is a supervised ensemble learning algorithm based on decision trees. It learns multiple estimators through training and obtains the final prediction value by combining the results of multiple estimators. For example, random forest uses the extraction and replacement algorithm to extract n samples from the sample set to generate a decision tree, and generates nodes of the decision tree by extracting d features from the sample. Repeat these two steps to generate k decision trees. Each decision tree will output an answer, which will be averaged by using a combiner to generate the final answer. Random forest can evaluate the importance of features. The average weight of each feature is obtained by averaging the contribution of each feature on each tree, so that users can know which features have a higher weight. This solution uses the feature weight ratio obtained by random forest, and fine-tunes the weight factor in the formula through the weight ratio, and this stage may be repeated many times to obtain a relatively stable final weight. Of course, this implementation is only an example, and does not limit the method of obtaining the final weight. For example, according to the sample vulnerability data, the final weights obtained by linear regression and random forest algorithm are A1=0.1, A2=0.3, A3=0.1, A4=0.4, A5=0.1, respectively. Substitute the above final weights into the above formula (1), and the obtained vulnerability assessment formula is shown in the following formula (2):

[0050] Total_score=SP_score*(R score *0.1+EPSS score *0.3+Percentile score *0.1

[0051] +CIA score *0.4+F score *0.1)(2)

[0052] Step S104: Evaluate the vulnerability data to be evaluated according to the vulnerability evaluation formula to obtain an evaluation result.

[0053] Optionally, the vulnerability data to be evaluated is evaluated according to a vulnerability assessment formula to obtain an evaluation result, including: extracting an asset network topology map in the vulnerability data to be evaluated, and determining the shortest attack path for attacking the asset through the vulnerability based on the asset network topology map; substituting the vulnerability attribute information, asset attribute information and the shortest attack path in the data to be evaluated into the vulnerability assessment formula to obtain an evaluation score, and determining a vulnerability priority evaluation result based on the evaluation score, wherein the vulnerability priorities include medium risk, high risk and severe risk.

[0054] Optionally, the shortest attack path for attacking assets through vulnerabilities is determined based on the asset network topology map, including: constructing an asset network directed graph based on the asset network topology map, wherein the asset network directed graph includes device nodes associated with the assets and relationship weight values ​​between each device node; determining all attack paths for an attacker to reach the asset corresponding to the current vulnerability in the network directed graph; determining the weight sum of all relationship weight values ​​involved in each attack path, and taking the attack path with the smallest weight sum as the shortest attack path.

[0055] Specifically, in this embodiment, after obtaining the vulnerability assessment formula, since the vulnerability attribute information, asset attribute information and attack shortest path in the formula are all feature variables, and the final weights corresponding to the feature variables are all known, the variable features contained in the vulnerability data to be assessed, and the score corresponding to the attack shortest path determined according to the asset attribute information can be substituted into the above formula (2) to obtain the assessment results corresponding to each vulnerability data to be assessed. The vulnerability attribute information and asset attribute information in the formula can be directly extracted from the vulnerability data to be assessed, but the score corresponding to the attack shortest path needs to first determine the attack shortest path from a large number of attack paths, and then obtain the score corresponding to the attack shortest path. Among them, when obtaining the attack shortest path, the asset network topology map is first extracted from the asset attribute information, such as Figure 2 The figure shows a schematic diagram of the structure of the asset network topology diagram, which shows the path that the attacker takes under ideal network traffic conditions. Among them, the demilitarized zone (DMZ) zone servers, test zone servers, office zone servers, and intranet zone servers in the asset network topology diagram are all resources, and each vulnerability data to be evaluated is marked with the target resource corresponding to the vulnerability, that is, which specific resource has the vulnerability. In this implementation, a relationship weight value is set for each device node, and because the internal server is completely isolated at the network level, the relationship weight value is set to infinity, so that an asset network directed graph can be constructed based on the above-mentioned asset network topology diagram and the set relationship weight values, as shown in FIG. Figure 3 The following is an example of an asset network directed graph. In the network directed graph, there are multiple attack paths for an attacker to reach the asset corresponding to the current vulnerability to be evaluated. In this embodiment, a single-source shortest path algorithm can be used, such as the Dijkstra algorithm to obtain the shortest attack path for an attacker to reach the asset corresponding to the current vulnerability. After determining the shortest attack path, the corresponding score of the shortest attack path can be calculated based on the weight sum of all relationship weight values ​​involved in the shortest path. For example, the weight sum is used as the score, or the correspondence between the pre-configured weight sum and the score is referred to, and the score is obtained by querying the correspondence. Of course, this embodiment is only an example, and does not limit the method for obtaining the corresponding score of the shortest attack path.

[0056] It should be noted that in this implementation, the vulnerability attribute information, asset attribute information and the score corresponding to the shortest attack path in the data to be evaluated are substituted into the vulnerability evaluation formula to obtain the evaluation score. After obtaining the evaluation score, the vulnerability priority corresponding to the vulnerability data to be evaluated can also be obtained based on the corresponding relationship between the evaluation score and the priority, where the vulnerability priority includes medium risk, high risk and serious risk, where the vulnerability priority respectively indicates the degree of impact of the vulnerability on the corresponding asset. In this implementation, only the three levels of vulnerability priority are used as an example for explanation, and in actual applications, users can further refine according to the accuracy of the evaluation, which is not limited in this implementation.

[0057] In the implementation mode of the present application, when vulnerability data is collected, not only the attribute information of the vulnerability itself is included, but also the attribute information of the resources corresponding to the vulnerability, so as to obtain comprehensive data information of the vulnerability, and when performing vulnerability assessment, the assessment is performed according to the vulnerability assessment formula that includes the shortest attack path, so that the assessment result is more accurate and can more accurately reflect the actual security situation of the business environment.

[0058] Embodiment 2

[0059] Figure 4 The second embodiment of the present invention provides a flowchart of an asset vulnerability assessment method. This embodiment is based on the above embodiment. After evaluating the vulnerability data to be assessed according to the vulnerability assessment formula to obtain the assessment result, it also includes: saving the assessed asset vulnerability to be assessed to a specified database; when receiving an asset vulnerability dispatch instruction, extracting the vulnerability data to be dispatched from the specified database according to the dispatch instruction; merging the vulnerability data to be dispatched to obtain a dispatch task, and executing the dispatch task. Figure 4 Shown is a flow chart of a methodology for assessing asset vulnerabilities.

[0060] Step S201, collecting vulnerability data of assets from a data source.

[0061] Optionally, vulnerability data of assets is collected from a data source, including: obtaining asset attribute information from an asset management platform, wherein the asset attribute information includes an asset importance score, an asset network topology map, and a score for the region and business system where the asset is located; obtaining first-category vulnerability attribute information from a general vulnerability scoring system, wherein the first-category vulnerability attribute information includes a vulnerability number and a first-category vulnerability severity score; obtaining second-category vulnerability attribute information from a predictive scoring system, wherein the second-category vulnerability attribute information includes a vulnerability number, a second-category vulnerability severity score, and a score for the likelihood of the vulnerability being exploited.

[0062] Step S202: acquiring sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data.

[0063] Optionally, sample vulnerability data and vulnerability data to be evaluated are obtained based on the vulnerability data, including: randomly screening the vulnerability data according to a pre-configured sample ratio to obtain filtered vulnerability data; receiving user scores for the filtered vulnerability data, and adding the scores to the filtered vulnerability data to obtain sample vulnerability data; and using the remaining vulnerability data after screening as the vulnerability data to be evaluated.

[0064] Step S203: determining a vulnerability assessment formula according to the sample vulnerability data.

[0065] Optionally, a vulnerability assessment formula is determined based on the sample vulnerability data, including: determining initial weights corresponding to vulnerability attribute information and asset attribute information respectively using linear regression based on the sample vulnerability data; optimizing and adjusting the initial weights using a random forest algorithm to obtain final weights; and determining a vulnerability assessment formula based on the final weights corresponding to each vulnerability attribute information and asset attribute information.

[0066] Step S204: Evaluate the vulnerability data to be evaluated according to the vulnerability evaluation formula to obtain an evaluation result.

[0067] Optionally, the vulnerability data to be evaluated is evaluated according to a vulnerability assessment formula to obtain an evaluation result, including: extracting an asset network topology map in the vulnerability data to be evaluated, and determining the shortest attack path for attacking the asset through the vulnerability based on the asset network topology map; substituting the vulnerability attribute information, asset attribute information and the shortest attack path in the data to be evaluated into the vulnerability assessment formula to obtain an evaluation score, and determining a vulnerability priority evaluation result based on the evaluation score, wherein the vulnerability priorities include medium risk, high risk and severe risk.

[0068] Optionally, the shortest attack path for attacking assets through vulnerabilities is determined based on the asset network topology map, including: constructing an asset network directed graph based on the asset network topology map, wherein the asset network directed graph includes device nodes associated with the assets and relationship weight values ​​between each device node; determining all attack paths for an attacker to reach the asset corresponding to the current vulnerability in the network directed graph; determining the weight sum of all relationship weight values ​​involved in each attack path, and taking the attack path with the smallest weight sum as the shortest attack path.

[0069] Step S205, the assessed asset vulnerabilities to be assessed are saved in a designated database, and when an asset vulnerability dispatch instruction is received, the vulnerability data to be dispatched is extracted from the designated database according to the dispatch instruction.

[0070] Specifically, in this embodiment, after the evaluation is completed, the evaluation result will be marked on the asset vulnerability to be evaluated, and the marked asset vulnerability with evaluation will be saved in the specified database. When the distribution instruction of the asset vulnerability is received, the vulnerability data to be distributed will be extracted from the specified database according to the distribution instruction. The distribution instruction in this embodiment can be generated regularly, for example, the distribution instruction of the asset vulnerability is automatically sent once every day, or the user inputs it according to the distribution demand. The specific method of obtaining the distribution instruction is not limited in this embodiment.

[0071] Step S206, merging the vulnerability data to be distributed to obtain a distribution task, and executing the distribution task.

[0072] Among them, in this implementation, after determining the vulnerability data to be distributed, the asset information corresponding to the vulnerability will be queried. If it can be associated with the person in charge corresponding to the vulnerable asset, the vulnerability will be marked as complete asset information, otherwise it will be marked as incomplete asset information. For vulnerabilities with complete asset information, it will first be determined whether there are identical tasks that have been created. This judgment method is based on the task name. Because the task name is usually named in the form of asset + person in charge, it can be judged as long as there is a match in the task management center to see if there is an identical task name. If there is no identical task, the vulnerabilities and related information in the batch that have not yet created tasks, such as vulnerability priority scores, affected assets, and vulnerability numbers will be uniformly output to a table. When creating a new task, the two dimensions of the assets and asset persons in the table will be merged, and then all the merged vulnerabilities will be associated with the task to be created. If there is an identical task, you only need to update this vulnerability into the existing task to achieve vulnerability merging.

[0073] In addition, for the vulnerability of incomplete asset information, the task name will be different because of the lack of the asset manager, and the task should be assigned to the corresponding asset organizer for unified distribution. Therefore, the creation and update of tasks are unified as a task named "Missing Asset Vulnerability + Asset Organizer Name". Therefore, the vulnerability data in the same dispatched task corresponds to the same asset manager or the same asset organizer.

[0074] Optionally, after executing the dispatching task, the method further includes: obtaining repair results for the vulnerability data to be dispatched; and graphically displaying the vulnerability data to be dispatched in a specified format according to the repair results.

[0075] Specifically, in this implementation, after the distribution task is completed for the vulnerability, the asset manager Mr. Hu will repair the asset based on the vulnerability, and obtain the asset repair time after the repair is completed. In addition, in this implementation, the vulnerability data to be distributed will be graphically displayed in a specified format, such as Figure 5 The following is a comparison of the mean and median vulnerability repair time. Figure 5 When displaying the vulnerability repair time through a bar chart, draw the average and median to reflect the distribution characteristics of the data and the impact of extreme values. Figure 5 It can be seen that the mean and median of vulnerability repair time are quite different. Therefore, it can be found that in the process of vulnerability repair, the repair time of some vulnerabilities is significantly longer than that of other vulnerabilities. Figure 6 The following is a graph showing the relationship between vulnerability score and repair time. Figure 6 In this paper, we use the scatter plot to overlay the regression line to analyze the relationship between vulnerability score and repair time, verify the guiding role of the score on the actual vulnerability repair priority, and Figure 6 It can be seen that vulnerability repairs are carried out in descending order of vulnerability scores. For vulnerabilities with higher scores, the repair priority is higher; Figure 7 The following is a curve chart showing the progress of vulnerability repairs, from Figure 7 It can be seen that 70 vulnerabilities were fixed one by one in 30 days, and the rate of repair was relatively even. The number of repairs on the 12th and 21st days was slightly higher than usual. Figure 8The figure shows the predicted success rate and time curve of vulnerability repair, where the blue dotted line is a curve that follows a normal distribution with a mean of 15 and a standard deviation of 5. After adding the observed data of vulnerability repair time in the actual environment, the red solid line is obtained, which is the final predicted value. In this embodiment, only the above four specified formats are used as examples for graphical display. Of course, assets can also be divided into high, medium and low priority groups through scatter plots, and cluster analysis can be performed according to vulnerability type, repair time and business impact to show the rationality of the grouping results; or according to the entire life cycle of the vulnerability, such as detection, dispatch, repair and closure, the time consumption of each stage can be displayed in the figure through a stacked bar chart, and the average time consumption line of each stage can be drawn to find the longest stage. The specific form of graphical display is not limited in this embodiment.

[0076] Specifically, in this implementation, the existing vulnerability priority technology is combined and the business asset dimension is added. By combining the existing vulnerability priority technology and associating the three dimensions of business assets, such as the region, the business system to which it belongs, and the importance of assets, the vulnerabilities are scored and sorted, and the final score and sorting results can reflect the real vulnerability risk situation of the business environment; scoring is achieved by combining machine learning with formulas, because there are dynamic data in the selected data sources, such as EPSS, asset data, etc. If only machine learning is used, the model needs to be retrained according to the changes in the data, which does not conform to the actual use scenario, but the formula can solve this problem. The formula is fixed, and the data can be dynamic. The weight factor of the formula can be continuously polished by combining the characteristics of the linear regression algorithm and the feature importance evaluation of the random forest, and sufficient stability and rationality can be obtained. If the data changes, it is only necessary to recalculate the score through the formula; for the integrated vulnerability data, it can be sent to the corresponding business system person in charge according to the task management function of the asset platform, so as to form a closed loop for the management of vulnerabilities. There are many ways to send work order reminders, and currently the email method is used for reminders. After the work order is sent, the existing vulnerability management system is not able to achieve such a complete full life cycle management, or does not combine so much raw data; combined with multi-dimensional data such as vulnerability discovery time, vulnerability details, scoring data, and repair time, the vulnerability information is fully integrated and visualized through the dashboard function to form a complete closed-loop data view. At the same time, a prediction function is provided for the future trend of the vulnerability. The content displayed in the chart and the method of using it are important key points of the present invention, which can intuitively present the full life cycle information of the vulnerability and support decision analysis; combined with attack path restoration, the accuracy of vulnerability repair priority decision-making is improved. The present invention introduces the attack path dimension, by restoring the possible path of the attacker, calculating the shortest path of the attack, and comprehensively evaluating the risk score of the vulnerability in the actual environment. Based on this score, the priority of vulnerability repair is further determined to improve the scientificity and practicality of vulnerability management.

[0077] In the implementation mode of the present application, when vulnerability data is collected, not only the attribute information of the vulnerability itself is included, but also the attribute information of the resources corresponding to the vulnerability, so as to obtain comprehensive data information of the vulnerability, and when performing vulnerability assessment, the assessment is performed according to the vulnerability assessment formula that includes the shortest attack path, so that the assessment result is more accurate and can more accurately reflect the actual security situation of the business environment.

[0078] Embodiment 3

[0079] Fig. 9 A schematic diagram of the structure of an asset vulnerability assessment device provided by Embodiment 3 of the present invention. Fig. 9As shown, the device includes: a vulnerability data collection module 310, a vulnerability data screening module 320, a vulnerability assessment formula determination module 330 and an assessment module 340.

[0080] The vulnerability data collection module 310 is used to collect vulnerability data of assets from data sources, wherein the vulnerability data includes vulnerability attribute information and asset attribute information of assets corresponding to the vulnerability;

[0081] A vulnerability data screening module 320 is used to obtain sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data;

[0082] A vulnerability assessment formula determination module 330 is used to determine a vulnerability assessment formula based on the sample vulnerability data, wherein the vulnerability assessment formula includes the corresponding relationship between vulnerability attribute information, asset attribute information, the shortest attack path and the vulnerability score;

[0083] The evaluation module 340 is used to evaluate the vulnerability data to be evaluated according to the vulnerability evaluation formula to obtain an evaluation result.

[0084] Optionally, a vulnerability data collection module is used to obtain asset attribute information from the asset management platform, wherein the asset attribute information includes an asset importance score, an asset network topology map, and a score of an asset location and a business system;

[0085] Obtain first-category vulnerability attribute information from a common vulnerability scoring system, wherein the first-category vulnerability attribute information includes a vulnerability number and a first-category vulnerability severity score;

[0086] The second type of vulnerability attribute information is obtained from the vulnerability exploitation prediction scoring system, wherein the second type of vulnerability attribute information includes a vulnerability number, a second type of vulnerability severity score, and a vulnerability exploitation possibility score.

[0087] Optionally, a vulnerability data screening module is used to randomly screen the vulnerability data according to a pre-configured sample ratio to obtain screened vulnerability data;

[0088] receiving a user's score for the filtered vulnerability data, and adding the score to the filtered vulnerability data to obtain sample vulnerability data;

[0089] The remaining vulnerability data will be screened as vulnerability data to be evaluated.

[0090] Optionally, a vulnerability assessment formula determination module is used to determine initial weights corresponding to vulnerability attribute information and asset attribute information respectively by linear regression according to sample vulnerability data;

[0091] The random forest algorithm is used to optimize and adjust the initial weights to obtain the final weights;

[0092] A vulnerability assessment formula is determined based on the final weights corresponding to each vulnerability attribute information and asset attribute information.

[0093] Optionally, an assessment module is used to extract an asset network topology map from the vulnerability data to be assessed, and determine the shortest attack path for attacking the asset through the vulnerability based on the asset network topology map;

[0094] Substitute the vulnerability attribute information, asset attribute information and shortest attack path in the data to be evaluated into the vulnerability assessment formula to obtain the assessment score, and determine the vulnerability priority assessment result based on the assessment score, where the vulnerability priorities include medium risk, high risk and severe risk.

[0095] Optionally, the evaluation module is further used to construct an asset network directed graph according to the asset network topology graph, wherein the asset network directed graph includes device nodes associated with the assets and relationship weight values ​​between the device nodes;

[0096] Determine all attack paths in the network directed graph from which the attacker can reach the asset corresponding to the current vulnerability;

[0097] The weight sum of all relationship weight values ​​involved in each attack path is determined, and the attack path with the smallest weight sum is taken as the shortest attack path.

[0098] Optionally, the device further includes a task dispatching module, which is used to save the vulnerabilities of the assets to be assessed that have been assessed into a designated database;

[0099] When receiving an asset vulnerability dispatch instruction, extract the vulnerability data to be dispatched from the specified database according to the dispatch instruction;

[0100] The vulnerability data to be distributed are merged to obtain a distribution task, and the distribution task is executed, wherein the vulnerability data in the same distribution task corresponds to the same asset manager or the same asset sorter.

[0101] Optionally, the device further includes a graphical display module for obtaining repair results for the vulnerability data to be distributed;

[0102] According to the repair results, the vulnerability data to be distributed will be graphically displayed in the specified format.

[0103] The model detection device provided in the embodiment of the present invention can execute the model detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0104] Embodiment 4

[0105] Fig.10The present invention is a block diagram of an electronic device 10 that can be used to implement an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0106] like Fig.10 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0107] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0108] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the asset vulnerability assessment method.

[0109] In some embodiments, the method for assessing asset vulnerabilities may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for assessing asset vulnerabilities described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the method for assessing asset vulnerabilities in any other appropriate manner (e.g., by means of firmware).

[0110] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0111] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0112] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0113] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0114] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0115] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0116] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0117] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for evaluating asset vulnerabilities, characterized in that: include: Collecting vulnerability data of assets from a data source, wherein the vulnerability data includes vulnerability attribute information and asset attribute information of assets corresponding to the vulnerability; Acquire sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data; Determine a vulnerability assessment formula according to the sample vulnerability data, wherein the vulnerability assessment formula includes the corresponding relationship between the vulnerability attribute information, the asset attribute information, the shortest attack path and the vulnerability score; The vulnerability data to be evaluated is evaluated according to the vulnerability evaluation formula to obtain an evaluation result.

2. The method according to claim 1, characterized in that The collecting of vulnerability data of assets from the data source includes: Acquire the asset attribute information from the asset management platform, wherein the asset attribute information includes an asset importance score, an asset network topology map, and a score of an asset location and a business system; Obtain first-category vulnerability attribute information from a common vulnerability scoring system, wherein the first-category vulnerability attribute information includes a vulnerability number and a first-category vulnerability severity score; The second type of vulnerability attribute information is obtained from the vulnerability exploitation prediction scoring system, wherein the second type of vulnerability attribute information includes a vulnerability number, a second type of vulnerability severity score, and a vulnerability exploitation possibility score.

3. The method according to claim 1, characterized in that The obtaining sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data includes: Randomly screening the vulnerability data according to a pre-configured sample ratio to obtain screening vulnerability data; receiving a user's score for the screened vulnerability data, and adding the score to the screened vulnerability data to obtain the sample vulnerability data; The remaining vulnerability data is screened and used as the vulnerability data to be evaluated.

4. The method according to claim 3, characterized in that Determining a vulnerability assessment formula according to the sample vulnerability data includes: Determine initial weights corresponding to the vulnerability attribute information and the asset attribute information respectively by using a linear regression method according to the sample vulnerability data; The random forest algorithm is used to optimize and adjust the initial weights to obtain the final weights; The vulnerability assessment formula is determined according to the final weights respectively corresponding to each of the vulnerability attribute information and the asset attribute information.

5. The method according to claim 2, characterized in that: The step of evaluating the vulnerability data to be evaluated according to the vulnerability evaluation formula to obtain an evaluation result includes: Extracting the asset network topology map from the vulnerability data to be assessed, and determining the shortest attack path for attacking the asset through the vulnerability according to the asset network topology map; The vulnerability attribute information, the asset attribute information and the shortest attack path in the data to be evaluated are substituted into the vulnerability evaluation formula to obtain an evaluation score, and a vulnerability priority evaluation result is determined according to the evaluation score, wherein the vulnerability priority includes medium risk, high risk and severe risk.

6. The method according to claim 5, characterized in that Determining the shortest attack path for attacking assets through vulnerabilities according to the asset network topology diagram includes: Constructing an asset network directed graph according to the asset network topology graph, wherein the asset network directed graph includes device nodes associated with the assets and relationship weight values ​​between the device nodes; Determine all attack paths for an attacker to reach the asset corresponding to the current vulnerability in the network directed graph; The weight sum of all relationship weight values ​​involved in each attack path is determined, and the attack path with the smallest weight sum is used as the shortest attack path.

7. The method according to claim 5, characterized in that After evaluating the vulnerability data to be evaluated according to the vulnerability evaluation formula to obtain the evaluation result, the method further includes: Save the vulnerabilities of the assets to be assessed that have been assessed to the designated database; When receiving an asset vulnerability dispatch instruction, extracting vulnerability data to be dispatched from the designated database according to the dispatch instruction; The vulnerability data to be distributed are merged to obtain a distribution task, and the distribution task is executed, wherein the vulnerability data in the same distribution task corresponds to the same asset manager or the same asset sorter.

8. The method according to claim 7, characterized in that After executing the dispatching task, the method further includes: Obtaining a repair result for the vulnerability data to be distributed; The vulnerability data to be distributed is graphically displayed in a specified format according to the repair result.

9. An asset vulnerability assessment device, characterized in that: include: A vulnerability data collection module, used to collect vulnerability data of assets from a data source, wherein the vulnerability data includes vulnerability attribute information and asset attribute information of assets corresponding to the vulnerability; A vulnerability data screening module, used to obtain sample vulnerability data and vulnerability data to be evaluated according to the vulnerability data; A vulnerability assessment formula determination module, used to determine a vulnerability assessment formula based on the sample vulnerability data, wherein the vulnerability assessment formula includes the corresponding relationship between the vulnerability attribute information, the asset attribute information, the shortest attack path and the vulnerability score; The evaluation module is used to evaluate the vulnerability data to be evaluated according to the vulnerability evaluation formula to obtain an evaluation result.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 8 when executed.

Images