Network security threat assessment method and system

Abstract

The invention relates to the technical field, in particular to a network security threat assessment method and system, and the method comprises the following steps: obtaining the connection relation of network nodes, analyzing the propagation path of the network nodes, simulating the condition after an initial network node triggers a threat event in combination with the propagation characteristics of key network nodes, and obtaining a threat assessment result. And generating a network node threat propagation dynamic feature set according to a simulation result. According to the method, the connection relation of the network nodes is obtained, the propagation path is analyzed by utilizing the propagation event triggering probability, the key nodes are extracted, and dynamic simulation is performed in combination with the propagation characteristics of the key nodes, so that the propagation rule of the threat events in the network and the cooperative relation between the nodes can be comprehensively reflected. Through introduction of random disturbance and adjustment of a critical path, the diffusion range and node connectivity of the path are evaluated, so that the influence of threat propagation is more quantifiable.

Description

Technical Field

[0001] The present invention relates to the technical field, and in particular to a network security threat assessment method and system. Background Art

[0002] The field of information security technology refers to the technologies, measures and methods adopted to ensure the confidentiality, integrity and availability of information in response to security threats that may arise during the storage, transmission and processing of information. This field covers cryptography, network security, identity authentication, access control, intrusion detection and other aspects, and is used to prevent data leakage, network attacks and other forms of security threats.

[0003] Among them, the network security threat assessment method is a technology in the field of information security. It analyzes and evaluates potential network security threats, identifies weak links in the system or network, and proposes corresponding improvement plans. Its main purpose is to provide organizations with comprehensive threat identification and risk assessment services, thereby improving the defense capabilities of network systems.

[0004] Existing technologies mainly analyze threat assessments through existing static data in the network. Although they can identify weak links in the system or network, they lack in-depth characterization of the dynamic propagation characteristics of threat events and the complex relationships between key nodes. For example, when dealing with the connection relationship between nodes, existing technologies often only analyze based on fixed security policies, and cannot dynamically reflect the trend of risk changes between nodes over time. In addition, the lack of simulation and evaluation capabilities for disturbance factors limits its ability to predict the behavior of key paths and nodes under abnormal conditions, which may result in some potential high-risk paths not being identified in a timely manner. For the ranking of threat priorities, existing technologies are mostly limited to risk factors in a single dimension, while ignoring comprehensive characteristics such as trigger frequency and coverage, resulting in overly one-sided evaluation results that cannot provide a reliable basis for comprehensive optimization of defense strategies. Summary of the invention

[0005] In order to solve the technical problems existing in the prior art, an embodiment of the present invention provides a network security threat assessment method and system. The technical solution is as follows:

[0006] A network security threat assessment method comprises the following steps:

[0007] S1: Obtain the connection relationship of network nodes, analyze the propagation path of network nodes, simulate the situation after the initial network node triggers the threat event based on the propagation characteristics of key network nodes, and generate a dynamic feature set of network node threat propagation based on the simulation results;

[0008] S2: Based on the dynamic feature set of the network node threat propagation and superimposing random disturbances, the paths and corresponding network nodes most affected by the disturbances in the propagation process are extracted to generate propagation path characteristic analysis results;

[0009] S3: Based on the network nodes extracted from the propagation path characteristic analysis results, hierarchical clustering is performed on the paths most affected by the disturbance during the propagation process and the corresponding network nodes, and potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results to generate a threat path hierarchical and strength association set;

[0010] S4: sorting the risk priorities of the paths according to the threat path stratification and strength association set, and generating a path threat priority list;

[0011] S5: Obtain the threat transmission chain of the corresponding path in the order of the path threat priority list, evaluate the future threat diffusion trend in the entire network according to the threat transmission chain, and generate a network threat diffusion assessment result.

[0012] The present invention has the following improvements: the network node threat propagation dynamic feature set includes the node trigger probability distribution, propagation time interval, and key node security status; the propagation path characteristic analysis results include the path characteristics most affected by the disturbance, the propagation influence of the corresponding node, and the path diffusion range; the threat path stratification and strength association set includes the threat path, threat node distribution, and potential threat area; the path threat priority list specifically includes path risk level, threat path ranking, and node priority processing order; the network threat diffusion assessment results include the threat transmission chain, threat diffusion trend, and future risk area prediction.

[0013] The present invention has the following improvements: obtaining the connection relationship of network nodes, analyzing the propagation path of network nodes, simulating the situation after the initial network node triggers a threat event in combination with the propagation characteristics of key network nodes, and generating a dynamic feature set of network node threat propagation according to the simulation results:

[0014] S101: Based on the acquired connection relationship of the network nodes, the probability of triggering a propagation event between the network nodes is calculated, and the propagation path of the network nodes is analyzed in combination with the probability of triggering the propagation event, so as to generate a propagation path analysis result of the network nodes;

[0015] S102: extracting key network nodes in the propagation path based on the network node propagation path analysis result, identifying and classifying the key network nodes according to their triggering probabilities and connection relationships, and generating key network node classification results;

[0016] S103: Based on the classification results of the key network nodes, the propagation characteristics of the key network nodes are analyzed, and the propagation path and propagation time delay after the initial network node triggers the threat event are simulated in combination with the propagation characteristics to generate a dynamic feature set of network node threat propagation.

[0017] The present invention is improved in that the formula is used to calculate the probability of triggering a propagation event between network nodes:

[0018]

[0019] Get the propagation event trigger probability P between node pairs ij ;

[0020] Among them, C ij represents the connection strength from node i to node j, R ij represents the risk factor from node i to node j, It represents the sum of the weighted connection strength and risk factor between node i and all adjacent nodes k.

[0021] The present invention is improved in that, based on the network node threat propagation dynamic feature set superimposed with random disturbance, the path and the corresponding network node most affected by the disturbance in the propagation process are extracted, and the specific steps of generating the propagation path characteristic analysis result are as follows:

[0022] S201: Based on the network node threat propagation dynamic feature set, superimpose random disturbances on key path network nodes, adjust the triggering probability and propagation time parameters of the key path network nodes, and generate key path node disturbance analysis results;

[0023] S202: Based on the critical path node disturbance analysis result, analyze the impact of random disturbance on the connectivity of critical path network nodes, evaluate the propagation path diffusion range after the initial network node triggers the threat event in combination with the analysis result, and generate a random disturbance path diffusion range evaluation result;

[0024] S203: Based on the random disturbance path diffusion range evaluation result, the path most affected by the disturbance during the propagation process and the corresponding network node are extracted to generate a propagation path characteristic analysis result.

[0025] The present invention is improved in that, based on the network nodes extracted from the propagation path characteristic analysis results, hierarchical clustering is performed on the paths and corresponding network nodes that are most affected by the disturbance during the propagation process, and the potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results. The specific steps of generating the threat path hierarchical and strength association set are as follows:

[0026] S301: Based on the propagation path characteristic analysis result, extract the network nodes in the propagation path, obtain the trigger frequency, network node coverage and attack intensity information of the network nodes, wherein the trigger frequency is quantified by numerical value, and the attack intensity is graded by using a graded scoring standard to generate the network node threat feature information;

[0027] S302: Based on the network node threat feature information, the trigger frequency, network node coverage and attack intensity information are evaluated, and a fuzzy membership function is constructed according to the evaluation result to generate a network node threat feature analysis result;

[0028] S303: Based on the threat feature analysis results of the network nodes, combined with the paths and corresponding network nodes that are most affected by the disturbance during the propagation process, hierarchical clustering is performed on the paths and nodes, and potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results to generate a threat path hierarchy and strength association set.

[0029] The present invention has the following improvements: for constructing the fuzzy membership function, the formula is adopted:

[0030]

[0031] Calculate the membership value μ(x) of the network node;

[0032] Among them, x is the current node feature, λ is the parameter for adjusting the steepness in the membership function, and -λ(x-θ) represents the deviation between the current feature value x and the feature fuzzy classification center threshold θ.

[0033] The present invention is improved in that the risk priority of the path is sorted according to the threat path layering and strength association set, and the specific steps of generating the path threat priority list are as follows:

[0034] S401: Based on the threat path layering and strength association set, a cumulative trigger value of the trigger frequency is obtained, and the number ratio of the multi-frequency network nodes in the path is obtained in combination with the cumulative trigger value to generate a multi-frequency network node analysis result;

[0035] S402: Based on the multi-frequency network node ratio result, analyze the overall impact capability of the path according to the network node coverage rate, and generate a path impact capability analysis result in combination with the coverage rate result;

[0036] S403: Based on the path impact capability analysis result, the density of potential threat network nodes is evaluated according to the level distribution of attack intensity, and the risk paths are sorted in combination with the density and path priority to generate a path threat priority list.

[0037] The present invention is improved in that the threat transmission chain of the corresponding path is obtained in the order of the path threat priority list, and the future threat diffusion trend in the entire network is evaluated according to the threat transmission chain. The specific steps of generating the network threat diffusion evaluation result are as follows:

[0038] S501: Based on the path threat priority list, obtain the risk path according to the priority sorting, extract the connection relationship and trigger event record of each node in the risk path, and generate the risk path node transmission relationship;

[0039] S502: Based on the risk path node transmission relationship, analyze the threat propagation direction and transmission chain between nodes, evaluate the role of key nodes in the transmission chain in combination with the trigger event record, and generate a risk path threat transmission chain;

[0040] S503: Based on the risk path threat transmission chain, combined with the node propagation characteristics and the threat priority of the path, the future diffusion trend of the threat in the entire network and the scope of the affected nodes are evaluated to generate a network threat diffusion assessment result.

[0041] A network security threat assessment system, the system comprising:

[0042] The network node analysis module obtains the connection relationship of network nodes, analyzes the propagation path of network nodes, simulates the propagation of threat events triggered by the initial network nodes based on the propagation characteristics of key network nodes, and generates a dynamic feature set of network node threat propagation based on the simulation results;

[0043] The random disturbance analysis module superimposes random disturbances based on the dynamic feature set of threat propagation of network nodes, extracts the paths and corresponding network nodes most affected by the disturbances during the propagation process, and generates propagation path characteristic analysis results;

[0044] The threat path clustering module performs hierarchical clustering based on the network nodes extracted from the propagation path characteristic analysis results, combined with the trigger frequency, network node coverage and attack intensity information, and marks the potential threat areas and hidden threat network nodes in the path according to the clustering results, sorts the risk priorities of the path, and generates a path threat priority list;

[0045] The threat diffusion assessment module obtains the threat transmission chain of the corresponding path in order of priority based on the path threat priority list, evaluates its future threat diffusion trend in the entire network according to the threat transmission chain, and generates a network threat diffusion assessment result.

[0046] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0047] By obtaining the connection relationship of network nodes, analyzing the propagation path using the probability of propagation event triggering, extracting key nodes and combining their propagation characteristics for dynamic simulation, it is possible to fully reflect the propagation law of threat events in the network and the collaborative relationship between nodes. By introducing random disturbances and adjusting key paths, evaluating the diffusion range of paths and node connectivity, the impact of threat propagation is made more quantifiable, and the paths and nodes most affected by disturbances can be identified, thereby improving the accuracy of threat positioning. In addition, based on the extraction and quantitative evaluation of threat characteristics of network nodes, classification analysis is performed through fuzzy membership functions, which not only realizes the labeling of potential threat areas, but also distinguishes hidden threat nodes, further improving the accuracy of risk prediction. In risk priority sorting, the use of multi-dimensional analysis such as trigger frequency, coverage, and attack intensity enhances the depth of evaluation of path diffusion capabilities, thereby optimizing the ability to identify and sort high-risk paths. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 is a flow chart of the method of the present invention;

[0050] Figure 2 This is a detailed flow chart of step S1 of the present invention;

[0051] Figure 3 This is a detailed flow chart of step S2 of the present invention;

[0052] Figure 4 This is a detailed flow chart of step S3 of the present invention;

[0053] Figure 5 This is a detailed flow chart of step S4 of the present invention;

[0054] Figure 6 This is a detailed flow chart of step S5 of the present invention;

[0055] Figure 7 It is a system module diagram of the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0057] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0058] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0059] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0060] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0061] See also Figure 1 The embodiment of the present invention provides a network security threat assessment method, comprising the following steps:

[0062] S1: Obtain the connection relationship of network nodes, analyze the propagation path of network nodes, simulate the situation after the initial network node triggers the threat event based on the propagation characteristics of key network nodes, and generate a dynamic feature set of network node threat propagation based on the simulation results;

[0063] S2: Based on the dynamic feature set of threat propagation of network nodes and superimposed random disturbances, the paths and corresponding network nodes most affected by the disturbances in the propagation process are extracted to generate propagation path characteristic analysis results;

[0064] S3: Based on the network nodes extracted from the propagation path characteristic analysis results, hierarchical clustering is performed on the paths and corresponding network nodes that are most affected by the disturbance during the propagation process. According to the clustering results, the potential threat areas and hidden threat network nodes in the paths are marked to generate a threat path hierarchy and strength association set.

[0065] S4: Sort the risk priorities of the paths according to the threat path stratification and strength association set, and generate a path threat priority list;

[0066] S5: Obtain the threat transmission chain of the corresponding path in the order of the path threat priority list, evaluate the future threat diffusion trend in the entire network based on the threat transmission chain, and generate a network threat diffusion assessment result.

[0067] The dynamic feature set of network node threat propagation includes the trigger probability distribution of nodes, propagation time interval, and security status of key nodes; the propagation path characteristic analysis results include the path characteristics most affected by disturbances, the propagation influence of corresponding nodes, and the path diffusion range; the threat path stratification and intensity association set includes threat paths, threat node distribution, and potential threat areas; the path threat priority list specifically includes path risk level, threat path ranking, and node priority processing order; the network threat diffusion assessment results include threat transmission chain, threat diffusion trend, and future risk area prediction.

[0068] See also Figure 2 , obtain the connection relationship of network nodes, analyze the propagation path of network nodes, and simulate the situation after the initial network node triggers the threat event based on the propagation characteristics of key network nodes. The specific steps of generating the dynamic feature set of network node threat propagation based on the simulation results are as follows:

[0069] S101: Based on the acquired connection relationship of the network nodes, the probability of triggering a propagation event between the network nodes is calculated, and the propagation path of the network nodes is analyzed in combination with the probability of triggering the propagation event, so as to generate a propagation path analysis result of the network nodes;

[0070] The connection relationships of network nodes include physical connection relationships, logical connection relationships and communication connection relationships. Physical connection relationships refer to direct hardware interconnections between nodes, such as Ethernet interfaces; logical connection relationships refer to virtual connection paths formed by routing rules; and communication connection relationships refer to data interaction relationships realized through transmission protocols, such as communication dialogues based on TCP / IP protocols. These relationships are determined through network topology and traffic data analysis.

[0071] To calculate the probability of triggering a propagation event between network nodes, the formula is used:

[0072]

[0073] Get the propagation event trigger probability P between node pairs ij ;

[0074] Among them, C ij represents the connection strength from node i to node j. The connection strength is obtained by monitoring the number of data packet transmissions or the transmission rate between nodes in the network. For example, the value recorded in the transmission log is exported by a network traffic monitoring tool, and the number of data packet interactions between nodes in a certain period of time is extracted as C ij. Determined in the following ways: Statistics based on the amount of data transmitted: Extract all data packet records between node i and node j from the network traffic log, and count the total amount of data transmitted per unit time. The total amount of transmission can be accumulated by analyzing the size of the data packet (in bytes). For example, node 1 transmits 100 data packets to node 2 in 10 seconds, and the size of each data packet is 512 bytes. The total amount of data transmitted is 100×512=51200 bytes. Statistics based on interaction frequency: Count the number of interactions between data packets between nodes per unit time. For example, by analyzing the network log records, it is found that node 1 and node 2 perform 20 interaction operations per second, then their interaction frequency is 20 times / second, which can be used as the basic parameter of connection strength. Combined with communication duration: In some cases, connection strength can also be measured by the duration of communication. For example, record the duration of the data flow between node i and node j. Assuming that the communication between node 1 and node 2 lasts for 300 seconds and the communication between node 1 and node 3 lasts for 150 seconds, the connection strength value can be determined according to the ratio of the duration. Combined with comprehensive weight analysis: If you need to consider multiple parameters at the same time, you can normalize the amount of data transmitted, the interaction frequency, and the communication duration, and calculate the comprehensive connection strength in a weighted manner. For example, assuming that the weight of the amount of data transmitted is 0.5, the weight of the interaction frequency is 0.3, and the weight of the communication duration is 0.2, then the comprehensive connection strength value is the weighted sum of these three normalized values. ij It represents the risk factor from node i to node j, reflecting the threat correlation between nodes. The risk factor can be determined by the correlation analysis of historical attack events, such as extracting the attack event records in the network security log, analyzing the number and severity of attacks between the attack source and the target node, and extracting the attack event records in the network security log. The interactive behavior between the attack source and the target node is analyzed, and the timestamp, attack source IP address, target IP address, attack type and attack severity indicators (such as packet loss rate or service interruption time) involved in the attack event are extracted. For the analysis of the number of attacks, the number of attack events between the source node and the target node can be counted, and this can be used as part of the correlation strength between nodes; for the analysis of severity indicators, it can be graded according to the attack type (such as DDoS attack, SQL injection), for example: DDoS attack: judge the severity according to the attack duration and traffic peak; data leakage attack: divide the severity level according to the sensitivity of the leaked data; attempted attack: record as a low-level threat. By counting the total number of attacks from the source node to the target node and combining the attack severity classification, the comprehensive risk factor value between nodes is summarized. For example, if node 1 launches 5 attacks on node 2, 3 of which are high-severity attacks and 2 are medium-severity attacks, after comprehensive evaluation, its risk factor can be set to a proportional value directly related to the number and severity of attacks, such as 0.4 or 0.5. It represents the sum of the weighted connection strength and risk factor between node i and all adjacent nodes k, and comprehensively reflects the propagation event triggering capability of node i. This value is calculated through the denominator in the above formula.

[0075] By monitoring the interaction behavior between network nodes, the connection strength between node 1 and node 2 is set to 150 through transmission log analysis, and the connection strength between node 1 and node 3 is set to 300. At the same time, the risk factor between node 1 and node 2 is set to 0.4, and the risk factor between node 1 and node 3 is set to 0.6.

[0076] Substitute the parameters into the formula:

[0077]

[0078] The calculation results show that the probability of triggering a propagation event from node 1 to node 2 is 0.25, and the probability of triggering a propagation event to node 3 is 0.75. These results can reflect that the propagation behavior of node 1 is biased towards node 3, which helps determine the propagation path between nodes.

[0079] When analyzing the propagation path of network nodes in combination with the propagation event trigger probability, it is necessary to sort the propagation priorities of all adjacent nodes according to the propagation event trigger probability. For example, the trigger probability of node 1 is P 13 >P 12 , then its propagation path is more likely to select node 3, and then repeat the above steps in the propagation path of node 3 to form a complete propagation path record, and store all node numbers and probability values ​​in the path, and finally generate the network node propagation path analysis result.

[0080] S102: based on the network node propagation path analysis result, extract the key network nodes in the propagation path, identify and classify the key network nodes according to their triggering probabilities and connection relationships, and generate key network node classification results;

[0081] Extract key network nodes in the propagation path, extract data on the node trigger probability and generate a trigger probability list based on the node trigger probability and the connection relationship between adjacent nodes recorded in the propagation path, and extract the direct connection relationship between the node and the adjacent nodes to form an adjacency matrix, set the trigger probability classification threshold, and the threshold is named the trigger probability classification threshold. When the node trigger probability is higher than the trigger probability classification threshold, it is marked as a high-threat node, and other nodes are marked as low-threat nodes. For example, the threshold is set to 0.5, and the node with a trigger probability of 0.7 is marked as a high-threat node, and the node with a trigger probability of 0.4 is marked as a low-threat node. At the same time, the direct connection relationship of the high-threat node is further analyzed, and its connection strength and number of connections with other nodes are recorded to generate a high-threat node association information table. Finally, a key network node classification index is established and a key network node classification result is generated.

[0082] S103: Based on the classification results of key network nodes, the propagation characteristics of key network nodes are analyzed, and the propagation path and propagation time delay after the initial network node triggers the threat event are simulated in combination with the propagation characteristics to generate a dynamic feature set of network node threat propagation;

[0083] Extract the propagation characteristics of high-threat nodes, use network simulation software such as NS3 to simulate the propagation path, import the classification results and connection relationship matrix of high-threat nodes during simulation, set the timestamp of the node trigger event and the initial conditions of the propagation path, record the time delay data between nodes during the threat propagation process, obtain the propagation time of each segment on the propagation path and organize it into a time delay table, which contains the starting node, target node and corresponding propagation time of each segment. Extract the time characteristics of the propagation path through the time delay table, for example, the propagation time from node 1 to node 3 is 5ms, and the propagation time from node 1 to node 2 is 8ms. Use these propagation times to analyze the time delay distribution characteristics in the propagation path, and simulate the dynamic changes of the propagation path after the initial node triggers the threat event, adjust the node propagation order and record the propagation feature information, and finally generate a dynamic feature set of network node threat propagation.

[0084] See also Figure 3 ,Based on the dynamic feature set of network node threat propagation and superimposed random disturbance, the paths and corresponding network nodes most affected by the disturbance in the propagation process are extracted, and the specific steps for generating the propagation path characteristic analysis results are as follows:

[0085] S201: Based on the dynamic feature set of network node threat propagation, random disturbances are superimposed on the critical path network nodes, the triggering probability and propagation time parameters of the critical path network nodes are adjusted, and the critical path node disturbance analysis results are generated;

[0086] Random disturbances are superimposed on the critical path network nodes, and disturbance data is generated through the random disturbance generation module. The disturbance data includes the random adjustment value of the node trigger probability and the offset value of the propagation time. The trigger probability and propagation time parameters of the critical path network nodes are extracted and superimposed according to the disturbance data. The adjustment of the trigger probability is achieved by adding and subtracting the disturbance value, and the offset of the propagation time is adjusted by delay or acceleration parameters. For example, the initial trigger probability of node A is 0.6, and the disturbance value is -0.1, then the adjusted trigger probability is 0.5; the propagation time of node B is 5ms, and the disturbance value is +2ms, then the adjusted propagation time is 7ms. Similar adjustments are made to all nodes on the critical path one by one to generate an adjusted critical path network node parameter table. The parameter tables before and after the adjustment are compared to extract the difference features, and finally the critical path node disturbance analysis results are generated.

[0087] S202: Based on the key path node disturbance analysis results, analyze the impact of random disturbances on the connectivity of key path network nodes, evaluate the propagation path diffusion range after the initial network node triggers the threat event in combination with the analysis results, and generate random disturbance path diffusion range evaluation results;

[0088] The impact of random disturbances on the connectivity of critical path network nodes is analyzed, and the adjusted values ​​of trigger probability and propagation time are extracted from the adjusted critical path network node parameter table. Combined with the adjacency matrix data of the critical path network nodes, it is analyzed whether the connectivity status between nodes is maintained after the disturbance. The judgment of node connectivity is achieved by setting a threshold, which is named the connectivity judgment threshold. If the node trigger probability is lower than the connectivity judgment threshold, the connectivity between nodes is judged to be interrupted. For example, the threshold is 0.4. If the trigger probability of a node is adjusted to 0.3, it is judged that the connectivity between the node and other nodes is lost. At the same time, the impact of connectivity interruption on the length of the critical path is calculated. For example, the original path length is 4 hops, and the path length becomes 6 hops after the connectivity of a node is interrupted. The results are recorded in the path adjustment table. Combined with all path adjustment records, the diffusion range of the propagation path after the initial network node triggers the threat event is evaluated, and finally the random disturbance path diffusion range evaluation result is generated.

[0089] S203: based on the random disturbance path diffusion range evaluation result, extract the path most affected by the disturbance during the propagation process and the corresponding network node, and generate the propagation path characteristic analysis result;

[0090] The paths and corresponding network nodes that are most affected by the disturbance during the propagation process are extracted, and the paths with the largest change in propagation range are selected from the diffusion range evaluation results. The change range is achieved by comparing the number of nodes covered by the path before and after the disturbance. For example, the number of nodes covered by the original path is 10, and the number of covered nodes after the disturbance becomes 15, then the change range is +5. At the same time, the nodes with the largest changes in trigger probability and propagation time after the disturbance on the path are extracted. For example, the trigger probability of node C changes to +0.2, and the propagation time changes to +3ms. Combined with the overall disturbance change record of the path, a disturbance feature table is generated. By comparing the change ranges of each path in the feature table, the path with the largest change range is selected as the path most affected by the disturbance, and the disturbance features of all network nodes on the path are extracted to finally generate the propagation path characteristic analysis results.

[0091] See also Figure 4 ,Based on the network nodes extracted from the propagation path characteristic analysis results, the paths and corresponding network nodes that are most affected by the disturbance in the propagation process are hierarchically clustered, and the potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results. The specific steps for generating the threat path hierarchical and intensity association set are as follows:

[0092] S301: Based on the propagation path characteristic analysis result, extract the network nodes in the propagation path, obtain the trigger frequency, network node coverage and attack strength information of the network nodes, wherein the trigger frequency is quantified by numerical value, and the attack strength is graded by using a graded scoring standard to generate the network node threat feature information;

[0093] The trigger frequency, coverage rate and attack intensity information of network nodes are obtained. The trigger event records of each node are obtained by parsing the network traffic log, and the total number of trigger events of each node in unit time is counted. The trigger frequency is defined as the ratio of the total number to the unit time. For example, if a node triggers 30 events in one minute, the trigger frequency is 30 times / minute. For the calculation of coverage, the adjacency matrix of the node is parsed, the number of direct neighbors of each node is extracted and the ratio is calculated with the total number of nodes in the path. For example, if a node is connected to 5 neighbor nodes and the total number of nodes in the path is 20, the coverage is 5 / 20=0.25. For attack intensity, the type and severity of each attack are extracted by analyzing the historical attack log records, and the attack severity is graded. For example, DDoS attacks are considered high intensity, SQL injections are considered medium intensity, and light abnormal traffic is considered low intensity. The attack intensity is calculated according to the proportion of attack types of each node. For example, a node has a total of 10 attack records, of which 6 are DDoS attacks and 4 are light abnormal traffic. The attack intensity of this node is high. All node feature information is organized into a network node threat feature table, which contains information on trigger frequency, coverage, and attack intensity, and ultimately generates network node threat feature information.

[0094] S302: Based on the network node threat feature information, the trigger frequency, network node coverage and attack intensity information are evaluated, and a fuzzy membership function is constructed according to the evaluation result to generate a network node threat feature analysis result;

[0095] For constructing the fuzzy membership function, the formula is used:

[0096]

[0097] Calculate the membership value μ(x) of the network node;

[0098] Among them, μ(x) represents the membership value of the node on a certain threat feature, ranging from 0 to 1, reflecting the possibility that the node belongs to a certain threat category. x is the input value of a certain feature of the current node, such as trigger frequency, coverage or attack intensity, which is obtained by extracting the feature data of the network node and counting the total number of trigger events per unit time of each node from the network log. The specific method is to parse the timestamp and count the trigger records, and extract the ratio of the number of other nodes directly covered by the node to the total number of nodes in the path through the adjacency matrix. For example, if the number of covered adjacent nodes is 5 and the total number of nodes is 20, the coverage is 5 / 20=0.25. Attack intensity: The attack type and severity of each node are extracted from the historical attack event log, combined with the classification rules (such as DDoS S attack is of high intensity) to determine the level value, λ is the parameter for adjusting the steepness in the membership function, which indicates the steepness of the membership function curve and is determined through experimental fitting. The higher the steepness, the more obvious the classification interval. For example, the optimal value of λ can be adjusted by fitting the trigger frequency membership curve. θ is the feature fuzzy classification center threshold, which indicates the middle point of the fuzzy interval and is obtained through statistical analysis. For example, distribution statistics of a certain feature value data are performed and the average or median is taken as the feature fuzzy classification center threshold. e is the base of the natural logarithm and is used to define the growth rate of the exponential function. -λ(x-θ) indicates the deviation between the current feature value x and the feature fuzzy classification center threshold θ. Adjusting the steepness parameter λ is used to scale the deviation value. The calculation result is used to adjust the output range of the membership function.

[0099] Trigger frequency membership calculation: Assume that the trigger frequency of node A is 8, the steepness parameter λ = 0.5, and the feature fuzzy classification center threshold θ = 10:

[0100]

[0101] The results show that the trigger frequency membership value of node A is 0.268, indicating that it is less likely to belong to the high-frequency threat category.

[0102] Coverage membership calculation: Assume that the coverage of node B is 0.6, the steepness parameter λ = 1.0, and the feature fuzzy classification center threshold θ = 0.5:

[0103]

[0104] The results show that the coverage membership of node B is 0.525, which means that its coverage belongs to the fuzzy intermediate state, which may affect the breadth of threat propagation.

[0105] Attack intensity membership calculation: Assume that the attack intensity of node C is 2 (medium level), the steepness parameter λ = 2.0, and the feature fuzzy classification center threshold θ = 2:

[0106]

[0107] The results show that the attack intensity membership of node C is 0.5, which belongs to the fuzzy boundary state, indicating that the node may cause moderate threat events.

[0108] Through the calculation of fuzzy membership function, the trigger frequency of node A, the coverage of node B, the attack intensity of node C and other characteristics are mapped to membership values, which are used to evaluate the position of nodes in threat categories. The low membership of node A indicates that it does not belong to the high threat category, while the membership of nodes B and C is in a fuzzy state and needs to be further analyzed in combination with other characteristics. The final result can be used to guide the hierarchical analysis and priority processing of network threats.

[0109] S303: Based on the results of the threat feature analysis of the network nodes, combined with the paths and corresponding network nodes that are most affected by the disturbance during the propagation process, hierarchical clustering is performed on the paths and nodes, and the potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results, and a threat path layering and intensity association set is generated;

[0110] Combined with the paths and corresponding network nodes that are most affected by the disturbance during the propagation process, the paths and nodes are hierarchically clustered. The node features are organized into an input matrix through the trigger frequency, coverage rate and attack intensity membership values ​​extracted from the threat feature analysis results of the network nodes. For example, the trigger frequency memberships of nodes A, B and C are 0.4, 0.7 and 0.3, respectively, the coverage memberships are 0.6, 0.5 and 0.4, respectively, and the attack intensity memberships are 0.8, 0.9 and 0.7, respectively. The input matrix records the threat features of each node and is used to analyze the similarity between nodes. The distance measurement method is used to compare the differences in node features. By comparing the differences in feature values ​​between nodes, it is determined which nodes have similar threat features. For example, the trigger frequency and attack intensity of nodes A and B are relatively close, so they are marked as the same category. At the same time, the coverage of the node path is analyzed, and the high threat areas and potential hidden threat nodes in the path are marked. All classification and annotation results are recorded in the path threat stratification and intensity association set, and finally the threat path stratification and intensity association set is generated.

[0111] See also Figure 5 ,According to the threat path layering and strength association set, the risk priority of the path is sorted, and the specific steps of generating the path threat priority list are as follows:

[0112] S401: Based on the threat path layering and strength association set, a cumulative trigger value of the trigger frequency is obtained, and the number ratio of the multi-frequency network nodes in the path is obtained in combination with the cumulative trigger value to generate a multi-frequency network node analysis result;

[0113] Get the cumulative trigger value of the trigger frequency, parse the node trigger record log, count and accumulate the trigger frequencies of all nodes in the path one by one. For example, if nodes 1, 2, and 3 in path A are triggered 15 times, 20 times, and 25 times respectively, the cumulative trigger value of path A is 60 times. Calculate the number ratio of multi-frequency network nodes in the path through the cumulative trigger value. Define multi-frequency network nodes as nodes with a trigger frequency higher than a predetermined threshold. The threshold is named the trigger frequency lower limit. Set the threshold to 20 times, filter nodes that meet the conditions in path A, and the trigger frequencies of nodes 2 and 3 are both higher than 20 times, accounting for 2 / 3 of the total number of path nodes. Record the calculation results in the path node analysis table, perform the same calculation operation on all paths, and finally generate the multi-frequency network node analysis results.

[0114] S402: Based on the multi-frequency network node ratio result, the overall impact capability of the path is analyzed according to the network node coverage rate, and the path impact capability analysis result is generated in combination with the coverage rate result;

[0115] The overall influence of the path is analyzed according to the network node coverage rate. The node coverage range of each path is extracted from the path node coverage rate data. For example, in path A, node 1 covers 5 adjacent nodes, node 2 covers 8 adjacent nodes, and node 3 covers 4 adjacent nodes. The overall coverage range of path A is 5+8+4=17 nodes. The ratio of the path coverage range to the total number of nodes in the path is calculated. For example, the total number of nodes in path A is 10, and the coverage rate of path A is 17 / 10=1.7. The influence of each path is ranked by comparing the path coverage rates. For example, the coverage rate of path A is 1.7, the coverage rate of path B is 2.0, and the coverage rate of path C is 1.5. Path B has the highest influence. The coverage rates and ranking results of all paths are recorded in the path influence table to generate the path influence capacity analysis results.

[0116] S403: Based on the results of the path impact capability analysis, the density of potential threat network nodes is evaluated according to the level distribution of attack intensity, and the risk paths are sorted in combination with the density and path priority to generate a path threat priority list;

[0117] Evaluate the density of potential threat network nodes according to the distribution of attack intensity levels, and extract the distribution from the attack intensity data of path nodes. For example, if the attack intensity of nodes 1, 2, and 3 in path A are high, medium, and high, respectively, then the high-intensity nodes account for 2 / 3. Determine the density of potential threat nodes by calculating the proportion of nodes of each attack intensity level in each path. Combine the results with the path impact capability and sort the paths by risk priority. For example, if the high-intensity nodes in path A account for 2 / 3 and the path impact capability ranks second, then the risk priority of path A is ranked after path C. Use the same method to analyze and sort other paths, record all sorting results in the path priority list, and finally generate a path threat priority list.

[0118] See also Figure 6 ,According to the order of the path threat priority list, the threat transmission chain of the corresponding path is obtained, and the future threat diffusion trend in the entire network is evaluated according to the threat transmission chain. The specific steps for generating the network threat diffusion assessment result are as follows:

[0119] S501: Based on the path threat priority list, obtain the risk path according to the priority sorting, extract the connection relationship and trigger event record of each node in the risk path, and generate the risk path node transmission relationship;

[0120] The connection relationship and trigger event record of each node in the risk path are extracted, and each node in the risk path is screened and recorded by parsing the trigger event log. The connection relationship and trigger frequency of the node and its adjacent nodes are analyzed one by one. For example, node A is connected to node B and node C. The event triggering time interval between node B and node C is 2ms. The trigger event record shows that the triggering frequency of node A is 20 times. The importance index of the node is calculated by combining these triggering data and connection relationships. The importance index is equal to the weighted sum of the node triggering frequency and the number of connection relationships. For example, the triggering frequency of node A is 20 times and the number of connection relationships is 2. The importance index of node A is 20×0.7+2×0.3=14.6. The index value is further compared with the average importance index of all network nodes. If the node index value is higher than the average value and the node with a triggering frequency in the upstream 10% is marked as a high-risk node, all marking results are summarized to generate the risk path node transmission relationship.

[0121] S502: Based on the risk path node transmission relationship, analyze the threat propagation direction and transmission chain between nodes, evaluate the role of key nodes in the transmission chain in combination with the trigger event record, and generate a risk path threat transmission chain;

[0122] A propagation sequence is established by parsing the timestamp information in the trigger event record. For example, the timestamp from node A to node B is T1=10ms, and the timestamp from node B to node C is T2=25ms. A chain of A→B→C is formed in sequence according to the propagation direction. The efficiency of the propagation chain is measured by counting the sum and average of the transmission time in each propagation chain. For example, if the total transmission time of a chain is 80ms and it contains 4 nodes, the average transmission time is 80ms / 4=20ms. The efficient propagation chain (the chain with an average time lower than the average of the entire chain) is marked as the priority chain. The chain integrity is further analyzed in combination with the distribution frequency and connection relationship of the key nodes in the chain. For example, if 80% of the nodes in a chain are high-risk nodes and there are no breakpoints or isolated nodes in the chain, the chain integrity is marked as high. After all the results are sorted out, a risk path threat transmission chain is generated.

[0123] S503: Based on the risk path threat transmission chain, combined with the node propagation characteristics and the threat priority of the path, the future diffusion trend of the threat in the entire network and the scope of the affected nodes are evaluated to generate the network threat diffusion assessment results;

[0124] By counting the number of high-risk nodes, average connection strength and total propagation efficiency in the transmission chain, for example, a path A contains 5 high-risk nodes, its average connection strength is 6, and the total propagation efficiency is 50ms. The comprehensive diffusion capacity of path A is calculated as the number of high-risk nodes × average connection strength / total propagation efficiency, that is, 5 × 6 / 50 = 0.6. The comprehensive diffusion capacity of all paths in the network is ranked according to the path priority. At the same time, the range of affected nodes is analyzed in combination with the distribution position of high-risk nodes in the path. For example, the number of direct nodes covered by the diffusion chain of path A is 10, and the number of downstream nodes indirectly transmitted to is 15. Finally, the comprehensive diffusion capacity of path A is evaluated to be medium. All results are sorted to generate the network threat diffusion assessment result.

[0125] See also Figure 7 , a network security threat assessment system, the system comprising:

[0126] The network node analysis module obtains the connection relationship of network nodes, analyzes the propagation path of network nodes, simulates the propagation of threat events triggered by the initial network nodes based on the propagation characteristics of key network nodes, and generates a dynamic feature set of network node threat propagation based on the simulation results;

[0127] The random disturbance analysis module is based on the dynamic feature set of threat propagation of network nodes, superimposes random disturbances, extracts the paths and corresponding network nodes most affected by the disturbances during the propagation process, and generates propagation path characteristic analysis results;

[0128] The threat path clustering module performs hierarchical clustering based on the network nodes extracted from the propagation path characteristic analysis results, combined with the trigger frequency, network node coverage and attack intensity information. According to the clustering results, the potential threat areas and hidden threat network nodes in the path are marked, and the risk priority of the path is sorted to generate a path threat priority list.

[0129] The threat diffusion assessment module is based on the path threat priority list, obtains the threat transmission chain of the corresponding path in order of priority, evaluates its future threat diffusion trend in the entire network according to the threat transmission chain, and generates network threat diffusion assessment results.

[0130] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0131] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0132] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0133] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0134] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0135] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0138] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0139] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A network security threat assessment method, characterized in that: The following steps are involved: Obtain the connection relationship of network nodes, analyze the propagation path of network nodes, simulate the situation after the initial network node triggers the threat event based on the propagation characteristics of key network nodes, and generate a dynamic feature set of network node threat propagation based on the simulation results; Based on the dynamic feature set of the network node threat propagation superimposed with random disturbances, the paths and corresponding network nodes most affected by the disturbances in the propagation process are extracted to generate propagation path characteristic analysis results; Based on the network nodes extracted from the propagation path characteristic analysis results, hierarchical clustering is performed on the paths most affected by disturbances during the propagation process and the corresponding network nodes, and potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results to generate a threat path hierarchical and strength association set; Sorting the risk priorities of the paths according to the threat path stratification and strength association set, and generating a path threat priority list; The threat transmission chain of the corresponding path is obtained in the order of the path threat priority list, and the future threat diffusion trend in the entire network is evaluated according to the threat transmission chain to generate a network threat diffusion evaluation result.

2. The network security threat assessment method according to claim 1, characterized in that: The network node threat propagation dynamic feature set includes the trigger probability distribution of nodes, propagation time interval, and key node security status; The propagation path characteristic analysis results include the path characteristics most affected by the disturbance, the propagation influence of the corresponding node, and the path diffusion range; the threat path stratification and strength association set includes the threat path, threat node distribution, and potential threat area; the path threat priority list specifically includes the path risk level, threat path ranking, and node priority processing order; the network threat diffusion assessment results include the threat transmission chain, threat diffusion trend, and future risk area prediction.

3. The network security threat assessment method according to claim 1, characterized in that: Obtain the connection relationship of network nodes, analyze the propagation path of network nodes, and simulate the situation after the initial network node triggers a threat event based on the propagation characteristics of key network nodes. The specific steps for generating a dynamic feature set of network node threat propagation based on the simulation results are as follows: Based on the connection relationship of the obtained network nodes, the probability of triggering the propagation event between the network nodes is calculated, and the propagation path of the network nodes is analyzed in combination with the probability of triggering the propagation event, so as to generate the propagation path analysis result of the network nodes; Based on the network node propagation path analysis result, extract the key network nodes in the propagation path, identify and classify the key network nodes according to their triggering probabilities and connection relationships, and generate key network node classification results; Based on the classification results of the key network nodes, the propagation characteristics of the key network nodes are analyzed, and the propagation path and propagation time delay after the initial network node triggers a threat event are simulated in combination with the propagation characteristics to generate a dynamic feature set of network node threat propagation.

4. The network security threat assessment method according to claim 3, characterized in that: To calculate the probability of triggering a propagation event between network nodes, the formula is used: Get the propagation event trigger probability P between node pairs ij ; Among them, C ij represents the connection strength from node i to node j, R ij represents the risk factor from node i to node j, It represents the sum of the weighted connection strength and risk factor between node i and all adjacent nodes k.

5. The network security threat assessment method according to claim 1, characterized in that: Based on the dynamic feature set of network node threat propagation superimposed with random disturbance, the path and corresponding network node most affected by the disturbance in the propagation process are extracted, and the specific steps of generating propagation path characteristic analysis results are as follows: Based on the network node threat propagation dynamic feature set, random disturbances are superimposed on the critical path network nodes, the triggering probability and propagation time parameters of the critical path network nodes are adjusted, and critical path node disturbance analysis results are generated; Based on the critical path node disturbance analysis results, the impact of random disturbances on the connectivity of critical path network nodes is analyzed, and the diffusion range of the propagation path after the initial network node triggers the threat event is evaluated in combination with the analysis results, and a random disturbance path diffusion range evaluation result is generated; Based on the evaluation result of the diffusion range of the random disturbance path, the path most affected by the disturbance during the propagation process and the corresponding network nodes are extracted to generate a propagation path characteristic analysis result.

6. The network security threat assessment method according to claim 1, characterized in that: Based on the network nodes extracted from the propagation path characteristic analysis results, hierarchical clustering is performed on the paths and corresponding network nodes that are most affected by the disturbance during the propagation process, and the potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results. The specific steps for generating the threat path hierarchical and intensity association set are as follows: Based on the propagation path characteristic analysis results, network nodes in the propagation path are extracted to obtain the trigger frequency, network node coverage and attack intensity information of the network nodes, wherein the trigger frequency is quantified by numerical values, and the attack intensity is graded using a graded scoring standard to generate network node threat feature information; Based on the network node threat feature information, the trigger frequency, network node coverage and attack intensity information are evaluated, and a fuzzy membership function is constructed according to the evaluation result to generate a network node threat feature analysis result; Based on the analysis results of the threat characteristics of the network nodes, combined with the paths and corresponding network nodes that are most affected by the disturbance during the propagation process, the paths and nodes are hierarchically clustered, and the potential threat areas and hidden threat network nodes in the paths are marked according to the clustering results to generate a threat path hierarchy and intensity association set.

7. The network security threat assessment method according to claim 6, characterized in that: For constructing the fuzzy membership function, the formula is used: Calculate the membership value μ(x) of the network node; Among them, x is the current node feature, λ is the parameter for adjusting the steepness in the membership function, and -λ(x-θ) represents the deviation between the current feature value x and the feature fuzzy classification center threshold θ.

8. The network security threat assessment method according to claim 1, characterized in that: The specific steps of sorting the risk priorities of the paths according to the threat path stratification and strength association set and generating the path threat priority list are as follows: Based on the threat path layering and strength association set, a cumulative trigger value of the trigger frequency is obtained, and the number ratio of the multi-frequency network nodes in the path is obtained in combination with the cumulative trigger value to generate a multi-frequency network node analysis result; Based on the multi-frequency network node ratio result, analyzing the overall impact capability of the path according to the network node coverage rate, and generating a path impact capability analysis result in combination with the coverage rate result; Based on the path impact capability analysis results, the density of potential threat network nodes is evaluated according to the level distribution of attack intensity, and the risk paths are sorted in combination with the density and path priority to generate a path threat priority list.

9. The network security threat assessment method according to claim 1, characterized in that: The specific steps of obtaining the threat transmission chain of the corresponding path in the order of the path threat priority list, evaluating the future threat diffusion trend in the entire network according to the threat transmission chain, and generating the network threat diffusion assessment result are as follows: Based on the path threat priority list, the risk path is obtained according to the priority sorting, the connection relationship and trigger event record of each node in the risk path are extracted, and the risk path node transmission relationship is generated; Based on the risk path node transmission relationship, analyze the threat propagation direction and transmission chain between nodes, evaluate the role of key nodes in the transmission chain in combination with the trigger event records, and generate a risk path threat transmission chain; Based on the risk path threat transmission chain, combined with the node propagation characteristics and the threat priority of the path, the future spread trend of the threat in the entire network and the scope of the affected nodes are evaluated to generate a network threat diffusion assessment result.

10. A network security threat assessment system, characterized in that: According to any one of claims 1 to 9, the network security threat assessment method is implemented, and the system comprises: The network node analysis module obtains the connection relationship of network nodes, analyzes the propagation path of network nodes, simulates the propagation of threat events triggered by the initial network nodes based on the propagation characteristics of key network nodes, and generates a dynamic feature set of network node threat propagation based on the simulation results; The random disturbance analysis module superimposes random disturbances based on the dynamic feature set of threat propagation of network nodes, extracts the paths and corresponding network nodes most affected by the disturbances during the propagation process, and generates propagation path characteristic analysis results; The threat path clustering module performs hierarchical clustering based on the network nodes extracted from the propagation path characteristic analysis results, combined with the trigger frequency, network node coverage and attack intensity information, and marks the potential threat areas and hidden threat network nodes in the path according to the clustering results, sorts the risk priorities of the path, and generates a path threat priority list; The threat diffusion assessment module obtains the threat transmission chain of the corresponding path in order of priority based on the path threat priority list, evaluates its future threat diffusion trend in the entire network according to the threat transmission chain, and generates a network threat diffusion assessment result.

Images