A multi-technology fusion network security health assessment method and system

Abstract

A multi-technology fusion network security health assessment method and system, in the method, an activity index of an IP address is generated; an open port information is obtained by performing port detection on the IP address with an activity index greater than a first threshold through a configurable port scanning mode; a service detection data packet is sent to the open port; a service type and a version number are extracted according to response information of the service detection data packet to obtain a service change frequency; an asset dynamic score is calculated based on the activity index of the IP address and the service change frequency; the IP address is divided into stable assets and temporary assets according to the asset dynamic score; a low-frequency deep detection mode is used for the stable assets and a high-frequency rapid detection mode is used for the temporary assets to obtain a detection result; the detection result and the asset dynamic score are input into a risk assessment function to calculate a risk security value of each IP address; and an evaluation report is generated according to the security risk value. The application is used for improving the accuracy of enterprise network security evaluation.

Description

Technical Field

[0001] This application belongs to the field of cybersecurity health assessment, and in particular relates to a cybersecurity health assessment method and system that integrates multiple technologies. Background Technology

[0002] With the rapid development of internet technology and the continuous expansion of network scale, network security has become an increasingly important issue of concern for enterprises and individuals. Traditional network security protection systems mainly rely on passive defense measures such as firewalls and intrusion detection systems. This passive protection approach is difficult to detect potential security threats in a timely manner, leaving enterprise networks in a passive and vulnerable position, and making it difficult to effectively control security risks.

[0003] In related technologies, web crawlers can automatically collect asset data such as IP addresses, domain names, open ports, and service information of target networks, and create network asset maps to achieve proactive discovery and risk assessment of network assets. Compared with traditional passive defense measures, this method has the advantages of being more proactive and having a wider coverage.

[0004] However, in a cloud computing environment, enterprise network assets are frequently in a state of dynamic migration and elastic scaling, resulting in increasingly shorter asset lifecycles. Because the aforementioned technologies employ fixed-cycle scanning, it is often difficult to detect newly added or changed assets within the interval between scans, leading to assessment blind spots. These assets in assessment blind spots may contain security vulnerabilities, becoming entry points for intrusion and reducing enterprise network security. Summary of the Invention

[0005] This application provides a multi-technology integrated cybersecurity health assessment method and system to improve the accuracy of enterprise cybersecurity assessment.

[0006] In the first aspect, this application provides a network security health assessment method that integrates multiple technologies, obtains network traffic data of an enterprise network within a first preset time period, and generates an IP address activity index based on the access frequency and duration of each IP address.

[0007] Within a second preset time period, port probes are performed on IP addresses with activity indicators greater than the first threshold using a configurable port scanning method to obtain open port information;

[0008] Send service probe packets to the open ports at a preset frequency;

[0009] The service type and version number are extracted from the response information of the service probe data packet to obtain the service change frequency;

[0010] Calculate asset dynamic scores based on IP address activity metrics and service change frequency;

[0011] IP addresses are classified into stable assets and temporary assets based on dynamic asset scores.

[0012] For stable assets, a low-frequency deep probing method is used, and for temporary assets, a high-frequency fast probing method is used to obtain the probing results. The probing results include the number of unreachable ports and the service response time. The low-frequency deep probing method includes a complete port scan and service identification, while the high-frequency fast probing method only probes commonly used ports.

[0013] The detection results and asset dynamic scores are input into the risk assessment function to calculate the risk security value for each IP address;

[0014] A security health assessment of the enterprise network is conducted based on the security risk values, and an assessment report is generated.

[0015] By adopting the above technical solution, dynamic identification of network assets is achieved through acquiring network traffic data and calculating IP address activity indicators. Combined with port scanning and service probing, the system grasps the open ports and service information of assets. By analyzing service change frequency and activity indicators, a dynamic asset score is calculated, enabling the system to categorize assets into stable and temporary assets. Differentiated probing strategies are employed for different asset types: stable assets undergo low-frequency, in-depth probing, while temporary assets undergo high-frequency, rapid probing, ensuring both comprehensiveness and efficiency. The probing results and the asset's dynamic score are input into a risk assessment function to obtain a risk security value, ultimately generating an assessment report. This multi-dimensional, differentiated assessment method reduces the limitations of traditional single-technology assessments, more accurately reflecting the actual security status of network assets. Furthermore, the differentiated probing strategy balances the depth and efficiency of the assessment, achieving a comprehensive and efficient network security health assessment.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, an IP address activity index is generated based on the access frequency and duration of each IP address, specifically including:

[0017] Input the access frequency and duration into the activity index calculation function to obtain the activity index of the IP address;

[0018] The activity index calculation function is:

[0019]

[0020] In the function, A is the activity index of the IP address, F is the access frequency, L is the duration, I is the standard deviation of the access time interval, and w1, w2 and w3 are preset weight parameters.

[0021] By adopting the above technical solution, an activity index calculation function is introduced, incorporating the access frequency, duration, and standard deviation of the access time interval of an IP address into the calculation. By setting different weight parameters, the function can flexibly adjust the influence of each factor on the activity index. Access frequency reflects the intensity of IP address usage, duration reflects the stability of the IP address, and the standard deviation of the access time interval reflects the regularity of access behavior. The comprehensive calculation of these three dimensions allows the activity index to more comprehensively characterize the usage features of IP addresses.

[0022] In conjunction with some embodiments of the first aspect, in some embodiments, the risk assessment function is:

[0023]

[0024] In the function, R is the risk safety value, D(τ) is the function of the change of asset dynamic score over time, and D... max U represents the maximum value of the asset dynamic score, and U represents the number of unreachable ports. max The maximum possible number of unreachable ports, where T is the service response time. max The maximum allowed response time, S is the system load rate, P is the number of currently open ports, and P max The maximum number of open ports is defined by Δt, which is a fixed evaluation time window. α, β, γ, and δ are weighting coefficients, and α+β+δ=1, 0≤γ≤1.

[0025] To calculate the average of the asset dynamic score within a fixed time window, This indicates an increased risk associated with unreachable ports;

[0026] This indicates the risk associated with service response time; the longer the service response time, the greater the risk. This indicates the basic risk and cyclical fluctuation risk of system load.

[0027] By adopting the above technical solutions, the risk assessment function comprehensively considers multiple risk factors such as asset dynamism, port reachability, service response performance, and system load. The function calculates the average asset dynamic score through time integration, avoiding the impact of instantaneous fluctuations. The number of unreachable ports is mapped using a logarithmic function, reflecting the characteristic of diminishing marginal risk. Service response time is transformed using an exponential function, reflecting the non-linear relationship between response latency and risk. The impact of system load is decomposed into two parts: basic risk and periodic fluctuations, which better reflects actual operating conditions. The various sub-items are balanced through weighting coefficients, ensuring the rationality of the assessment results.

[0028] In conjunction with some embodiments of the first aspect, in some embodiments, a security health assessment of the enterprise network is performed based on security risk values, and an assessment report is generated, specifically including:

[0029] When the safety risk value is within the preset first range, an assessment report containing the preset first assessment content is generated;

[0030] When the safety risk value is within the preset second range, an assessment report containing the preset second assessment content is generated;

[0031] When the safety risk value is within the preset third range, an assessment report containing the preset third assessment content is generated.

[0032] By adopting the above technical solution, differentiated assessment reports are generated based on different ranges of safety risk values, establishing a correspondence between risk values ​​and specific assessment content. By pre-setting assessment content for different ranges, the system can provide corresponding assessment suggestions and improvement measures for different risk levels.

[0033] In conjunction with some embodiments of the first aspect, in some embodiments, after generating the evaluation report, the method further includes:

[0034] Divide IP addresses into multiple business groups according to their business functions;

[0035] Calculate the average security risk value for each business group;

[0036] When the average security risk value of any business group exceeds the second threshold, increase the detection frequency of all IP addresses in the business group; count the service types of each IP address in the business group and generate a service type list;

[0037] The system periodically compares changes in the service type list and increases the security risk value of the corresponding IP address by a preset percentage when unauthorized service changes are detected.

[0038] By adopting the above technical solution, IP addresses are divided into multiple business groups according to business functions, and the average security risk value of each business group is calculated. This allows the system to assess network security from a business perspective. When the average security risk value of a business group exceeds a threshold, increasing the detection frequency of all IP addresses within the group can promptly detect potential security threats within that business group. By generating and comparing service type lists, the system can detect unauthorized service changes and reflect the potential risks brought about by these changes by increasing the security risk value of the corresponding IP addresses. This enables the system to identify security vulnerabilities in specific business areas. The periodic comparison of service type lists ensures the controllability of changes to business systems, prevents security vulnerabilities caused by unauthorized service deployments, and improves the accuracy and timeliness of the system's identification and response to security threats.

[0039] In conjunction with some embodiments of the first aspect, in some embodiments, after increasing the security risk value of the corresponding IP address by a preset ratio, the method further includes:

[0040] Statistics on the internal access frequency and cross-business group access frequency across multiple business groups;

[0041] Set access baselines based on internal access frequency and cross-business group access frequency.

[0042] When the frequency of internal access to any business group and the frequency of cross-business group access are detected to exceed the access baseline, an over-limit access event is recorded.

[0043] Regularly analyze access violation events to identify abnormal access patterns;

[0044] When the duration of an abnormal access pattern exceeds the third threshold, adjust the security protection policy of the business group.

[0045] By adopting the above technical solution, when access behavior deviates from the baseline, the system records it as an over-limit access event. Through periodic analysis of these events, the system can identify persistent abnormal access patterns and uncover potential threats that are difficult to detect using traditional security detection methods, such as abnormal connection behavior after an internal system attack or abnormal access patterns during data breaches. Through continuous monitoring and analysis of abnormal access patterns, the system can adjust its security protection strategies in a timely manner before threats cause substantial harm, improving the system's ability to resist complex network attacks. The business group-based access behavior analysis method also enables the system to more accurately distinguish between normal business access and potential security threats, reducing false positives.

[0046] In conjunction with some embodiments of the first aspect, in some embodiments, the security protection strategy of the business group is adjusted, specifically including:

[0047] Lower the service response time alarm threshold for business groups;

[0048] Increase the frequency of port scanning for all IP addresses in the business group;

[0049] Shorten the security assessment cycle for business groups.

[0050] By adopting the above technical solutions, and through dynamically adjusting the service response time alarm threshold for business groups, increasing port scanning frequency, and shortening the security assessment cycle, the system achieves refined security control over high-risk business groups. Lowering the service response time alarm threshold allows the system to detect service anomalies more quickly; the increased port scanning frequency ensures the system can promptly discover new security vulnerabilities; and the shortened security assessment cycle guarantees the system can quickly evaluate the effectiveness of security measures. This improves the system's response speed and protection effectiveness against security threats, reducing the likelihood of attacks on high-risk business groups.

[0051] Secondly, embodiments of this application provide a multi-technology integrated cybersecurity health assessment system, which includes: one or more processors and a memory; the memory is coupled to one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call the computer instructions to cause the system to perform the method described in the first aspect and any possible implementation thereof.

[0052] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a system, cause the system to perform the method described in the first aspect and any possible implementation thereof.

[0053] Fourthly, embodiments of this application provide a computer program product that, when run on a system, causes the system to execute the method described in any possible implementation of the first aspect.

[0054] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0055] 1. This application provides a multi-technology integrated network security health assessment method. By acquiring network traffic data and calculating IP address activity indicators, it achieves dynamic identification of network assets. Combined with port scanning and service probing, the system grasps the open ports and service information of assets. By analyzing service change frequency and activity indicators, a dynamic score of the asset is calculated, enabling the system to classify assets into stable assets and temporary assets. Differentiated probing strategies are adopted for different types of assets: stable assets undergo low-frequency deep probing, while temporary assets undergo high-frequency rapid probing, ensuring both comprehensiveness and efficiency in the probing. The probing results and the asset's dynamic score are input into a risk assessment function to obtain a risk security value, ultimately generating an assessment report. The combination of multi-dimensional and differentiated assessment methods reduces the limitations of traditional single-technology assessments, more accurately reflecting the actual security status of network assets. At the same time, the differentiated probing strategy balances the depth and efficiency of the assessment, achieving a comprehensive and efficient network security health assessment.

[0056] 2. This application provides a multi-technology integrated network security health assessment method. IP addresses are divided into multiple business groups according to business functions, and the average security risk value of each business group is calculated. The system can assess network security status from a business perspective. When the average security risk value of a business group exceeds a threshold, the detection frequency of all IP addresses within the group is increased, enabling timely detection of potential security threats within that business group. By generating and comparing a service type list, the system can detect unauthorized service changes and reflect the potential risks brought about by these changes by increasing the security risk value of the corresponding IP addresses. This allows the system to identify security vulnerabilities in specific business areas. The periodic comparison of the service type list ensures the controllability of changes to the business system, prevents security vulnerabilities caused by unauthorized service deployments, and improves the accuracy and timeliness of the system's identification and response to security threats.

[0057] 3. This application provides a multi-technology integrated network security health assessment method. When access behavior deviates from the baseline, the system records it as an over-limit access event. By periodically analyzing these events, the system can identify persistent abnormal access patterns and discover potential threats that are difficult to identify using traditional security detection methods, such as abnormal connection behavior after an internal system attack or abnormal access patterns during data breaches. Through continuous monitoring and analysis of abnormal access patterns, the system can adjust its security protection strategy in a timely manner before threats cause substantial harm, improving the system's ability to resist complex network attacks. The access behavior analysis method based on business groups also enables the system to more accurately distinguish between normal business access and potential security threats, reducing the false positive rate. Attached Figure Description

[0058] Figure 1 This is a flowchart illustrating a multi-technology integrated cybersecurity health assessment method in an embodiment of this application.

[0059] Figure 2 This is a flowchart illustrating a network security health assessment method based on business groups in an embodiment of this application.

[0060] Figure 3 This is a schematic diagram of the physical device structure of a network security health assessment system that integrates multiple technologies, as provided in an embodiment of this application. Detailed Implementation

[0061] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0062] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0063] The following example is used in conjunction with Figure 1 This application describes a network security health assessment method that integrates multiple technologies:

[0064] Please see Figure 1 This is a flowchart illustrating a multi-technology integrated cybersecurity health assessment method in an embodiment of this application.

[0065] S101. Obtain network traffic data of the enterprise network within a first preset time period, and generate an IP address activity index based on the access frequency and duration of each IP address.

[0066] The system acquires network traffic data of the enterprise network within a first preset time period, and generates an IP address activity index based on the access frequency and duration of each IP address. Specifically, the access frequency and duration are input into the activity index calculation function to obtain the IP address activity index.

[0067] The activity index calculation function is:

[0068]

[0069] In the function, A is the activity index of the IP address, F is the access frequency, L is the duration, I is the standard deviation of the access time interval, and w1, w2 and w3 are preset weight parameters.

[0070] This step primarily aims to acquire network traffic data for the enterprise network within a specific timeframe and calculate the activity level of each IP address based on this data. The system can acquire network traffic data through various methods, such as network monitoring devices and traffic acquisition tools. The time granularity of the data can be set according to actual needs, such as hourly or daily levels. After obtaining the network traffic data, the system can extract features such as the access frequency and duration of each IP address, and design a suitable activity index calculation function to comprehensively consider various features and calculate the activity level of the IP addresses.

[0071] Specifically, the system can count the number of times each IP address accesses a location within a first preset time period as the access frequency, and calculate the average duration of each access as the duration. Then, the access frequency F and duration L are input into a preset activity index calculation function. This function yields a comprehensive numerical indicator reflecting the activity level of the IP address.

[0072] S102. During the second preset time period, port detection is performed on IP addresses with an activity index greater than the first threshold using a configurable port scanning method to obtain open port information.

[0073] This step primarily involves port probing of highly active IP addresses to obtain open port information. The system first filters IP addresses with activity levels exceeding a preset threshold (first threshold) based on the activity index calculated in the first step, thus reducing the probe scope and improving efficiency. Then, within a second preset time period, the system can employ various port scanning techniques, such as TCP SYN scanning, TCP connect scanning, and UDP scanning, to probe the target IP addresses. During the scanning process, parameters such as the port range, timeout, and concurrency can be set to balance the speed and accuracy of the probe.

[0074] In practice, the system can provide a configurable scanning scheme, allowing users to select or customize scanning technologies and parameters according to their actual needs. For example, users can choose to scan only commonly used ports or scan the entire port range; they can set a shorter timeout to speed up the detection process or a longer timeout to improve accuracy; they can also adjust the concurrency parameters to increase the parallelism of the scan, provided network and system resources allow. The scan results can be saved as an open port list, recording the open port numbers on each IP address.

[0075] A potential problem with this step is that large-scale port scanning can place a significant load on the network and the target system, and may even be mistaken for malicious activity by the target system. To address this, the system can send a notification message to the target system before performing a scan, explaining the purpose and scope of the scan and providing contact information for temporarily stopping the scan. Simultaneously, the system can control the frequency and concurrency of scans to avoid excessive impact on the network and system. Furthermore, for different scanning technologies, the system can set corresponding policies and thresholds to alert and restrict suspicious scanning behavior, ensuring the security and compliance of the scanning process.

[0076] S103. Send service probe data packets to the open port at a preset frequency;

[0077] This step primarily involves sending probe packets to open ports to identify the type and version of services running on those ports. The system can construct targeted probe packets based on the characteristics of common services, such as HTTP request packets and FTP command packets. Then, probe packets are sent to the open ports identified in the second step at a preset frequency. By parsing the port's response data, the type and version information of the services are determined. The preset frequency can be adjusted based on factors such as network environment and system resources to ensure timely probes while avoiding excessively frequent probes that could impact the network and system.

[0078] In practice, the system can maintain a feature library of common services, including default ports, request and response characteristics, etc., for various services. When sending probe packets, the system can first search the feature library based on the port number, select the service most likely to be running on that port, and construct the corresponding probe packet. If no match is found in the feature library, the system can also send some general probe packets, such as TCP SYN packets and UDP ICMP packets, and infer the service type based on the response data. For identified services, the system can further determine the service version number by requesting specific resources (such as the favicon.ico file for HTTP services, banner information for FTP services, etc.).

[0079] One potential issue with this step is that some services might restrict or block excessively frequent probe requests, affecting the accuracy of the probes. To address this, the system can take measures such as randomly changing the source IP address during the probe process to simulate the behavior of multiple clients; adding random delays to the probe requests to avoid overly predictable patterns; and setting reasonable probe frequency limits for different services to avoid triggering protective measures. Simultaneously, the system can also use machine learning algorithms to dynamically adjust strategies and parameters during the probe process, continuously improving the success rate and efficiency of the probes based on feedback results.

[0080] S104. Extract the service type and version number from the response information of the service probe data packet to obtain the service change frequency. This step mainly involves extracting the service type and version number based on the service response information obtained in the previous step, and calculating the service change frequency within a certain time range. Service types can be classified according to application layer protocols, such as HTTP, FTP, SSH, etc.; the version number is the specific version identifier of the service software, reflecting the software's update and iteration status. By tracking the changes in service type and version number over a period of time, the service change frequency can be obtained, i.e., the number of times the service changes per unit of time.

[0081] In practice, the system can periodically (e.g., daily or weekly) scan service ports to obtain service types and version numbers, and compare these results with previous scans to identify service changes. For example, if the service on a port changes from Apache httpd 2.2.31 to nginx 1.19.0, it means that both the service type and version number have changed. The system can record the timestamp of each change, then, based on a set time window (e.g., 30 days), count the number of service changes within that window, and divide by the window length to obtain the service change frequency.

[0082] S105. Calculate the dynamic asset score based on the activity index and service change frequency of IP address;

[0083] This step primarily involves comprehensively assessing the dynamic changes of assets based on the previously calculated IP address activity index and service change frequency, resulting in a quantified dynamic score. The asset dynamic score reflects the asset's activity level and stability; a higher score indicates a more active and frequently changing asset, while a lower score indicates a more stable and less frequently changing asset. This indicator can serve as an important basis for subsequent asset classification and detection strategy selection.

[0084] In practical implementation, the system can design a dynamic score calculation function that takes IP address activity and service change frequency as input to calculate a score between 0 and 100. The function can employ methods such as weighted summation and numerical mapping, and can also consider incorporating other relevant indicators, such as the number of open ports and historical security events. The weighting coefficients can be adjusted based on the importance and actual effectiveness of the indicators to ensure that the calculated dynamic score more accurately reflects the actual situation of the assets.

[0085] S106. Divide IP addresses into stable assets and temporary assets based on the dynamic asset score;

[0086] This step primarily involves classifying IP addresses into two categories—stable assets and transient assets—based on the dynamic asset score calculated in the previous step. Stable assets refer to those that exist long-term and change infrequently, typically the company's core business systems and production environment servers. Transient assets, on the other hand, refer to those that exist short-term and change frequently, such as development and testing environments and temporarily set up services. Subsequent security management strategies and detection methods should differ for different types of assets.

[0087] In practice, the system can set a dynamic score threshold. IP addresses exceeding this threshold are classified as temporary assets, while those below or equal to the threshold are classified as stable assets. The threshold can be adjusted based on the company's actual situation and security needs. Alternatively, a multi-level threshold approach can be used to classify assets into multiple levels for more refined classification management. For example, the dynamic score can be divided into three ranges: low, medium, and high, corresponding to stable, semi-stable, and temporary assets, respectively.

[0088] S107. Use a low-frequency deep probing method for stable assets and a high-frequency fast probing method for temporary assets to obtain the probing results;

[0089] The system uses a low-frequency deep probing method for stable assets and a high-frequency fast probing method for temporary assets to obtain the probing results. The probing results include the number of unreachable ports and the service response time. The low-frequency deep probing method includes a complete port scan and service identification, while the high-frequency fast probing method only probes commonly used ports.

[0090] This step primarily employs differentiated detection strategies based on asset stability to achieve comprehensive and efficient security monitoring within limited resources. For stable assets, which change less frequently, a low-frequency, deep detection approach can be used, with longer intervals between each detection, but the detected content is more comprehensive and detailed, covering all aspects of the system. For transient assets, due to their short lifecycle and rapid changes, a high-frequency, rapid detection approach is required to capture the asset's real-time status as much as possible. Although the content of a single detection may not be comprehensive enough, it can be compensated for by high-frequency repeated detection. The results of the two detection methods complement each other, jointly constructing a complete asset security profile.

[0091] In practical implementation, the system needs to design different detection tasks and rules for different types of assets. For stable assets, the system can use methods such as deep scanning based on vulnerability databases and compliance checks based on configuration to conduct comprehensive health checks on assets regularly (e.g., monthly or quarterly) to identify system vulnerabilities and non-compliance items. During the detection process, it can also focus on the implementation of some security baseline requirements, such as identity authentication, access control, and log auditing. For temporary assets, the system can use methods such as rapid port scanning and process anomaly detection to conduct frequent (e.g., hourly or daily) rapid inspections of assets to promptly identify security risks such as newly opened ports and newly running services. At the same time, the detection of temporary assets should minimize the impact on business operations and avoid affecting normal development and testing work due to excessively frequent detection. The detection results can be generated into a standardized report, recording the detailed configuration of the asset, the problems found, and other relevant information.

[0092] S108. Input the detection results and asset dynamic score into the risk assessment function to calculate the risk security value of each IP address;

[0093] The system inputs the detection results and asset dynamic score into the risk assessment function to calculate the risk security value for each IP address. The risk assessment function is as follows:

[0094]

[0095] In the function, R is the risk safety value, D(τ) is the function of the change of asset dynamic score over time, and D... max U represents the maximum value of the asset dynamic score, and U represents the number of unreachable ports. max The maximum possible number of unreachable ports, where T is the service response time. max The maximum allowed response time, S is the system load rate, P is the number of currently open ports, and P max The maximum number of open ports is defined by Δt, which is a fixed evaluation time window. α, β, γ, and δ are weighting coefficients, and α+β+δ=1, 0≤γ≤1.

[0096] To calculate the average of the asset dynamic score within a fixed time window, This indicates an increased risk associated with unreachable ports;

[0097] This indicates the risk associated with service response time; the longer the service response time, the greater the risk. This indicates the basic risk and cyclical fluctuation risk of system load.

[0098] This step primarily uses the previously obtained detection results and asset dynamic scores as input, and calculates the risk security value for each IP address using a predefined risk assessment function. The risk security value is a comprehensive evaluation indicator that reflects the degree of security threats faced by the asset and its security protection capabilities. A higher value indicates a higher risk and worse security, while a lower value indicates a lower risk and better security. This indicator allows for a direct assessment of the overall security status of the enterprise network and the identification of security weaknesses.

[0099] In practical implementation, the system needs to design a scientifically sound risk assessment function that comprehensively considers various security-related factors and assigns appropriate weighting coefficients. The function's input can include the number and severity of vulnerabilities discovered, configuration items that do not meet security baselines, asset exposure and activity levels, and the number of historical security incidents. Simultaneously, factors such as asset vulnerability and business importance should be considered and quantitatively weighted during the risk assessment process. The function's form can be designed according to actual needs, such as weighted summation or a positive exponential function, as long as it objectively and accurately reflects the asset's risk status. The system can provide some commonly used risk assessment function templates and also allow users to adjust and optimize the function based on their experience and needs. The output of the risk assessment function is a risk security value between 0 and 100, directly reflecting the security risk level of the IP address.

[0100] During the calculation process, the system can also incorporate dynamic factors to improve the relevance and real-time nature of risk assessment. For example, machine learning algorithms can be used to analyze historical asset data, predict risk trends over a future period, and assign them appropriate weights during the assessment. It can also correlate with real-time threat intelligence across the entire network, assigning higher risk scores to assets currently under attack. Furthermore, the results of manual analysis can be fed back into the assessment process to correct the calculated risk values. In addition, since different industries and enterprises may have different security concerns, the system should also support personalized customization of the assessment function, allowing users to independently set thresholds for each assessment element and adjust the weight coefficients of different factors to obtain more realistic assessment results.

[0101] S109. Conduct a security health assessment of the enterprise network based on the security risk value and generate an assessment report.

[0102] The system performs a security health assessment of the enterprise network based on security risk values ​​and generates an assessment report, which includes:

[0103] When the safety risk value is within a preset first range, an assessment report containing preset first assessment content is generated; when the safety risk value is within a preset second range, an assessment report containing preset second assessment content is generated; when the safety risk value is within a preset third range, an assessment report containing preset third assessment content is generated.

[0104] This step primarily involves calculating the risk and security value of each IP address, assessing the overall security health of the enterprise's network, and generating a comprehensive assessment report. The assessment may include key security issues and risks within the network, an analysis of the strengths and weaknesses of security protection capabilities, and a maturity assessment of security management. The aim is to help enterprises gain a comprehensive understanding of their current security status, identify areas for improvement, and provide a basis for subsequent security planning and development.

[0105] In practical implementation, the system can classify different security levels based on the distribution of risk security values ​​and set corresponding assessment standards. For example, risk values ​​can be divided into four levels: low, medium, high, and severe, corresponding to four assessment results: good security protection, few security vulnerabilities, high security risk, and severe security situation, respectively. For IP addresses at different levels, the system can provide different security suggestions and remedial measures when generating reports, helping enterprises to carry out targeted security hardening work. During the report generation process, the system should also use intuitive and easy-to-understand charts, data comparisons, and other forms to improve the readability and persuasiveness of the reports. At the same time, the system can also support personalized customization of report templates, allowing enterprises to adjust the content and format of the reports according to their own needs, improving the relevance and professionalism of the reports.

[0106] In the above embodiments, dynamic identification of network assets is achieved by acquiring network traffic data and calculating IP address activity indicators. Combined with port scanning and service probing, the system grasps the open ports and service information of assets. By analyzing service change frequency and activity indicators, a dynamic asset score is calculated, enabling the system to classify assets into stable and temporary assets. Differentiated probing strategies are adopted for different types of assets: stable assets undergo low-frequency deep probing, while temporary assets undergo high-frequency rapid probing, ensuring both comprehensiveness and efficiency. The probing results and asset dynamic scores are input into a risk assessment function to obtain a risk security value, ultimately generating an assessment report. This multi-dimensional and differentiated assessment method reduces the limitations of traditional single-technology assessments, more accurately reflecting the actual security status of network assets. Simultaneously, the differentiated probing strategy balances the depth and efficiency of the assessment, achieving a comprehensive and efficient network security health assessment.

[0107] The system achieves network security health assessment based on IP addresses using the method described in the first embodiment. However, in real-world applications, IP addresses in enterprise networks typically carry different business functions, and these different services are closely interconnected. To better assess network security from a business perspective, this application also provides a network security health assessment method based on business groups. After obtaining the risk security value of each IP address, this method further groups and manages the IP addresses according to their business functions, thus extending the assessment from a single point to a holistic business assessment. The following section combines... Figure 2 The present application describes a network security health assessment method based on business groups in its embodiments:

[0108] Please see Figure 2 This is a flowchart illustrating a network security health assessment method based on business groups in an embodiment of this application.

[0109] S201. Divide IP addresses into multiple service groups according to their service functions;

[0110] This step primarily involves dividing the business functions carried by IP addresses within the enterprise network into multiple business groups, thereby modeling the business dimension of network security. Since enterprise business systems typically consist of multiple IP addresses, and different services have complex calling relationships, it is necessary to abstract and cluster business functions to form several logical business groups. This allows for a more comprehensive assessment of the security status of each service, revealing security dependencies and risk propagation relationships between services.

[0111] In practical implementation, the system can perform preliminary business classification of IP addresses based on existing information such as network architecture diagrams and asset management systems. For example, it can be divided by department, grouping IP addresses used by the finance department into one group and those used by the R&D department into another; or by application system, grouping IP addresses involved in the ERP system into one group and those involved in the CRM system into another. Building on this, network traffic analysis and business call chain tracing techniques can be used to further optimize the division of business groups, grouping frequently communicating and highly correlated IP addresses into the same business group. Each of these business groups can then form a relatively independent and complete business security view.

[0112] S202. Calculate the average security risk value for each business group;

[0113] This step primarily involves calculating the average security risk value for each business group, based on the existing business groupings. This average risk value serves as an overall indicator for assessing the security status of that business. Since each business group may contain multiple IP addresses, and the risk values ​​of each IP address differ, a comprehensive calculation is required to obtain a quantitative value that represents the overall security level of the business group. This comprehensive indicator reflects the magnitude of the overall security risks faced by the business, helping security managers quickly identify and prioritize high-risk businesses.

[0114] In practice, the system can employ various calculation methods to generate the average security risk value for a business group. The simplest method is an arithmetic average, which sums the security risk values ​​of all IP addresses within the business group and then divides by the number of IP addresses. However, this method does not consider the differences in the importance of different IP addresses and may mask the high-risk status of some critical IP addresses. Therefore, a weighted average method can also be used, setting weight coefficients based on factors such as the importance level and access frequency of IP addresses before performing a weighted calculation. For example, critical assets such as core switches and major databases can be assigned higher weights, while non-critical assets can be given lower weights, allowing the calculated average risk value to more accurately reflect the impact of the security status of critical assets on the overall business.

[0115] S203. When the average security risk value of any business group exceeds the second threshold, increase the detection frequency of all IP addresses in the business group.

[0116] This step primarily involves dynamically adjusting the detection strategy based on the average security risk value of the business groups, enabling focused monitoring of high-risk businesses. Since the security risk levels of different business groups vary significantly, using a uniform detection strategy may result in insufficient granularity, inefficiency, and waste. Therefore, the system should be able to flexibly set the frequency and depth of detection based on the risk status of each business group, centralizing security management resources and capabilities to conduct more frequent and detailed security checks on higher-risk businesses, promptly identifying and eliminating security vulnerabilities.

[0117] In practice, the system can preset a security risk threshold (i.e., a second threshold) as the basis for determining whether to adjust the detection strategy. When the average security risk value of a business group exceeds this threshold, the business group is considered to be in a high-risk state, and the detection frequency of all IP addresses within the business group needs to be increased, such as increasing the detection frequency from once a week to once a day. At the same time, the system can also improve the depth and comprehensiveness of the detection, such as upgrading the original basic vulnerability scan to a comprehensive penetration test, in order to uncover security issues more deeply. The adjusted detection strategy can be maintained for a period of time until the average risk value of the business group drops below the threshold, at which point the original regular detection strategy will be restored.

[0118] S204. Analyze the service type of each IP address in the statistical business group and generate a service type list;

[0119] This step primarily involves statistically analyzing the open service ports of IP addresses within the business group to generate a service type list reflecting the current status of business applications. Since each business system typically contains multiple service modules listening on different ports, comprehensively analyzing the types and distribution of these services helps security managers gain a detailed understanding of the business's functional composition and application architecture, providing a foundation for subsequent security hardening, compliance checks, and change management. Simultaneously, the service type list can be compared with business application design documents and management records to promptly identify potential unauthorized services and violations.

[0120] In practice, during the detection process, the system uses techniques such as port scanning and service identification to obtain the service type and version information running on each IP address within a business group. Then, it aggregates and statistically analyzes the service information within the same business group, generating a formatted service type list that includes all service types appearing in the business group, their running IP addresses, port numbers, version numbers, and other detailed information. The list can be categorized and sorted according to service importance and purpose, allowing administrators to quickly find and locate services. The system can also generate statistical charts of service types in a visual manner, intuitively displaying the distribution and proportion of services, providing intuitive data support for assessing the current state of business security.

[0121] S205. Periodically compare changes in the service type list. When an unauthorized service change is detected, increase the security risk value of the corresponding IP address by a preset percentage.

[0122] This step primarily involves continuously tracking the service type list of business groups to promptly identify unauthorized service type changes and accordingly increase the security risk value of the affected IP addresses to reflect any deterioration in their security status. In actual business operations, temporary business adjustments or emergency responses may occur, leading to changes in service types. These changes may not be updated in the change management system in a timely manner. Such unauthorized or unrecorded service changes require high-level security attention, assessment of their potential risk impact, and implementation of appropriate control measures. By tracking changes to the service type list, the actual operational status of the business can be monitored more comprehensively, reducing blind spots in security management.

[0123] In practice, the system can compare the service type list of the same business group at certain time periods (such as daily or weekly) to identify newly added, removed, or changed service types. For each identified service change, the system can query the change management record to verify whether the change has passed the approval process. If unauthorized or unregistered service changes are found, the system can determine that the business group is in a state of violation, and its security risk level needs to be increased. The increase can be set by a preset percentage, such as increasing the original security risk value by 20%. This percentage can be flexibly set according to the company's security management regulations and risk tolerance.

[0124] After increasing the security risk level, the system needs to generate an alert event for service change anomalies, notifying security management personnel to intervene. The alert message should clearly identify the specific details of the service change, the affected IP address, and the change time, facilitating subsequent verification and evidence collection by security personnel. Simultaneously, the system should automatically trigger a security scan of the relevant business group to reassess the potential risks, vulnerabilities, and compliance issues arising from the service change. The scan results can serve as supplementary material to the alert event, providing richer data support for risk analysis of the security incident.

[0125] In the above embodiments, IP addresses are divided into multiple business groups according to business functions, and the average security risk value of each business group is calculated. The system can assess network security status from a business perspective. When the average security risk value of a business group exceeds a threshold, the detection frequency of all IP addresses within the group is increased, which can promptly detect potential security threats within that business group. By generating and comparing a service type list, the system can detect unauthorized service changes and reflect the potential risks brought about by the service changes by increasing the security risk value of the corresponding IP addresses. This enables the system to identify security vulnerabilities in specific business areas. The periodic comparison of the service type list ensures the controllability of changes to the business system, prevents security vulnerabilities caused by unauthorized service deployments, and improves the accuracy and timeliness of the system's identification and response to security threats.

[0126] Furthermore, in another embodiment, after increasing the security risk value of the corresponding IP address by a preset percentage, the method further includes:

[0127] Statistics on the internal access frequency and cross-business group access frequency across multiple business groups;

[0128] Set access baselines based on internal access frequency and cross-business group access frequency.

[0129] When the frequency of internal access to any business group and the frequency of cross-business group access are detected to exceed the access baseline, an over-limit access event is recorded.

[0130] Regularly analyze access violation events to identify abnormal access patterns;

[0131] When the duration of an abnormal access pattern exceeds the third threshold, adjust the security protection policy of the business group, specifically including:

[0132] Lower the service response time alarm threshold for business groups;

[0133] Increase the frequency of port scanning for all IP addresses in the business group;

[0134] Shorten the security assessment cycle for business groups.

[0135] This embodiment further expands the methods for business group security assessment and protection by introducing an anomaly detection and response mechanism based on access behavior. By continuously monitoring the internal and external access frequencies of business groups and comparing them with preset access baselines, abnormal inter-group access behavior and risk events can be detected in a timely manner. Abnormal access patterns usually indicate unexpected data flow and abuse of permissions between business groups, which is highly likely to be an attack by external intrusion or internal threats. For these anomalies, the system needs to conduct in-depth analysis and implement a series of adjustments to security protection strategies to strengthen the security monitoring and risk management level of business groups and curb the further escalation of security incidents.

[0136] In practical implementation, the system first needs to collect access traffic data from business groups in real time, and statistically analyze the access frequency between terminals within each business group, as well as the cross-boundary access frequency between business groups. The access frequency can be set with different statistical calibers based on the actual network environment and business characteristics, such as the number of requests per unit time, traffic volume, and number of connections. After obtaining access frequency data within a certain time range, the system can use statistical principles to establish a baseline standard for business group access behavior. The access baseline reflects the access patterns and characteristics of a business group under normal operating conditions, such as average access volume and peak-period access intensity.

[0137] During continuous monitoring, if the system detects that the access frequency of any business group exceeds the baseline threshold, it can determine that an over-limit access event has occurred and generate a corresponding event log. The event log must clearly indicate the time of the abnormal access, the source and destination IPs, the access type, and the extent of the over-limit violation, facilitating subsequent analysis and evidence collection by security personnel. Simultaneously, the system needs to correlate multiple over-limit event logs, comprehensively analyze the time-series characteristics of the abnormal access, and summarize and extract recurring abnormal access patterns, such as brute-force scanning and data breaches. These patterns often represent potential intrusion or violation risks and require close monitoring.

[0138] When the duration of an abnormal access pattern exceeds a certain threshold (i.e., the third threshold), it often indicates that a security risk is escalating within the business group, necessitating an upgrade to the business group's security protection strategy. This threshold setting can be dynamically adjusted based on the enterprise's security needs and risk tolerance. The direction of strategy adjustment is to increase resource investment, shorten the protection response cycle, and reduce risk tolerance. For example, the performance alarm threshold for critical assets in the business group can be lowered to provide timely warnings after service response times exceed the limit; the frequency of port scanning for all business group terminals can be increased to more quickly detect suspicious open ports; and the overall security assessment cycle of the business group can be shortened to ensure that risk assessment results are synchronized with the real-time security status of the business group. Through these strategy adjustments, the business group's protection capabilities can be rapidly improved, curbing the spread of security threats.

[0139] In the above embodiments, when access behavior deviates from the baseline, the system records it as an over-limit access event. By periodically analyzing these events, the system can identify persistent abnormal access patterns and discover potential threats that are difficult to identify using traditional security detection methods, such as abnormal connection behavior after an internal system attack or abnormal access patterns during data leakage. Through continuous monitoring and analysis of abnormal access patterns, the system can adjust its security protection strategy in a timely manner before threats cause substantial harm, improving the system's ability to resist complex network attacks. The access behavior analysis method based on business groups also enables the system to more accurately distinguish between normal business access and potential security threats, reducing the false alarm rate.

[0140] The system in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference needed]. Figure 3 This is a schematic diagram of the physical device structure of a multi-technology integrated network security health assessment system provided in an embodiment of this application.

[0141] It should be noted that, Figure 3 The structure of the system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0142] like Figure 3As shown, the system includes a Central Processing Unit (CPU) 301, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on a program stored in Read-Only Memory (ROM) 302 or a program loaded from storage portion 308 into Random Access Memory (RAM) 303. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An Input / Output (I / O) interface 305 is also connected to the bus 304.

[0143] The following components are connected to I / O interface 305: input section 306 including a camera, infrared sensor, etc.; output section 307 including a liquid crystal display (LCD) and speakers, etc.; storage section 308 including a hard disk, etc.; and communication section 309 including a network interface card such as a LAN (Local Area Network) card and a modem, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0144] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs the various functions defined in the present invention.

[0145] It should be noted that the computer-readable medium shown in the embodiments of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. The transmitted data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0146] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0147] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the system described in the above embodiments; or it may exist independently and not assembled into the system. The storage medium carries one or more computer programs that, when executed by a processor of a system, cause the system to implement the methods provided in the above embodiments.

[0148] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0149] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0150] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0151] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A multi-technology integrated cybersecurity health assessment method, characterized in that, include: Obtain network traffic data of the enterprise network within a first preset time period, and generate an IP address activity index based on the access frequency and duration of each IP address; Within a second preset time period, port detection is performed on IP addresses whose activity index is greater than the first threshold using a configurable port scanning method to obtain open port information; Send service probe data packets to the open port at a preset frequency; The service type and version number are extracted from the response information of the service probe data packet to obtain the service change frequency; Calculate the asset dynamic score based on the activity index of the IP address and the service change frequency; The IP addresses are classified into stable assets and temporary assets based on the asset dynamic score. The stable assets are probed using a low-frequency deep probing method, and the temporary assets are probed using a high-frequency fast probing method to obtain the detection results. The detection results include the number of unreachable ports and the service response time. The low-frequency deep probing method includes a complete port scan and service identification, while the high-frequency fast probing method only probes commonly used ports. The detection results and the asset dynamic score are input into a risk assessment function to calculate the risk security value for each IP address. The risk assessment function is as follows: ; In the function, the For the risk safety value, the The asset's dynamic score is a function of its change over time. The maximum value of the asset's dynamic score, the The number of unreachable ports, the To the maximum possible number of unreachable ports, the The service response time is the duration of the service. The maximum allowable response time, the For system load rate, the The number of currently open ports, the To determine the maximum number of allowed open ports, the For a fixed evaluation time window, the The above The above and the aforementioned These are the weighting coefficients, and , ; The To calculate the average of the asset's dynamic score within a fixed time window, the This indicates an increased risk associated with unreachable ports; The This indicates the risk associated with the service response time; the longer the service response time, the greater the risk. This indicates the fundamental risk and cyclical fluctuation risk of system load; A security health assessment of the enterprise network is conducted based on the security risk values, and an assessment report is generated.

2. The method according to claim 1, characterized in that, The process of generating an IP address activity index based on the access frequency and duration of each IP address specifically includes: The access frequency and duration are input into the activity index calculation function to obtain the activity index of the IP address; The activity index calculation function is as follows: ； In the function, the The activity index of the IP address, the For the access frequency, the For the duration, the The standard deviation of the access time interval, the The above and the aforementioned These are preset weight parameters.

3. The method according to claim 1, characterized in that, The step of conducting a security health assessment of the enterprise network based on the security risk value and generating an assessment report specifically includes: When the security risk value is within a preset first range, an assessment report containing preset first assessment content is generated; When the security risk value is within a preset second range, an assessment report containing preset second assessment content is generated; When the security risk value is within a preset third range, an assessment report containing preset third assessment content is generated.

4. The method according to claim 1, characterized in that, After generating the evaluation report, the method further includes: The IP addresses are divided into multiple service groups according to their business functions; Calculate the average security risk value for each of the aforementioned business groups; When the average security risk value of any of the business groups exceeds the second threshold, the detection frequency of all IP addresses in the business group is increased; Collect the service types of each IP address in the business group and generate a service type list; The system periodically compares changes in the service type list, and when unauthorized service changes are detected, increases the security risk value of the corresponding IP address by a preset percentage.

5. The method according to claim 4, characterized in that, After increasing the security risk value of the corresponding IP address by a preset percentage, the method further includes: Statistical analysis of the internal access frequency and cross-business group access frequency of the aforementioned multiple business groups; Set an access baseline based on the internal access frequency and the cross-business group access frequency; When the internal access frequency and cross-business group access frequency of any of the business groups are detected to exceed the access baseline, an over-limit access event is recorded. The abnormal access patterns are obtained by periodically analyzing the aforementioned access violation events. When the duration of the abnormal access pattern exceeds the third threshold, the security protection policy of the business group is adjusted.

6. The method according to claim 5, characterized in that, The adjustment of the security protection strategy for the business group specifically includes: Lower the service response time alarm threshold for the aforementioned service group; Increase the port scanning frequency for all IP addresses in the aforementioned service group; Shorten the security assessment cycle for the aforementioned business group.

7. A network security health assessment system integrating multiple technologies, characterized in that, The system includes: One or more processors and a memory; the memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors invoking the computer instructions to cause the system to perform the method as described in any one of claims 1-6.

8. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are executed on the system, the system performs the method as described in any one of claims 1-6.

9. A computer program product, characterized in that, When the computer program product is run on the system, the system performs the method as described in any one of claims 1-6.

Images