Asset vulnerability risk assessment method based on security knowledge graph

Abstract

The invention discloses an asset vulnerability risk assessment method based on a security knowledge graph. The method comprises the following steps: S1, constructing a knowledge graph containing related nodes; s2, calculating the importance of each node in the knowledge graph; s3, mining the vulnerability risk sub-graph; and S4, carrying out risk assessment analysis on the asset vulnerabilities, and respectively obtaining risk assessment values of the assets and the asset vulnerabilities. According to the method, the knowledge graph containing assets, vulnerabilities, vulnerability types, attack modes and asset access relations is constructed, the incidence relation between the vulnerabilities is considered, the vulnerability types, the attack modes and other information related to external threats are also considered, and the incidence relation between the vulnerabilities is described more accurately; according to the node importance calculation method based on random walk, the asset risk and the risk of asset vulnerabilities can be flexibly evaluated as required.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically provides a method for asset vulnerability risk assessment based on a security knowledge graph. Background Art

[0002] Enterprises own digital assets, and these digital assets may have vulnerabilities. When vulnerabilities are exploited by external attackers, they will cause harm to enterprise assets and even affect enterprise production and operation. Vulnerability risk assessment is to identify enterprise assets, analyze the vulnerabilities and threats faced by the assets, assess the vulnerability risks before a cyber-attack occurs, and then manage the asset vulnerabilities.

[0003] When conducting vulnerability risk assessment, the patent with the application number 202410217566.3 analyzes the vulnerability of the vulnerability in isolation and does not consider the correlation between vulnerabilities, so it cannot provide an accurate vulnerability risk assessment strategy; the patent with the application number 202410498941.6 uses a vulnerability attack graph to describe the correlation between vulnerabilities, but the vulnerability attack graph has too strong constraints. It relies on an existing vulnerability exploitation knowledge base and cannot handle unknown vulnerabilities and vulnerability exploitations. Summary of the Invention

[0004] To solve the above problems, the present invention provides a method for asset vulnerability risk assessment based on a security knowledge graph, including the following steps: S1. Construct a knowledge graph containing relevant nodes; wherein, the relevant nodes specifically include: assets, vulnerabilities, vulnerability types, and attack methods; S2. Calculate the importance of each node in the knowledge graph; S3. Mine the vulnerability risk sub-graph; S4. Conduct a risk assessment analysis of asset vulnerabilities to obtain the risk assessment values of assets and asset vulnerabilities respectively.

[0005] Further, the S1 step specifically includes the following sub-steps: S11. Obtain the access relationships between each host IP address; S12. Obtain asset data information through asset detection; S13. Conduct a vulnerability scan on the asset data information to obtain the vulnerability information of the assets; S14. Analyze the vulnerability information and add connection information between the vulnerability and the vulnerability type based on the analysis results; S15. Analyze the vulnerability type and add connection information between the vulnerability type and the attack method based on the analysis results.

[0006] Further, in the S11 step, the access relationships between host IP addresses are mainly obtained through firewalls, switches, and routers.

[0007] Further, the formula for calculating the importance of each node in the S2 step is: ; in the above formula, PageRank(p i) represents node P i ; q represents the damping coefficient; n represents the total number of vertices; 1 represents a unit vector of length n, where each element is 1; P j represents P i 's neighbor vertices; L(P j ) represents the degree of vertex P j .

[0008] Furthermore, specifically in the step S4: Based on the same assets and vulnerabilities, the associated vulnerability types and attack methods are merged and summed to obtain the risk assessment values of the assets and asset vulnerabilities respectively.

[0009] The present invention provides a method for asset vulnerability risk assessment based on a security knowledge graph, which has the following beneficial effects: The present invention constructs a knowledge graph including assets, vulnerabilities, vulnerability types, attack patterns, and asset access relationships, which not only considers the association relationships between vulnerabilities, but also considers information related to external threats such as vulnerability types and attack patterns, and describes the association relationships between vulnerabilities more accurately; the node importance calculation method based on random walk can flexibly evaluate the asset risk and the risk of asset vulnerabilities as needed. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on the structures shown in these drawings.

[0011] Figure 1 is the flowchart of the method provided by the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0012] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0013] The following will describe the implementation method of the present invention in detail with reference to the drawings. The described are only some embodiments, not all embodiments. For the purpose of clarity, the representations and descriptions unrelated to the present invention are omitted in the drawings and the description.

[0014] For a clearer understanding of the technical features, objectives, and beneficial effects of the present invention, the following provides a detailed description of the technical solution of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all embodiments, and should not be construed as a limitation on the scope of implementation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the protection scope of the present invention.

[0015] As Figure 1 shown, the present invention provides a method for asset vulnerability risk assessment based on a security knowledge graph, including the following steps: S1. Construct a knowledge graph containing relevant nodes; wherein, the relevant nodes specifically include: assets (CPE), vulnerabilities (CVE), vulnerability types (CWE), and attack methods (CAPEC); S2. Calculate the importance of each node in the knowledge graph; S3. Mine the vulnerability risk subgraph; S4. Conduct a risk assessment analysis of asset vulnerabilities to obtain the risk assessment values of assets and asset vulnerabilities respectively.

[0016] Step S1 specifically includes the following sub-steps: S11. Obtain the access relationships between each host IP address, and obtain the access relationships between host IP addresses through firewalls, switches, and routers.

[0017] S12. Obtain asset data information through asset detection, and assets are represented by CPE. For example, the CPE number of a certain sensor is "cpe:2.3:h:pepperl-fuchs:oit500-f113-b12-cb:-:*:*:*:*:*:*:*", and through detection, it is found that there is an association relationship between a certain IP address and this CPE.

[0018] S13. Conduct a vulnerability scan on the asset data information to obtain the vulnerability information of the asset, represented by CVE. If an asset has a vulnerability, then there is an edge between the corresponding CPE vertex and the corresponding CVE vertex. This sensor has a vulnerability CVE-2024-6421, so there is an edge between "cpe:2.3:h:pepperl-fuchs:oit500-f113-b12-cb:-:*:*:*:*:*:*:*" and CVE-2024-6421.

[0019] S14. Analyze the vulnerability information and add connection information between the vulnerability and the vulnerability type based on the analysis results. By analyzing the information related to CVE-2024-6421, it is found that it is associated with CWE-200, so there is an edge between the two.

[0020] S15. Analyze the vulnerability types and add connection information between vulnerability types and attack methods based on the analysis results. Further analysis of CWE-200 reveals that there are connection relationships between it and CAPEC-116, CAPEC-13, etc. Then, add edges between the corresponding vertices.

[0021] In step S2, abstract the above knowledge graph into an undirected graph and use the random walk method to calculate the steady-state probability of each node in the graph. The steady-state probability of a node represents the importance of the node. The formula for calculating the importance of each node is: ; In the above formula, PageRank(p i ) represents the importance value of node P i ; q represents the damping coefficient; n represents the total number of vertices; 1 represents a unit vector of length n, where each element is 1; P j represents the neighbor vertices of P i ; L(P j ) represents the degree of vertex P j .

[0022] In the knowledge graph, mine all "CPE-CVE-CWE-CAPEC" (asset-vulnerability-vulnerability type-attack method) subgraphs. Each node in each subgraph has a steady-state probability. Each subgraph is a dictionary, where the keys of the dictionary are (CPE-x, CVE-xx, CWE-xxx, CAPEC-xxxx), and the values of the dictionary are the importance values of these 4 vertices respectively.

[0023] Specifically in step S4: Based on the same assets and vulnerabilities, merge and sum the associated vulnerability types and attack methods to obtain the risk assessment values of the assets and asset vulnerabilities respectively.

[0024] For example: There are 3 subgraphs related to asset CPE-5. After merging, the risk value of asset CPE-5 is 0.009, and the risk value of the asset vulnerability combination (CPE-5, CVE-6) is 0.0054, as shown in Table 1.

[0025] Table 1 Calculation of the risk value of the asset vulnerability combination (CPE-5, CVE-6) When assessing vulnerability risks, in order to consider the correlation between vulnerabilities, the access relationship between assets and assets is introduced, and then the correlation between vulnerabilities is considered; when constructing the relationship graph, in addition to considering asset and vulnerability information, attack type information is introduced through vulnerability type information, and external threats related to attacks are considered by introducing attack type information.

[0026] The present invention constructs a knowledge graph including assets, vulnerabilities, vulnerability types, attack patterns, and asset access relationships. It not only considers the association relationships between vulnerabilities, but also takes into account information related to external threats such as vulnerability types and attack patterns, and describes the association relationships between vulnerabilities more accurately. The node importance calculation method based on random walk can flexibly evaluate the asset risk and the risk of asset vulnerabilities as needed.

[0027] The above are only the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications, and environments, and can be changed within the scope of the concept described herein through the above teachings or the technology or knowledge in the relevant field. And the changes and alterations made by those skilled in the art without departing from the spirit and scope of the present invention shall fall within the protection scope of the appended claims of the present invention.

Claims

1. A method for assessing asset vulnerability risk based on security knowledge graph, characterized in that: The following steps are involved: S1. Construct a knowledge graph containing relevant nodes; wherein the relevant nodes specifically include: assets, vulnerabilities, vulnerability types, and attack methods; S2. Calculate the importance of each node in the knowledge graph; S3. Mining vulnerability risk subgraphs; S4. Conduct risk assessment analysis on asset vulnerabilities to obtain risk assessment values ​​for assets and asset vulnerabilities respectively.

2. The asset vulnerability risk assessment method based on security knowledge graph according to claim 1 is characterized in that: The S1 step specifically includes the following sub-steps: S11. Obtain the access relationship between each host IP address; S12. Obtain asset data information through asset detection; S13. Scan the asset data information for vulnerabilities and obtain the asset vulnerability information; S14. Analyze the vulnerability information, and add connection information between the vulnerability and the vulnerability type based on the analysis results; S15. Analyze the vulnerability type, and add connection information between the vulnerability type and the attack method based on the analysis result.

3. The asset vulnerability risk assessment method based on security knowledge graph according to claim 2 is characterized in that: In the step S11, the access relationship between the host IP addresses is mainly obtained through the firewall, switch, and router.

4. The asset vulnerability risk assessment method based on security knowledge graph according to claim 1 is characterized in that: The formula for calculating the importance of each node in step S2 is: ； In the above formula, PageRank(p i ) represents the node P i The importance value of ; q represents the damping coefficient; n represents the total number of vertices; 1 represents a unit vector of length n, in which each element is 1; P j Indicates P i Neighbor vertices of L(P j ) represents the vertex P j The degree.

5. The asset vulnerability risk assessment method based on security knowledge graph according to claim 1 is characterized in that: The step S4 specifically includes: based on the same assets and vulnerabilities, the vulnerability types and attack methods associated therewith are combined and summed to obtain risk assessment values ​​of the assets and asset vulnerabilities respectively.

Images