Network security risk assessment method and device

Abstract

The invention provides a network security risk assessment method and device, and the method comprises the steps: determining a risk factor of an alarm event according to the received alarm event; then, for each risk factor of the alarm event, performing normalization processing on the risk factor to obtain an initial risk value of the risk factor; then, according to all the alarm events and the risk factors of the alarm events, determining the weight of each risk factor of each alarm event; determining the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event; and finally, performing aggregation analysis according to the risk values of all the alarm events to obtain the total risk of the cloud network assets and the total risk of the external attack IP. Therefore, risk assessment is carried out on network security comprehensively and accurately.

Description

Technical Field

[0001] This application relates to the field of network security technologies, and particularly relates to a network security risk assessment method and device. Background Art

[0002] The research on information system risk analysis and security situation assessment methods has always been an important research direction in network security situation research. Risk assessment first needs to identify the assets, threats, and vulnerabilities of information systems.

[0003] However, the network security risk assessment in the prior art only calculates the asset risk based on alarm events, and does not consider the impact on network security in multiple dimensions. As a result, the final security risk assessment result is not comprehensive and accurate. Summary of the Invention

[0004] In view of this, this application provides a network security risk assessment method and device, which can comprehensively and accurately assess the network security risks.

[0005] The first aspect of this application provides a network security risk assessment method, including:

[0006] Determine the risk factors of the alarm event according to the received alarm event;

[0007] For each risk factor of the alarm event, perform normalization processing on the risk factor to obtain the initial risk value of the risk factor;

[0008] Determine the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm events;

[0009] Determine the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event;

[0010] Perform aggregation analysis according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs.

[0011] Optionally, the step of performing normalization processing on each risk factor of the alarm event to obtain the initial risk value of the risk factor includes:

[0012] For each risk factor of the alarm event, perform normalization processing on each index value in the risk factor to obtain the normalized index value;

[0013] Calculate the initial risk value of the risk factor according to all the normalized index values in the risk factor.

[0014] Optionally, determining the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm events includes:

[0015] Generating a risk sequence according to all alarm events and the risk factors of the alarm events;

[0016] Determining a mother sequence and a child sequence according to the risk sequence;

[0017] Generating a difference matrix according to the mother sequence and the child sequence;

[0018] Generating a correlation degree matrix according to the two-level maximum difference, the two-level minimum difference, the resolution coefficient and the difference matrix; wherein, the two-level maximum difference is the maximum value in the difference matrix, and the two-level minimum difference is the minimum value in the difference matrix;

[0019] Determining the grey correlation degree of each risk factor according to the correlation degree matrix;

[0020] Determining the weight of the risk factor according to the grey correlation degree of the risk factor.

[0021] Optionally, determining the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event includes:

[0022] For each risk factor in the alarm event, taking the product of the initial risk value of the risk factor and the weight corresponding to the risk factor as the target risk value of the risk factor;

[0023] Determining the risk value of the alarm event according to the target risk values of all risk factors.

[0024] Optionally, performing aggregation analysis according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs, including:

[0025] Taking cloud network assets as the evaluation object, performing aggregation calculations respectively for external threat situations, lateral movement situations and asset external connection situations according to the risk values of all alarm events to obtain a first aggregation result, a second aggregation result and a third aggregation result;

[0026] Determining the total risk of cloud network assets according to the first aggregation result, the second aggregation result and the third aggregation result;

[0027] Taking external attack IPs as the evaluation object, performing aggregation calculations respectively for external threat situations and asset external connection situations according to the risk values of all alarm events to obtain a fourth aggregation result and a fifth aggregation result;

[0028] Determine the total risk of the external attack IP based on the fourth aggregation result and the fifth aggregation result.

[0029] The second aspect of this application provides a network security risk assessment device, including:

[0030] A risk factor determination unit, configured to determine the risk factor of the alarm event according to the received alarm event;

[0031] A normalization unit, configured to perform normalization processing on each risk factor of the alarm event to obtain the initial risk value of the risk factor;

[0032] A weight determination unit, configured to determine the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm events;

[0033] A risk value determination unit, configured to determine the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event;

[0034] An aggregation analysis unit, configured to perform aggregation analysis according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs.

[0035] Optionally, the normalization unit includes:

[0036] A normalization processing unit, configured to perform normalization processing on each index value in each risk factor of the alarm event to obtain the normalized index value;

[0037] A calculation unit, configured to calculate the initial risk value of the risk factor according to all the normalized index values in the risk factor.

[0038] Optionally, the weight determination unit includes:

[0039] A risk sequence generation unit, configured to generate a risk sequence according to all alarm events and the risk factors of the alarm events;

[0040] A risk sequence processing unit, configured to determine the mother sequence and the sub-sequence according to the risk sequence;

[0041] A difference matrix generation unit, configured to generate a difference matrix according to the mother sequence and the sub-sequence;

[0042] An association degree matrix generation unit, configured to generate an association degree matrix according to the two-level maximum difference, the two-level minimum difference, the discrimination coefficient, and the difference matrix; where the two-level maximum difference is the maximum value in the difference matrix, and the two-level minimum difference is the minimum value in the difference matrix;

[0043] A grey relational grade determination unit, configured to determine the grey relational grade of each risk factor according to a relational grade matrix;

[0044] A weight determination subunit, configured to determine the weight of the risk factor according to the grey relational grade of the risk factor.

[0045] Optionally, the risk value determination unit includes:

[0046] A first risk value determination subunit, configured to, for each risk factor in the alarm event, use the product of the initial risk value of the risk factor and the weight corresponding to the risk factor as the target risk value of the risk factor;

[0047] A second risk value determination subunit, configured to determine the risk value of the alarm event according to the target risk values of all risk factors.

[0048] Optionally, the aggregation analysis unit includes:

[0049] A first aggregation subunit, configured to use cloud network assets as an evaluation object, and perform aggregation calculations respectively for external threat situations, lateral movement situations, and asset external connection situations according to the risk values of all alarm events, to obtain a first aggregation result, a second aggregation result, and a third aggregation result;

[0050] A first total risk determination unit, configured to determine the total risk of the cloud network assets according to the first aggregation result, the second aggregation result, and the third aggregation result;

[0051] A second aggregation subunit, configured to use an external attack IP as an evaluation object, and perform aggregation calculations respectively for external threat situations and asset external connection situations according to the risk values of all alarm events, to obtain a fourth aggregation result and a fifth aggregation result;

[0052] A second total risk determination unit, configured to determine the total risk of the external attack IP according to the fourth aggregation result and the fifth aggregation result.

[0053] A third aspect of the present application provides an electronic device, including:

[0054] One or more processors;

[0055] A storage device, on which one or more programs are stored;

[0056] When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the network security risk assessment method according to any item of the first aspect.

[0057] A fourth aspect of the present application provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the network security risk assessment method described in any one of the first aspects is implemented.

[0058] As can be seen from the above solutions, the present application provides a network security risk assessment method and apparatus. First, according to the received alarm events, the risk factors of the alarm events are determined; then, for each risk factor of the alarm events, the risk factors are normalized to obtain the initial risk values of the risk factors; after that, according to all the alarm events and the risk factors of the alarm events, the weights of each risk factor of each alarm event are determined; then, according to the initial risk values of the risk factors of the alarm events and the weights of the risk factors of the alarm events, the risk values of the alarm events are determined; finally, according to the risk values of all the alarm events, an aggregation analysis is performed to obtain the total risk of the cloud network assets and the total risk of the external attack IPs. Thus, a comprehensive and accurate risk assessment of network security is carried out. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0060] Figure 1 It is a specific flowchart of a network security risk assessment method provided by an embodiment of the present application;

[0061] Figure 2 It is an example diagram of converting the comprehensive score of CVSS vulnerabilities provided by another embodiment of the present application;

[0062] Figure 3 It is a flowchart of a method for determining the weights of risk factors provided by another embodiment of the present application;

[0063] Figure 4 It is a schematic diagram of the distribution of the aggregated risk scores provided by another embodiment of the present application;

[0064] Figure 5 It is a schematic diagram of the distribution of the aggregated risk scores provided by another embodiment of the present application;

[0065] Figure 6 It is a schematic diagram of an aggregation analysis method provided by another embodiment of the present application;

[0066] Figure 7Schematic diagram of an aggregation analysis method provided by another embodiment of the present application;

[0067] Figure 8 Schematic diagram of an aggregation analysis method provided by another embodiment of the present application;

[0068] Figure 9 Schematic diagram of an aggregation analysis method provided by another embodiment of the present application;

[0069] Figure 10 Schematic diagram of an aggregation analysis method provided by another embodiment of the present application;

[0070] Figure 11 Schematic diagram of a network security risk assessment device provided by another embodiment of the present application;

[0071] Figure 12 Schematic diagram of an electronic device for implementing a network security risk assessment method provided by another embodiment of the present application. Detailed implementation manners

[0072] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0073] As used herein, the term "including" and its variations are open-ended, that is, "including but not limited to". The term "based on" is "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0074] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of relevant countries and regions.

[0075] It should be noted that the concepts such as "first" and "second" mentioned in the present application are only used to distinguish different devices, modules, or units, and are not used to limit the order or mutual dependence relationship of the functions performed by these devices, modules, or units.

[0076] It should be noted that the modifications of "one" and "multiple" mentioned in this application are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly specified in the context, it should be understood as "one or more".

[0077] An embodiment of this application provides a network security risk assessment method, as Figure 1 shown, which specifically includes the following steps:

[0078] S101. Determine the risk factors of the alarm event according to the received alarm event.

[0079] In the specific implementation process of this application, the risk factors can be but are not limited to asset value, asset value, vulnerability (number of vulnerabilities, vulnerability level, and CVSS score), threat event level (alarm level), associated threat intelligence level, threat event confidence level, attack chain stage, IP ban situation (whether banned and number of bans), etc., which are not limited here.

[0080] S102. For each risk factor of the alarm event, perform normalization processing on the risk factor to obtain the initial risk value of the risk factor.

[0081] In the specific implementation process of this application, a non-linear transformation method can be used, but is not limited to, to non-linearly transform the index values of the risk factors, and at the same time perform normalization processing and improve the numerical accuracy. The main function of non-linear transformation is to amplify the difference between the high score segment and the low score segment. Taking the threat event level as an example, the harmfulness of the 4-point level may not be twice that of the 2-point level. Through non-linear transformation, it is reflected that the harm of high scores is higher and the harm of low scores is lower; on the other hand, non-linear transformation can map the numerical values to the interval of [0, 1], complete the normalization of the numerical values, and increase the numerical accuracy.

[0082] Among them, the Sigmoid conversion formula is as follows:

[0083] ;

[0084] is the original index value, is the upper limit of the original index value, is the normalized index value. Through the above normalization transformation, the scores in the middle position are still in the middle part after transformation, while the data differences on the high score side and the low score side gradually increase. The distribution of the transformed scores is as Figure 2 shown (taking the CVSS vulnerability comprehensive score as an example), where the abscissa is the original index value and the ordinate is the normalized index value.

[0085] It can be understood that after all indicators are transformed by the Sigmoid function, the non-linear relationship transformation is completed, and at the same time, the normalization process is completed. The scores are all normalized to the range of [0, 1], and the numerical accuracy is improved.

[0086] Taking the CVSS vulnerability comprehensive score as an example, after being transformed by the Sigmoid function, the score correspondence is shown in Table 1:

[0087] Table 1

[0088] Original index value Sigmoid conversion score (normalized index value) 0 0.007 1 0.018 2 0.047 3 0.119 4 0.269 5 0.5 6 0.731 7 0.881 8 0.953 9 0.982 10 0.993

[0089] After normalizing each indicator value in the risk factor to obtain the normalized indicator value, continue to calculate the initial risk value of the risk factor according to all the normalized indicator values in the risk factor.

[0090] For vulnerability indicators, it is necessary to combine the CVSS vulnerability comprehensive score, vulnerability level, and the number of vulnerabilities, and calculate the final vulnerability assessment value through calculation. If there are n vulnerabilities on an asset, the assessment value (initial risk value) of all vulnerabilities on this asset is:

[0091] ;

[0092] Among them, S is the comprehensive vulnerability assessment value, Z i is the normalized value of the comprehensive score of vulnerability i, and D i is the normalized value of the vulnerability level of vulnerability i.

[0093] Similarly, for the banned situation indicator, it is necessary to comprehensively consider whether it is banned and the number of bans, and calculate the final ban score through calculation. If an IP has n ban records, the ban score corresponding to this IP is:

[0094] ;

[0095] Among them, F is the comprehensive ban score (initial risk value), and E i is the normalized value of ban record i (whether it is banned).

[0096] S103. Determine the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm events.

[0097] In the specific implementation process of this application, the calculation of the weight can adopt but is not limited to grey relational analysis. The basic idea of grey relational analysis is to judge whether the connection is close according to the similarity degree of the geometric shapes of the sequence curves. The closer the curves are, the greater the correlation degree between the corresponding sequences, and vice versa.

[0098] Optionally, in another embodiment of the present application, an implementation manner of step S103 is as follows Figure 3 shown, including:

[0099] S301. Generate a risk sequence according to all alarm events and risk factors of the alarm events.

[0100] In the specific implementation process of the present application, the finally generated risk sequence can be recorded as:

[0101] ;

[0102] where m is the number of risk factors and n is the number of alarm events.

[0103] S302. Determine a mother sequence and a child sequence according to the risk sequence.

[0104] Among them, the mother sequence is similar to the dependent variable Y. In the specific implementation process of the present application, there is no objective mother sequence. A benchmark is formed through the child sequence, and the average value or maximum value of the child sequence is used as a substitute. The present application uses the maximum value of all evaluation indicators to replace the risk variable Y.

[0105] .

[0106] The child sequence refers to the data sequence composed of each index, that is, each index column, and is recorded as:

[0107] .

[0108] S303. Generate a difference matrix according to the mother sequence and the child sequence.

[0109] Among them, the element of the difference matrix K is the absolute value of the difference between the child sequence and the mother sequence:

[0110] .

[0111] S304. Generate a correlation degree matrix according to the two-level maximum difference, the two-level minimum difference, the resolution coefficient, and the difference matrix.

[0112] Among them, the two-level maximum difference b is the maximum value in the difference matrix, and the two-level minimum difference is the minimum value a in the difference matrix. That is , .

[0113] First, calculate the correlation degree between indicators:

[0114] ; is the resolution coefficient, generally taking 0.5. Substitute the absolute value |k of each value from the difference matrix K ijIf so, a new correlation matrix can be calculated, and the elements therein are denoted as the correlation ξ ij .

[0115] S305. Determine the grey correlation degree of each risk factor according to the correlation matrix.

[0116] In the specific implementation process of this application, the following calculation formula can be used to calculate the grey correlation degree of the risk factor:

[0117] ; where is the grey correlation degree of the j-th index. Taking the index as the unit, adding up the index correlation degree values of all alarm events and then taking the average can calculate the grey correlation degree of each index, denoted as .

[0118] Taking the vulnerability index as an example, the calculation formula is as follows:

[0119] ;

[0120] where n is the number of alarm events, and i represents the i-th alarm event currently.

[0121] S306. Determine the weight of the risk factor according to the grey correlation degree of the risk factor.

[0122] In the specific implementation process of this application, the following calculation formula can be used to calculate the weight of each index in the risk factor:

[0123] ;

[0124] where w j is the weight of the j-th index. Dividing the grey correlation degree r j of the j-th index by the sum of the grey correlation degrees of all indexes is the weight of the j-th index. Taking the calculation of the vulnerability index weight as an example, the calculation formula is as follows:

[0125] .

[0126] S104. Determine the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event.

[0127] In the specific implementation process of this application, by performing a weighted summation operation on the normalized values of each index and the calculated weights, the final risk value of each alarm can be obtained.

[0128] Specifically, for each risk factor in the alarm event, the product of the initial risk value of the risk factor and the weight corresponding to the risk factor is used as the target risk value of the risk factor; the risk value of the alarm event is determined according to the target risk values of all risk factors.

[0129] Taking the risk factors of asset value, vulnerability, and block record as examples, the risk value of the alarm event can be calculated using the following formula:

[0130] 。

[0131] Among them, is the risk value of the alarm event, is the initial risk value of the asset value, is the weight of the asset value, is the initial risk value of the vulnerability, is the weight of the vulnerability, is the initial risk value of the block record, is the weight of the block record. Multiplying by 100 is to convert the score to a percentage score. Of course, it can also not be converted in the actual application process.

[0132] S105. Aggregate and analyze according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs.

[0133] Among them, the information of the alarm time is associated with the attacked and the attacker. After calculating the risk value of the alarm event, through the aggregate analysis at the levels of the attacked and the attacker, the total risks of the final attacked (cloud network assets) and the attacker (external attack IP) can be obtained.

[0134] It should be noted that in another embodiment of the present application, the attacker can also be an intranet compromised asset, which is not limited here.

[0135] As shown in Table 2, it is an example after calculating the risk value of the alarm event provided by the present application.

[0136] Table 2

[0137] Alarm event name Risk value Cloud network assets External attack IP Internal initiation of highly suspicious Trojan backdoor connection 56.14 A 1.1.1.1 Internal initiation of suspicious Trojan backdoor connection behavior 50.09 A 1.1.1.1 Internal initiation of suspicious WebShell access behavior 73.96 A 1.1.1.2 Vulnerability scan reporting behavior 90.48 A 1.1.1.1 SQL injection attack 53.59 B 2.2.2.2 Reported user behavior 71.97 B 2.2.2.2 Vulnerability scan reporting behavior 46.2 B 2.2.2.2 TCP Trojan attempt to connect to mining pool 60.19 C 3.3.3.3 Vulnerability scan reporting behavior 68.04 D 3.3.3.3 TCP Trojan attempt to connect to mining pool 62.93 E 3.3.3.3 Nested use of built-in lookup format string 55.71 F 3.3.3.3 External initiation of suspicious remote code execution behavior 57.24 F 3.3.3.3 HTTP vulnerability scan 66.78 G 4.4.4.4 HTTP security risk suspicious behavior 44.39 H 4.4.4.4 HTTP vulnerability scan 47.33 H 5.5.5.5

[0138] In the actual application process of the present application, there are three situations, including external threats, lateral movement, and asset external connection, which need to be considered separately when calculating risks.

[0139] (1) External threat refers to the situation where the attack source is an external attack IP and the attacked source is cloud network assets.

[0140] Taking cloud network assets as the evaluation object, it is necessary to first aggregate cloud network assets and external attack IPs on the basis of warning risks.

[0141] In the specific implementation process of this application, it is possible to use, but not limited to, high quantiles (90%-95% quantiles) to aggregate risks, and no limitation is made here.

[0142] It can be understood that when the risks are mainly reflected in the high score segment, high quantiles can fully reflect the high risks; when the risks are mainly in the low score segment, the impact of high-risk events can be captured based on the overall risk trend; when the risks are evenly distributed in the low score area or high score area, the functions of high quantiles are almost the same as those of the average, median, etc. (as Figure 4 shown).

[0143] Quantile calculation method: First, arrange the risk values of a group of warning events for which the quantile is to be calculated in ascending order, and each value will correspond to a serial number (from 1 to N), and then calculate through the following formula:

[0144] ; among them, if R is not an integer, then , if R is an integer, then .

[0145] Among them, P is the percentile rank (for example, when calculating the 90% quantile, P is 90), N is the total number of a group of data, R is the serial number of the observed value corresponding to P; R up is the serial number of R rounded up, R low is the serial number of R rounded down; is R up corresponding observed value, is the observed value corresponding to Rlow, V R is the observed value corresponding to R; X is the finally calculated percentile.

[0146] For example, as Figure 5 shown, taking cloud network asset A and external attack IP address 192.201.2.58 as an example, when aggregating cloud network asset A - external attack IP, if the average is used for aggregation, the average risk value of 192.201.2.58 is 65.56, while the average risk value of 192.201.2.58 is 73.96. Theoretically speaking, the risk caused by 192.201.2.58 to cloud network asset A should be higher than that of 192.201.2.58, but the average effect instead results in a value lower than 1.1.1.2; when using the high quantile scheme, the calculated 90% quantile risk value of 192.201.2.58 is 83.61, which is higher than 73.96 of 192.201.2.58, and the calculation result is more reasonable.

[0147] When the external attack IP is used as the evaluation object, the calculation method is the same as that when the cloud network assets are used as the evaluation object. For example, Figure 6 As shown, the risk values are aggregated based on the external attack IP-cloud network assets at the high quantile on the basis of the alarm risk, which will not be elaborated here.

[0148] (2) Asset external connection refers to the situation where the access source is cloud network assets and the accessed source is an external attacker.

[0149] The calculation method of aggregating the risk values of cloud network assets and external attack IPs is the same as that of the external threat scenario. For example, Figure 7 As shown, the risk aggregation analysis of the external attack IP and cloud network assets and the cloud network assets and external attack IPs is carried out.

[0150] (3) Lateral movement refers to the situation where the attack source is cloud network assets and the attacked source is also cloud network assets. Therefore, in this case, there is only an aggregation analysis of the risks of cloud network assets.

[0151] The calculation method is the same as that of external threats. The difference is that there is only an asset-asset aggregation analysis, but only the aggregation calculation is carried out for cloud network assets (attacker)-cloud network assets (attacked), that is, the final focus is on analyzing the risks suffered by cloud network assets (attacked). The risks in the direction of cloud network assets (attacked)-cloud network assets (attacker) do not need to be aggregated and analyzed anymore, because before the lateral movement, the risks suffered by cloud network assets (attacker) have been reflected in the external threats. The overall calculation process is as Figure 8 shown.

[0152] (4) Aggregate the phased risk values calculated in the previous three situations of external threats, lateral movement and asset external connection, and then conduct subsequent risk aggregation analysis to form the total risks of the final external attack IP and cloud network assets.

[0153] In the specific implementation process of this application, since the impact of high-risk events has been fully considered through high quantiles in the previous round of risk aggregation, when conducting subsequent aggregation, the average method can be directly considered for aggregation.

[0154] Regarding the asset risks, it involves aggregating the asset risk values of external threats, lateral movement and asset external connection in the previous step, and based on this, obtaining the final total risk. The calculation formula is as follows:

[0155] ; where is the first aggregation result; is the second aggregation result; is the third aggregation result.

[0156] Exemplarily, the specific calculation process can be referred to Figure 9 .

[0157] The calculation method of the total risk of external attack IPs is similarly as follows. It involves aggregating the IP risk values of external threats and external connections of assets in the previous step, and based on this, obtaining the final IP risk value. The calculation formula is as follows:

[0158] ; where is the fourth aggregation result; is the fifth aggregation result.

[0159] Exemplarily, the specific calculation process can refer to Figure 10 .

[0160] In the specific implementation process of this application, another great benefit of the associated fusion analysis of the risks of cloud network assets and external attack IPs is that when the risk assessment values of cloud network assets or external attack IPs are finally obtained, specific traceability analysis can be carried out. Since the risks of external attack IPs and cloud network assets are continuously aggregated from the risks of the finest-grained single alarm events, they can all be traced back. That is, the risk assessment of assets mainly comes from the aggregation of the risk values of external attack IPs that pose risks and hazards to the assets. Therefore, the asset risk can be traced back to the risk of each corresponding external attack IP, and the risk values can be sorted from high to low to focus on key threat objects; vice versa, the risk traceability of external attack IPs is the same.

[0161] As can be seen from the above solution, this application provides a network security risk assessment method. First, according to the received alarm events, the risk factors of the alarm events are determined; then, for each risk factor of the alarm events, the risk factors are normalized to obtain the initial risk values of the risk factors; after that, according to all the alarm events and the risk factors of the alarm events, the weight of each risk factor of each alarm event is determined; then, according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event, the risk value of the alarm event is determined; finally, according to the risk values of all the alarm events, an aggregation analysis is carried out to obtain the total risk of cloud network assets and the total risk of external attack IPs. Thus, a comprehensive and accurate risk assessment of network security is carried out.

[0162] This application embodiment provides a network security risk assessment device, as shown in Figure 11 and specifically includes:

[0163] A risk factor determination unit 1101, configured to determine the risk factors of the alarm events according to the received alarm events.

[0164] A normalization unit 1102, configured to normalize each risk factor of the alarm events to obtain the initial risk values of the risk factors.

[0165] Optionally, in another embodiment of the present application, an implementation manner of the normalization unit 1102 includes:

[0166] A normalization processing unit, configured to perform normalization processing on each index value in the risk factors for each risk factor of the alarm event to obtain normalized index values;

[0167] A calculation unit, configured to calculate an initial risk value of the risk factor according to all the normalized index values in the risk factor.

[0168] For the specific working process of the unit disclosed in the above embodiment of the present application, reference may be made to the corresponding method embodiment content, which will not be elaborated here.

[0169] A weight determination unit 1103, configured to determine the weight of each risk factor of each alarm event according to all the alarm events and the risk factors of the alarm events.

[0170] Optionally, in another embodiment of the present application, an implementation manner of the weight determination unit 1103 includes:

[0171] A risk sequence generation unit, configured to generate a risk sequence according to all the alarm events and the risk factors of the alarm events.

[0172] A risk sequence processing unit, configured to determine a mother sequence and a child sequence according to the risk sequence.

[0173] A difference matrix generation unit, configured to generate a difference matrix according to the mother sequence and the child sequence.

[0174] A correlation degree matrix generation unit, configured to generate a correlation degree matrix according to the two-level maximum difference, the two-level minimum difference, the resolution coefficient, and the difference matrix.

[0175] Wherein, the two-level maximum difference is the maximum value in the difference matrix, and the two-level minimum difference is the minimum value in the difference matrix.

[0176] A grey correlation degree determination unit, configured to determine the grey correlation degree of each risk factor according to the correlation degree matrix.

[0177] A weight determination subunit, configured to determine the weight of the risk factor according to the grey correlation degree of the risk factor.

[0178] For the specific working process of the unit disclosed in the above embodiment of the present application, reference may be made to the corresponding method embodiment content, as Figure 3 shown, which will not be elaborated here.

[0179] A risk value determination unit 1104, configured to determine the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event.

[0180] Optionally, in another embodiment of the present application, an implementation manner of the risk value determination unit 1104 includes:

[0181] The first risk value determination subunit is configured to, for each risk factor in the alarm event, use the product of the initial risk value of the risk factor and the weight corresponding to the risk factor as the target risk value of the risk factor.

[0182] The second risk value determination subunit is configured to determine the risk value of the alarm event according to the target risk values of all risk factors.

[0183] For the specific working process of the unit disclosed in the above embodiment of the present application, reference can be made to the corresponding method embodiment content, which will not be elaborated here.

[0184] The aggregation analysis unit 1105 is configured to perform aggregation analysis according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs.

[0185] For the specific working process of the unit disclosed in the above embodiment of the present application, reference can be made to the corresponding method embodiment content, as Figure 1 shown, which will not be elaborated here.

[0186] Optionally, in another embodiment of the present application, an implementation manner of the aggregation analysis unit 1105 includes:

[0187] The first aggregation subunit is configured to take cloud network assets as the evaluation object, and perform aggregation calculations respectively for the external threat situation, lateral movement situation, and asset external connection situation according to the risk values of all alarm events to obtain a first aggregation result, a second aggregation result, and a third aggregation result.

[0188] The first total risk determination unit is configured to determine the total risk of cloud network assets according to the first aggregation result, the second aggregation result, and the third aggregation result.

[0189] The second aggregation subunit is configured to take the external attack IP as the evaluation object, and perform aggregation calculations respectively for the external threat situation and the asset external connection situation according to the risk values of all alarm events to obtain a fourth aggregation result and a fifth aggregation result.

[0190] The second total risk determination unit is configured to determine the total risk of the external attack IP according to the fourth aggregation result and the fifth aggregation result.

[0191] For the specific working process of the unit disclosed in the above embodiment of the present application, reference can be made to the corresponding method embodiment content, which will not be elaborated here.

[0192] As can be seen from the above solution, the present application provides a network security risk assessment device. First, the risk factor determination unit 1101 determines the risk factors of the alarm event according to the received alarm event. Then, the normalization unit 1102 performs normalization processing on each risk factor of the alarm event to obtain the initial risk value of the risk factor. After that, the weight determination unit 1103 determines the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm event. The risk value determination unit 1104 determines the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event. Finally, the aggregation analysis unit 1105 performs aggregation analysis according to the risk values of all alarm events to obtain the total risk of the cloud network assets and the total risk of the external attack IPs. Thus, a comprehensive and accurate risk assessment of network security is carried out.

[0193] The functions described above in this article can be performed at least in part by one or more hardware logic components. For example, without limitation, the exemplary types of hardware logic components that can be used include: Field Programmable Gate Array (FPGA), Application Specific Integrated Circuit (ASIC), Application Specific Standard Product (ASSP), System on Chip (SOC), Complex Programmable Logic Device (CPLD), and so on.

[0194] Another embodiment of the present application provides an electronic device, as Figure 12 shown, including:

[0195] One or more processors 1201.

[0196] A storage device 1202, on which one or more programs are stored.

[0197] When the one or more programs are executed by the one or more processors 1201, the one or more processors 1201 are caused to implement the network security risk assessment method as described in the above embodiment.

[0198] Another embodiment of the present application provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the network security risk assessment method as described in the above embodiment is implemented.

[0199] In the context of the present application, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media would include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0200] It should be noted that the computer-readable medium described above in the present application can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any combination of the foregoing. More specific examples of a computer-readable storage medium can include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In the present application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. And in the present application, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium can be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.

[0201] The above computer-readable medium can be included in the above electronic device; or it can exist separately without being assembled into the electronic device.

[0202] Another embodiment of the present application provides a computer program product which, when executed, is used to perform the above-mentioned network security risk assessment method.

[0203] Specifically, according to the embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, an embodiment of the present application includes a computer program product that includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program codes for performing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, it performs the above-mentioned functions defined in the methods of the embodiments of the present application.

[0204] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in this application is not necessarily limited to the specific features or acts described above. On the contrary, the specific features and acts described above are merely example forms of implementing this application.

[0205] Although a number of specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of separate embodiments can also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment can also be implemented separately or in any suitable sub-combination in multiple embodiments.

[0206] The above description is only a preferred embodiment of the present application and an explanation of the technical principles applied. Those skilled in the art should understand that the scope of the application involved in this application is not limited to the technical solutions formed by the specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above application concept. For example, the technical solutions formed by mutually replacing the above features with the technical features (but not limited to) having similar functions applied in this application.

Claims

1. A network security risk assessment method, characterized in that, Including: Determine the risk factors of the alarm event according to the received alarm event; For each risk factor of the alarm event, perform normalization processing on the risk factor to obtain the initial risk value of the risk factor; Determine the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm events; Determine the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event; Perform aggregation analysis according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs.

2. The network security risk assessment method according to claim 1, wherein The step of, for each risk factor of the alarm event, performing normalization processing on the risk factor to obtain the initial risk value of the risk factor includes: For each risk factor of the alarm event, perform normalization processing on each index value in the risk factor to obtain the normalized index value; Calculate the initial risk value of the risk factor according to all the normalized index values in the risk factor.

3. The network security risk assessment method according to claim 1, wherein The step of determining the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm events includes: Generate a risk sequence according to all alarm events and the risk factors of the alarm events; Determine the mother sequence and the child sequence according to the risk sequence; Generate a difference matrix according to the mother sequence and the child sequence; Generate a correlation degree matrix according to the two-level maximum difference, the two-level minimum difference, the discrimination coefficient, and the difference matrix; wherein, the two-level maximum difference is the maximum value in the difference matrix, and the two-level minimum difference is the minimum value in the difference matrix; Determine the grey correlation degree of each risk factor according to the correlation degree matrix; Determine the weight of the risk factor according to the grey correlation degree of the risk factor.

4. The network security risk assessment method according to claim 1, characterized in that The step of determining the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event includes: For each risk factor in the alarm event, take the product of the initial risk value of the risk factor and the weight corresponding to the risk factor as the target risk value of the risk factor; Determine the risk value of the alarm event according to the target risk values of all risk factors.

5. The network security risk assessment method according to claim 1, wherein The step of performing aggregation analysis according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs includes: Taking cloud network assets as the evaluation object, perform aggregation calculations respectively for the external threat situation, the lateral movement situation, and the asset external connection situation according to the risk values of all alarm events to obtain the first aggregation result, the second aggregation result, and the third aggregation result; Determine the total risk of cloud network assets according to the first aggregation result, the second aggregation result, and the third aggregation result; Taking the external attack IP as the evaluation object, perform aggregation calculations respectively for the external threat situation and the asset external connection situation according to the risk values of all alarm events to obtain the fourth aggregation result and the fifth aggregation result; Determine the total risk of the external attack IP according to the fourth aggregation result and the fifth aggregation result.

6. A network security risk assessment device, characterized in that, Including: A risk factor determination unit, configured to determine the risk factors of the alarm event according to the received alarm event; A normalization unit for normalizing each risk factor of the alarm event to obtain an initial risk value of the risk factor; A weight determination unit for determining the weight of each risk factor of each alarm event according to all alarm events and the risk factors of the alarm events; A risk value determination unit for determining the risk value of the alarm event according to the initial risk value of the risk factor of the alarm event and the weight of the risk factor of the alarm event; An aggregation analysis unit for performing aggregation analysis according to the risk values of all alarm events to obtain the total risk of cloud network assets and the total risk of external attack IPs.

7. The network security risk assessment device according to claim 6, wherein The normalization unit includes: A normalization processing unit for normalizing each index value in each risk factor of the alarm event to obtain a normalized index value; A calculation unit for calculating the initial risk value of the risk factor according to all the normalized index values in the risk factor.

8. The network security risk assessment device according to claim 6, wherein The weight determination unit includes: A risk sequence generation unit for generating a risk sequence according to all alarm events and the risk factors of the alarm events; A risk sequence processing unit for determining a mother sequence and a child sequence according to the risk sequence; A difference matrix generation unit for generating a difference matrix according to the mother sequence and the child sequence; A correlation degree matrix generation unit for generating a correlation degree matrix according to the two-level maximum difference, the two-level minimum difference, the resolution coefficient, and the difference matrix; wherein, the two-level maximum difference is the maximum value in the difference matrix, and the two-level minimum difference is the minimum value in the difference matrix; A grey correlation degree determination unit for determining the grey correlation degree of each risk factor according to the correlation degree matrix; A weight determination subunit for determining the weight of the risk factor according to the grey correlation degree of the risk factor.

9. The network security risk assessment device according to claim 6, wherein The risk value determination unit includes: A first risk value determination subunit for taking the product of the initial risk value of each risk factor in the alarm event and the weight corresponding to the risk factor as the target risk value of the risk factor for each risk factor in the alarm event; A second risk value determination subunit for determining the risk value of the alarm event according to the target risk values of all risk factors.

10. The network security risk assessment device according to claim 6, characterized in that, The aggregation analysis unit includes: A first aggregation subunit for taking cloud network assets as the evaluation object and performing aggregation calculations respectively for the external threat situation, the lateral movement situation, and the asset external connection situation according to the risk values of all alarm events to obtain a first aggregation result, a second aggregation result, and a third aggregation result; A first total risk determination unit for determining the total risk of cloud network assets according to the first aggregation result, the second aggregation result, and the third aggregation result; A second aggregation subunit for taking the external attack IP as the evaluation object and performing aggregation calculations respectively for the external threat situation and the asset external connection situation according to the risk values of all alarm events to obtain a fourth aggregation result and a fifth aggregation result; A second total risk determination unit for determining the total risk of the external attack IP according to the fourth aggregation result and the fifth aggregation result.

Images