Intelligent data security exposure surface risk assessment method, system, device and medium

Abstract

This invention provides an intelligent data security exposure surface risk assessment method, system, device, and medium, relating to the field of information security technology. The method includes: constructing an exposure surface asset map using an asset fingerprinting engine and calculating an asset exposure index; building a vulnerability knowledge base to identify potential vulnerabilities; calculating the trigger probability of potential vulnerabilities as a dynamic vulnerability score based on standard vulnerability scores, the activity level of vulnerability exploitation tools, and the frequency of attack events within a set time period; obtaining the frequency of malicious IP access and the matching degree of leaked records through firewall logs and dark web monitoring data, and calculating a threat intelligence factor; combining the asset exposure index, dynamic vulnerability score, and threat intelligence factor to calculate the exposure surface risk value; and calculating the residual risk value based on a time decay model, according to the exposure surface risk value and business impact factors, to obtain the exposure surface risk assessment result. This invention further improves the accuracy of risk assessment through multi-dimensional data fusion.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to an intelligent data security exposure surface risk assessment method, system, device, and medium based on multidimensional dynamic analysis. Background Technology

[0002] GB / T45577-2025, "Data Security Technology - Data Security Risk Assessment Methods," breaks away from a single technical perspective, emphasizing risk assessment across the entire data lifecycle, including collection, storage, use, sharing, and destruction. It focuses on analyzing the security attributes (confidentiality, integrity, availability, and processing rationality) of data security processing activities at each stage, identifying the legitimacy and technical vulnerabilities of threatening data processing. While it places greater emphasis on general data lifecycle risk assessment, it does not fully address issues such as identifying which data assets, which attack techniques, and how attacks are being launched.

[0003] While the standard proposes a dual-dimensional assessment of "scenario + elements," it focuses on identifying risk scenarios based on business types, such as cross-border transmission and government data, and lacks an assessment approach that considers more granular risk scenarios that trigger attacks, thus failing to identify subsequent improvements in technology and management measures. The assessment elements cover four dimensions: data assets, processing activities, security measures, and threat sources, currently filling a standard gap in the field of data security risk assessment. However, it does not incorporate automated risk assessment technology. To address the deepening development of the data element market, automated risk assessment technologies and devices are needed to meet the dynamic security challenges of massive data scenarios.

[0004] The existing assessment methodology and process for GB / T45577-2025 is as follows: 1. Preparation phase: Define objectives and scope, and establish a cross-departmental team; 2. Research and analysis: Compile a data asset list and a processing activity map; 3. Risk identification: Identify high-risk links through threat database and vulnerability analysis; 4. Evaluation and handling: Use quantitative / qualitative methods to classify risk levels and formulate rectification strategies.

[0005] The technology has the following shortcomings: 1. It has not fully considered the full-element characteristics of data security risk assessment, ignoring the role of assets, business, and results in actual production, and has not considered the comparison between risks, nor has it established a comprehensive, dynamically updated risk assessment correlation analysis mechanism; 2. In the process of identifying assets, the methods and means of collection through automated technology are not clearly defined; 3. The impact of the subjective work experience of the assessors on the risk assessment conclusions has not been considered; 4. Real-time matching of vulnerability risks has not been performed, and a unified identification method has not been implemented for information such as configuration errors; 5. It lacks the ability to integrate threat intelligence with risk judgment, malicious IP access, and data leakage records, resulting in a disconnect between risk assessment and actual threats; 6. It has not considered the effectiveness of remediation measures based on time factors, and cannot dynamically respond to changes in risks. Summary of the Invention

[0006] In view of this, embodiments of this application provide a method, system, device, and medium for intelligent data security exposure risk assessment, which further improves the accuracy of risk assessment through multi-dimensional data fusion.

[0007] This application provides the following technical solution: a method for intelligent data security exposure surface risk assessment based on multidimensional dynamic analysis, including:

[0008] An asset exposure map is constructed using an asset fingerprinting engine, and the asset exposure index (AEI) is calculated.

[0009] A vulnerability knowledge base is constructed, and the system features obtained during system scanning are matched with the vulnerability features in the vulnerability knowledge base in real time to identify potential vulnerabilities. Based on standard vulnerability scores, the activity of vulnerability exploitation tools, and the frequency of attack events within a set time period, the trigger probability of the potential vulnerabilities is calculated, and the trigger probability is used as the dynamic vulnerability score (DVS).

[0010] By obtaining malicious IP access frequencies from firewall logs and acquiring dark web monitoring data, the similarity calculation of leaked data from the dark web with the company's own asset information is performed to obtain the matching degree of the leaked records; based on the malicious IP access frequencies and the matching degree of the leaked records, the threat intelligence factor T is calculated. k ;

[0011] Combining the Asset Exposure Index (AEI), the Dynamic Vulnerability Score (DVS), and the Threat Intelligence Factor (T) k Calculate the exposure risk value (ERR);

[0012] Based on the time decay model, the residual risk value RRR is calculated according to the exposure surface risk value ERR and the business impact factor BIF to obtain the exposure surface risk assessment result.

[0013] According to one embodiment of this application, constructing an exposure surface asset map using an asset fingerprint recognition engine includes:

[0014] By using distributed crawling and natural language processing technologies, the system scans enterprise network boundary assets, identifies asset information in API ports, cloud storage buckets, database instances, and network code repositories, generates an asset fingerprint database, and obtains the exposed surface asset map.

[0015] According to one embodiment of this application, calculating the Asset Exposure Index (AEI) includes:

[0016] Based on the sensitivity of enterprise data assets, asset importance is graded and assigned values, and asset type weighting coefficients are predefined according to asset type; the Asset Exposure Index (AEI) is calculated using the following formula:

[0017]

[0018] Among them, C i The value assigned to W indicates the importance of the asset. type S represents the asset type weighting coefficient. total T represents the total assets. update This indicates the asset update frequency, and n represents the level of asset importance.

[0019] According to one embodiment of this application, the dynamic vulnerability score DVS is calculated using the following formula:

[0020]

[0021] in, Indicates standard vulnerability scoring. Indicates the activity level of exploit tools. This indicates the frequency of attack events within a specified time period.

[0022] According to one embodiment of this application, the threat intelligence factor T is calculated using the following formula. k :

[0023]

[0024] in, Indicates the frequency of malicious IP access. This indicates the degree of matching of the leaked records.

[0025] According to one embodiment of this application, the exposure surface risk value (ERR) is calculated using the following formula:

[0026]

[0027] Wherein, AEI is the asset exposure index, DVS is the dynamic vulnerability score, and T... kdenoted as threat intelligence factor, m as the number of threat indicators, and k as the range of values ​​for the threat intelligence factor.

[0028] According to one embodiment of this application, the residual risk value RRR is calculated using the following formula:

[0029]

[0030] Where ERR is the exposure risk value, BIF is the business impact factor, t is the time for risk detection, and λ is the dynamic risk decay rate coefficient.

[0031] According to one embodiment of this application, the dynamic risk decay rate coefficient λ is calculated using the following formula:

[0032]

[0033] in, Based on the attenuation rate, This is the learning rate coefficient. This refers to the actual time it took to fix the vulnerability. The timeframe for the planned vulnerability fix.

[0034] According to one embodiment of this application, the method further includes: triggering automated safety measures when the residual risk value RRR exceeds a set threshold θ.

[0035] This application also provides an intelligent data security exposure surface risk assessment system based on multidimensional dynamic analysis, including:

[0036] The asset identification module is used to construct an exposure surface asset map through an asset fingerprint recognition engine and calculate the asset exposure index (AEI).

[0037] The vulnerability analysis module is used to build a vulnerability knowledge base. It matches the system features obtained during system scanning with the vulnerability features in the vulnerability knowledge base in real time to identify potential vulnerabilities. Based on the standard vulnerability score, the activity of vulnerability exploitation tools, and the frequency of attack events within a set time period, it calculates the trigger probability of the potential vulnerability and uses the trigger probability as the dynamic vulnerability score (DVS).

[0038] The threat modeling module is used to obtain malicious IP access frequency through firewall logs, acquire dark web monitoring data, calculate the similarity between leaked data from the dark web and the enterprise's own asset information to obtain the leak record matching degree; based on the malicious IP access frequency and the leak record matching degree, the threat intelligence factor T is calculated. k ;

[0039] The risk quantification module is used to combine the Asset Exposure Index (AEI), the Dynamic Vulnerability Score (DVS), and the Threat Intelligence Factor (T). kCalculate the exposure risk value (ERR);

[0040] The risk assessment module is used to calculate the residual risk value RRR based on the exposure surface risk value ERR and the business impact factor BIF, using a time decay model, to obtain the exposure surface risk assessment result.

[0041] This application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described intelligent data security exposure surface risk assessment method.

[0042] This application also provides a computer-readable storage medium storing a computer program that performs the above-described intelligent data security exposure surface risk assessment method.

[0043] Compared with traditional methods, the beneficial effects that at least one of the technical solutions adopted in the embodiments of this specification can achieve include at least the following:

[0044] (1) The embodiments of the present invention calculate the asset exposure index. It replaces traditional static asset scoring and pays more attention to the asset exposure index as it is updated. The dynamic changes transform the time dimension into a mathematically computable quantity, thus improving the technical pain point of risk lag caused by traditional static weights.

[0045] (2) In this embodiment of the invention, threat intelligence factors are calculated by integrating a threat intelligence engine. It connects internal and external data in real time. When a malicious IP attack is detected, the threat factor is updated quickly. For example, when dark web data is matched, the impact of historical risk is quantified by matching the leaked records.

[0046] (3) The embodiments of the present invention introduce attenuation control, which is dynamically adjusted by the dynamic risk attenuation rate coefficient λ. If the actual repair time is too long, the risk attenuation rate can be automatically reduced. This solves the technical difficulty of the original technology's inability to measure repair efficiency and realizes the physical simulation of risk attenuation for the first time.

[0047] (4) The embodiments of the present invention further improve the accuracy of the assessment by introducing the asset dimension AEI, the vulnerability dimension DVS, and the threat intelligence factor T. k The accuracy of the assessment is improved by integrating multi-dimensional data.

[0048] The embodiments of the present invention realize real-time dynamic assessment of data security risks, eliminating the response lag caused by static weights; constructing a multi-dimensional fusion model to quantify residual risks; and reducing the cost of manual intervention through automated closed-loop processing. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a schematic diagram of the intelligent data security exposure surface risk assessment method of the present invention;

[0051] Figure 2 This is a first schematic diagram of the risk assessment process according to an embodiment of the present invention;

[0052] Figure 3 This is a second schematic diagram of the risk assessment process according to an embodiment of the present invention;

[0053] Figure 4 This is a schematic diagram of the risk attenuation model according to an embodiment of the present invention;

[0054] Figure 5 This is a system interaction diagram during the execution of an embodiment of the present invention;

[0055] Figure 6 This is a schematic diagram of the risk assessment system according to the first embodiment of the present invention;

[0056] Figure 7 This is a schematic diagram of the risk assessment system according to the second embodiment of the present invention;

[0057] Figure 8 This is a schematic diagram of the structure of the computer device of the present invention. Detailed Implementation

[0058] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0059] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0060] like Figure 1As shown, this embodiment of the invention provides a method for intelligent data security exposure surface risk assessment based on multidimensional dynamic analysis, including:

[0061] S101. Construct an exposure surface asset map using an asset fingerprinting engine and calculate the asset exposure index (AEI);

[0062] S102. Construct a vulnerability knowledge base, match the system features obtained during system scanning with the vulnerability features in the vulnerability knowledge base in real time to identify potential vulnerabilities; calculate the trigger probability of the potential vulnerability based on standard vulnerability scores, the activity of vulnerability exploitation tools and the frequency of attack events within a set time period, and use the trigger probability as the dynamic vulnerability score (DVS).

[0063] S103. Obtain the malicious IP access frequency through firewall logs, acquire dark web monitoring data, calculate the similarity between the leaked data in the dark web and the enterprise's own asset information to obtain the leak record matching degree; based on the malicious IP access frequency and the leak record matching degree, calculate the threat intelligence factor T. k ;

[0064] S104. Combining the Asset Exposure Index (AEI), the Dynamic Vulnerability Score (DVS), and the Threat Intelligence Factor (T) k Calculate the exposure risk value (ERR);

[0065] S105. Based on the time decay model, calculate the residual risk value RRR according to the exposure surface risk value ERR and the business impact factor BIF to obtain the exposure surface risk assessment result.

[0066] This invention proposes an intelligent data security exposure surface risk assessment method based on multi-dimensional dynamic analysis. First, an exposure surface asset map is constructed using an asset fingerprinting engine. Then, a dynamic weighting algorithm is used to calculate the asset exposure index (AEI) and a dynamic vulnerability score. Combined with real-time threat intelligence, an exposure surface risk value (ERR) is generated, and a residual risk value (RRR) is output based on a time decay function. Traditional assessment methods are static, primarily using static weights, such as the fixed score in CVSS (Common Vulnerability Scoring System), lacking time decay correction technology. Furthermore, in traditional solutions, scanning, analysis, and remediation are independent processes. This invention introduces an asset update frequency T. update Reflecting the asset renewal frequency factor, introducing By reflecting the progress of quantitative risk remediation and introducing the Business Impact Factor (BIF) which is bound to data classification and grading, the method of this invention can dynamically update risk scores, realize real-time dynamic assessment of data security risks, intuitively display attack vectors through risk path diagrams, eliminate response lag caused by static weights, and improve assessment accuracy.

[0067] This invention integrates the three traditional factors of asset update frequency, business data value, and repair time decay effect into a dynamic risk assessment framework through mathematical modeling, thus solving the alarm fatigue problem caused by continuously inflated risk values ​​in traditional solutions.

[0068] According to a specific embodiment of the present invention, such as Figures 2-3 As shown, the intelligent data security exposure surface risk assessment method based on multidimensional dynamic analysis in this embodiment includes the following steps:

[0069] S101. Initiate an assessment task, using distributed crawler technology to scan the enterprise's network boundary assets (IP / domain name), identify API ports, cloud storage buckets, and database instances, and generate an asset fingerprint database. Simultaneously, utilize Natural Language Processing (NLP) to identify sensitive data (such as database credentials and API keys) and other asset information in the code repository, ultimately obtaining the aforementioned exposure surface asset map.

[0070] S102. Calculate the AEI value using the Asset Exposure Index formula, and assign asset importance values ​​based on the number of assets identified in step S101 above. The importance can be tiered according to the sensitivity of the data assets carrying the enterprise, with five levels of importance:

[0071] a. Data carriers that carry corporate financial data, business financial interaction data, and other data with financial attributes can be defined as Level 5 most important data assets;

[0072] b. Data assets that carry core corporate assets are classified as Level 4 highly sensitive data assets if leaked, as such data assets may cause significant economic losses or legal risks.

[0073] c. Data assets that carry personal privacy or critical business information and require strict protection measures, typically requiring encrypted storage or operation log recording, are defined as Level 3 sensitive data assets.

[0074] d. Data that is limited to internal organizational use and typically includes non-sensitive data assets generated during daily operations, and whose access is restricted through access control, is defined as internal data asset level 2;

[0075] e. Data carriers that are open to the public, do not involve any sensitive information or confidentiality requirements, and are often used for brand promotion or information disclosure are defined as Level 1 public data assets.

[0076] After defining and classifying the importance of the assets, a predefined weight is applied to each asset type. Based on the relevant importance level, i.e., the weight coefficient, the total asset amount S identified in step S101 above is then used to determine the asset type. total and asset update frequency T update Calculate the Asset Exposure Index (AEI). The Asset Exposure Index (AEI) is calculated using the following formula:

[0077]

[0078] Among them, C i The value assigned to indicate the importance of the asset ranges from 1 to 5 (the specific value is subjectively defined based on experience), W type S represents the predefined asset type weighting coefficient. total T represents the total assets. update This represents the asset update frequency (times / day, dynamic value), n represents the order of asset importance, and log represents the logarithmic function with base e. S103. By integrating mainstream vulnerability libraries CNVD / CNNVD / CVE, a vulnerability knowledge base is built, thereby enabling a feature-matching scanning method for data assets. By establishing a vulnerability feature library, the system features obtained during the scanning process are compared with the vulnerabilities in the feature library to identify potential corresponding vulnerabilities.

[0079] Most mainstream vulnerability databases typically score vulnerabilities according to the CVSS standard. In this embodiment of the invention, an AI-based vulnerability exploitation tool activity index is incorporated. exp Adjustments were made to further match the probability of vulnerabilities being triggered based on static scoring, while also introducing the attack time frequency P over the past 30 days. active This involves inferring the probability of potential vulnerability attacks, establishing a probabilistic threat model, and calculating a dynamic vulnerability score by real-time matching with a vulnerability database. The dynamic vulnerability score (DVS) is calculated using the following formula:

[0080]

[0081] in, This represents the standard vulnerability score, ranging from 0 to 10. Indicates the activity level of the exploit tool, an integer ranging from 0 to 10. This represents the frequency of attack events in the past 30 days, taking integers ≥ 0. This is a constant value, representing the normalization factor. In practice, CVSS is the base score for the general vulnerability score, and it is publicly available data; the activity level of tools exploiting vulnerabilities... Publicly available data on the internet; frequency of attack incidents Evidence was obtained through actual investigation and collection.

[0082] S104. Matching vulnerability risks with dynamic vulnerability scoring can eliminate security risks as much as possible, discover and fix security vulnerabilities as early as possible, and effectively utilize existing system resources to improve network operating efficiency. Due to the diversity of vulnerabilities and security risks, the remediation process may expose previously hidden vulnerability risks. Therefore, a holistic and overarching perspective is needed. To achieve an appropriate balance between tolerable risk levels and acceptable costs, this invention proposes an effective technology to improve network security risk remediation. This technology works in conjunction with firewalls to objectively assess risk levels, proactively identify vulnerability risks, and combine with passive firewall defense methods to form proactive and comprehensive technical measures. Threat intelligence factors are calculated by correlating dark web monitoring data with firewall logs. The threat intelligence factor T is calculated using the following formula. k :

[0083]

[0084] in, This indicates the frequency of malicious IP access, ranging from 0 to 1. This indicates the match rate of the leaked records, ranging from 0 to 1.

[0085] This embodiment uses automated methods to scan leaked data on the dark web and compares it with the enterprise's own asset information to quantify the likelihood of data asset leakage. This design, for the first time, transforms unstructured dark web data into quantifiable risk indicators. Through dynamic monitoring, it crawls multi-source data from the dark web in real time; then performs intelligent matching, fusing a three-dimensional similarity algorithm based on fields, structure, and context; finally, it links with threat intelligence factors to achieve automated response. This fundamentally changes the traditional, reactive approach of relying on manual traceability of leaks, achieving a closed loop from monitoring dark web threats, quantifying associated risks, to handling risks within seconds.

[0086] S105, combining the Asset Exposure Index (AEI) and Dynamic Vulnerability Score (DVS), introduces threat intelligence factors to construct threat correlation analysis. Risk is scaled by multiplying the Asset Exposure Index (AEI) by the Dynamic Vulnerability Score (DVS) to a threat amplification factor of 1, and then adding the average of standardized threat intelligence matching scores. This allows the construction of attack path topologies based on network topology and access relationships. The threat intelligence matching score quantifies the correlation between assets and known malicious indicators. The Exposure Surface Risk Value (ERR) is generated based on the following formula:

[0087]

[0088] Wherein, AEI is the Asset Exposure Index, DVS is the Dynamic Vulnerability Score, ranging from 0 to 10; T kis the threat intelligence factor, ranging from 0 to 1; m is the number of threat indicators, taking an integer greater than or equal to 1; k is the range of threat factor values, ranging from [0,1].

[0089] S106. The effectiveness of remedial measures is evaluated based on a time decay function. A Business Impact Factor (BIF), determined by data classification and grading, is introduced to quantify data value. A time decay model is applied to calculate the residual risk (RRR). When RRR(t) > threshold θ, automated processing is triggered. The residual risk value RRR(t) is calculated using the following formula:

[0090]

[0091] Where ERR is the exposure risk value, BIF is the business impact factor (determined according to data classification and grading), t is the time for risk detection, and λ is the dynamic risk decay rate coefficient.

[0092] The dynamic risk decay rate coefficient λ is calculated using the following formula:

[0093]

[0094] in, The base attenuation rate is 0.1 by default (configurable). The learning rate coefficient, 0 < ≤ 0.5, The actual time taken to fix the vulnerability is in days. The timeframe for the planned vulnerability fix is ​​in days.

[0095] like Figure 4 As shown, Figure 4 The risk attenuation model in this embodiment is shown. As can be seen from the figure, the initial risk is: at t=0, RRR(0)=ERR=100, "● indicates the initial risk value, which has not been attenuated"; the intermediate assessment is: that is, the attenuation process, the value calculated on day 7 is RRR(7)=48, "○ indicates the intermediate state of risk attenuation after the implementation of the remediation measures"; the residual risk is: the value calculated on day 30 is RRR(30)=5, "△ indicates the residual value of the long-term unremediated risk, which needs to be continuously monitored".

[0096] like Figure 5 As shown, Figure 5 A system interaction diagram illustrating the implementation of the method in this embodiment is shown. Specific steps include:

[0097] Step 1: The system initiates an evaluation request, corresponding to the Internet user interaction interface (REST API specification).

[0098] Step 2: The scanning engine employs hybrid scanning technology;

[0099] Step 3: Calculate and return the AEI value, which generates real-time quantitative data on asset exposure.

[0100] Step 4: Calculate the threat intelligence factor T k ;

[0101] Step 5: Return to T k Value, i.e., the weighted fusion result of threat intelligence;

[0102] Step 6: Calculate the ERR value and send an alarm value for dynamic threshold comparison (trigger response strategy when ERR>0);

[0103] Step 7: Match firewall rules to block high-risk IPs, and implement risk-based automated policies.

[0104] Introduced in the embodiments of the present invention Dynamic factors transform the time dimension into a mathematically computable quantity; Dynamic Vulnerability Score (DVS) merges with Exploitation Tool Activity AI. exp and attack time frequency P active Establish probabilistic threat modeling This invention achieves, for the first time, a physical simulation of risk attenuation. Simultaneously, it transforms abstract concepts such as assets, vulnerabilities, and threats into computable relationships, constructing a positive feedback loop of dynamic weighting, intelligence fusion, and attenuation control. This enables real-time updates of asset discovery, vulnerability scanning, and threat intelligence. The time attenuation function prevents persistently inflated risk values, reduces invalid alerts, improves assessment accuracy, and achieves closed-loop risk management.

[0105] like Figure 6 As shown, an intelligent data security exposure surface risk assessment system 200 based on multidimensional dynamic analysis includes:

[0106] Asset identification module 201 is used to construct an exposure surface asset map through an asset fingerprint recognition engine and calculate the asset exposure index (AEI).

[0107] The vulnerability analysis module 202 is used to build a vulnerability knowledge base, match the system features obtained during system scanning with the vulnerability features in the vulnerability knowledge base in real time, and identify potential vulnerabilities; and calculate the trigger probability of the potential vulnerability based on the standard vulnerability score, the activity of vulnerability exploitation tools and the frequency of attack events within a set time period, and use the trigger probability as the dynamic vulnerability score DVS.

[0108] Threat modeling module 203 is used to obtain malicious IP access frequency through firewall logs, acquire dark web monitoring data, calculate the similarity between leaked data from the dark web and the enterprise's own asset information to obtain the leak record matching degree; and calculate the threat intelligence factor T based on the malicious IP access frequency and the leak record matching degree. k ;

[0109] Risk quantification module 204 is used to combine the Asset Exposure Index (AEI), the Dynamic Vulnerability Score (DVS), and the Threat Intelligence Factor (T). k Calculate the exposure risk value (ERR);

[0110] The risk assessment module 205 is used to calculate the residual risk value RRR based on the exposure surface risk value ERR and the business impact factor BIF, according to the time decay model, and to obtain the exposure surface risk assessment result.

[0111] like Figure 7 As shown, in a specific implementation, this system also includes a response execution module 206, which is used to trigger automated safety handling when the residual risk value RRR exceeds a set threshold θ.

[0112] This invention proposes an intelligent data security exposure surface risk assessment system based on multi-dimensional dynamic analysis. In terms of technical design, it adopts a layered architecture: an asset identification layer (addressing "what data assets are exposed?"), a vulnerability analysis layer (addressing "where might be compromised?"), and a threat modeling layer (addressing "attacks using specific methods"). This approach not only conforms to the NIST framework but also provides deeper coverage of the entire lifecycle of user-identified exposure surfaces, assisting users in dynamically improving relevant security actions through a combination of technical and management methods. Essentially, it overturns the cyclical assessments dominated by human experience, achieving a shift towards "data-driven real-time risk navigation."

[0113] In one embodiment, a computer device is provided, such as Figure 8 As shown, it includes a memory 301, a processor 302, and a computer program stored on the memory 301 and executable on the processor 302. When the processor 302 executes the computer program, it implements the above-mentioned intelligent data security exposure surface risk assessment method based on multidimensional dynamic analysis.

[0114] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0115] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that performs the above-described intelligent data security exposure surface risk assessment method based on multidimensional dynamic analysis.

[0116] Specifically, computer-readable storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.

[0117] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

[0118] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for intelligent data security exposure surface risk assessment based on multidimensional dynamic analysis, characterized in that, include: An asset exposure map is constructed using an asset fingerprinting engine, and the asset exposure index (AEI) is calculated. A vulnerability knowledge base is constructed, and the system features obtained during system scanning are matched with the vulnerability features in the vulnerability knowledge base in real time to identify potential vulnerabilities. Based on standard vulnerability scores, the activity of vulnerability exploitation tools, and the frequency of attack events within a set time period, the trigger probability of the potential vulnerabilities is calculated, and the trigger probability is used as the dynamic vulnerability score (DVS). By obtaining the frequency of malicious IP access through firewall logs, acquiring dark web monitoring data, and calculating the similarity between the leaked data in the dark web and the company's own asset information, the matching degree of the leaked records can be obtained. Based on the frequency of malicious IP access and the matching degree of the leaked records, the threat intelligence factor T is calculated. k ; Combining the Asset Exposure Index (AEI), the Dynamic Vulnerability Score (DVS), and the Threat Intelligence Factor (T) k Calculate the exposure risk value (ERR); Based on the time decay model, the residual risk value RRR is calculated according to the exposure surface risk value ERR and the business impact factor BIF to obtain the exposure surface risk assessment result. The calculation of the Asset Exposure Index (AEI) includes: Based on the sensitivity of enterprise data assets, asset importance is graded and assigned values, and asset type weighting coefficients are predefined according to asset type; the Asset Exposure Index (AEI) is calculated using the following formula: Among them, C i The value assigned to W indicates the importance of the asset. type S represents the asset type weighting coefficient. total T represents the total assets. update This indicates the asset update frequency, and n represents the level of asset importance.

2. The intelligent data security exposure surface risk assessment method according to claim 1, characterized in that, Constructing an exposure surface asset map using an asset fingerprinting engine, including: By using distributed crawling and natural language processing technologies, the system scans enterprise network boundary assets, identifies asset information in API ports, cloud storage buckets, database instances, and network code repositories, generates an asset fingerprint database, and obtains the exposed surface asset map.

3. The intelligent data security exposure surface risk assessment method according to claim 1, characterized in that, The dynamic vulnerability score DVS is calculated using the following formula: in, Indicates standard vulnerability scoring. Indicates the activity level of exploit tools. This indicates the frequency of attack events within a specified time period.

4. The intelligent data security exposure surface risk assessment method according to claim 1, characterized in that, The threat intelligence factor T is calculated using the following formula. k : in, Indicates the frequency of malicious IP access. This indicates the degree of matching of the leaked records.

5. The intelligent data security exposure surface risk assessment method according to claim 1, characterized in that, The exposure risk value ERR is calculated using the following formula: Wherein, AEI is the asset exposure index, DVS is the dynamic vulnerability score, and T... k denoted as threat intelligence factor, m as the number of threat indicators, and k as the range of values ​​for the threat intelligence factor.

6. The intelligent data security exposure surface risk assessment method according to claim 1, characterized in that, The residual risk value RRR is calculated using the following formula: Where ERR is the exposure risk value, BIF is the business impact factor, t is the time for risk detection, and λ is the dynamic risk decay rate coefficient.

7. The intelligent data security exposure surface risk assessment method according to claim 6, characterized in that, The dynamic risk decay rate coefficient λ is calculated using the following formula: in, Based on the attenuation rate, This is the learning rate coefficient. This refers to the actual time it took to fix the vulnerability. The timeframe for the planned vulnerability fix.

8. The intelligent data security exposure surface risk assessment method according to claim 1, characterized in that, The method further includes triggering automated safety measures when the residual risk value RRR exceeds a set threshold θ.

9. A smart data security exposure surface risk assessment system based on multidimensional dynamic analysis, characterized in that, include: The asset identification module is used to construct an exposure surface asset map through an asset fingerprint recognition engine and calculate the asset exposure index (AEI). The vulnerability analysis module is used to build a vulnerability knowledge base. It matches the system features obtained during system scanning with the vulnerability features in the vulnerability knowledge base in real time to identify potential vulnerabilities. Based on the standard vulnerability score, the activity of vulnerability exploitation tools, and the frequency of attack events within a set time period, it calculates the trigger probability of the potential vulnerability and uses the trigger probability as the dynamic vulnerability score (DVS). The threat modeling module is used to obtain the frequency of malicious IP access through firewall logs, acquire dark web monitoring data, and calculate the similarity between the leaked data in the dark web and the enterprise's own asset information to obtain the matching degree of the leaked records. Based on the frequency of malicious IP access and the matching degree of the leaked records, the threat intelligence factor T is calculated. k ; The risk quantification module is used to combine the Asset Exposure Index (AEI), the Dynamic Vulnerability Score (DVS), and the Threat Intelligence Factor (T). k Calculate the exposure risk value (ERR); The risk assessment module is used to calculate the residual risk value RRR based on the exposure surface risk value ERR and the business impact factor BIF, using a time decay model, to obtain the exposure surface risk assessment result. The calculation of the Asset Exposure Index (AEI) includes: Based on the sensitivity of enterprise data assets, asset importance is graded and assigned values, and asset type weighting coefficients are predefined according to asset type; the Asset Exposure Index (AEI) is calculated using the following formula: Among them, C i The value assigned to W indicates the importance of the asset. type S represents the asset type weighting coefficient. total T represents the total assets. update This indicates the asset update frequency, and n represents the level of asset importance.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the intelligent data security exposure surface risk assessment method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the intelligent data security exposure surface risk assessment method according to any one of claims 1 to 8.

Images