Vulnerability risk assessment method based on network surveying and mapping

Abstract

The invention discloses a vulnerability risk assessment method based on network surveying and mapping, and belongs to the technical field of network security, and the assessment method comprises the following specific steps: (1) identifying all devices and services in a network, and drawing a network topological graph to classify and identify risk points and asset distribution in the network; (2) scanning all devices and services in the network, collecting vulnerability data, simulating different attack scenes and vulnerability utilization means, and verifying a scanning result; the method can adapt to different network environments and security requirements, improves the accuracy of vulnerability risk assessment, improves the diversity and refinement degree of vulnerability risk scoring, and enhances the policy decision support of vulnerability repair; transmission of sensitive data is avoided, privacy protection is enhanced, the vulnerability defense capability of the whole system is improved, the requirement for bandwidth and transmission delay are reduced, and the vulnerability response speed and repair efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability risk assessment method based on network mapping. Background Art

[0002] With the continuous development and application of network technologies, network security issues have become increasingly prominent. Vulnerability management and risk assessment have become key tasks in ensuring information system security. A vulnerability refers to a security flaw in network devices, application systems, or services that attackers can exploit to carry out malicious activities, such as data leakage, service disruption, or other forms of network attacks. The impact of a vulnerability depends not only on its severity but also on multiple factors, including its propagation path within the network, the difficulty of exploitation, and the criticality of the assets involved. Therefore, conducting a comprehensive risk assessment of network vulnerabilities to determine their severity and priority has become a core task in improving network security protection capabilities. Traditional vulnerability management methods often rely on static vulnerability scanning tools, ignoring the impact of factors such as network topology, device configuration, and asset relationships on vulnerability risk. In recent years, vulnerability risk assessment methods based on network mapping have gradually emerged. By dynamically mapping the network topology and analyzing the interactions between various devices and services within the network, they provide a more precise perspective for vulnerability risk assessment. This method can combine multi-dimensional data such as network structure, traffic information, device status, and vulnerability characteristics to conduct a comprehensive multi-factor assessment, providing strong support for vulnerability repair, mitigation measures, and security reinforcement; therefore, it is particularly important to invent a vulnerability risk assessment method based on network mapping.

[0003] After searching, Chinese patent number CN117473512A discloses a vulnerability risk assessment method based on network mapping. Although this invention can quickly generate a vulnerability risk assessment index, effectively analyze the global impact range and industry of the vulnerability, comprehensively assess the impact of the vulnerability on the network system security, and improve the efficiency of vulnerability security management, it cannot adapt to different network environments and security requirements, reduces the accuracy of vulnerability risk assessment, and has high limitations in vulnerability risk scoring. In addition, the existing vulnerability risk assessment method has poor privacy protection, reduces the vulnerability defense capability of the entire system, and has high bandwidth requirements and transmission delays. Therefore, we propose a vulnerability risk assessment method based on network mapping. Summary of the Invention

[0004] The purpose of the present invention is to solve the defects in the prior art and to propose a vulnerability risk assessment method based on network mapping.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] The vulnerability risk assessment method based on network mapping has the following specific steps:

[0007] (1) Identify all devices and services in the network and draw a network topology map to classify and identify risk points and asset distribution in the network;

[0008] (2) Scan all devices and services in the network, collect vulnerability data, and simulate different attack scenarios and vulnerability exploitation methods to verify the scan results;

[0009] (3) Conduct risk assessments on each set of vulnerability data based on the characteristics, impact scope, and severity of the vulnerability, and analyze the risk propagation of each vulnerability;

[0010] (4) Predict high-risk areas in the network and conduct distributed vulnerability collaborative defense based on each vulnerability risk.

[0011] As a further solution of the present invention, the specific steps of classifying and identifying risk points and asset distribution in the network in step (1) are as follows:

[0012] S1.1: Use network scanning tools to perform port scanning and service detection on the entire network. Obtain information about each device and service by identifying the open ports, services, and protocol types of the devices, generating a large amount of raw scan data. Duplicate device information is removed from each scan data, missing values ​​are filled, and outliers are processed. Finally, a corresponding network topology is constructed based on the device and service information on the network.

[0013] S1.2: Normalize each data set of different types and convert the normalized data into a pre-set format using one-hot encoding. Then, collect historical network data and assign corresponding ground truth labels to each set of historical network data. Preprocess each set of historical network data and divide it into training and validation sets.

[0014] S1.3: Build a classification and recognition model based on the MLP architecture, including an input layer, a hidden layer, and an output layer. The training set is then input into the classification and recognition model, which performs forward propagation on each data point in the training set. The input layer receives and passes the training data. The hidden layer then extracts and transforms features from each data set using the ReLU activation function. The output layer receives the output data from the hidden layer and outputs the predicted probability value for each category based on the requirements of the device classification task.

[0015] S1.4: Calculate the loss between the predicted probability value and the true label using the cross-entropy loss function. Starting from the output layer of the classification recognition model, the gradient of the loss value for each layer of the classification recognition model is calculated using the backpropagation algorithm. The model parameters are optimized using the Adam optimizer. After each round of training, the performance indicators of the classification recognition model are evaluated using the validation set. If the model loss value converges to the preset range, the training is stopped. Otherwise, the classification recognition model is repeatedly trained and verified until the preset number of iterations is reached.

[0016] S1.5: Input the latest scan data into the classification recognition model. The classification recognition model performs forward propagation on each set of scan data and classifies the devices into different types. Then, by comparing the device type, service, and database of known vulnerabilities, the model marks devices with higher security risks.

[0017] As a further solution of the present invention, the specific steps of simulating different attack scenarios and vulnerability exploitation methods and verifying the scan results in step (2) are as follows:

[0018] S2.1: Select the assets and high-risk devices identified in the network topology as attack targets. Based on the characteristics of the vulnerability, select attack methods such as remote code execution, privilege escalation, and denial of service. Then, use the attacker's attack path to simulate the attacker's behavior in the network to construct the corresponding attack scenario.

[0019] S2.2: After the attack scenario is constructed, simulate the vulnerability exploitation attack. When the initial privilege level is low, simulate the attacker using the privilege escalation vulnerability to elevate their own privileges. Based on the acquired privileges, simulate the attacker further attacking other devices in the network, expanding the attack surface.

[0020] S2.3: Collect vulnerability information generated by the simulated attack, compare it with the vulnerability risk list provided by the vulnerability scanning tool, and verify whether the scanning tool has missed any network vulnerabilities, attack paths, and risk points. If so, record the missing data in the vulnerability risk list and update the local database information of the vulnerability scanning tool.

[0021] As a further solution of the present invention, the specific steps of performing risk assessment on each set of vulnerability data in step (3) are as follows:

[0022] S3.1: Establish a vulnerability risk scoring model based on the severity, scope, difficulty of exploitation, and exploitability of the network vulnerability. Based on the weights of each factor in the risk scoring model, construct a corresponding weight space. Initialize a population in the weight space, where each individual in the population represents a set of weight configurations.

[0023] S3.2: Input the weight configuration of each individual, the actual risk score of the vulnerability, and the priority label into the risk scoring model. The fitness value of the risk scoring model is calculated using the MSE function. The individual with the highest fitness value in the population is then selected as the leader.

[0024] S3.3: The remaining individuals in the population update their positions based on the leader's position in the weight space, adjusting their own weight configurations. They then repeatedly perform risk scoring model testing, fitness value calculation, leader update, and individual position adjustment.

[0025] S3.4: When the leader's fitness value converges to the preset threshold after multiple iterations, the iteration is stopped, and the weight configuration of the individual with the highest fitness value in the current population is output as the optimal configuration of the risk scoring model. Then, the detected vulnerability information of each group is input into the risk scoring model and the score of each vulnerability risk is output, and priority is sorted according to the score.

[0026] As a further solution of the present invention, the specific scoring formula of the risk scoring model described in S3.1 is as follows:

[0027] R=w1·S+w2·I+w3·D+w4·A

[0028] In the formula, R represents the total risk score of the vulnerability; S represents the severity score of the vulnerability; I represents the impact score of the vulnerability; D represents the difficulty score of exploiting the vulnerability; A represents the exploitability score of the vulnerability; w1, w2, w3 and w4 represent the weights of different factors;

[0029] The specific calculation formula of the MSE function described in S3.2 is as follows:

[0030]

[0031] In the formula, F(wolf i ) represents the fitness of the i-th group of individuals; M represents the number of vulnerability samples; R j represents the actual risk score of the jth group of vulnerabilities; represents the true risk score of the jth group of vulnerabilities calculated using the weight configuration of the ith group of individuals;

[0032] The specific calculation formula for location update described in S3.3 is as follows:

[0033]

[0034] Where, as well as Respectively represent the weight configuration of each individual after update; as well as Represents the current weight configuration of each individual; as well as represents the leadership position weight configuration; c1, c2, c3 and c4 represent the coefficients for controlling the learning rate, which are randomly selected in the range of [0, 1].

[0035] As a further solution of the present invention, the specific steps of analyzing the risk propagation of each vulnerability in step (3) are as follows:

[0036] S4.1: Based on the network topology, collect the data on each device and service, as well as the communication relationships between them. Randomly select a device as the starting point for the vulnerability. Set propagation conditions based on the communication relationships between devices. Calculate the probability of the risk propagating from the current device to adjacent devices based on experiments and vulnerability characteristics. Construct a preliminary propagation tree based on the current device node.

[0037] S4.2: Set the current device node as the root node of the propagation tree. Starting from the root node, select an unvisited adjacent node. Based on the set propagation conditions and propagation probability, decide whether to propagate from the current node to the selected adjacent node. If the propagation probability is higher than the preset threshold, the propagation is successful, and the adjacent node is updated as the next step of propagation. Continue to expand the propagation tree. Otherwise, backtrack and select another path for simulation.

[0038] S4.3: Calculate the total score of the propagation path based on the number of propagated nodes, trace the total score back to the root node, and update the score of each node on the same path. Repeat the simulation, expansion, evaluation, and update until the preset number of simulations is reached. Stop the simulation and select the path with the highest propagation path score in the propagation tree as the optimal path for vulnerability propagation. At the same time, use this path as the final propagation path and generate a corresponding risk propagation report based on the device information on the propagation path.

[0039] As a further solution of the present invention, the specific steps of the distributed vulnerability collaborative defense in step (4) are as follows:

[0040] S5.1: Each node collects its local vulnerability detection data, including vulnerability scan results, log records, and traffic monitoring data for the corresponding device. The central server generates initial parameters for the global model through random initialization and then distributes the global model parameters to each node, which uses them as the node's local model.

[0041] S5.2: Use the binary cross entropy loss function as the loss function for each node. Each node uses the local dataset to train its own local model. The loss function calculates the loss between each local model and the classification results of real vulnerabilities and normal traffic. Gradient descent is then used to update the parameters of each local model.

[0042] S5.3: After each round of training, each node sends its locally trained model parameters to the central server. The central server collects the local model parameters from all participating nodes and updates the global model parameters based on the local model parameters of each node and through weighted averaging.

[0043] S5.4: The updated global model will be distributed to each participating node. Each node will use this global model as the new initialization model and conduct the next round of training until the preset number of training rounds is reached. Training will then be stopped and the final global model's precision, recall, and F1 score will be evaluated. The defense strategy will be adjusted based on the evaluation results.

[0044] As a further solution of the present invention, the specific calculation formula of the binary cross entropy loss function described in S5.2 is as follows:

[0045]

[0046] Where, L local (w) represents the local loss function of the node; N represents the number of data in the local dataset; y i represents the true label of the i-th sample; x i represents the input feature of the i-th sample; p(y i |x i ,w) represents the probability that the i-th sample output by the local model belongs to a vulnerability; w represents the weight of the local model;

[0047] The specific calculation formula for the weighted average mentioned in S5.3 is as follows:

[0048]

[0049] Where, represents the updated global model parameters; represents the model parameters of the kth node after the tth round of training; n k represents the local data volume of node k; n total Represents the total amount of data for all nodes.

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] 1、the network mapping based vulnerability risk assessment method establishes a risk score model of the vulnerability, constructs a corresponding weight space according to the weight of each factor of the risk score model, initializes a group of populations in the weight space, wherein each individual of the population respectively represents a group of weight configurations, respectively inputs the weight configuration of each individual, the real risk score of the vulnerability and the priority label into the risk score model, and calculates the fitness value of the risk score model through the MSE function, then selects the individual with the highest fitness value in the population as the leader, and the remaining individuals in the population update their positions according to the position information of the leader in the weight space, that is, adjust their weight configurations, then repeatedly test the risk score model, calculate the fitness value, update the leader and adjust the position of the individual, when the change value of the fitness value of the leader after multiple iterations converges to a preset threshold, stop iteration, and output the weight configuration of the individual with the highest fitness value in the current population as the optimal configuration of the risk score model, then input each group of detected vulnerability information into the risk score model and output the risk score of each vulnerability, and sort the priorities according to the score, which can adapt to different network environments and security requirements, improve the accuracy of vulnerability risk assessment, improve the diversity and refinement of vulnerability risk score, and enhance the strategy decision support of vulnerability repair.

[0052] 2、the network mapping based vulnerability risk assessment method collects the local vulnerability detection data of each node, the central server generates the initial parameters of the global model through random initialization, then sends the global model parameters to each node as the local model of the node, and uses the binary cross entropy loss function as the loss function of each node, each node trains its local model using the local data set, calculates the loss value of each local model and the real vulnerability and normal traffic classification result through the loss function, and updates the parameters of each local model using the gradient descent method, after each round of training, each node sends the model parameters obtained by local training to the central server, the central server collects the local model parameters from all participating nodes, updates the parameters of the global model according to the local model parameters of each node, and updates the parameters of the global model through weighted average, the updated global model will be sent to each participating node, each node uses this global model as a new initialization model, and performs the next round of training, until the preset training rounds are reached, the training is stopped, and the accuracy, recall rate and F1 score of the final global model are evaluated, and the defense strategy is adjusted according to the evaluation result, to avoid the transmission of sensitive data, enhance privacy protection, improve the vulnerability defense capability of the whole system, reduce the demand for bandwidth and transmission delay, and improve the vulnerability response speed and repair efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0053] The accompanying drawings are included to provide a further understanding of the application, and constitute a part of the specification, which together with the embodiments of the application, serve to explain the application, and do not constitute a limitation of the application.

[0054] Figure 1 A flow chart of the network mapping-based vulnerability risk assessment method proposed by the present application is shown in the figure.

[0055] Figure 2 A flow chart of the risk score model weight configuration update in the network mapping-based vulnerability risk assessment method proposed by the present application is shown in the figure. DETAILED DESCRIPTION

[0056] Embodiment 1

[0057] Reference Figure 1 The network mapping-based vulnerability risk assessment method is as follows:

[0058] All devices and services in the network are identified, and a network topology map is drawn to classify and identify risk points and asset distribution in the network.

[0059] Specifically, a network scanning tool is used to perform port scanning and service detection on the entire network, and information about each device and service is obtained by identifying the open ports, services and protocol types of the devices, and a large amount of raw scanning data is generated. Then, the duplicate device information in each scanning data is removed, missing values are filled, and outliers are processed. Then, a corresponding network topology map is constructed according to the information about each device and service in the network, and each group of data is normalized. The normalized data is converted into data in a predetermined format using one-hot encoding. Then, historical network data is collected, and corresponding true labels are matched for each group of historical network data. Each historical network data is preprocessed and divided into a training set and a validation set. A classification identification model is established based on the MLP architecture, including an input layer, a hidden layer and an output layer. The training set is input into the classification identification model, and the classification identification model performs forward propagation on each data in the training set. The input layer receives each training data and transmits it. Then, the hidden layer extracts and converts the features of each group of data through the ReLU activation function. The output layer receives the output data of the hidden layer and outputs the predicted probability value of each class according to the requirements of the device classification task. The loss value of the predicted probability value and the true label is calculated by the cross-entropy loss function. The loss value is calculated from the output layer of the classification identification model, and the gradient value of the loss value for each layer of the classification identification model is calculated by the backpropagation algorithm. The model parameters are optimized using the Adam optimizer. After each training round, the performance indicators of the classification identification model are evaluated using the validation set. If the model loss value converges to a predetermined range, the training is stopped. Otherwise, the classification identification model is repeatedly trained and validated until a predetermined number of iterations is reached. The latest scanning data is input into the classification identification model, the classification identification model performs forward propagation on each group of scanning data, and the devices are classified into different types. Then, the types of the devices, services and known vulnerability database are compared to mark the devices with high security risks.

[0060] Scan all devices and services on the network, collect vulnerability data, and simulate different attack scenarios and vulnerability exploitation methods to verify the scan results.

[0061] Specifically, select the assets and high-risk devices identified in the network topology map as attack targets. According to the characteristics of the vulnerability, select remote code execution, privilege escalation and denial of service attack methods. Then use the attack path taken by the attacker to simulate the attacker's behavior in the network to build the corresponding attack scenario. After the attack scenario is built, simulate the attack using the vulnerability. When the authority at the beginning of the attack is low, simulate the attacker to use the privilege escalation vulnerability to elevate his own authority, and based on the obtained authority, simulate the attacker to further attack other devices in the network to expand the attack surface, collect various vulnerability information generated by the simulated attack, and compare it with the vulnerability risk list provided by the vulnerability scanning tool to verify whether the scanning tool has missed network vulnerabilities, attack paths and risk points. If so, record the missing data in the vulnerability risk list and update the local database information of the vulnerability scanning tool.

[0062] Example 2

[0063] Reference Figure 1-2 ,The vulnerability risk assessment method based on network mapping, the specific steps of this assessment method are as follows:

[0064] Based on the characteristics, impact scope and severity of the vulnerabilities, risk assessments are conducted on each group of vulnerability data, and the risk propagation of each vulnerability is analyzed.

[0065] Specifically, refer to Figure 2 It can be seen that a vulnerability risk scoring model is established based on the severity, impact scope, exploitability, and exploitability of network vulnerabilities. According to the weights of each factor in the risk scoring model, a corresponding weight space is constructed. A population is initialized in the weight space, where each individual in the population represents a set of weight configurations. The weight configurations of each individual, the actual risk score of the vulnerability, and the priority label are input into the risk scoring model. The fitness value of the risk scoring model is calculated using the MSE function. The individual with the highest fitness value in the population is then selected as the leader. The remaining individuals in the population update their positions based on the position information of the leader in the weight space, that is, adjust their own weight configurations. The risk scoring model is then tested, the fitness value is calculated, the leader is updated, and the individual position adjustment is repeated. When the change value of the leader's fitness value converges to the preset threshold after multiple iterations, the iteration is stopped, and the weight configuration of the individual with the highest fitness value in the current population is output as the optimal configuration of the risk scoring model. The information of each group of detected vulnerabilities is then input into the risk scoring model, and the risk score of each vulnerability is output. At the same time, the vulnerability is prioritized according to the score.

[0066] It should be further explained that the specific scoring formula of the risk scoring model is as follows:

[0067] R=w1·S+w2·I+w3·D+w4·A

[0068] In the formula, R represents the total risk score of the vulnerability; S represents the severity score of the vulnerability; I represents the impact score of the vulnerability; D represents the difficulty score of exploiting the vulnerability; A represents the exploitability score of the vulnerability; w1, w2, w3 and w4 represent the weights of different factors;

[0069] The specific calculation formula of the MSE function is as follows:

[0070]

[0071] In the formula, F(wolf i ) represents the fitness of the i-th group of individuals; M represents the number of vulnerability samples; R j represents the actual risk score of the jth group of vulnerabilities; represents the true risk score of the jth group of vulnerabilities calculated using the weight configuration of the ith group of individuals;

[0072] The specific calculation formula for location update is as follows:

[0073]

[0074] Where, as well as Respectively represent the weight configuration of each individual after update; as well as Represents the current weight configuration of each individual; as well as represents the leadership position weight configuration; c1, c2, c3 and c4 represent the coefficients for controlling the learning rate, which are randomly selected in the range of [0, 1].

[0075] Specifically, according to the network topology, the communication relationships between each device and service, as well as between each device and service, are collected. A device is randomly selected as the starting point of the vulnerability, and the propagation conditions are set based on the communication relationships between the devices. The probability of risk propagation from the current device to adjacent devices each time is calculated through experiments and vulnerability characteristics. A preliminary propagation tree is constructed based on the current device node, and the current device node is used as the root node of the propagation tree. Starting from the root node, an adjacent node that has not been visited is selected. Based on the set propagation conditions and propagation probability, a decision is made as to whether to propagate from the current node to the selected adjacent node. If the propagation probability is higher than a preset threshold, the propagation is successful, and the adjacent node is updated as the next step of propagation, and the propagation tree is continued to be expanded. Otherwise, the propagation is backtracked and another path is selected for simulation. The total score of the propagation path is calculated based on the number of nodes propagated, and the total score is traced back to the root node. The score of each node on the same path is updated. The simulation, expansion, evaluation, and update are then repeated until the preset number of simulations is reached. The simulation is stopped, and the path with the highest propagation path score in the propagation tree is selected as the optimal path for vulnerability propagation. This path is also used as the final propagation path. A corresponding risk propagation report is generated based on the device information on the propagation path.

[0076] Predict high-risk areas in the network and conduct distributed collaborative vulnerability defense based on each vulnerability risk.

[0077] Specifically, each node collects its local vulnerability detection data, including vulnerability scan results, log records, and traffic monitoring data of the corresponding device. The central server generates the initial parameters of the global model through random initialization, and then sends the global model parameters to each node and uses it as the node's local model. The binary cross entropy loss function is used as the loss function of each node. Each node uses the local dataset to train its own local model. At the same time, the loss value of each local model and the classification results of real vulnerabilities and normal traffic are calculated through the loss function, and the gradient descent method is used to update the parameters of each local model. After each round of training, each node sends the model parameters obtained by its local training to the central server. The central server collects the local model parameters from all participating nodes, updates the parameters of the global model based on the local model parameters of each node and through weighted averaging. The updated global model is then sent to each participating node. Each node uses this global model as the new initialization model and conducts the next round of training until the preset number of training rounds is reached. Training is stopped and the final global model's precision, recall rate, and F1 score indicators are evaluated. The defense strategy is adjusted based on the evaluation results.

[0078] It should be further explained that the specific calculation formula of the binary cross entropy loss function is as follows:

[0079]

[0080] where L local (w) represents the local loss function of the node; N represents the number of data in the local data set; y i represents the true label of the i-th sample; x i represents the input features of the i-th sample; p(y i |x i , w) represents the probability that the i-th sample output by the local model belongs to the vulnerability; w represents the weight of the local model;

[0081] The weighted average is specifically calculated as follows:

[0082]

[0083] where, represents the updated global model parameters; represents the model parameters of the k-th node after the t-th round of training; n k represents the local data amount of node k; n total represents the total amount of data of all nodes.

Claims

1. A vulnerability risk assessment method based on network mapping, characterized by: The specific steps of this evaluation method are as follows: (1) Identify all devices and services in the network and draw a network topology map to classify and identify risk points and asset distribution in the network; (2) Scan all devices and services in the network, collect vulnerability data, and simulate different attack scenarios and vulnerability exploitation methods to verify the scan results; (3) Conduct risk assessments on each set of vulnerability data based on the characteristics, impact scope, and severity of the vulnerability, and analyze the risk propagation of each vulnerability; (4) Predict high-risk areas in the network and conduct distributed vulnerability collaborative defense based on each vulnerability risk.

2. The vulnerability risk assessment method based on network mapping according to claim 1 is characterized in that: The specific steps for classifying and identifying risk points and asset distribution in the network described in step (1) are as follows: S1.1: Use network scanning tools to perform port scanning and service detection on the entire network. Obtain information about each device and service by identifying the open ports, services, and protocol types of the devices, generating a large amount of raw scan data. Duplicate device information is removed from each scan data, missing values ​​are filled, and outliers are processed. Finally, a corresponding network topology is constructed based on the device and service information on the network. S1.2: Normalize each data set of different types and convert the normalized data into a pre-set format using one-hot encoding. Then, collect historical network data and assign corresponding ground truth labels to each set of historical network data. Preprocess each set of historical network data and divide it into training and validation sets. S1.3: Build a classification and recognition model based on the MLP architecture, including an input layer, a hidden layer, and an output layer. The training set is then input into the classification and recognition model, which performs forward propagation on each data point in the training set. The input layer receives and passes the training data. The hidden layer then extracts and transforms features from each data set using the ReLU activation function. The output layer receives the output data from the hidden layer and outputs the predicted probability value for each category based on the requirements of the device classification task. S1.4: Calculate the loss between the predicted probability value and the true label using the cross-entropy loss function. Starting from the output layer of the classification recognition model, the gradient of the loss value for each layer of the classification recognition model is calculated using the backpropagation algorithm. The model parameters are optimized using the Adam optimizer. After each round of training, the performance indicators of the classification recognition model are evaluated using the validation set. If the model loss value converges to the preset range, the training is stopped. Otherwise, the classification recognition model is repeatedly trained and verified until the preset number of iterations is reached. S1.5: Input the latest scan data into the classification recognition model. The classification recognition model performs forward propagation on each set of scan data and classifies the devices into different types. Then, by comparing the device type, service, and database of known vulnerabilities, the model marks devices with higher security risks.

3. The vulnerability risk assessment method based on network mapping according to claim 2 is characterized in that: The specific steps for simulating different attack scenarios and vulnerability exploitation methods in step (2) and verifying the scan results are as follows: S2.1: Select the assets and high-risk devices identified in the network topology as attack targets. Based on the characteristics of the vulnerability, select attack methods such as remote code execution, privilege escalation, and denial of service. Then, use the attacker's attack path to simulate the attacker's behavior in the network to construct the corresponding attack scenario. S2.2: After the attack scenario is constructed, simulate the vulnerability exploitation attack. When the initial privilege level is low, simulate the attacker using the privilege escalation vulnerability to elevate their own privileges. Based on the acquired privileges, simulate the attacker further attacking other devices in the network, expanding the attack surface. S2.3: Collect vulnerability information generated by the simulated attack, compare it with the vulnerability risk list provided by the vulnerability scanning tool, and verify whether the scanning tool has missed any network vulnerabilities, attack paths, and risk points. If so, record the missing data in the vulnerability risk list and update the local database information of the vulnerability scanning tool.

4. The vulnerability risk assessment method based on network mapping according to claim 1 is characterized in that: The specific steps for risk assessment of each set of vulnerability data in step (3) are as follows: S3.1: Establish a vulnerability risk scoring model based on the severity, scope, difficulty of exploitation, and exploitability of the network vulnerability. Based on the weights of each factor in the risk scoring model, construct a corresponding weight space. Initialize a population in the weight space, where each individual in the population represents a set of weight configurations. S3.2: Input the weight configuration of each individual, the actual risk score of the vulnerability, and the priority label into the risk scoring model. The fitness value of the risk scoring model is calculated using the MSE function. The individual with the highest fitness value in the population is then selected as the leader. S3.3: The remaining individuals in the population update their positions based on the leader's position in the weight space, adjusting their own weight configurations. They then repeatedly perform risk scoring model testing, fitness value calculation, leader update, and individual position adjustment. S3.4: When the leader's fitness value converges to the preset threshold after multiple iterations, the iteration is stopped, and the weight configuration of the individual with the highest fitness value in the current population is output as the optimal configuration of the risk scoring model. Then, the detected vulnerability information of each group is input into the risk scoring model and the score of each vulnerability risk is output, and priority is sorted according to the score.

5. The vulnerability risk assessment method based on network mapping according to claim 2 is characterized in that: The specific steps for analyzing the risk propagation of each vulnerability in step (3) are as follows: S4.1: Based on the network topology, collect the data on each device and service, as well as the communication relationships between them. Randomly select a device as the starting point for the vulnerability. Set propagation conditions based on the communication relationships between devices. Calculate the probability of the risk propagating from the current device to adjacent devices based on experiments and vulnerability characteristics. Construct a preliminary propagation tree based on the current device node. S4.2: Set the current device node as the root node of the propagation tree. Starting from the root node, select an unvisited adjacent node. Based on the set propagation conditions and propagation probability, decide whether to propagate from the current node to the selected adjacent node. If the propagation probability is higher than the preset threshold, the propagation is successful, and the adjacent node is updated as the next step of propagation. Continue to expand the propagation tree. Otherwise, backtrack and select another path for simulation. S4.3: Calculate the total score of the propagation path based on the number of propagated nodes, trace the total score back to the root node, and update the score of each node on the same path. Repeat the simulation, expansion, evaluation, and update until the preset number of simulations is reached. Stop the simulation and select the path with the highest propagation path score in the propagation tree as the optimal path for vulnerability propagation. At the same time, use this path as the final propagation path and generate a corresponding risk propagation report based on the device information on the propagation path.

6. The vulnerability risk assessment method based on network mapping according to claim 1 is characterized in that: The specific steps of the distributed vulnerability collaborative defense described in step (4) are as follows: S5.1: Each node collects its local vulnerability detection data, including vulnerability scan results, log records, and traffic monitoring data for the corresponding device. The central server generates initial parameters for the global model through random initialization and then distributes the global model parameters to each node, which uses them as the node's local model. S5.2: Use the binary cross entropy loss function as the loss function for each node. Each node uses the local dataset to train its own local model. The loss function calculates the loss between each local model and the classification results of real vulnerabilities and normal traffic. Gradient descent is then used to update the parameters of each local model. S5.3: After each round of training, each node sends its locally trained model parameters to the central server. The central server collects the local model parameters from all participating nodes and updates the global model parameters based on the local model parameters of each node and through weighted averaging. S5.4: The updated global model will be distributed to each participating node. Each node will use this global model as the new initialization model and conduct the next round of training until the preset number of training rounds is reached. Training will then be stopped and the final global model's precision, recall, and F1 score will be evaluated. The defense strategy will be adjusted based on the evaluation results.

Images