Network security assessment method and system based on threat intelligence

Abstract

The invention provides a network security assessment method and system based on threat intelligence, and the method comprises the steps: obtaining a threat intelligence data set and a to-be-assessed network data set, and carrying out the feature association extraction processing, thereby obtaining a target security feature set; the target security feature set covers threat and component association matching, threat and behavior influence conduction and network component protection capability features, calling a pre-training security assessment model to carry out risk situation analysis on the target security feature set, and generating a network security assessment result including a potential threat triggering probability and a threat influence propagation path, and determining a to-be-evaluated network risk level and key risk point distribution information according to the network security evaluation result, generating a network security evaluation report containing a risk positioning identifier, and outputting the network security evaluation report to the network management terminal to support security policy adjustment operation, so that the network security condition can be comprehensively and accurately evaluated, and the user experience is improved. And the pertinence and effectiveness of safety protection are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network security assessment method and system based on threat intelligence. BACKGROUND

[0002] In today's digital age, network security has become one of the key challenges faced by enterprises and organizations. With the rapid development of network technology, network attack means is increasingly complex and diverse, hackers use various vulnerabilities and malicious software to attack network systems, resulting in data leakage, service interruption and other serious consequences. Traditional network security assessment methods mainly rely on manual experience and simple rule matching, which is difficult to comprehensively and accurately identify and assess potential threats in the network.

[0003] Existing network security assessment technologies usually only focus on the static configuration information of network components, ignoring the dynamic changes of threat intelligence and the correlation between threats and network components. In addition, these methods often cannot accurately predict the triggering probability and propagation path of threats, resulting in a lack of scientific basis for the development of security policies and difficulty in effectively responding to the changing network threat environment. SUMMARY

[0004] In view of the above-mentioned problems, in combination with the first aspect of the present application, the embodiments of the present application provide a network security assessment method based on threat intelligence, the method comprising:

[0005] Obtain a set of threat intelligence data and a set of network data to be evaluated, the set of threat intelligence data containing type description information and impact range description information of historical threat events, and the set of network data to be evaluated containing component configuration description information and communication behavior description information of the current network;

[0006] Perform feature correlation extraction processing on the set of threat intelligence data and the set of network data to be evaluated to obtain a set of target security features, the set of target security features containing correlation matching features of threats and components, influence conduction features of threats and behaviors, and protection ability features of network components;

[0007] Call a pre-trained security assessment model to perform risk situation analysis processing on the set of target security features to generate a network security assessment result, the network security assessment result containing triggering probability description information of potential threats and propagation path description information of threat influence;

[0008] Determine the risk level of the network to be evaluated and the key risk point distribution information according to the network security assessment result, the risk level being used to represent the severity of the threat faced by the network, and the key risk point distribution information being used to represent the location of the network component where the threat influence is most concentrated;

[0009] Generate a network security evaluation report containing risk positioning identification based on the risk level and the key risk point distribution information, and output the network security evaluation report to a network management terminal to support security policy adjustment operations.

[0010] In another aspect, the embodiment of the present application also provides a network security evaluation system based on threat intelligence, which comprises a processor, a machine readable storage medium, the machine readable storage medium is connected with the processor, the machine readable storage medium is used for storing programs, instructions or codes, and the processor is used for executing the programs, instructions or codes in the machine readable storage medium to realize the above method.

[0011] Based on the above aspects, the embodiment of the present application can comprehensively and accurately mine the correlation matching features between threats and network components, the influence transmission features of threats and behaviors, and the protection ability features of network components by acquiring a threat intelligence data set and a network data set to be evaluated, and performing feature correlation extraction processing on the two types of data. By calling a pre-trained security evaluation model to perform risk situation analysis processing on a target security feature set, a network security evaluation result containing trigger probability description information of potential threats and propagation path description information of threat influence can be generated, which not only improves the accuracy and efficiency of the evaluation, but also predicts the development trend of the threat, provides forward-looking guidance for the formulation of security policies, determines the risk level and the key risk point distribution information of the network to be evaluated according to the network security evaluation result, and generates a network security evaluation report containing risk positioning identification, which can help network management personnel to quickly locate the security risk points in the network and take targeted security policy adjustment operations, can significantly improve the pertinence and effectiveness of network security protection, and reduce the risk of network attacks. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 is the execution flow diagram of the network security evaluation method based on threat intelligence provided by an embodiment of the present application.

[0013] Figure 2 is the schematic diagram of exemplary hardware and software components of the network security evaluation system based on threat intelligence provided by an embodiment of the present application. DETAILED DESCRIPTION

[0014] The present application will be described in detail below with reference to the accompanying drawings, Figure 1 is the flow diagram of the network security evaluation method based on threat intelligence provided by an embodiment of the present application, which will be described in detail below.

[0015] Step S110: Acquire a threat intelligence data set and a network data set to be evaluated, wherein the threat intelligence data set includes type description information and impact scope description information of historical threat events, and the network data set to be evaluated includes component configuration description information and communication behavior description information of the current network.

[0016] In this embodiment, the threat intelligence data set includes descriptions of the types and impacts of historical threat events, helping to understand the types of threats the network has faced in the past and the scope of their impact. The network to be assessed data set focuses on the current state of the network, including component configuration descriptions and communication behavior descriptions, reflecting the current network structure and operational status.

[0017] Step S111: Collect historical threat event records from different sources from the public threat intelligence platform. The historical threat event records include timestamp information of the event occurrence time, identity description information of the threat subject, technical feature description information of the threat means, and description information of the loss type caused by the event.

[0018] In this step, you need to collect historical threat event records from multiple public threat intelligence platforms. Public threat intelligence platforms aggregate cybersecurity information from various sources. To accurately collect the required historical threat event records, you can access the interface services of multiple public threat intelligence platforms and send query requests containing time range and threat type parameters. The time range parameter specifies the time interval for collecting events, for example, you can specify to collect historical threat event records within a recent period. The threat type parameter specifies the threat category of the collected events, such as malware attacks, phishing attacks, etc.

[0019] Step S1111: Receive historical threat event record data returned by each public threat intelligence platform. The historical threat event record data contains structured field information and unstructured description information. The structured field information includes event ID, occurrence time, threat subject, and impact scope. The unstructured description information includes technical details of the attack method and specific cases of losses caused.

[0020] After receiving the query request, each public threat intelligence platform can return historical threat event record data, which includes structured field information and unstructured description information. The structured field information has a clear format and specification, facilitating subsequent processing and analysis. For example, the event ID can uniquely identify a historical threat event, the occurrence time can understand the chronological order of the historical threat event, the threat subject can clearly indicate which object initiated the threat, and the impact range can indicate the extent of the threat.

[0021] Step S1112: Natural language processing is performed on the unstructured description information to extract key information segments, including threat means feature keywords, impact loss type keywords, and attack target component type keywords.

[0022] Since the unstructured description information is natural language text, it needs to be processed by natural language processing to extract key information segments. Natural language processing is a technology for analyzing and understanding text, which can identify important information in the text. In this process, threat means feature keywords can be extracted, which can summarize the characteristics of the threat means; impact loss type keywords can clearly indicate the type of loss caused by the threat; and attack target component type keywords can indicate which network component the threat is targeting.

[0023] Step S1113: Convert the key information segments into a format consistent with the structured field information to generate a unified structure of historical threat event records.

[0024] After extracting the key information segments, in order to facilitate subsequent unified processing and analysis, the key information segments need to be converted into a format consistent with the structured field information, thereby generating a unified structure of historical threat event records, so that all historical threat event records have the same format and specification, facilitating comparison and correlation analysis.

[0025] Step S1114: Cross-verify the historical threat event records returned by different platforms, compare the record information of the same event ID, and correct the inconsistent field contents.

[0026] Different public threat intelligence platforms may provide records of the same historical threat event, but due to differences in information sources and collection methods, these records may have inconsistencies. Therefore, cross-verification of historical threat event records returned by different platforms is needed. By comparing the record information of the same event ID, the inconsistent field contents are found and corrected to ensure the accuracy and reliability of the historical threat event records.

[0027] Step S112: Extract the component configuration records of the current network from the log management system of the network to be evaluated, which contains the model identification information of network devices, version identification information of software systems, rule description information of access control policies, and protocol type description information of data transmission.

[0028] The log management system of the network to be evaluated records detailed configuration information of various components in the network. Extract the component configuration records of the current network from the log management system, which contains the model identification information of network devices, different network device models have different performance and characteristics; version identification information of software systems, different versions of software systems may have different security and functionality; rule description information of access control policies, which determines which users or devices can access network resources; protocol type description information of data transmission, different protocol types also have different security and efficiency in data transmission.

[0029] Step S113: Extract the communication behavior records of the current network from the traffic monitoring system of the network to be evaluated, which contains the interactive object identification information of terminal devices, the frequency interval description information of data transmission, the sensitive data type description information of communication content, and the session termination reason description information of abnormal connection.

[0030] The traffic monitoring system of the network to be evaluated can record the communication behavior of terminal devices in the network. Extract the communication behavior records of the current network from the traffic monitoring system, which contains the interactive object identification information of terminal devices, which can understand which other devices the terminal device interacts with; the frequency interval description information of data transmission, which can reflect the regularity and frequency of data transmission; the sensitive data type description information of communication content, which can help determine whether the communication content contains sensitive information; and the session termination reason description information of abnormal connection, which can understand why the abnormal connection is terminated.

[0031] Step S114: De-duplicate the historical threat event records, delete the same timestamp information and the same threat principal identity description information of duplicate records, and keep the unique event records corresponding to different loss type description information.

[0032] In the collected historical threat event records, there may be duplicate records. In order to avoid interference of repeated information on subsequent analysis, it is necessary to de-duplicate the historical threat event records. By comparing the timestamp information and the threat principal identity description information in the records, if the same timestamp information and the same threat principal identity description information are found, the duplicate records are deleted, and only the unique event records corresponding to different loss type description information are kept, thereby ensuring the uniqueness and accuracy of the historical threat event records.

[0033] Step S115: performing format unification processing on the component configuration record and the communication behavior record, and converting information in different log formats into standardized data records with a unified field structure.

[0034] Because component configuration and communication activity records may originate from different systems or devices, their log formats may differ. To facilitate subsequent processing and analysis, these logs need to be standardized. Through conversion and adjustment, information in different log formats is transformed into standardized data records with a unified field structure. This ensures that all component configuration and communication activity records share the same format and specifications, facilitating data integration and analysis.

[0035] Step S116: The deduplicated historical threat event records are used as a threat intelligence data set, and the component configuration records and the communication behavior records in a unified format are combined as a network data set to be evaluated.

[0036] After the previous processing, the deduplicated historical threat event records are integrated to form a threat intelligence data set. At the same time, the component configuration records and communication behavior records, which have been standardized in format, are merged together to form the network data set to be evaluated.

[0037] Step S120: Perform feature association extraction processing on the threat intelligence data set and the network data set to be evaluated to obtain a target security feature set, which includes association matching features between threats and components, impact transmission features between threats and behaviors, and protection capability features of network components.

[0038] After acquiring the threat intelligence data set and the network data set to be assessed, it is necessary to perform feature correlation extraction on the threat intelligence data set and the network data set to be assessed to obtain the target security feature set. Each feature in the target security feature set reflects the threats faced by the network and the security capabilities of the network components from different perspectives.

[0039] Step S121: performing feature labeling processing on the historical threat event records in the threat intelligence data set, adding a threat type label, a means feature label, and an impact loss label to each event record, wherein the threat type label is used to distinguish different threat categories.

[0040] In the feature tagging process of historical threat event records in the threat intelligence data set, a comprehensive and accurate threat feature label library is first established, which covers a threat type label set, a means feature label set and an impact loss label set. Among them, the threat type label set contains a variety of different labels, such as malware attack label, phishing attack label, DDoS attack label, etc., which can clearly distinguish different threat categories.

[0041] Step S1211: Establish a threat feature label library, which contains a threat type label set, a means feature label set and an impact loss label set, and the threat type label set contains a malware attack label, a phishing attack label and a DDoS attack label.

[0042] Building a threat feature label library is the basis of the entire feature tagging process. Through the analysis and summary of a large number of historical threat events, the labels corresponding to different threat types, means features and impact losses are determined. For the threat type label set, common threat categories are considered to ensure that most possible threat situations can be covered. The means feature label set needs to extract and summarize the features of various threat means to form representative labels. The impact loss label set is classified according to different loss types caused by threat events, such as data leakage, system paralysis, etc., and sets corresponding labels for each loss type.

[0043] Step S1212: Perform semantic analysis on the threat subject identity description information and threat means technical feature description information of each historical threat event record, identify the threat type keywords, match the threat type keywords with the threat type label set, and add corresponding threat type labels to the historical threat event record.

[0044] When performing semantic analysis on the threat subject identity description information and threat means technical feature description information in each historical threat event record, natural language processing technology is used to perform word segmentation, part-of-speech tagging, named entity recognition, etc. on the text. Through these operations, the keywords related to the threat type are identified. For example, if keywords such as "Trojan program" and "virus infection" appear in the description information, it can be judged that the threat event may belong to the malware attack type. Then, match these identified threat type keywords with the threat type label set in the threat feature label library to add corresponding threat type labels to the historical threat event record.

[0045] Step S1213: Perform pattern recognition on the threat means technical feature description information of each historical threat event record, extract the technical feature keywords therein, match the technical feature keywords with the means feature label set, and add the corresponding means feature label to the historical threat event record.

[0046] When performing pattern recognition on the threat means technical feature description information, machine learning and pattern matching algorithms are used to extract technical features from the text. By analyzing the technical details in the description information, representative technical feature keywords such as "SQL injection" and "port scanning" are found. These technical feature keywords are matched with the means feature label set, and the corresponding means feature label is added to the historical threat event record. For example, if the extracted technical feature keywords match the "SQL injection" means feature label, the "SQL injection" means feature label is added to the historical threat event record.

[0047] Step S1214: Classify and summarize the loss type description information of the impact of each historical threat event record, identify the loss type keywords therein, match the loss type keywords with the impact loss label set, and add the corresponding impact loss label to the historical threat event record.

[0048] When classifying and summarizing the loss type description information of the impact of the historical threat event record, the loss is classified according to its nature and degree. Text classification algorithms are used to analyze the description information and identify the loss type keywords such as "data loss" and "service interruption". These loss type keywords are matched with the impact loss label set, and the corresponding impact loss label is added to the historical threat event record. For example, if the identified loss type keywords match the "data loss" impact loss label, the "data loss" impact loss label is added to the historical threat event record.

[0049] Step S1215: Check the label addition of each historical threat event record to ensure that each historical threat event record contains at least one threat type label, one means feature label, and one impact loss label. Historical threat event records that do not meet the label quantity requirement are supplemented with label processing.

[0050] After tagging is complete, each historical threat event record needs to be checked for tagging. A checker program is written to iterate through the tag information of each historical threat event record, ensuring that each record contains at least one threat type tag, one means characteristic tag, and one impact loss tag. If a historical threat event record is found to not meet the required number of tags, it needs to be supplemented with additional tags. This supplementary tagging can be completed by reanalyzing the descriptive information of the historical threat event record or by referring to relevant historical data and experience to ensure that the tag information of each historical threat event record is complete and accurate.

[0051] Step S122: Perform feature labeling on the component configuration records in the network data set to be evaluated, and add a device type label, a protection capability label, and a vulnerability exposure label to each component configuration record. The protection capability label is used to indicate the device's level of resistance to set threats.

[0052] When characterizing component configuration records within the network data set to be assessed, it's necessary to comprehensively consider multiple aspects of the component information. For device type labels, by analyzing the network device model identification information and software system version identification information within the component configuration record, combined with a pre-established device type classification system, a corresponding device type label is determined for each component configuration record. For example, if a component configuration record indicates a specific server model, the "server" device type label is assigned based on the model's corresponding relationship within the classification system. For protection capability labels, the device's resilience against defined threats can be assessed based on factors such as the component's hardware configuration, software security settings, and the presence of installed protection software. A series of evaluation metrics and algorithms are used to quantify the device's protection capability. Based on the quantified results, the component configuration record is assigned a corresponding protection capability label, such as "high protection capability," "medium protection capability," or "low protection capability." For vulnerability exposure labels, a vulnerability scanning tool is used to conduct a comprehensive scan of the component, combining it with a known vulnerability database to identify any vulnerabilities. Based on factors such as the severity and impact of the vulnerability, vulnerability exposure labels are added to component configuration records, such as "high-risk vulnerability exists", "medium-risk vulnerability exists", "low-risk vulnerability exists", and other labels.

[0053] Step S123: Perform feature labeling processing on the communication behavior records in the network data set to be evaluated, and add an interaction mode label, a sensitivity level label and an abnormal tendency label to each communication behavior record. The abnormal tendency label is used to indicate the degree to which the communication behavior deviates from the normal mode.

[0054] When performing feature tagging on the communication behavior record, first, the interactive object identification information of the terminal device and the frequency interval description information of data transmission in the communication behavior record are analyzed according to the interactive mode tag. According to different interactive modes and frequency characteristics, the communication behavior is divided into different interactive modes, such as a “frequent interactive mode”, an “intermittent interactive mode”, a “one-way interactive mode”, and the like, and the corresponding interactive mode tag is added to each communication behavior record. For the sensitive level tag, the sensitive data type description information of the communication content is analyzed, and the sensitivity of the communication content is judged in combination with the pre-set sensitive data classification standard. For example, if the communication content contains highly sensitive data such as personal identity information and financial information of the user, the “high sensitive level” tag is added to the communication behavior record; if only some ordinary business information is contained, the “low sensitive level” tag is added. For the abnormal tendency tag, a normal communication behavior mode benchmark model can be established, and the degree of deviation of the current communication behavior record from the benchmark model is calculated by comparing and analyzing the current communication behavior record with the benchmark model. According to the size of the deviation degree, the corresponding abnormal tendency tag is added to the communication behavior record, such as the “high abnormal tendency” tag, the “moderate abnormal tendency” tag, the “mild abnormal tendency” tag, and the like.

[0055] Step S124: establishing an association relationship table of the threat type tag and the device type tag, counting the number of successful attacks of different threat types on different device types in historical threat events, and generating an association matching feature of the threat and the component.

[0056] When establishing the association relationship table of the threat type tag and the device type tag, the historical threat event records are first comprehensively combed and analyzed. For each combination of a threat type tag and a device type tag, the number of successful attacks of the threat type on the device type in the historical threat events is counted. In order to ensure the accuracy of the statistics, the definition of the successful attack can be clearly defined, for example, the system failure of the device, the data leakage, and the like can be clearly judged as the result of the successful attack. In the statistical process, data storage and query technology can be used to filter and count the historical threat event records. According to the number of successful attacks obtained by the statistics, the association matching feature of the threat and the component is generated. The association matching feature can be represented in the form of a numerical value, such as an association probability, which is obtained by calculating the ratio of the number of successful attacks to the total number of attacks. For example, the number of successful attacks of a certain threat type on a certain device type is a certain number, and the total number of attacks is another number, and the association probability of the threat type and the device type is obtained by dividing the two numbers. These association probabilities are used as the association matching feature of the threat and the component.

[0057] Step S125: establishing an association relationship table of the means feature tag and the abnormal tendency tag, analyzing the matching degree of the historical threat means feature and the current communication abnormal tendency, and generating an influence transmission feature of the threat and the behavior.

[0058] When the association relationship table of the means characteristic label and the abnormal tendency label is established, the means characteristic label in the historical threat event record is associated and analyzed with the abnormal tendency label in the current communication behavior record. For each combination of the means characteristic label and the abnormal tendency label, the matching degree of the historical threat means characteristic and the current communication abnormal tendency is analyzed. The similarity of the characteristic vectors of the means characteristic and the abnormal tendency can be calculated by establishing a characteristic similarity calculation model. For example, the cosine similarity algorithm is used to calculate the similarity value of the characteristic vectors of the means characteristic and the abnormal tendency. According to the size of the similarity value, the matching degree is determined. If the similarity value is high, it means that the matching degree of the historical threat means characteristic and the current communication abnormal tendency is high; otherwise, it is low. The results of the matching degree are sorted into an association relationship table, which is used as the influence transmission characteristic of the threat and the behavior. The influence transmission characteristic can be represented in the form of a numerical value, such as a matching coefficient, which is used for subsequent analysis and decision-making.

[0059] Step S126: Establishing an association relationship table of the impact loss label and the protection capability label, calculating the difference value between the historical threat loss degree and the current device protection capability, and generating the protection capability characteristic of the network component.

[0060] When the association relationship table of the impact loss label and the protection capability label is established, the impact loss label in the historical threat event record can be associated and analyzed with the protection capability label in the current component configuration record. For each combination of the impact loss label and the protection capability label, the quantitative value of the historical threat loss degree and the quantitative value of the current device protection capability are first determined. The historical threat loss degree can be quantified by analyzing the impact of the threat event on the device damage, data loss, business interruption, etc., combined with the pre-set loss evaluation standard. The quantitative value of the current device protection capability has been calculated when the protection capability label is added to the component configuration record. Then, the difference value between the historical threat loss degree and the current device protection capability is calculated. The larger the difference value, the weaker the protection capability of the device when facing the corresponding threat. The difference values are sorted into an association relationship table, which is used as the protection capability characteristic of the network component. The protection capability characteristic can be represented in the form of a numerical value, such as a protection gap value, which is used to measure the relationship between the protection capability of the device and the threat loss degree.

[0061] Step S127: Merging the association matching characteristic, the influence transmission characteristic and the protection capability characteristic as a target security characteristic set.

[0062] In the process of merging the correlation matching features, influence conduction features, and protection capability features into the target security feature set, it is necessary to consider that the dimensions and properties of these features may be different. First, the features need to be uniformly processed in terms of format and dimension to ensure that they can be effectively merged. The feature vectors of the correlation matching features, influence conduction features, and protection capability features can be spliced in a set order. For example, the feature vectors of the correlation matching features are placed first, followed by the feature vectors of the influence conduction features, and finally the feature vectors of the protection capability features. During the splicing process, attention should be paid to maintaining the consistency of the dimensions of the feature vectors to avoid dimension mismatch problems. After splicing, the target security feature set is obtained. The target security feature set integrates information from multiple aspects, such as the correlation matching between threats and components, the influence conduction between threats and behaviors, and the protection capability of network components.

[0063] Step S130: Call the pre-trained security evaluation model to perform risk situation analysis processing on the target security feature set, and generate a network security evaluation result. The network security evaluation result contains trigger probability description information of potential threats and propagation path description information of threat influence.

[0064] After obtaining the target security feature set, it is necessary to call the pre-trained security evaluation model to perform risk situation analysis processing. The pre-trained security evaluation model can evaluate and analyze the security status of the network according to the input target security feature set.

[0065] Step S131: Input the target security feature set into the feature encoding layer of the security evaluation model to perform vector conversion processing on the correlation matching features, influence conduction features, and protection capability features, and generate security feature vectors with uniform dimension representation.

[0066] When the target security feature set is input into the feature encoding layer of the security assessment model, the feature encoding layer will process the correlation matching features, influence conduction features, and protection capability features. Since these features may initially have different representations and dimensions, vector conversion processing is needed to generate security feature vectors with uniform dimensional representations. The feature encoding layer will use a series of encoding algorithms and neural network structures. For example, for correlation matching features, an embedding layer can be used to convert their original label information into low-dimensional vector representations. Similar methods can also be used for vector conversion of influence conduction features and protection capability features. During the conversion process, the correlation matching features, influence conduction features, and protection capability features can be normalized to ensure that all feature vector values are within a suitable range, avoiding the influence of large-scale differences in feature values on subsequent model calculations. By continuously adjusting the encoding parameters and neural network weights, the converted feature vectors have uniform dimensions, and finally generate security feature vectors. These security feature vectors will serve as input data for the subsequent risk identification layer, propagation analysis layer, and probability prediction layer.

[0067] Step S132: Perform pattern matching processing on the security feature vector through the risk identification layer of the security assessment model, identify potential threat scenarios that match historical threat event patterns, and output type identification information of the potential threat.

[0068] The risk identification layer of the security assessment model can perform pattern matching processing after receiving the security feature vector. The risk identification layer will pre-store a large number of historical threat event patterns, which are obtained by feature extraction and analysis of historical threat event records. In the pattern matching process, similarity calculation algorithms can be used to compare the security feature vector with historical threat event patterns. For example, cosine similarity, Euclidean distance, and other algorithms can be used to calculate the similarity values of the security feature vector and each historical threat event pattern. According to the size of the similarity value, it is determined whether there is a potential threat scenario that matches the historical threat event pattern. If the similarity value exceeds a pre-set threshold, it is considered that there is a matching potential threat scenario. For the matching potential threat scenario, type identification information of the potential threat can be output according to the type of the corresponding historical threat event. The type identification information can be a specific threat type name, such as "malware attack", "DDoS attack", "phishing attack", etc., or a corresponding unique code, which is convenient for subsequent management and analysis.

[0069] Step S134: Perform statistical learning processing on the security feature vector through the probability prediction layer of the security assessment model, calculate the triggering probability of the potential threat scenario in the current network environment, and output triggering probability description information of the potential threat.

[0070] The probability prediction layer of the security assessment model can perform statistical learning processing after receiving the security feature vector. The probability prediction layer uses machine learning and statistical analysis algorithms to calculate the triggering probability of potential threat scenarios in the current network environment, taking into account various factors such as network traffic, device status, security policies, and so on. First, feature selection and extraction can be performed on the security feature vector to filter out features related to the triggering probability of potential threats. Then, a trained probability prediction model, such as a logistic regression model, decision tree model, or neural network model, is used to learn and analyze these features. During training of the probability prediction model, a large amount of historical data is used as training samples, including security feature vectors and corresponding labels indicating whether potential threats were triggered. Through learning from training samples, the model learns the relationship between features and potential threat triggering. When calculating the triggering probability, the current security feature vector is input into the trained probability prediction model, which outputs a probability value representing the triggering probability of potential threat scenarios in the current network environment. According to the calculated probability value, triggering probability description information of potential threats is generated, such as "high triggering probability," "medium triggering probability," "low triggering probability," and other levels of description, or in the form of specific probability values.

[0071] Step S133: performing path derivation processing on the security feature vector by the propagation analysis layer of the security assessment model, based on the association relationship between threats and components and the transmission relationship between threats and behaviors, deriving the propagation path of threats from the initial attack point to the target component, and outputting propagation path description information of threat impact.

[0072] When performing path derivation processing on the security feature vector, the propagation analysis layer of the security assessment model needs to consider the association relationship between threats and components and the transmission relationship between threats and behaviors to accurately derive the propagation path of threats from the initial attack point to the target component.

[0073] Step S1331: extracting threat-component association matching features from the security feature vector by the propagation analysis layer of the security assessment model, wherein the association matching features include threat type-device type association probability values.

[0074] In this embodiment, the propagation analysis layer uses the internal mechanism of the model to extract threat-component association matching features from the security feature vector. These association matching features reflect the degree of association between different threat types and different device types, specifically in the form of association probability values. For example, the association probability value of a certain type of malicious software attack on a server device may be high, while the association probability value on a terminal device may be low. By analyzing and processing the security feature vector, these association probability values are extracted.

[0075] Step S1332: Extracting the influence conduction features of threats and behaviors from the security feature vector, the influence conduction features including matching degree values of threat means and communication abnormality tendencies.

[0076] In addition to extracting the associated matching features of threats and components, the propagation analysis layer also needs to extract the influence conduction features of threats and behaviors from the security feature vector. These influence conduction features reflect the matching degree between threat means and communication abnormality tendencies, represented by matching degree values. For example, a certain threat means has a high matching degree value with the abnormal data transmission tendency in communication behavior, indicating that the threat means is likely to be conducted through the above-mentioned abnormal communication behavior. Through further analysis of the security feature vector, these matching degree values are extracted for subsequent path derivation judgment.

[0077] Step S1333: Establishing derivation rules of threat propagation paths, the derivation rules defining the initial attack point as the communication behavior occurrence point with significant abnormality tendency, the intermediate node as the device type component with threat type associated probability value exceeding the threshold value, and the terminal point as the target component corresponding to the impact loss label.

[0078] In order to accurately derive the threat propagation path, a set of clear derivation rules need to be established. According to the characteristics and experience of network security, the initial attack point is defined as the communication behavior occurrence point with significant abnormality tendency. These communication behaviors with significant abnormality tendency are often the breakthrough point of threat intrusion. The intermediate node is selected as the device type component with threat type associated probability value exceeding the threshold value, which is more susceptible to attacks of specific threat types. The terminal point is defined as the target component corresponding to the impact loss label, i.e. the component affected by the threat.

[0079] Step S1334: Starting from the initial attack point, selecting the next intermediate node according to the associated probability value, the selection priority of the intermediate node being positively related to the size of the associated probability value.

[0080] After determining the initial attack point, the next intermediate node is selected according to the previously extracted associated probability value of threats and components. The larger the associated probability value, the more likely the device type component is attacked by the corresponding threat type, and therefore the higher the selection priority. The propagation analysis layer compares the associated probability values of all possible intermediate nodes and selects the device type component with the largest associated probability value as the next intermediate node. For example, if the associated probability value of the server device is the largest, the server device is selected as the next intermediate node.

[0081] Step S1335: Between adjacent nodes, judging whether the threat means can be conducted to the next node through the current communication behavior according to the matching degree value, the conduction condition being that the matching degree value exceeds the preset conduction threshold value.

[0082] After the adjacent intermediate node is selected, it is necessary to determine whether the threat means can be transmitted to the next node through the current communication behavior. According to the matching degree value of the threat and the behavior extracted in the foregoing, the matching degree value is compared with a preset transmission threshold. If the matching degree value exceeds the preset transmission threshold, it is considered that the threat means can be transmitted to the next node through the current communication behavior; otherwise, the threat means cannot be transmitted to the next node.

[0083] Step S1336: The node selection and transmission determination process is repeated until the target component is reached or transmission cannot continue, and complete threat influence propagation path description information is generated.

[0084] According to the node selection and transmission determination method described above, the process is repeatedly performed until the target component corresponding to the influence loss label is reached or transmission cannot continue. In each process of selecting an intermediate node and determining transmission, information of the node and transmission conditions are recorded. Finally, the recorded information is integrated to generate complete threat influence propagation path description information, which describes the propagation path of the threat from the initial attack point to the target component in detail.

[0085] Step S134: The security feature vector is statistically learned by a probability prediction layer of the security evaluation model, a triggering possibility of a potential threat scenario in a current network environment is calculated, and triggering probability description information of the potential threat is output.

[0086] The probability prediction layer of the security evaluation model statistically learns the security feature vector. Through a statistical learning algorithm and a model, a triggering possibility of a potential threat scenario in a current network environment is calculated. Various factors of the current network are considered, such as configurations of network components, communication behaviors, and the like, and influences of the factors on triggering of the potential threat scenario are comprehensively analyzed. According to a calculation result, triggering probability description information of the potential threat is output, which can be used to represent a possibility size of occurrence of the potential threat in the current network environment.

[0087] Step S135: The type identification information of the potential threat, the propagation path description information of the threat influence, and the triggering probability description information of the potential threat are merged as a network security evaluation result.

[0088] Finally, the type identification information of the potential threat, the propagation path description information of the threat influence, and the triggering probability description information of the potential threat are merged together to form a network security evaluation result. The network security evaluation result contains important information about a type, a propagation path, and a triggering probability of the potential threat, and is very valuable for evaluating a security situation of a network to be evaluated.

[0089] Step S140: determining the risk level of the network to be evaluated and the key risk point distribution information according to the network security evaluation result, the risk level being used to represent the severity of the threat faced by the network, and the key risk point distribution information being used to represent the position of the network component most concentrated by the threat.

[0090] After obtaining the network security evaluation result, it is necessary to determine the risk level of the network to be evaluated and the key risk point distribution information according to the network security evaluation result. The risk level can intuitively represent the severity of the threat faced by the network, and the key risk point distribution information can facilitate the positioning of the position of the network component most concentrated by the threat.

[0091] Step S141: parsing the trigger probability description information of the potential threat in the network security evaluation result, and extracting the trigger probability value corresponding to each potential threat type.

[0092] First, the trigger probability description information of the potential threat in the network security evaluation result is parsed, and the trigger probability value corresponding to each potential threat type in the description information is extracted by a text parsing algorithm. These trigger probability values reflect the possibility of different potential threats occurring in the current network environment. Different potential threat types may correspond to different trigger probability values, for example, the trigger probability value of a certain malicious software attack and the trigger probability value of a phishing attack may be different.

[0093] Step S142: parsing the propagation path description information of the threat impact in the network security evaluation result, and extracting the network component identification information involved in each propagation path.

[0094] Then, the propagation path description information of the threat impact in the network security evaluation result is parsed. Through natural language processing and information extraction technology, the network component identification information involved in each propagation path is extracted from the propagation path description information. These network component identification information can uniquely identify each component in the network, such as the identification of a server, the identification of a terminal device, etc. By extracting these identification information, it can be clearly monitored which network components each threat propagation path will pass through.

[0095] Step S143: establishing an evaluation rule table of the risk level, the evaluation rule table containing the corresponding relationship between different trigger probability value ranges and risk levels, and determining the risk level of the network to be evaluated according to the matching result of the trigger probability value and the evaluation rule table.

[0096] In order to determine the risk level of the network to be evaluated, an evaluation rule table of risk level needs to be established. The evaluation rule table is established according to a large number of network security experiences and data analysis, and contains the corresponding relationship between different trigger probability value ranges and risk levels. For example, when the trigger probability value is in a certain lower range, the corresponding risk level can be a relatively low risk level; when the trigger probability value is in a certain higher range, the corresponding risk level can be a relatively high risk level. Thus, the trigger probability value corresponding to each potential threat type extracted in the foregoing can be matched with the evaluation rule table, and the risk level of the network to be evaluated is determined according to the matching result. For example, if the trigger probability values of most potential threats correspond to a high risk level, the overall risk level of the network to be evaluated will be determined as a high level.

[0097] Step S144: Count the number of times that the network components involved in each propagation path are covered by different threat types, and generate a component risk coverage count statistical result.

[0098] The embodiment needs to count the number of times that the network components involved in each propagation path are covered by different threat types. First, a statistical table of component risk coverage count is initialized, and the row field of the statistical table is network component identification information, and the column field is threat type label information. Then, all threat-affected propagation path description information is traversed, and for each path, the network component identification information and the corresponding threat type label information involved in the path are extracted. For each network component identification information and threat type label information in each path, the count in the cross cell corresponding to the row and column in the statistical table is increased by 1. After the traversal is completed, the statistical table is summarized and processed, the count sum of all threat type label information corresponding to each network component identification information is calculated, and the component total risk coverage count is generated; meanwhile, the statistical table is classified and processed, the count sum of all network component identification information corresponding to each threat type label information is calculated, and the threat type coverage component quantity is generated. Finally, the statistical table, the component total risk coverage count and the threat type coverage component quantity are combined as the component risk coverage count statistical result. For example, a server component is covered by different threat types in multiple propagation paths, and the component total risk coverage count of the server component will be increased accordingly; and if a certain threat type covers a large number of network components, the threat type coverage component quantity of the threat type will be large.

[0099] Step S1441: Initialize a statistical table of component risk coverage count, and the row field of the statistical table is network component identification information, and the column field is threat type label information.

[0100] Before the statistics of the risk coverage times of the components is performed, a statistics table needs to be initialized. The row field of the statistics table is the network component identification information, and each row corresponds to a network component. The column field is the threat type label information, and each column corresponds to a threat type. In this way, the coverage of each network component by different threat types can be clearly recorded. For example, the row field can contain the identification of multiple servers, the identification of terminal equipment, etc., and the column field can contain threat type labels such as malware attacks, phishing attacks, etc.

[0101] Step S1442: Traverse all the propagation path description information of the threat influence, and extract the network component identification information and the corresponding threat type label information involved in each path.

[0102] Next, all the propagation path description information of the threat influence is traversed. In the traversal process, the information extraction algorithm is used to extract the network component identification information and the corresponding threat type label information involved in each propagation path description information. For example, in a certain propagation path description information, it can be found that it involves a certain server component, and the corresponding threat type is a malware attack, so the identification information of the server component and the threat type label information of the malware attack are extracted.

[0103] Step S1443: For each network component identification information and threat type label information in each path, increase the count by 1 in the intersection cell of the corresponding row and column in the statistics table.

[0104] After the network component identification information and the threat type label information in each path are extracted, the intersection cell of the corresponding row and column in the initialized statistics table is found. For example, if the extracted network component identification information corresponds to a certain row in the statistics table, and the threat type label information corresponds to a certain column in the statistics table, then the count in the intersection cell of this row and this column is increased by 1. In this way, the number of times each network component is covered by different threat types can be counted.

[0105] Step S1444: Perform summary processing on the statistics table, calculate the sum of the counts of all threat type label information corresponding to each network component identification information, and generate the total risk coverage times of the components.

[0106] After the traversal and counting of all paths are completed, the summary processing of the statistics table is performed. For each network component identification information, the counts of all threat type label information corresponding thereto are summed up to obtain the total risk coverage times of the components. The total risk coverage times of the components can reflect the overall degree of threat to the network component. The higher the total risk coverage times of the components, the greater the risk faced by the network component.

[0107] Step S1445: classifying the statistical table, calculating the count sum of all network component identification information corresponding to each threat type label information, and generating threat type coverage component quantity.

[0108] In addition to calculating the total risk coverage times of components, the statistical table also needs to be classified. For each threat type label information, the count of all network component identification information corresponding to it is summed up to obtain the threat type coverage component quantity. The threat type coverage component quantity can reflect the range of network components affected by a certain threat type. The more the threat type coverage component quantity, the wider the range of influence of the threat type.

[0109] Step S145: extracting network components with coverage times exceeding a preset threshold from the component risk coverage times statistical result, and taking their identification information as key risk point identification information.

[0110] After obtaining the component risk coverage times statistical result, key risk point identification information needs to be extracted from it. A preset threshold is set, which is determined according to the requirements and experience of network security. Network components with coverage times exceeding the preset threshold in the component risk coverage times statistical result are screened out, and their identification information is taken as key risk point identification information. The network components corresponding to these key risk point identification information are components in the network that face higher risks and need to be focused on and protected.

[0111] Step S146: analyzing the position distribution of network components corresponding to the key risk point identification information in the propagation path, and generating key risk point distribution information containing component physical location and logical level.

[0112] Finally, the position distribution of network components corresponding to the key risk point identification information in the propagation path is analyzed. Through the analysis of network topology structure and propagation path, the physical location and logical level of these network components are determined. The physical location can be the actual installation location of the device in the network, and the logical level can be the hierarchical relationship of the device in the network architecture. These information is integrated to generate key risk point distribution information containing component physical location and logical level. The key risk point distribution information can intuitively show the position of the network components most affected by the threat.

[0113] Step S150: generating a network security evaluation report containing risk positioning identification based on the risk level and the key risk point distribution information, and outputting the network security evaluation report to the network management terminal to support security policy adjustment operation.

[0114] For example, step S151: obtaining a preset evaluation report template, the evaluation report template containing a risk overview chapter, a risk analysis chapter, and a policy suggestion chapter.

[0115] The preset evaluation report template is designed according to the industry standard of network security evaluation, past evaluation experience and actual needs of network management. When the evaluation report template is obtained, the system interface can be used to call from the database storing the template. The risk overview section in the evaluation report template aims to macroscopically describe the risk status of the whole network; the risk analysis section is used to deeply analyze the specific risk points and influencing factors in the network; and the policy suggestion section provides targeted security policy adjustment suggestions for the network administrator based on the analysis results.

[0116] Step S152: filling the description information of the risk level in the risk overview section, including the name identification and definition of the risk level.

[0117] When filling the risk level description information in the risk overview section, the name identification of the risk level is first determined. These name identifications are determined according to the pre-set risk level division standard, for example, can be divided into high risk, medium risk and low risk and different levels. For each risk level, there is a clear definition. The definition will elaborate the risk characteristics and influence degree corresponding to the risk level, for example, the high risk level may mean that the network is facing serious security threats, which may cause key business system paralysis, large amount of sensitive data leakage and other serious consequences; the medium risk level indicates that the network has certain security hidden danger, which may affect part of the business function; the low risk level indicates that the network security situation is relatively good, but still needs to be vigilant. When filling the description information, the actual risk situation of the network to be evaluated can be combined, accurate and clear language is used for expression, and it is ensured that the personnel reading the report can quickly understand the overall risk level of the network.

[0118] Step S153: filling the key risk point distribution information in the risk analysis section, including the component physical location description, logical level description and covered threat type description information of the key risk point.

[0119] In the risk analysis chapter, when filling in the distribution information of key risk points, the component physical location description of the key risk points can be accurate to the specific machine room location, cabinet number, and slot position in the cabinet, and other detailed information. Through the above accurate description, the network administrator can quickly locate the actual physical location of the key risk point. The logical level description explains the hierarchical relationship of the key risk point in the network architecture, such as whether it is in the core layer, the convergence layer, or the access layer, etc. At the same time, the logical connection relationship between the key risk point and other network components can be explained, as well as its importance in the entire network logical structure. For the description information of the covered threat types, various threat types that the key risk point faces can be listed in detail, such as malware attacks, DDoS attacks, phishing attacks, etc. Not only the names of the threat types will be listed, but also the characteristics, attack methods, and possible impacts of each threat type will be analyzed in depth. For example, for malware attacks, the type of malware (such as viruses, Trojans, worms, etc.), the transmission path, and how to attack by exploiting system vulnerabilities, etc. information can be explained.

[0120] Step S154: For each key risk point, a corresponding risk positioning identifier is generated, which contains coordinate information of component physical location and path information of logical level.

[0121] When generating the risk positioning identifier for each key risk point, the coordinate information of component physical location can be obtained through geographic information system (GIS) technology or the positioning system provided by the network device. These coordinate information can accurately reflect the location of the key risk point in the physical space. The path information of logical level is determined by analyzing the network topology structure. Starting from the root node of the network, along the logical connection relationship, each network component and node passed through to reach the key risk point is described step by step, forming a clear path. The coordinate information of component physical location and the path information of logical level are integrated to generate a unique risk positioning identifier. The risk positioning identifier can be presented in the form of code, or can be displayed in the form of graphics in the network topology graph, which is convenient for the network administrator to quickly locate and identify the key risk point.

[0122] Step S155: In the policy suggestion chapter, according to the protection capability characteristics of the key risk point, the security reinforcement measure description information matching the protection capability characteristics is extracted, which contains device configuration adjustment suggestions and communication behavior monitoring suggestions.

[0123] In the policy recommendation chapter, security reinforcement measure description information is extracted according to the protection ability characteristics of key risk points. For device configuration adjustment recommendations, specific device configuration adjustment schemes can be proposed for different key risk points and the threat types they face. For example, if a key risk point is a server and its protection ability is weak, it is vulnerable to network attacks, so it is recommended to upgrade the server's operating system and install the latest security patches to fix known security vulnerabilities; adjust the firewall rules to limit unnecessary network access and only allow legitimate traffic to pass through; configure an intrusion detection system (IDS) or intrusion prevention system (IPS) to monitor and prevent network attacks in real time. For communication behavior monitoring recommendations, appropriate monitoring measures can be proposed based on the communication characteristics and potential threats of the network area where the key risk point is located. For example, real-time monitoring of network traffic in this area can be enhanced by setting traffic thresholds and issuing alerts when traffic exceeds the threshold; deep packet inspection (DPI) can be performed on communication content to identify and block data packets containing malicious code or sensitive information; an abnormal communication behavior model can be established to analyze communication behavior through machine learning algorithms to detect and warn of abnormal communication behavior in a timely manner.

[0124] Step S156: Integrate the contents of the risk overview chapter, the risk analysis chapter and the policy recommendation chapter, add the risk positioning identifier as the visual annotation information of the key risk point, and generate a network security assessment report.

[0125] When integrating the contents of each chapter, the contents of the risk overview chapter, the risk analysis chapter and the policy recommendation chapter can be uniformly typeset and edited according to the format requirements of the assessment report template. Ensure logical coherence between chapters and natural content transition. When adding the risk positioning identifier as the visual annotation information of the key risk point, the risk positioning identifier can be displayed in a visual and clear manner in the report. For example, different colored icons or numbers can be used on the network topology map to represent different key risk points, and the corresponding risk positioning identifier information can be annotated next to them. At the same time, in the text part of the report, the risk positioning identifier will also be described in detail so that network administrators can accurately understand and use this information. After integration and annotation, a complete network security assessment report containing risk positioning identifiers is generated.

[0126] After completing the generation of the network security assessment report, the report is output to the network management terminal. The network management terminal can be a computer, server or dedicated network management platform used by the network administrator. The output method can be through network transmission protocols such as HTTP, FTP, etc. to send the report in the form of an electronic document to the network management terminal. The network administrator can view the report content on the terminal and adjust the network security policy according to the information in the report, such as risk level, key risk point distribution information, and security reinforcement measures, etc. to improve the security of the network and reduce the risk faced by the network.

[0127] For privacy-sensitive data that may be involved in the data collection process, various privacy protection and leakage prevention techniques are adopted. In the data collection phase, privacy-sensitive data is desensitized, such as encrypting and replacing parts involving user identity information, converting real identity information into encrypted codes. In terms of data storage, encryption storage technology is used to encrypt the stored privacy-sensitive data, and only authorized personnel can obtain the original data through decryption algorithm. In the data transmission process, a secure transmission protocol such as SSL / TLS is used to encrypt the data transmission to prevent data from being stolen or tampered with during transmission. At the same time, a strict access control mechanism is established, only authorized personnel can access privacy-sensitive data, and access behavior is recorded and audited to detect abnormal access behavior in a timely manner.

[0128] Regarding the pre-trained security assessment model, its construction and training process is as follows: the security assessment model mainly includes a feature encoding layer, a risk identification layer, a propagation analysis layer and a probability prediction layer. The feature encoding layer is used to convert the input target security feature set into a security feature vector with a unified dimension representation, which processes and converts the input features through a series of neural network layers. The risk identification layer is connected to the feature encoding layer, receives the security feature vector, and processes it through convolutional neural networks and fully connected layers for pattern matching, identifies potential threat scenarios and outputs the type identification information of potential threats. The propagation analysis layer also receives the security feature vector and uses techniques such as graph neural networks to deduce the threat propagation path based on the association between threats and components and the conduction relationship between threats and behaviors, and outputs the propagation path description information. The probability prediction layer receives the security feature vector and uses methods such as recurrent neural networks and logistic regression for statistical learning processing to calculate the trigger probability of potential threats and output the trigger probability description information.

[0129] In the model training phase, a large amount of training data is first prepared, which includes historical threat intelligence data and corresponding network security evaluation results. The training data is divided into a training set and a validation set, the training set is used for training the security evaluation model, and the validation set is used for evaluating the performance of the security evaluation model. In the training process, optimization algorithms such as stochastic gradient descent are used to continuously adjust the parameters of the model, so that the error between the output results of the security evaluation model and the true network security evaluation results is minimized. The training parameters include learning rate, batch size, training round number, etc. The learning rate controls the step size of the model parameter update, the batch size determines the amount of data used for each training, and the training round number represents the number of times the security evaluation model is trained on the entire training set. By continuously adjusting these parameters, the security evaluation model achieves good performance on the validation set. In practical applications, the target security feature set of the network to be evaluated is used as the input of the model, and the security evaluation model outputs the network security evaluation result after processing through each layer, realizing the effective combination of the security evaluation model and the network security evaluation scene.

[0130] Figure 2 A schematic diagram of exemplary hardware and software components of a threat intelligence based network security evaluation system 100 according to some embodiments of the present application is shown. For example, a processor 120 can be used in the threat intelligence based network security evaluation system 100 and used to perform the functions in the present application.

[0131] The threat intelligence based network security evaluation system 100 can be a general-purpose server or a special-purpose server, both of which can be used to implement the threat intelligence based network security evaluation method of the present application. Although only one server is shown in the present application, for the sake of convenience, the functions described in the present application can be implemented in a distributed manner on multiple similar platforms to balance the processing load.

[0132] For example, the threat intelligence based network security evaluation system 100 can include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and different forms of storage media 140, such as a disk, a ROM, or a RAM, or any combination thereof. Exemplarily, the threat intelligence based network security evaluation system 100 can also include program instructions stored in a ROM, a RAM, or other types of non-transitory storage media, or any combination thereof. The method of the present application can be implemented according to these program instructions. The threat intelligence based network security evaluation system 100 also includes an I / O interface 150 between the computer and other input / output devices.

[0133] For the convenience of description, only one processor is described in the threat intelligence based network security assessment system 100. However, it should be noted that the threat intelligence based network security assessment system 100 in the present application can also include multiple processors, and therefore the steps performed by one processor described in the present application can also be jointly performed by multiple processors or individually performed. For example, if the processor of the threat intelligence based network security assessment system 100 performs steps A and B, it should be understood that steps A and B can also be jointly performed by two different processors or individually performed in one processor. For example, a first processor performs step A, a second processor performs step B, or the first processor and the second processor jointly perform steps A and B.

[0134] In addition, the embodiment of the present application further provides a readable storage medium, wherein computer executable instructions are preset, and when a processor executes the computer executable instructions, the threat intelligence based network security assessment method is realized.

[0135] It should be noted that, in order to simplify the description of the present application and to help the understanding of one or more embodiments of the present application, in the foregoing description of the embodiments of the present application, various features are sometimes combined into one embodiment, figure or description thereof.

Claims

1. A method for cyber security assessment based on threat intelligence, characterized in that, The method comprises: obtaining a threat intelligence data set and a network data set to be evaluated, the threat intelligence data set containing type description information and impact range description information of historical threat events, and the network data set to be evaluated containing component configuration description information and communication behavior description information of a current network; performing feature correlation extraction processing on the threat intelligence data set and the network data set to be evaluated to obtain a target security feature set, the target security feature set containing threat-component correlation matching features, threat-behavior impact conduction features, and network component protection capability features; calling a pre-trained security evaluation model to perform risk situation analysis processing on the target security feature set to generate a network security evaluation result, the network security evaluation result containing trigger probability description information of potential threats and propagation path description information of threat impacts; determining a risk level of the network to be evaluated and key risk point distribution information according to the network security evaluation result, the risk level being used to represent the severity of threats faced by the network, and the key risk point distribution information being used to represent the positions of network components with the most concentrated threat impacts; generating a network security evaluation report containing risk positioning marks based on the risk level and the key risk point distribution information, and outputting the network security evaluation report to a network management terminal to support security policy adjustment operations.

2. The threat intelligence based cyber security assessment method as claimed in claim 1, wherein, The obtaining of the threat intelligence data set and the network data set to be evaluated comprises: collecting historical threat event records of different sources from a public threat intelligence platform, the historical threat event records containing timestamp information of event occurrence time, identity description information of threat subjects, technical feature description information of threat means, and loss type description information of event impacts; extracting component configuration records of the current network from a log management system of the network to be evaluated, the component configuration records containing model identification information of network devices, version identification information of software systems, rule description information of access control policies, and protocol type description information of data transmission; extracting communication behavior records of the current network from a traffic monitoring system of the network to be evaluated, the communication behavior records containing interactive object identification information of terminal devices, frequency interval description information of data transmission, sensitive data type description information of communication content, and session termination reason description information of abnormal connections; performing deduplication processing on the historical threat event records, deleting the same timestamp information and the same threat subject identity description information of duplicate records, and retaining unique event records corresponding to different loss type description information; performing format unification processing on the component configuration records and the communication behavior records, and converting information in different log formats into standardized data records with unified field structures; combining the deduplicated historical threat event records as the threat intelligence data set and the component configuration records and the communication behavior records after format unification as the network data set to be evaluated.

3. The threat intelligence based cyber security assessment method as claimed in claim 2, wherein, The collecting of the historical threat event records of different sources from the public threat intelligence platform comprises: Accessing an interface service of a plurality of public threat intelligence platforms, sending a query request containing a time range parameter and a threat type parameter, the time range parameter being used to specify a time interval of collecting events, the threat type parameter being used to specify a threat category of collecting events; Receiving historical threat event record data returned by each public threat intelligence platform, the historical threat event record data containing structured field information and unstructured description information, the structured field information including event ID, occurrence time, threat subject, and impact range, and the unstructured description information including technical details of attack means and specific cases of loss caused; Performing natural language processing on the unstructured description information to extract key information segments therefrom, the key information segments including feature keywords of threat means, type keywords of impact loss, and component type keywords of attack targets; Converting the key information segments into a format consistent with the structured field information to generate historical threat event records of a uniform structure; Cross-verifying historical threat event records returned by different platforms, comparing record information of the same event ID, and correcting inconsistent field contents therein.

4. The threat intelligence based cyber security assessment method as claimed in claim 1, wherein, The feature correlation extraction processing on the threat intelligence data set and the network data set to be evaluated to obtain a target security feature set includes: Performing feature labeling processing on historical threat event records in the threat intelligence data set, adding threat type labels, means feature labels, and impact loss labels to each event record, and the threat type labels being used to distinguish different threat categories; Performing feature labeling processing on component configuration records in the network data set to be evaluated, adding device type labels, protection capability labels, and vulnerability exposure labels to each component configuration record, and the protection capability labels being used to represent the resistance ability level of a device to a set threat; Performing feature labeling processing on communication behavior records in the network data set to be evaluated, adding interaction mode labels, sensitivity level labels, and abnormal tendency labels to each communication behavior record, and the abnormal tendency labels being used to represent the degree of deviation of communication behavior from a normal mode; Establishing an association relationship table of threat type labels and device type labels, counting the number of successful attacks of different threat types on different device types in historical threat events, and generating associated matching features of threats and components; Establishing an association relationship table of means feature labels and abnormal tendency labels, analyzing the matching degree of historical threat means features and current communication abnormal tendency, and generating influence transmission features of threats and behaviors; Establishing an association relationship table of impact loss labels and protection capability labels, calculating the difference between historical threat loss degree and current device protection capability, and generating protection capability features of network components; Merging the associated matching features, the influence transmission features, and the protection capability features as the target security feature set.

5. The threat intelligence based cyber security assessment method as claimed in claim 4, wherein, The feature labeling processing on the historical threat event records in the threat intelligence data set includes: A threat feature label library is established, and the threat feature label library includes a threat type label set, a means feature label set, and an impact loss label set, the threat type label set includes a malware attack label, a phishing attack label, and a DDoS attack label; The threat subject identity description information and the threat means technology feature description information of each historical threat event record are subjected to semantic analysis, threat type keywords are identified, the threat type keywords are matched with the threat type label set, and corresponding threat type labels are added to the historical threat event record; The threat means technology feature description information of each historical threat event record is subjected to pattern recognition, technology feature keywords are extracted, the technology feature keywords are matched with the means feature label set, and corresponding means feature labels are added to the historical threat event record; The loss type description information of the impact of each historical threat event record is classified and summarized, loss type keywords are identified, the loss type keywords are matched with the impact loss label set, and corresponding impact loss labels are added to the historical threat event record; The label addition of each historical threat event record is checked, so that each historical threat event record includes at least one threat type label, one means feature label, and one impact loss label, and historical threat event records that do not meet the label quantity requirement are subjected to supplementary labeling processing.

6. The threat intelligence based cyber security assessment method as claimed in claim 1, wherein, The pre-trained security evaluation model is called to perform risk situation analysis processing on the target security feature set, and a network security evaluation result is generated, including: The target security feature set is input into the feature encoding layer of the security evaluation model, the associated matching feature, the impact conduction feature, and the defense capability feature are subjected to vector conversion processing, and a security feature vector with uniform dimension representation is generated; The security feature vector is subjected to pattern matching processing by the risk identification layer of the security evaluation model, potential threat scenarios that match historical threat event patterns are identified, and type identification information of the potential threat is output; The security feature vector is subjected to path derivation processing by the propagation analysis layer of the security evaluation model, based on the association relationship between threats and components and the conduction relationship between threats and behaviors, the propagation path of the threat from the initial attack point to the target component is derived, and propagation path description information of the threat impact is output; The security feature vector is subjected to statistical learning processing by the probability prediction layer of the security evaluation model, the triggering possibility of the potential threat scenario in the current network environment is calculated, and triggering probability description information of the potential threat is output; The type identification information of the potential threat, the propagation path description information of the threat impact, and the triggering probability description information of the potential threat are combined as the network security evaluation result.

7. The threat intelligence based cyber security assessment method as claimed in claim 6, wherein, The security feature vector is subjected to path derivation processing by the propagation analysis layer of the security evaluation model, based on the association relationship between threats and components and the conduction relationship between threats and behaviors, the propagation path of the threat from the initial attack point to the target component is derived, and propagation path description information of the threat impact is output, including: extracting, from the security feature vector, threat and component association matching features by a propagation analysis layer of the security assessment model, the threat and component association matching features including threat type and device type association probability values; extracting, from the security feature vector, threat and behavior influence conduction features, the threat and behavior influence conduction features including threat means and communication abnormality tendency matching degree values; establishing a threat propagation path derivation rule, the threat propagation path derivation rule defining an initial attack point as a communication behavior occurrence point with a significant abnormality tendency, an intermediate node as a device type component with a threat type association probability value exceeding a threshold value, and a terminal point as a target component corresponding to an impact loss label; starting from the initial attack point, selecting a next intermediate node according to the association probability value, the selection priority of the intermediate node being positively correlated with the size of the association probability value; between adjacent nodes, judging whether a threat means can be conducted to a next node through a current communication behavior according to the matching degree value, the conduction condition being that the matching degree value exceeds a preset conduction threshold value; repeating the node selection and conduction judgment process until the target component is reached or the conduction cannot continue, and generating complete threat influence propagation path description information.

8. The threat intelligence based cyber security assessment method as claimed in claim 1, wherein, The method further includes the following steps: parsing trigger probability description information of potential threats in the network security assessment result, and extracting a trigger probability value corresponding to each potential threat type; parsing threat influence propagation path description information in the network security assessment result, and extracting network component identification information involved in each propagation path; establishing an evaluation rule table of risk levels, the evaluation rule table including a correspondence between different trigger probability value ranges and risk levels, and determining a risk level of the network to be evaluated according to a matching result of the trigger probability value and the evaluation rule table; counting a number of times that a network component involved in each propagation path is covered by different threat types, and generating a component risk coverage number statistical result; extracting a network component whose coverage number exceeds a preset threshold in the component risk coverage number statistical result, and taking identification information of the network component as key risk point identification information; analyzing a position distribution of a network component corresponding to the key risk point identification information in a propagation path, and generating key risk point distribution information including a component physical location and a logical level.

9. The threat intelligence based cyber security assessment method of claim 8, wherein, The method further includes the following steps: initializing a statistical table of component risk coverage numbers, a row field of the statistical table being network component identification information, and a column field being threat type label information; traversing all threat influence propagation path description information, and extracting network component identification information and corresponding threat type label information involved in each path; for each network component identification information and threat type label information in each path, increasing a count by 1 in a cross cell of a corresponding row and column in the statistical table. The statistical table is summarized to calculate a count sum of all threat type label information corresponding to each network component identification information, and generate a component total risk coverage number of times; The statistical table is classified to calculate a count sum of all network component identification information corresponding to each threat type label information, and generate a threat type coverage component number; The statistical table, the component total risk coverage number of times and the threat type coverage component number are merged as a component risk coverage number of times statistical result. 10.A system for threat intelligence based cyber security assessment, the system comprising: The network security evaluation method based on threat intelligence comprises a processor and a memory, the memory is connected with the processor, the memory is used for storing programs, instructions or codes, and the processor is used for executing the programs, instructions or codes in the memory to realize the network security evaluation method based on threat intelligence in any one of claims 1-9.

Images