Evaluation method and device for information security protection

Abstract

The invention discloses an information security protection assessment method and device, the method is used for performing security protection assessment on an information security protection device, and the method comprises the following steps: performing a vulnerability scanning test on each module of the information security protection device to obtain a vulnerability test value of each module; performing an attack reliability test on each module of the information security protection device to obtain an attack reliability test value set; the attack reliability test value set comprises a reliability value and an attack connection value of each module; and performing system security protection evaluation processing on the vulnerability test value and the attack reliability test value set to obtain a security protection evaluation value of the information security protection device.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and information system technology, and particularly relates to an information security protection evaluation method and device. BACKGROUND

[0002] Currently, with the rapid development of information technology, network attack means is becoming increasingly complex and diverse, and information security protection devices play a crucial role in ensuring the security of network systems. However, the existing information security protection evaluation methods still have many shortcomings, which are difficult to meet the growing security needs.

[0003] In terms of vulnerability scanning tests, traditional methods often only evaluate based on the results of a single vulnerability scanning tool, lacking fusion analysis of multi-source vulnerability information. Different scanning tools may produce result deviations due to differences in detection range and detection rules, resulting in incomplete and inaccurate vulnerability evaluation of information security protection devices. For example, some critical vulnerabilities may not be discovered due to the limitations of scanning tools, leaving the system with security risks. In addition, traditional methods usually only focus on the presence or absence of vulnerabilities, ignoring the relevance between vulnerabilities and the comprehensive impact on the overall system security.

[0004] In terms of attack reliability tests, existing technologies mostly focus on evaluating the single-point attack resistance of information security protection devices, lacking comprehensive consideration of the reliability and stability of the devices under continuous attacks. For example, when facing long-term and high-intensity network attacks, devices may experience performance degradation, connection interruption, and other problems, but traditional evaluation methods are difficult to effectively simulate and evaluate these situations. At the same time, existing methods often ignore the collaborative working ability between different modules and the chain reaction of attacks on the entire system.

[0005] In terms of system security protection evaluation processing, traditional methods usually use simple weighted summation or threshold judgment methods, failing to fully consider the internal correlation between vulnerability test values and attack reliability test values and the comprehensive impact on the overall system security protection capability. This evaluation method cannot accurately reflect the actual security state of information security protection devices, which may lead to a large deviation between the evaluation results and the actual situation.

[0006] In summary, the existing information security protection evaluation methods have obvious shortcomings in vulnerability scanning tests, attack reliability tests, and system security protection evaluation processing, and there is an urgent need for a more comprehensive, accurate, and efficient evaluation method to improve the evaluation quality and security of information security protection devices. SUMMARY

[0007] The application mainly solves the problems of the existing information security protection evaluation method in the aspects of vulnerability scanning test, attack reliability test and system security protection evaluation processing, and discloses an information security protection evaluation method and device.

[0008] In a first aspect, the application discloses an information security protection evaluation method, which is used for evaluating the security protection of an information security protection device.

[0009] S1, performing vulnerability scanning test on each module of the information security protection device to obtain a vulnerability test value of each module;

[0010] S2, performing attack reliability test on each module of the information security protection device to obtain an attack reliability test value set; the attack reliability test value set includes a reliability value and an attack connection value of each module;

[0011] S3, performing system security protection evaluation processing on the vulnerability test value and the attack reliability test value set to obtain a security protection evaluation value of the information security protection device.

[0012] The vulnerability scanning test on each module of the information security protection device to obtain a vulnerability test value of each module includes:

[0013] S11, performing vulnerability scanning on each module of the information security protection device by using a security vulnerability scanning tool to obtain a corresponding scanning result information set; the vulnerability scanning includes a plurality of vulnerability scanning items; the scanning result information set includes scanning result information, and each scanning result information corresponds to a vulnerability scanning item;

[0014] S12, obtaining a risk vulnerability library corresponding to the security vulnerability scanning tool; the risk vulnerability library records a standard result data set obtained by the security vulnerability scanning tool after scanning; the standard result data set includes a standard result data sub-set; each standard result data sub-set corresponds to a vulnerability scanning item;

[0015] S13, performing vulnerability fusion evaluation processing on the scanning result information set and the standard result data set to obtain a vulnerability test value of the module.

[0016] The vulnerability fusion evaluation processing on the scanning result information set and the standard result data set to obtain a vulnerability test value of the module includes:

[0017] S131, the scanning result information set and the standard result data set are respectively represented as a scanning matrix and a standard matrix; a row vector of the scanning matrix is a scanning result information; a row vector of the standard matrix is a standard result data sub-set;

[0018] S132, the scanning matrix and the standard matrix are subtracted to obtain a difference matrix;

[0019] S133, singular value decomposition is performed on the difference matrix to obtain a singular value sequence; the singular value sequence includes a plurality of singular values;

[0020] S134, the rank value τ of the difference matrix is calculated;

[0021] S135, difference feature calculation is performed on the difference matrix to obtain the vulnerability test value of the module.

[0022] The expression of the difference feature calculation is:

[0023]

[0024] Wherein, C ij is the element of the i-th row and j-th column of the difference matrix, γ i is the i-th singular value of the singular value sequence, C i is the mean value of the i-th row of the difference matrix, M and N are the row dimension and column dimension of the difference matrix respectively, γ0 and γ max are the average value and the maximum value of the singular value sequence respectively, p is the vulnerability test value of the module, is an N-order Weibull function.

[0025] The attack reliability test value set of each module of the information security protection device includes:

[0026] S21, simulating network attacks on each module of the information security protection device to obtain an anti-attack evaluation value of each module;

[0027] S22, performing reliability test on each module of the information security protection device to obtain a reliability value of each module;

[0028] S23, constructing the attack reliability test value set by using the anti-attack evaluation value and the reliability value of all modules.

[0029] The attack reliability test value set of each module of the information security protection device includes:

[0030] S211, respectively, each module of the information security protection device is simulated network attack in several preset time intervals, and the module connectivity probability of each module in each time interval is obtained;

[0031] S212, the module connectivity probability of all time intervals and the middle time value of the time interval are calculated by function fitting, and a probability fitting curve is obtained;

[0032] S213, the probability fitting curve is calculated by transformation, and the anti-attack evaluation value of the module is obtained.

[0033] The system security protection evaluation processing is performed on the vulnerability test value and the attack reliability test value set, and the security protection evaluation value of the information security protection device is obtained, including:

[0034] S31, the system vulnerability evaluation value is calculated by system vulnerability evaluation calculation on all vulnerability test values;

[0035] The expression of the system vulnerability evaluation calculation is:

[0036]

[0037] Where, p i The vulnerability test value of the i th module, Lf is the system vulnerability evaluation value, w i The preset importance weight of the i th module, and F is the total number of modules;

[0038] S32, the system security protection evaluation value of the information security protection device is obtained by system security protection evaluation calculation on the system vulnerability evaluation value and the attack reliability test value set.

[0039] The second aspect of the embodiment of the application discloses an information security protection evaluation device, and the device comprises:

[0040] The memory stores executable program codes;

[0041] The processor is coupled with the memory;

[0042] The processor calls the executable program codes stored in the memory, and executes the information security protection evaluation method.

[0043] The third aspect of the embodiment of the application discloses a computer storage medium, the computer storage medium stores computer instructions, and the computer instructions are called by a computer to execute the information security protection evaluation method.

[0044] The fourth aspect of the embodiment of the present application discloses an information data processing terminal, which is used for realizing the information security protection evaluation method.

[0045] The present application has the following beneficial effects:

[0046] The information security protection evaluation method provided by the embodiment of the present application realizes comprehensive and accurate evaluation of the information security protection device through three key links of vulnerability scanning test, attack reliability test and system security protection evaluation processing, and has the following remarkable beneficial effects:

[0047] In the vulnerability scanning test link, the present application adopts a multi-source vulnerability information fusion evaluation technology, uses a security vulnerability scanning tool to obtain a scanning result information set, and combines a standard result data set in a risk vulnerability library to perform vulnerability fusion evaluation processing. By expressing the scanning result information set and the standard result data set in the form of a matrix and performing singular value decomposition and difference feature calculation, potential security vulnerabilities can be effectively identified, and the accuracy and comprehensiveness of vulnerability detection are improved. Compared with the traditional method, the present application can more accurately evaluate the vulnerability of the information security protection device, and timely discover and repair potential security risks.

[0048] In the attack reliability test link, the present application evaluates the reliability and stability of the information security protection device when facing attacks through simulation of network attacks and reliability test. By performing simulation attacks in multiple preset time intervals, obtaining a module connectivity probability, and performing function fitting and transformation calculation, the anti-attack ability of the device under continuous attack can be accurately evaluated. At the same time, in combination with the reliability value obtained through the reliability test, an attack reliability test value set is constructed, which provides more comprehensive and accurate data support for subsequent system security protection evaluation. Compared with the traditional method, the present application can more realistically simulate the actual network attack scene, evaluate the reliability and stability of the device, and provide a strong basis for optimization and improvement of the device.

[0049] In the system security protection evaluation processing link, the present application adopts a combination of system vulnerability evaluation calculation and system security protection evaluation calculation, fully considers the internal correlation between the vulnerability test value and the attack reliability test value and the comprehensive influence on the overall system security protection capability. Through the system vulnerability evaluation calculation expression, the system vulnerability evaluation value can be accurately calculated, reflecting the overall vulnerability risk of the system. In combination with the attack reliability test value set for system security protection evaluation calculation, the security protection evaluation value of the information security protection device can be obtained, and the security protection capability of the device can be comprehensively and accurately evaluated. Compared with the traditional method, the evaluation result of the present application is more scientific and accurate, and can provide strong decision support for the design, optimization and management of the information security protection device.

[0050] In summary, the information security protection evaluation method provided by the embodiment of the present application effectively solves the problems in the prior art by innovative technical means and evaluation models, improves the accuracy, comprehensiveness and reliability of information security protection device evaluation, and has important practical application value and popularization prospect. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 The flow chart of the method is shown. DETAILED DESCRIPTION

[0052] In order to better understand the content of the present application, an embodiment is given here.

[0053] Figure 1 The flow chart of the method is shown.

[0054] In the first aspect of the embodiment of the present application, an information security protection evaluation method is disclosed, which is used for security protection evaluation of an information security protection device, and the method comprises the following steps:

[0055] S1, performing vulnerability scanning test on each module of the information security protection device to obtain a vulnerability test value of each module;

[0056] S2, performing attack reliability test on each module of the information security protection device to obtain an attack reliability test value set; the attack reliability test value set comprises a reliability value and an attack connection value of each module;

[0057] S3, performing system security protection evaluation processing on the vulnerability test value and the attack reliability test value set to obtain a security protection evaluation value of the information security protection device.

[0058] The information security protection device comprises a boundary protection module, an access control module and a data encryption module; each module is connected to each other;

[0059] The boundary protection module is used for providing boundary protection and blocking external attacks; the access control module is used for identity authentication and access control; the data encryption module is used for data encryption to protect information from being acquired by the outside world; the boundary protection module can be realized by a firewall and the like;

[0060] The vulnerability scanning test on each module of the information security protection device to obtain a vulnerability test value of each module comprises the following steps:

[0061] S11, performing vulnerability scanning on each module of the information security protection device respectively by using a security vulnerability scanning tool to obtain a corresponding scanning result information set; the vulnerability scanning includes a plurality of vulnerability scanning items; the scanning result information set includes scanning result information, and each scanning result information corresponds to a vulnerability scanning item;

[0062] S12, obtaining a risk vulnerability library corresponding to the security vulnerability scanning tool; the risk vulnerability library records a standard result data set after scanning by the security vulnerability scanning tool; the standard result data set includes a standard result data sub-set; each standard result data sub-set corresponds to a vulnerability scanning item;

[0063] The standard result data is standard data obtained after performing a vulnerability scanning on an information system without security vulnerabilities by using the security vulnerability scanning tool;

[0064] S13, performing vulnerability fusion evaluation processing on the scanning result information set and the standard result data set to obtain a vulnerability test value of the module;

[0065] The vulnerability fusion evaluation processing on the scanning result information set and the standard result data set to obtain the vulnerability test value of the module includes:

[0066] S131, representing the scanning result information set and the standard result data set as a scanning matrix and a standard matrix respectively; a row vector of the scanning matrix is a scanning result information; a row vector of the standard matrix is a standard result data sub-set;

[0067] S132, subtracting the scanning matrix and the standard matrix to obtain a difference matrix;

[0068] S133, performing singular value decomposition on the difference matrix to obtain a singular value sequence; the singular value sequence includes a plurality of singular values;

[0069] S134, calculating a rank value τ of the difference matrix;

[0070] S135, performing difference feature calculation on the difference matrix to obtain the vulnerability test value of the module.

[0071] The expression of the difference feature calculation is:

[0072]

[0073] Wherein, C ij is an element of the i-th row and the j-th column of the difference matrix, γ i is the i-th singular value of the singular value sequence, and C iis the mean value of the i-th row of the difference matrix, M and N are the row dimension and column dimension of the difference matrix respectively, γ0 and γ max are the mean value and maximum value of the singular value sequence respectively, p is the vulnerability test value of the module, is the N-order Weibull function.

[0074] The expression of the difference feature calculation, by obtaining the singular value sequence through singular value decomposition, combines the singular value characteristics of the matrix with the element characteristics of the difference matrix, can capture the difference between the scanning result and the standard result from multiple dimensions, and improves the accuracy of vulnerability evaluation. The rank value τ of the difference matrix and the statistical characteristics of the singular value sequence Adaptive weight adjustment of different vulnerability characteristics is realized. For important vulnerability characteristics, higher weight is given, so that the influence of key vulnerabilities is more prominent. The exponential function Nonlinear mapping of the difference can better handle the complex relationship between vulnerability characteristics, and improve the expression ability of the evaluation model. The N-order Weibull function is used for standardization processing of the evaluation result, so that the vulnerability test values of different modules have comparability, which is convenient for subsequent system security evaluation.

[0075] The attack reliability test on each module of the information security protection device obtains a set of attack reliability test values, comprising:

[0076] S21, simulating network attacks on each module of the information security protection device to obtain an anti-attack evaluation value of each module;

[0077] S22, performing reliability test on each module of the information security protection device to obtain a reliability value of each module;

[0078] S23, using the anti-attack evaluation value and the reliability value of all modules to construct a set of attack reliability test values.

[0079] The attack reliability test on each module of the information security protection device obtains a set of attack reliability test values, comprising:

[0080] S211, simulating network attacks on each module of the information security protection device in a plurality of preset time intervals to obtain a module connectivity probability of each module in each time interval;

[0081] S212, performing function fitting calculation on the module connectivity probability of all time intervals and the middle time value of the time interval to obtain a probability fitting curve;

[0082] S213, transforming and calculating the probability fitting curve to obtain the anti-attack evaluation value of the module;

[0083] The function fitting calculation takes the module connectivity probability of all time intervals as the dependent variable and the middle time value of all time intervals as the independent variable, and performs linear function fitting on the independent variable and the dependent variable to obtain a probability fitting curve.

[0084] The expression of the transformation calculation is:

[0085]

[0086] Wherein, kz is the anti-attack evaluation value of the module, tmax is the maximum value of the middle time value of all time intervals, p(t) is the probability fitting curve, and t is the time variable.

[0087] The system security protection evaluation processing is performed on the vulnerability test value and the attack reliability test value set to obtain the security protection evaluation value of the information security protection device, including:

[0088] The system vulnerability evaluation calculation is performed on all vulnerability test values to obtain a system vulnerability evaluation value.

[0089] The expression of the system vulnerability evaluation calculation is:

[0090]

[0091] Wherein, p i is the vulnerability test value of the i-th module, Lf is the system vulnerability evaluation value, w i is the preset importance weight of the i-th module, and F is the total number of modules.

[0092] The system security protection evaluation calculation is performed on the system vulnerability evaluation value and the attack reliability test value set to obtain the security protection evaluation value of the information security protection device.

[0093] The system vulnerability evaluation calculation decomposes the information security protection device into multiple modules, calculates the vulnerability test value of each module, and combines the importance weight of the module for comprehensive evaluation, thereby realizing modular security analysis of the system. The multiplication form calculation can accurately reflect the cumulative effect of the vulnerability risk of each module in the system. When a module has a serious vulnerability, the system vulnerability evaluation value will be significantly reduced, thereby reminding the management personnel to focus on the security problem of the module. Through the preset importance weight of the module, the importance of the module in the system can be evaluated differently. For a critical module, a higher weight is given, so that the evaluation result is more in line with the actual security requirements. The multiplication form calculation is mathematically rigorous and can accurately describe the propagation and accumulation process of the system vulnerability risk, thereby providing a scientific basis for system security decision-making.

[0094] The expression of the system security protection evaluation calculation is:

[0095]

[0096] Wherein, FH is the security protection evaluation value of the information security protection device, kz i is the anti-attack evaluation value of the i th module, R i is the reliability value of the i th module.

[0097] The module communication probability is that the number of times that the module can normally work and communicate is measured in a time interval, and the number of times is divided by the total number of simulated network attacks to obtain the module communication probability.

[0098] The simulated network attack can adopt SQL injection (SQL Injection), cross-site scripting (XSS), remote code execution (RCE) or buffer overflow attack, etc.

[0099] The reliability test can adopt an electrical performance reliability test method, and the reliability value can adopt a rated voltage / current deviation value.

[0100] The security vulnerability scanning tool can be a professional scanning tool, such as Greenmo RSAS, AXT-DBS, etc.

[0101] The risk vulnerability library can be a CVE vulnerability library.

[0102] The information security protection device includes a sensitive information management module, a sensitive place management module, a sensitive meeting and activity management module, a sensitive device management module, a sensitive carrier management module and a sensitive post management module, and each module is connected with each other.

[0103] Each module of the information security protection device can be realized by a computer network.

[0104] In a second aspect of the embodiment of the present application, an information security protection evaluation device is disclosed, and the device comprises:

[0105] A memory storing executable program codes;

[0106] A processor coupled with the memory;

[0107] The processor calls the executable program codes stored in the memory to execute the information security protection evaluation method.

[0108] The third aspect of the embodiment of the present application discloses a computer storage medium, the computer storage medium stores computer instructions, the computer instructions are called by a computer, and are used for executing the information security protection evaluation method.

[0109] The fourth aspect of the embodiment of the present application discloses an information data processing terminal, the information data processing terminal is used for implementing the information security protection evaluation method.

[0110] The above merely illustrates the embodiments of the present application, and is not intended to limit the present application. The present application can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. An assessment method for information security protection, characterized in that, A method for security assessment of an information security protection device, the method comprising: S1, performing vulnerability scanning test on each module of the information security protection device to obtain a vulnerability test value of each module; S2, performing attack reliability test on each module of the information security protection device to obtain an attack reliability test value set; the attack reliability test value set comprises a reliability value and an attack connection value of each module; S3, performing system security assessment processing on the vulnerability test value and the attack reliability test value set to obtain a security assessment value of the information security protection device.

2. The method of claim 1, wherein, The vulnerability scanning test on each module of the information security protection device to obtain a vulnerability test value of each module comprises: S11, using a security vulnerability scanning tool to perform vulnerability scanning on each module of the information security protection device respectively to obtain a corresponding scanning result information set; the vulnerability scanning comprises a plurality of vulnerability scanning items; the scanning result information set comprises scanning result information, and each scanning result information corresponds to a vulnerability scanning item; S12, obtaining a risk vulnerability library corresponding to the security vulnerability scanning tool; the risk vulnerability library records a standard result data set after scanning by the security vulnerability scanning tool; the standard result data set comprises a plurality of standard result data sub-sets; each standard result data sub-set corresponds to a vulnerability scanning item; S13, performing vulnerability fusion evaluation processing on the scanning result information set and the standard result data set to obtain the vulnerability test value of the module.

3. The method of claim 2, wherein the information security posture is evaluated by: The vulnerability fusion evaluation processing on the scanning result information set and the standard result data set to obtain the vulnerability test value of the module comprises: S131, representing the scanning result information set and the standard result data set as a scanning matrix and a standard matrix respectively; a row vector of the scanning matrix is a scanning result information; a row vector of the standard matrix is a standard result data sub-set; S132, subtracting the scanning matrix from the standard matrix to obtain a difference matrix; S133, performing singular value decomposition on the difference matrix to obtain a singular value sequence; the singular value sequence comprises a plurality of singular values; S134, calculating a rank value τ of the difference matrix; S135, performing difference feature calculation on the difference matrix to obtain the vulnerability test value of the module.

4. The method of claim 3, wherein, The expression of the difference feature calculation is: wherein C ij is the element of the difference matrix in the i-th row and j-th column, γ i is the i-th singular value of the singular value sequence, C i is the mean value of the i-th row of the difference matrix, M and N are the row dimension and column dimension of the difference matrix respectively, γ0 and γ max are the mean value and maximum value of the singular value sequence respectively, p is the vulnerability test value of the module, is the N-order Weibull function.

5. The method of claim 1, wherein, The attack reliability test on each module of the information security protection device to obtain an attack reliability test value set comprises: S21, performing simulated network attack on each module of the information security protection device to obtain an anti-attack evaluation value of each module; S22, performing reliability test on each module of the information security protection device to obtain a reliability value of each module; S23, constructing the attack reliability test value set by using the anti-attack evaluation value and the reliability value of all modules.

6. The method of claim 5, wherein, The simulated network attack on each module of the information security protection device to obtain an anti-attack evaluation value of each module comprises: S211, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to each module of the information security protection device in several preset time intervals, respectively, to ​ ​ 7. The method of claim 1, wherein the information security posture is evaluated based on the information security posture of the at least one other entity. ​ ​ ​ Wherein, p i is the vulnerability test value of the i th module, Lf is the system vulnerability evaluation value, w i is the preset importance weight of the i th module, and F is the total number of modules. ​ 8. An information security protection evaluation device characterized by comprising: ​ ​ ​ ​ 9. A computer storable medium, characterized by ​ 10. An information data processing terminal, characterized by ​

Images