Network security risk prevention and control method and device, computer equipment and medium

Abstract

The embodiment of the invention provides a network security risk prevention and control method and device, computer equipment and a medium, and relates to the technical field of network security, and the method comprises the steps: obtaining a plurality of risk criteria for different risk scenes; obtaining asset data of a network to be prevented and controlled and vulnerability data of an internal network, matching the asset data and the vulnerability data with a plurality of risk criteria, and determining the matched risk criteria; according to the industry characteristics of the network to be prevented and controlled and the network condition of the network to be prevented and controlled, dynamically evaluating the numerical value of the risk factor and adjusting the enterprise attribute weight, and according to the evaluated numerical value of the risk factor and the adjusted enterprise attribute weight, quantitatively calculating the risk value of each matched risk criterion again; re-determining the risk priority of each matched risk criterion according to the calculated risk value; and forming a current risk list according to the matched risk criterion. According to the scheme, more accurate and effective network risk prevention and control are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security risk prevention and control method, device, computer equipment, and medium. Background Technology

[0002] Currently, a popular cybersecurity rating technology abroad is SecurityScorecard. It aims to design a multi-dimensional security indicator system and a quantitative scoring mechanism to continuously monitor and evaluate the cybersecurity status of enterprises and their supply chains. This technology is also used in cybersecurity insurance abroad. Key technologies include: Security Ratings: SecurityScorecard assesses a company's cybersecurity status based on publicly available cybersecurity intelligence and its assets, such as network domains, assigning a score similar to a credit score. Scores are typically based on multiple dimensions, such as vulnerability exposure, malware activity, exposed ports, and insecure configurations.

[0003] Supply Chain Security Risk Assessment: A significant portion of the security risks for modern enterprises stems from their supply chains. SecurityScorecard conducts security assessments of clients' suppliers and partners to help identify and mitigate supply chain attack risks, incorporating these assessments into clients' own risk rating factors.

[0004] Automated Continuous Monitoring: The SecurityScorecard platform continuously and automatically monitors customers' publicly accessible internet assets, reflecting changes in risk in real time and automatically notifying relevant contacts to pay attention to abnormal changes in risk.

[0005] Threat Intelligence Integration: SecurityScorecard aggregates a large amount of threat intelligence and security incident data, enabling insights into the latest attack trends and vulnerability situations. Combined with automated continuous monitoring and retrieval of threat incident intelligence relevant to customers, it provides timely risk feedback.

[0006] However, SecurityScorecard also has some shortcomings: for example, existing platforms (such as risk control platforms) only provide qualitative standards for high / medium / low-level risk event alerts, which cannot form effective quantitative risk guidance and make it impossible to monitor changes in the security situation in real time; risk assessment based on static security indicator systems or quantitative scoring mechanisms cannot be applied to dynamic changes in risks, affecting the accuracy of assessment results. Summary of the Invention

[0007] In view of this, embodiments of the present invention provide a network security risk prevention and control method to solve the technical problems of inaccuracy and inability to quantify network risk assessments in the prior art. The method includes: Multiple risk criteria are obtained for different risk scenarios. Each risk criterion includes a criterion type, triggering condition, security response action, and risk priority. For each risk criterion, the security response action of the risk criterion is triggered and executed when the triggering condition is detected. Obtain asset data and internal network vulnerability data of the network to be protected, match the asset data and vulnerability data with multiple risk criteria, and determine the matching risk criteria; Based on the industry characteristics and network status of the network to be controlled, the values ​​of risk factors are dynamically evaluated and the weights of enterprise attributes are adjusted. Based on the evaluated values ​​of risk factors and the adjusted weights of enterprise attributes, the risk value of each matching risk criterion is recalculated. Based on the calculated risk value, the risk priority of each matching risk criterion is re-determined. A current risk list is generated based on matching risk criteria. The current risk list includes the current risk scenario and the relevant content of the matching risk criteria.

[0008] This invention also provides a network security risk prevention and control device to address the technical problems of inaccuracy and lack of quantification in existing network risk assessments. The device includes: The acquisition module is used to acquire multiple risk criteria for different risk scenarios. Each risk criterion includes a type, triggering condition, security response action, and risk priority. For each risk criterion, the security response action of the risk criterion is triggered and executed when the triggering condition is detected. The matching module is used to acquire asset data and internal network vulnerability data of the network to be controlled, and match the asset data and vulnerability data with multiple risk criteria to determine the matching risk criteria; The adjustment module is used to dynamically evaluate the values ​​of risk factors and adjust the weights of enterprise attributes based on the industry characteristics and network conditions of the network to be controlled. Based on the evaluated values ​​of risk factors and the adjusted weights of enterprise attributes, the module recalculates the risk value of each matching risk criterion and redetermines the risk priority of each matching risk criterion based on the calculated risk value. The prevention and control module is used to generate a current risk list based on matching risk criteria. The current risk list includes the current risk scenario and the relevant content of the matching risk criteria.

[0009] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned network security risk prevention and control methods, thereby solving the technical problems of inaccuracy and inability to quantify network risk assessment in the prior art.

[0010] This invention also provides a computer-readable storage medium storing a computer program that executes any of the above-described network security risk prevention and control methods, in order to solve the technical problems of inaccuracy and inability to quantify network risk assessment in the prior art.

[0011] Compared with existing technologies, the beneficial effects achieved by at least one of the above-mentioned technical solutions adopted in the embodiments of this specification include at least the following: It proposes risk prevention and control based on multiple risk criteria for different risk scenarios, enabling targeted risk prevention and control. Compared with the generalized risk assessment methods of traditional technologies, this application can more accurately, precisely, and effectively prevent and control network risks in risk scenarios. Furthermore, it proposes dynamically evaluating the values ​​of risk factors and adjusting the weights of enterprise attributes based on the industry characteristics and network conditions of the network to be prevented. Then, it re-quantifies and calculates the risk value of each matching risk criterion based on the evaluated risk factor values ​​and adjusted enterprise attribute weights, and redetermines the risk priority of each matching risk criterion based on the calculated risk values. This allows for targeted prevention and control based on different industry characteristics and the network to be prevented. This application dynamically adjusts the risk priority of risk criteria based on network conditions, and conducts risk prevention and control based on the dynamically adjusted risk priority. Compared with existing traditional methods that rely on static security indicator systems or quantitative scoring mechanisms for risk assessment, this application can dynamically apply different industry characteristics and dynamic changes in risks to more accurately and effectively prevent and control network risks, avoiding false alarms or missed alarms. Furthermore, it proposes matching security data such as asset data of the network to be protected and vulnerability data of the internal network with multiple risk criteria, enabling the real-time, efficient, and accurate generation of a current risk list based on more comprehensive security data. Then, based on the current risk scenarios in the current risk list, alarms or security response actions can be triggered according to risk priority, achieving real-time, effective, and reliable network security risk prevention and control. Moreover, the inclusion of risk transfer measures helps to significantly reduce residual risks that cannot be completely eliminated. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a network security risk prevention and control method provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating a dynamic adjustment of risk criteria provided by an embodiment of the present invention; Figure 3 This is a structural block diagram of a computer device provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a network security risk prevention and control device provided in an embodiment of the present invention. Detailed Implementation

[0014] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0015] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] In this embodiment of the invention, a method for preventing and controlling network security risks is provided, such as... Figure 1 As shown, the method includes: Step S101: Obtain multiple risk criteria for different risk scenarios. Each risk criterion includes a type, triggering condition, security response action, and risk priority. For each risk criterion, when the triggering condition is detected, trigger the execution of the security response action of that risk criterion. Step S102: Obtain asset data and internal network vulnerability data of the network to be controlled, match the asset data and vulnerability data with multiple risk criteria, and determine the matching risk criteria; Step S103: Based on the industry characteristics and network conditions of the network to be controlled, dynamically evaluate the values ​​of risk factors and adjust the weights of enterprise attributes. Based on the evaluated values ​​of risk factors and the adjusted weights of enterprise attributes, recalculate the risk value of each matching risk criterion. Based on the calculated risk value, redetermine the risk priority of each matching risk criterion.

[0017] Step S104: Generate a current risk list based on the matching risk criteria. The current risk list includes the current risk scenario and the relevant content of the matching risk criteria. Depend on Figure 1 As shown in the flowchart, this application proposes a risk prevention and control approach based on multiple risk criteria for different risk scenarios. This allows for targeted, specific risk prevention and control. Compared to the generalized risk assessment methods of traditional technologies, this application can more accurately, precisely, and effectively prevent and control network risks in specific risk scenarios. Furthermore, it proposes dynamically evaluating the values ​​of risk factors and adjusting the weights of enterprise attributes based on the industry characteristics and network conditions of the network to be prevented. Then, it re-quantifies and calculates the risk value of each matching risk criterion based on the evaluated risk factor values ​​and adjusted enterprise attribute weights. Finally, it redetermines the risk priority of each matching risk criterion based on the calculated risk values, enabling the risk priority of risk criteria to be adjusted according to different industry characteristics and network conditions of the network to be prevented. This application dynamically adjusts risk priorities based on dynamically adjusted risk criteria for risk prevention and control. Compared to existing traditional methods that rely on static security indicator systems or quantitative scoring mechanisms for risk assessment, this application can dynamically adapt to different industry characteristics and dynamic changes in risks to more accurately and effectively prevent and control network risks, avoiding false alarms or missed alarms. Furthermore, it proposes matching security data, such as asset data of the network to be protected and vulnerability data of the internal network, with multiple risk criteria. This enables the real-time, efficient, and accurate generation of a current risk list based on more comprehensive security data. Subsequently, based on the current risk scenarios in the risk list, alarms can be triggered or security response actions can be executed according to risk priority, achieving real-time, effective, and reliable network security risk prevention and control.

[0018] In practice, the aforementioned risk scenarios may include data breaches, software ransomware, data unavailability, business interruption, physical damage, and other scenarios. At least one risk criterion can be constructed for each risk scenario, and the risk criteria corresponding to multiple risk scenarios form a risk criterion library.

[0019] In specific implementation, such as Figure 2 As shown, the risk criteria library can be constructed and optimized through the following steps.

[0020] 1. Construct a risk criterion library for risk scenarios in cybersecurity and the data flow and processing procedures for dynamic risk weight adjustment: Data input: Historical cybersecurity incident database (including information such as attack type, amount of loss, and industry distribution); Unstructured threat intelligence information (vulnerability information and malicious activity records related to enterprise systems, etc.); Industry-specific cybersecurity regulatory requirements for enterprises. For example, the financial industry has parallel regulatory requirements from the National Financial Regulatory Commission and the People's Bank of China; For example, based on five basic risk scenarios—data breach, software ransomware, data unavailability, business interruption, and physical damage—risk criteria are developed for each risk scenario to establish a risk criteria library.

[0021] Data processing procedure: Based on the input data, risk criteria are formulated, including basic fields such as criterion type, triggering conditions, safety response actions, and risk priority. An example is shown below: Guideline Types: Divided into preventative guidelines and emergency guidelines. Preventative guidelines are mainly applicable to preemptive prevention and risk control before security incidents occur; for example, in the case of ransomware, security response actions include deploying data backups and network zone division in advance to reduce the probability of risk occurrence and the scope of impact after the incident. Emergency guidelines are mainly for security incidents that have already occurred, and involve rapid response through pre-set security emergency procedures and security response actions to minimize various losses and negative impacts after the incident.

[0022] Triggering conditions: The conditions that trigger a security response action; for example, in the risk scenario of software ransomware, the triggering condition for emergency response guidelines is that a large number of files are rewritten with unknown extensions.

[0023] Security Response Actions: The security response actions taken after a criterion is triggered. Each criterion can have different security response actions; for example, actions under emergency criterions may include, but are not limited to, isolating infected terminals, blocking malicious IP communications, and triggering backup system snapshot restoration.

[0024] Risk Priority: The risk priority of the risk criteria themselves. Calculated based on the actual risk status of the enterprise network using a risk quantification model, these risk criteria represent the risk scenarios that different enterprise networks should focus on.

[0025] Examples of risk criteria for different risk scenarios are shown in Table 1 below.

[0026] Table 1

[0027] 2. Continuous collection and standardized processing of historical security data.

[0028] Data flow and processing: Data input: Asset data (network topology, system list, IP list, etc., which can be obtained through methods including but not limited to document verification, on-site inspection, and technical testing); Vulnerability data of the internal network (including vulnerabilities, firewall security logs, etc., can be obtained through methods including but not limited to vulnerability scanning, penetration testing, and security auditing); Data processing procedure: The input data is matched with risk criteria. An example of the analysis process for matching risk criteria is as follows: Taking office automation (OA) systems as an example, they have vulnerabilities such as weak passwords and unauthorized access.

[0029] By matching with the "Data Leakage - Database Permission Over-provisioning Detection Criteria", the specific risk scenario can be deduced as follows: Attackers enter the system through weak passwords of ordinary users, and further obtain all the personal information of employees in the office OA system through unauthorized access vulnerabilities, resulting in data leakage.

[0030] Repeat the matching analysis process described above to update and maintain a risk criterion library that includes different risk criteria that can be used for risk quantification.

[0031] 3. Establish a risk quantification model and calculate the risk value of the matching risk criteria to update the risk criteria library.

[0032] Data flow and processing: (1) Data input: Risk quantification model:

[0033] Right now:

[0034] Enterprise attribute weight S: Based on the actual situation of the enterprise network, such as industry, importance of core systems, and degree of dependence on network information technology, the corresponding parameter weights are directly adjusted to more accurately adjust the quantitative model's risk assessment results. The enterprise attribute weights specifically include the following weights: Vulnerability Severity Each of these has a corresponding vulnerability severity weight. ; Risk exposure level Its corresponding risk exposure weight ; Residual risk coefficient Its corresponding weight is the effectiveness of safety measures. ; Asset value factor Its corresponding asset value amplification effect weight. .

[0035] An example of dynamically adjusting the enterprise attribute weight S is shown in Table 2 below: Table 2

[0036] Time factor : Among them, weight The range of values ​​for its sub-factors is shown in Table 3 below.

[0037] Table 3

[0038] Residual risk coefficient : This represents the ability of an enterprise's existing network security measures to mitigate risks. Here, γ is the weight of the security measure's effectiveness, w represents the weight of different types of measures, and E represents the numerical value of the effectiveness of different types of measures. The specific definitions and values ​​are as follows: , =0.5 is the weight of the technical measures. =0.3 is the weight of management measures. =0.2 represents the weight of emergency measures.

[0039] The values ​​of effectiveness for different types of measures are shown in Table 4 below.

[0040] Table 4

[0041] Asset value factor : .in The value of the asset represents the weight of the asset value amplification effect. A represents the asset value, which can be subjectively determined by the appraiser and ranges from [0, 10]. The mapping relationship for determining its specific value is as follows: For core business systems, V=10; If it is a critical data system, V=8; For a typical office system, V=5; For edge device systems, V=2.

[0042] (2) Risk simulation: In the risk quantification model, each risk factor and weight is adjusted and assigned a value according to the aforementioned range. Then, risk quantification calculations are performed on the matched risk criteria to obtain the risk value for each matched risk criterion. Based on these risk values, risk priorities are determined. The mapping relationship between risk value range identifiers, corresponding risk priorities, and response recommendations can be defined, as shown in Table 5 below. Repeating the above quantification analysis process, the risk priorities (i.e., risk levels) of all risk criteria are finally obtained, allowing for further updates and optimization of the risk criterion library. Table 5

[0043] In practical implementation, after constructing the risk criterion library, risk control can be carried out on the networks of different enterprises to be controlled based on the risk criterion library. The principle of quantifying the risk value of each matching risk criterion during the risk control process is the same as the principle of quantifying the risk value of each matching risk criterion during the construction of the risk criterion library, and the risk quantification calculation model used is also the same. The difference lies in that the enterprise attribute weights and risk factors here are based on the industry characteristics and network conditions of the network to be controlled, and are the values ​​of the risk factors and adjusted enterprise attribute weights after assessment. For example, the risk value of each matching risk criterion is recalculated based on the assessed risk factor values ​​and adjusted enterprise attribute weights, including: A risk quantification calculation model is constructed using enterprise attribute weights and risk factors. Based on the assessed risk factor values ​​and adjusted enterprise attribute weights, the risk value of each matching risk criterion is recalculated. The risk factors include time factors, residual risk coefficients, asset value factors, and risk transfer measures. The enterprise attribute weights include vulnerability severity weights, risk exposure weights, security measure effectiveness weights, and asset value amplification effect weights. The residual risk coefficient represents the ability of existing security measures in the network to be controlled to reduce risk. The time factor includes the severity of vulnerability and the degree of risk exposure.

[0044] In practice, the principle of dynamically adjusting enterprise attribute weights during risk prevention and control is the same as the principle of dynamically adjusting enterprise attribute weights during the construction of the risk criterion database. For example, if the industry to which the network to be prevented belongs is an industry with low tolerance for high-risk vulnerabilities (such as the financial / medical industry), then... Increased to 0.8 Lower it to 0.2; If the network to be protected belongs to a high-protection industry (such as a cloud platform), then Upgraded to 1.0; If the industry to which the network to be controlled belongs is a core asset-intensive industry (such as critical infrastructure such as energy and telecommunications), then Increased to 0.9.

[0045] If the industry to which the network to be controlled belongs is a conventional or general industry, then general evaluation weights can be used, such as α=0.6, β=0.4, γ=0.8, δ=0.7.

[0046] In practice, the principles for calculating or determining the values ​​of each parameter of each risk factor during risk prevention and control are the same as those used in constructing the risk criteria library. For example, The range of vulnerability severity V is mapped according to the CVSS scoring criteria. Risk exposure level The range of values ​​for is calculated using the following formula:

[0047] in, Whether the assets are exposed on the internet, and if so, Take 1, if not, Set to 0; Is there any publicly available exploit code for this vulnerability? If so, Take 1, if not, Set to 0; The attack activity level can be set to 0.3, 0.6, or 1.0. For the estimated duration of risk exposure, the value can be 0.3, 0.6, or 1.0. For example, if the estimated duration of risk exposure is <7 days, t=0.37; if 7 < the estimated duration of risk exposure is <30 days, t=0.6; if the estimated duration of risk exposure is >30 days, t=1.0.

[0048] Effectiveness values ​​of technical measures Calculated using the following formula:

[0049] Where C is the coverage rate of safety technical measures, and its value ranges from [0,1]; U is the fastest update time of safety technical measures, and its value is 1, 0.5 or 0. For example, if the fastest update time is <30 days, U=1; if the fastest update time is within 30 to 90 days, U=0.5; if the fastest update time is >90 days, U=0. Effectiveness of management measures Calculated using the following formula:

[0050] in, For the sake of security policy integrity, the value range is [0,1]. The training coverage rate has a value range of [0,1]. The frequency of security audits is set to 1, 0.5, or 0.2, such as monthly audits. =1, Quarterly Audit =0.5, annual audit =0.2; Effectiveness values ​​of emergency measures Calculated using the following formula:

[0051] Where R is the response time, and its value ranges from [0,1]. For example, if the response time is less than 1 hour, R=1; if the response time is between 1 and 4 hours, R=0.5; and if the response time is greater than 4 hours, R=0. D is the effectiveness of the exercise, and its value ranges from [0,1].

[0052] In practice, the risk transfer measure Tsf is set to 1 or 0.5, indicating that cybersecurity risks cannot be completely eliminated, but can be further reduced through risk transfer measures. When Tsf is 1, it means that no risk transfer measures have been taken, and the final risk remains unchanged; when Tsf is 0.5, it means that risk transfer measures have been taken, effectively reducing the final risk.

[0053] In practice, during risk prevention and control, the risk value of each matching risk criterion is recalculated based on the assessed risk factor values ​​and adjusted enterprise attribute weights. The principle of converting risk values ​​into risk priorities is the same as that used in constructing the risk criterion library. After determining the risk priority of each matching risk criterion, a current risk list can be formed based on the matching risk criterions. This current risk list can include current risk scenarios derived from the matching risk criterions and related content of the matching risk criterions (such as security response actions and risk priorities). Based on the current risk list, risk warnings can be issued or relevant security response actions can be executed to achieve accurate and reliable risk prevention and control.

[0054] In practice, during the subsequent continuous risk monitoring and early warning process, the risk criteria in the previous risk quantification assessment can be used as a benchmark. Attention should be paid to the continuous improvement of the risk criteria with high risk priority. In the next round of risk assessment, the dynamic risk weights (i.e., enterprise attribute weights) should be readjusted and the values ​​of various risk factors should be reassessed to complete the closed loop of continuous risk management.

[0055] In this embodiment, a computer device is provided, such as... Figure 3 As shown, it includes a memory 301, a processor 302, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned network security risk prevention and control methods.

[0056] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0057] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that executes any of the above-described network security risk prevention and control methods.

[0058] Specifically, computer-readable storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.

[0059] Based on the same inventive concept, this invention also provides a network security risk prevention and control device, as described in the following embodiments. Since the principle by which the network security risk prevention and control device solves the problem is similar to that of the network security risk prevention and control method, the implementation of the network security risk prevention and control device can refer to the implementation of the network security risk prevention and control method; repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0060] Figure 4 This is a structural block diagram of a network security risk prevention and control device according to an embodiment of the present invention, such as... Figure 4 As shown, it includes: The acquisition module 401 is used to acquire multiple risk criteria for different risk scenarios. Each risk criterion includes a type, triggering condition, security response action and risk priority. For each risk criterion, the security response action of the risk criterion is triggered and executed when the triggering condition is detected. The matching module 402 is used to acquire asset data and vulnerability data of the internal network of the network to be controlled, and to match the asset data and vulnerability data with multiple risk criteria to determine the matching risk criteria. The adjustment module 403 is used to dynamically evaluate the value of risk factors and adjust the weight of enterprise attributes based on the industry characteristics and network conditions of the network to be controlled. Based on the evaluated value of risk factors and the adjusted weight of enterprise attributes, the risk value of each matching risk criterion is recalculated, and the risk priority of each matching risk criterion is re-determined based on the calculated risk value. The prevention and control module 404 is used to generate a current risk list based on the matching risk criteria. The current risk list includes the relevant content of the current risk scenario and the matching risk criteria.

[0061] In one embodiment, the adjustment module 403 is used to recalculate the risk value of each matching risk criterion based on the risk factor values ​​after evaluation and the adjusted enterprise attribute weights, using a risk quantification calculation model constructed with enterprise attribute weights and risk factors. The risk factors include a time factor, a residual risk coefficient, and an asset value factor. The enterprise attribute weights include a vulnerability severity weight, a risk exposure weight, a security measure effectiveness weight, and an asset value amplification effect weight. The residual risk coefficient represents the ability of existing security measures in the network to be controlled to reduce risk. The time factor includes the vulnerability severity and the risk exposure.

[0062] The embodiments of this invention achieve the following technical effects: First, it proposes risk prevention and control based on multiple risk criteria for different risk scenarios, enabling targeted and specific risk prevention and control. Compared to the generalized risk assessment methods of traditional technologies, this application can more accurately, precisely, and effectively prevent and control network risks in risk scenarios. Second, it proposes dynamically evaluating the values ​​of risk factors and adjusting the weights of enterprise attributes based on the industry characteristics and network conditions of the network to be prevented. Then, it re-quantifies and calculates the risk value of each matching risk criterion based on the evaluated risk factor values ​​and adjusted enterprise attribute weights. Finally, it redetermines the risk priority of each matching risk criterion based on the calculated risk values, allowing for the adjustment of risk priority based on different industry characteristics and network conditions of the network to be prevented. This application dynamically adjusts risk priorities based on dynamically adjusted risk criteria for risk prevention and control. Compared to existing traditional methods that rely on static security indicator systems or quantitative scoring mechanisms for risk assessment, this application can dynamically adapt to different industry characteristics and dynamic changes in risks to more accurately and effectively prevent and control network risks, avoiding false alarms or missed alarms. Furthermore, it proposes matching security data, such as asset data of the network to be protected and vulnerability data of the internal network, with multiple risk criteria. This enables the real-time, efficient, and accurate generation of a current risk list based on more comprehensive security data. Subsequently, based on the current risk scenarios in the risk list, alarms can be triggered or security response actions can be executed according to risk priority, achieving real-time, effective, and reliable network security risk prevention and control.

[0063] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

[0064] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for preventing and controlling network security risks, characterized in that, include: Multiple risk criteria are obtained for different risk scenarios. Each risk criterion includes a criterion type, triggering condition, security response action, and risk priority. For each risk criterion, the security response action of the risk criterion is triggered and executed when the triggering condition is detected. Obtain asset data and internal network vulnerability data of the network to be protected, match the asset data and vulnerability data with multiple risk criteria, and determine the matching risk criteria; Based on the industry characteristics and network status of the network to be controlled, the values ​​of risk factors are dynamically evaluated and the weights of enterprise attributes are adjusted. Based on the evaluated values ​​of risk factors and the adjusted weights of enterprise attributes, the risk value of each matching risk criterion is recalculated. Based on the calculated risk value, the risk priority of each matching risk criterion is re-determined. A current risk list is generated based on matching risk criteria. The current risk list includes the current risk scenario and the relevant content of the matching risk criteria.

2. The network security risk prevention and control method as described in claim 1, characterized in that, The risk value for each matching risk criterion is recalculated based on the assessed risk factor values ​​and adjusted enterprise attribute weights, including: A risk quantification calculation model is constructed using enterprise attribute weights and risk factors. Based on the assessed risk factor values ​​and adjusted enterprise attribute weights, the risk value of each matching risk criterion is recalculated. The risk factors include time factors, residual risk coefficients, asset value factors, and risk transfer measures. The enterprise attribute weights include vulnerability severity weights, risk exposure weights, security measure effectiveness weights, and asset value amplification effect weights. The residual risk coefficient represents the ability of existing security measures in the network to be controlled to reduce risk. The time factor includes the severity of vulnerability and the degree of risk exposure.

3. The network security risk prevention and control method as described in claim 2, characterized in that, The formula for the risk quantification calculation model is as follows: in, This is the risk value. For enterprise attribute weights, As a time factor, The residual risk coefficient, As an asset value factor, Weighted according to the severity of vulnerability, As a weight for the degree of risk exposure, Weighting the effectiveness of safety measures. As the weight of the asset value amplification effect, As the severity of vulnerability, As for the degree of risk exposure, For the first Weight of type of measures For the first The effectiveness value of the type of measure, The total number of types of measures, For the value of assets, + =1, Tsf represents risk transfer measures.

4. The network security risk prevention and control method as described in claim 3, characterized in that, Dynamically adjust the weights of enterprise attributes, including: If the industry to which the network to be protected belongs is an industry with low tolerance for high-risk vulnerabilities, then Increased to 0.8 Lower it to 0.2; If the industry to which the network to be protected belongs is a high-protection industry, then Upgraded to 1.0; If the industry to which the network to be controlled belongs is a core asset-intensive industry, then Increased to 0.

9.

5. The network security risk prevention and control method as described in claim 3, characterized in that, The range of vulnerability severity V is mapped according to the CVSS scoring criteria. Risk exposure level The range of values ​​for is calculated using the following formula: in, Whether the assets are exposed on the internet, and if so, Take 1, if not, Set to 0; Is there any publicly available exploit code for this vulnerability? If so, Take 1, if not, Set to 0; The attack activity level can be set to 0.3, 0.6, or 1.

0. The estimated duration of risk exposure is 0.3, 0.6, or 1.

0.

6. The network security risk prevention and control method as described in claim 3, characterized in that, Effectiveness values ​​of technical measures Calculated using the following formula: Where C is the coverage rate of safety technical measures, with a value range of [0,1]; U is the fastest update time of safety technical measures, with a value of 1, 0.5 or 0; Effectiveness of management measures Calculated using the following formula: in, For the sake of security policy integrity, the value range is [0,1]. The training coverage rate has a value range of [0,1]. The frequency of security audits can be set to 1, 0.5, or 0.

2. Effectiveness values ​​of emergency measures Calculated using the following formula: Where R represents response time, with a value range of [0,1]; and D represents exercise effectiveness, with a value range of [0,1].

7. The network security risk prevention and control method as described in claim 3, characterized in that, The risk transfer measure Tsf takes the value of 1 or 0.5; when Tsf takes the value of 1, it means that no risk transfer measures have been taken; when Tsf takes the value of 0.5, it means that risk transfer measures have been taken.

8. A network security risk prevention and control device, characterized in that, include: The acquisition module is used to acquire multiple risk criteria for different risk scenarios. Each risk criterion includes a type, triggering condition, security response action, and risk priority. For each risk criterion, the security response action of the risk criterion is triggered and executed when the triggering condition is detected. The matching module is used to acquire asset data and internal network vulnerability data of the network to be controlled, and match the asset data and vulnerability data with multiple risk criteria to determine the matching risk criteria; The adjustment module is used to dynamically evaluate the values ​​of risk factors and adjust the weights of enterprise attributes based on the industry characteristics and network conditions of the network to be controlled. Based on the evaluated values ​​of risk factors and the adjusted weights of enterprise attributes, the module recalculates the risk value of each matching risk criterion and redetermines the risk priority of each matching risk criterion based on the calculated risk value. The prevention and control module is used to generate a current risk list based on matching risk criteria. The current risk list includes the current risk scenario and the relevant content of the matching risk criteria.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the network security risk prevention and control method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the network security risk prevention and control method according to any one of claims 1 to 7.

Images