Information security risk classification method and system

Abstract

The invention discloses an information security risk classification method and system, and the method comprises the steps: collecting network data and log data of preset information, and carrying out the preprocessing of the network data and the log data; performing risk identification on the network data and the log data to obtain a network risk point and a log risk point, and performing multi-source extraction on the network risk point and the log risk point to obtain an information risk point; performing dynamic risk feature extraction on the information risk point to obtain a security risk feature, performing deduction evaluation according to the security risk feature to obtain a loss degree, and calculating a vulnerability degree of the information risk point according to an attack and defense difficulty degree of the security risk feature; and constructing a topological network information security risk classification model according to the loss degree and the vulnerability degree, optimizing the topological network information security risk classification model based on a reward strategy, inputting to-be-identified data into the topological network information security risk classification model, and outputting a classification result.

Description

Technical Field

[0001] This invention relates to the field of risk classification, and in particular to a method and system for classifying information security risks. Background Technology

[0002] Currently, information technology is developing rapidly, and information systems encompass various types of data, including network traffic, system logs, and hardware firmware, facing diverse security threats such as DDoS attacks, data breaches, and covert tunneling. Existing information security risk classification technologies often focus on single data points (such as analyzing only network traffic or boundary logs), identifying DDoS attacks solely through network traffic analysis without integrating authentication failure records from system logs. This leads to an inability to identify the combined threat of low-rate DDoS attacks and credential brute-force attacks, and insufficient collection of key data such as hardware layer and business context makes it difficult to identify cross-dimensional threats. Risk assessments rely on subjective experience or simple indicators, failing to comprehensively consider direct economic losses, indirect reputational losses, and compliance losses. Vulnerability calculations do not incorporate dynamic factors such as attack complexity, resulting in a disconnect from real-world scenarios. Classification models use static rules, lacking self-optimization and real-time adaptability, making them prone to false positives and false negatives, and unable to cope with covert and periodic attacks.

[0003] Compared to existing technologies, this solution offers significant improvements: First, it broadens the scope of data collection, encompassing various types of network data, including network traffic, system-level data, and hardware-level data, as well as log data from boundary devices and DNS, eliminating blind spots in risk identification through multi-source data integration. Second, it constructs a dynamic quantitative assessment system, extracting multi-dimensional security risk characteristics and combining a three-dimensional quantitative deduction model with attack and defense dimension indicators to accurately calculate loss and vulnerability, comprehensively reflecting the impact of risks. Third, it designs a self-optimizing model, integrating multiple algorithms to construct a topology network classification model, and iteratively optimizing it based on reward strategies to improve adaptability to dynamic threats and classification accuracy. Summary of the Invention

[0004] The purpose of this invention is to provide a method for classifying information security risks.

[0005] To achieve the above objectives, the present invention is implemented according to the following technical solution: This invention includes the following steps: The system collects network data and log data based on preset information, and preprocesses the network data and log data. The network risk data includes network traffic data, system-level data, security protection data, hardware layer data, business context data, open-source component vulnerability versions, authentication data, behavioral data, and threat intelligence data. The log data includes boundary device logs, DNS logs, security logs, BIOS / UEFI firmware logs, application logs, and cloud service API call logs. Risk identification is performed on the network data and the log data respectively to obtain network risk points and log risk points. Knowledge graph association analysis is then performed on the network risk points and log risk points to obtain information risk points. The information risk points are dynamically risk-featured to obtain security risk features. Based on the security risk features, the loss degree is obtained by extrapolation and evaluation. Based on the difficulty of attacking and defending the security risk features, the vulnerability of the information risk points is calculated. A topology network information security risk classification model is constructed based on the loss degree and the vulnerability degree. The topology network information security risk classification model is optimized based on a reward strategy. The data to be identified is input into the topology network information security risk classification model, and the classification result is output.

[0006] Furthermore, the method for risk identification of the network data and the log data respectively includes: The system employs traffic entropy analysis combined with an IP reputation database to detect and identify abnormal traffic peaks in network data, thereby obtaining DDoS attack data. It also uses packet payload keyword matching to detect and identify large outbound traffic from non-business ports, obtaining leaked data. Furthermore, it uses deep protocol compliance testing to detect and identify abnormal protocol payloads in network data, obtaining hidden tunnel data. Finally, it uses timestamps to mark the start and end points of nodes in DDoS attack data, data leaks, and hidden tunnel data, outputting the marked nodes as network risk points. Firewall logs are detected using time-series mutation detection, with a sharp increase in DENY rule triggering frequency and dispersed source IPs identified as the first log risk point. VPN logs are detected using geofencing policies, with VPN logs showing successful logins outside of working hours and from different IPs identified as the second log risk point. DNS logs are detected using domain name generation algorithms, with DNS logs showing a large number of NXDOMAIN responses and abnormally shortened TTLs identified as the third log risk point. The first, second, and third log risk points are then output as the log risk points.

[0007] Furthermore, a method for obtaining information risk points by performing knowledge graph association analysis on the network risk points and the log risk points includes: Risk entities of network risk points and log risk points are extracted by bidirectional long short-term memory network and BERT model. The risk entities are matched with the current node of network information knowledge graph. Risk entities with cosine similarity greater than 0.853 are merged with the current node to obtain risk point knowledge graph. Temporary nodes are automatically generated for unmatched valley risk nodes and potential relationships are linked. An improved DS evidence theory is adopted, and a time-series weighting factor is introduced to resolve conflicts. The expression is as follows: ; in For time series weighting factors, Let a be the total number of pieces of evidence for the a-th conflict. The time difference between when the evidence was generated and the present time. The credibility coefficient for the a-th evidence is set based on the authority of the evidence source and the cosine of the evidence type, and its value ranges from 0 to 1. Graph reasoning is performed based on a risk point knowledge graph to obtain information risk points. Graph reasoning includes path reasoning, semantic reasoning, and temporal reasoning. Path reasoning is performed using random walks combined with convolutional neural attention mechanisms to identify cross-system risk transmission. Knowledge graph embedding and completion combined with a rule engine are used to automatically generate production risk transmission rules. Semantic reasoning is performed based on production risk transmission rules to predict unexposed risk points. Long short-term memory temporal graph network analysis is used to analyze the correlation between basic input / output system log firmware update time and subsequent attacks. Temporal reasoning is performed based on the correlation to capture low-frequency, long-cycle attacks. To obtain the asset value, severity score, and betweenness centrality of information risk points, and to enhance the risk quantification of these information risk points, the expression is as follows: ; in Let c be the asset value at the c-th information risk point. Score the severity of the c-th information risk point. Let c be the betweenness centrality of the information risk point; The risk level of the c-th information risk point; Mark the risk level at each information risk point and output the result.

[0008] Furthermore, the method for dynamically extracting security risk features from the aforementioned information risk points includes: Information risk points are preprocessed and routed according to feature dimensions to obtain three dimensions: time series, business impact, and attack countermeasures. The first dynamic risk feature is obtained by using sliding window statistics to extract dynamic risk features in the time series dimension; the second dynamic risk feature is obtained by using asset dependency graph analysis to extract dynamic risk features in the business impact dimension; and the third dynamic risk feature is obtained by using red team / blue team adversarial data matching to extract dynamic risk features in the attack and adversarial dimension. The first dynamic risk characteristic includes volatility entropy, outbreak slope, and periodic intensity. The outbreak slope is the rate of increase in risk events per unit time, and the periodic intensity is the period matching a known attack pattern. The volatility entropy is calculated using the following formula: ; in The fluctuation entropy value within the time window t. Let i be the probability of the i-th risk event occurring; The second dynamic risk characteristic includes data lineage contamination and service dependency disruption value; where lineage contamination represents the proportion of affected data assets to key nodes in the business flow; and service dependency disruption value is the number of downstream systems associated with the threatened service. The third dynamic risk characteristic includes attack complexity, defense response strength, and countermeasure timeliness; where attack complexity is the vulnerability exploitation cost coefficient, defense response strength is the coverage of protective measures, and countermeasure timeliness is the threat intelligence freshness decay factor, expressed as: ,in The number of hours for intelligence delay; The first dynamic risk feature, the second dynamic risk feature, and the third dynamic risk feature are output as safety risk features.

[0009] Furthermore, the method for calculating and assessing the degree of loss based on the aforementioned security risk characteristics includes: By inputting security risk characteristics into a three-dimensional quantitative simulation model, direct economic losses, indirect reputational losses, and compliance losses can be obtained. Direct economic losses include data asset restoration costs, business interruption losses, and fines; indirect reputational losses include customer churn risk, brand value depreciation, and stock price fluctuations; compliance losses include the number and severity of regulatory violations. Based on the risk chain propagation model, the input security risk features are classified, and the attack cost coefficient, service dependency disruption value, and compliance deviation items of the classified security risk features are extracted. A conditional risk value model is then used to extrapolate the conditional risk value, expressed as follows: ; in For random loss variables, For confidence level, Confidence level Conditional Value at Risk The maximum loss at the u-quantile; Monte Carlo simulation was used to deduce the mapping relationship between the attack cost coefficient and the direct loss multiplication coefficient; graph propagation algorithm was used to deduce the mapping relationship between the service dependency damage value and the business interruption loss index; and rule engine matching was used to deduce the mapping relationship between compliance deviations and regulatory penalty levels. A three-stage simulation mechanism is integrated for dynamic simulation and evaluation. The three-stage mechanism consists of: 1. Initial impact assessment: calculating single-point loss based on vulnerability exploitation difficulty; 2. Secondary spillover assessment: calculating impact spread through business flow topology; 3. Long-tail effect assessment: introducing an intelligence freshness decay factor; the expression is: ; ; ; in For single-point loss, To prevent the spread of the impact, For loss degree, Information freshness decay factor For the number of hours of delay, For asset value, Based on the severity of the vulnerability, This represents the attack cost coefficient. For the service dependency disruption value of the b-th simulated risk event, To simulate the number of risk events.

[0010] Furthermore, the method for calculating the vulnerability of the information risk point based on the ease of attacking and defending the security risk characteristics includes: The attack complexity, vulnerability exploitability, intelligence freshness decay factor, control measure completeness rate, protection failure rate, and response lag coefficient are obtained. Attack complexity is the cumulative product of tool cost, technical threshold, and difficulty in evading detection. Vulnerability exploitability is the product of vulnerability disclosure rate and exploit path complexity. Control measure completeness rate is the product of deployment measures and intelligence freshness. Protection failure rate is the average number of failures of historical measures. Response lag coefficient is the threat detection time divided by the response time. Attack-related metrics include attack complexity, vulnerability exploitability, and intelligence freshness decay factor; defense-related metrics include control measure completeness rate, protection failure rate, and response lag coefficient. Calculate the vulnerability of information risk points based on attack and defense dimension indicators: ; in The vulnerability of the c-th information risk point, Let c be the threat capability level of the information risk point. For the resistance to the c-th information risk point, For the exploitability of the c-th information risk point, The inverse of the protection failure rate of the c-th information risk point; When the vulnerability is less than or equal to 0.3, seasonal monitoring is implemented; when the vulnerability is greater than 0.3 but less than or equal to 0.6, manual review is conducted within 15 days; when the vulnerability is greater than 0.6, automatic isolation and evidence collection and tracing are implemented.

[0011] Furthermore, the method for constructing a topological network information security risk classification model based on the loss degree and the vulnerability degree includes: The objective weighting of loss degree, vulnerability degree, and loss function is used as the objective function of the topology network information security risk classification model. The topology network information security risk classification model includes feature extraction algorithms, dynamic time series analysis algorithms, graph neural network algorithms, and deep learning algorithms; Feature extraction algorithms extract network security feature nodes by quantifying discriminative patterns in input data that can characterize attack behavior, system vulnerability, and potential impact. The dynamic time series analysis algorithm analyzes the changing patterns of network security feature nodes over time and captures the spatiotemporal correlation between network security feature nodes and their topological neighbors, dynamically deducing risk feature nodes that represent real-time threat states. The graph neural network algorithm constructs a risk level determination matrix based on loss degree and vulnerability, obtains the network topology graph of risk feature nodes, node reachability relationships and general vulnerability database, generates a state attack and defense graph based on the network topology graph, node reachability relationships and general vulnerability database, and outputs the attack path set and success probability. Deep learning algorithms serialize and encode attack paths, use attention mechanisms to weight and aggregate attack paths and success probabilities, and achieve end-to-end security risk level classification by optimizing the objective function and combining it with a risk level judgment matrix.

[0012] Furthermore, the method for optimizing the information security risk classification model of the topology network based on a reward strategy includes: Risk management is applied to the output of the topology network information security risk classification model. A reward function is constructed based on the accuracy reward, false alarm penalty, and timeliness reward of risk classification. The reward function value of the output is calculated, and the classification scheme with the largest reward function value is taken as the optimal value. The risk level judgment of the risk feature node is adjusted, and the reward function value is recalculated. If the current reward function value is greater than the optimal value, the optimal value is updated; otherwise, the risk level judgment of the risk feature node is adjusted. The expression for the given reward function is: ; in The reward function for the z-th risk classification is... A reward is given for the accuracy of the z-th risk classification. For accuracy weighting coefficients, The penalty for a false positive in the z-th risk classification. The weighting coefficient for false alarm penalties. As a time-sensitive reward for the z-th risk classification, This is a timeliness weighting coefficient; Historical risk events are collected and converted into triplets of state, action, and reward. The topology network information security risk classification model is trained, and a combinatorial optimization algorithm is used to adjust the accuracy reward, false alarm penalty, and timeliness reward. The process is iterated until the reward function value reaches its maximum value, and the adjustment result is output.

[0013] Secondly, an information security risk classification system includes: Data acquisition module: used to collect network data and log data with preset information, and preprocess the network data and log data; the network risk data includes network traffic data, system-level data, security protection data, hardware layer data, business context data, open source component vulnerability versions, authentication data, behavioral data, and threat intelligence data; the log data includes boundary device logs, DNS / DHCP logs, security logs, BIOS / UEFI firmware logs, application logs, and cloud service API call logs; Risk location module: used to identify risks in the network data and the log data respectively, obtain network risk points and log risk points, and obtain information risk points by multi-source extraction of the network risk points and the log risk points; Risk assessment module: used to dynamically extract security risk features from the information risk points, perform inference and assessment based on the security risk features to obtain the loss degree, and calculate the vulnerability of the information risk points based on the attack and defense difficulty of the security risk features; Modeling and optimization module: used to construct a topology network information security risk classification model based on the loss degree and the vulnerability, optimize the topology network information security risk classification model based on the reward strategy, input the data to be identified into the topology network information security risk classification model, and output the classification result.

[0014] The beneficial effects of this invention are: This invention relates to an information security risk classification method and system. Compared with existing technologies, this invention has the following technical advantages: This invention integrates various types of network data, including network traffic, hardware layer data, and business context data, as well as multiple types of log data, through preprocessing, risk identification, obtaining information on risk points, dynamic risk feature extraction, deductive assessment, vulnerability calculation, model building, and model optimization. This eliminates the limitations of single data sources, covers more risk scenarios, and improves the comprehensiveness of risk identification. Through multi-dimensional feature extraction and quantification models, it accurately calculates loss and vulnerability, providing assessments that more closely reflect actual risks. The topology network model, combined with a self-optimizing reward strategy, can dynamically adapt to threat changes, reduce false positives and false negatives, and simultaneously achieve end-to-end risk classification, improving the efficiency and accuracy of risk handling. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating the steps of an information security risk classification method according to the present invention. Detailed Implementation

[0016] The present invention will be further described below through specific embodiments. The illustrative embodiments and descriptions herein are used to explain the present invention, but are not intended to limit the present invention.

[0017] The present invention provides a method and system for classifying information security risks, comprising the following steps: like Figure 1 As shown, this embodiment includes the following steps: The system collects network data and log data based on preset information, and preprocesses the network data and log data. The network risk data includes network traffic data, system-level data, security protection data, hardware layer data, business context data, open-source component vulnerability versions, authentication data, behavioral data, and threat intelligence data. The log data includes boundary device logs, DNS logs, security logs, BIOS / UEFI firmware logs, application logs, and cloud service API call logs. In the actual assessment, network data (including peak traffic data of 8000Mbps, open source component vulnerability versions (such as Apache Struts2 with CVE-2023-50164 vulnerability), authentication data (32 abnormal login attempts)) and log data (including DNS logs (1200 NXDOMAIN responses) and cloud service API call logs (58 unauthorized calls)) were collected. After removing invalid and redundant data, a standardized dataset was formed. Risk identification is performed on the network data and the log data respectively to obtain network risk points and log risk points. Knowledge graph association analysis is then performed on the network risk points and log risk points to obtain information risk points. In the actual assessment, at the network data level, DDoS attack data was identified by combining traffic entropy analysis with IP reputation database (the IPs corresponding to abnormal traffic peaks are mostly malicious IPs); at the log data level, DNS logs were detected by domain name generation algorithm, and 1200 NXDOMAIN response logs were identified as the third log risk point, ultimately resulting in 2 network risk points and 3 log risk points. Risk entities were extracted using a bidirectional long short-term memory network and a BERT model. Entities with a cosine similarity greater than 0.853 were merged, and those that could not be matched were generated as temporary nodes. Conflicts were resolved by combining the improved DS evidence theory, and finally four information risk points were obtained. The risk level was calculated by formula, with the highest risk point being 0.82. The information risk points are dynamically risk-featured to obtain security risk features. Based on the security risk features, the loss degree is obtained by extrapolation and evaluation. Based on the difficulty of attacking and defending the security risk features, the vulnerability of the information risk points is calculated. In the actual assessment, security risk characteristics were extracted (such as a time series dimension fluctuation entropy value of 1.8, a business impact dimension service dependency disruption value of 6, and an attack complexity of 0.3 in the attack confrontation dimension); the loss degree was calculated to be 0.75 according to the three-dimensional quantitative deduction model (including direct losses (business interruption loss of 3 million yuan) and indirect losses (customer churn value of 5 million yuan)); and the vulnerability was calculated to be 0.65 based on the attack and defense indicators. A topology network information security risk classification model is constructed based on the loss degree and the vulnerability degree. The topology network information security risk classification model is optimized based on a reward strategy. The data to be identified is input into the topology network information security risk classification model, and the classification result is output. In the actual assessment, the input topology network model was optimized by the reward strategy (the reward for classification accuracy was 0.92, the reward for timeliness was 0.88, and the penalty for false positives was 0.1). The output showed that the risk level of the core transaction system of the e-commerce company during the promotion period was high risk (level 4), and manual review and vulnerability repair were required within 48 hours.

[0018] In this embodiment, the method for risk identification of the network data and the log data includes: The system employs traffic entropy analysis combined with an IP reputation database to detect and identify abnormal traffic peaks in network data, thereby obtaining DDoS attack data. It also uses packet payload keyword matching to detect and identify large outbound traffic from non-business ports, obtaining leaked data. Furthermore, it uses deep protocol compliance testing to detect and identify abnormal protocol payloads in network data, obtaining hidden tunnel data. Finally, it uses timestamps to mark the start and end points of nodes in DDoS attack data, data leaks, and hidden tunnel data, outputting the marked nodes as network risk points. Firewall logs are detected using time-series mutation detection, with a sharp increase in DENY rule triggering frequency and dispersed source IPs identified as the first log risk point. VPN logs are detected using geofencing policies, with VPN logs showing successful logins outside of working hours and from different IPs identified as the second log risk point. DNS logs are detected using domain name generation algorithms, with DNS logs showing a large number of NXDOMAIN responses and abnormally shortened TTLs identified as the third log risk point. The first, second, and third log risk points are then output as the log risk points.

[0019] In this embodiment, the method for obtaining information risk points by performing knowledge graph association analysis on the network risk points and the log risk points includes: Risk entities of network risk points and log risk points are extracted by bidirectional long short-term memory network and BERT model. The risk entities are matched with the current node of network information knowledge graph. Risk entities with cosine similarity greater than 0.853 are merged with the current node to obtain risk point knowledge graph. Temporary nodes are automatically generated for unmatched valley risk nodes and potential relationships are linked. An improved DS evidence theory is adopted, and a time-series weighting factor is introduced to resolve conflicts. The expression is as follows: ; in For time series weighting factors, Let a be the total number of pieces of evidence for the a-th conflict. The time difference between when the evidence was generated and the present time. The credibility coefficient for the a-th evidence is set based on the authority of the evidence source and the cosine of the evidence type, and its value ranges from 0 to 1. Graph reasoning is performed based on a risk point knowledge graph to obtain information risk points. Graph reasoning includes path reasoning, semantic reasoning, and temporal reasoning. Path reasoning is performed using random walks combined with convolutional neural attention mechanisms to identify cross-system risk transmission. Knowledge graph embedding and completion combined with a rule engine are used to automatically generate production risk transmission rules. Semantic reasoning is performed based on production risk transmission rules to predict unexposed risk points. Long short-term memory temporal graph network analysis is used to analyze the correlation between basic input / output system log firmware update time and subsequent attacks. Temporal reasoning is performed based on the correlation to capture low-frequency, long-cycle attacks. To obtain the asset value, severity score, and betweenness centrality of information risk points, and to enhance the risk quantification of these information risk points, the expression is as follows: ; in Let c be the asset value at the c-th information risk point. Score the severity of the c-th information risk point. Let c be the betweenness centrality of the information risk point; The risk level of the c-th information risk point; Mark the risk level at each information risk point and output the result.

[0020] In this embodiment, the method for dynamically extracting security risk features from the information risk points includes: Information risk points are preprocessed and routed according to feature dimensions to obtain three dimensions: time series, business impact, and attack countermeasures. The first dynamic risk feature is obtained by using sliding window statistics to extract dynamic risk features in the time series dimension; the second dynamic risk feature is obtained by using asset dependency graph analysis to extract dynamic risk features in the business impact dimension; and the third dynamic risk feature is obtained by using red team / blue team adversarial data matching to extract dynamic risk features in the attack and adversarial dimension. The first dynamic risk characteristic includes volatility entropy, outbreak slope, and periodic intensity. The outbreak slope is the rate of increase in risk events per unit time, and the periodic intensity is the period matching a known attack pattern. The volatility entropy is calculated using the following formula: ; in The fluctuation entropy value within the time window t. Let i be the probability of the i-th risk event occurring; The second dynamic risk characteristic includes data lineage contamination and service dependency disruption value; where lineage contamination represents the proportion of affected data assets to key nodes in the business flow; and service dependency disruption value is the number of downstream systems associated with the threatened service. The third dynamic risk characteristic includes attack complexity, defense response strength, and countermeasure timeliness; where attack complexity is the vulnerability exploitation cost coefficient, defense response strength is the coverage of protective measures, and countermeasure timeliness is the threat intelligence freshness decay factor, expressed as: ,in The number of hours for intelligence delay; The first dynamic risk feature, the second dynamic risk feature, and the third dynamic risk feature are output as safety risk features.

[0021] In this embodiment, the method for obtaining the degree of loss by extrapolating and evaluating based on the security risk characteristics includes: By inputting security risk characteristics into a three-dimensional quantitative simulation model, direct economic losses, indirect reputational losses, and compliance losses can be obtained. Direct economic losses include data asset restoration costs, business interruption losses, and fines; indirect reputational losses include customer churn risk, brand value depreciation, and stock price fluctuations; compliance losses include the number and severity of regulatory violations. Based on the risk chain propagation model, the input security risk features are classified, and the attack cost coefficient, service dependency disruption value, and compliance deviation items of the classified security risk features are extracted. A conditional risk value model is then used to extrapolate the conditional risk value, expressed as follows: ; in For random loss variables, For confidence level, Confidence level Conditional Value at Risk The maximum loss at the u-quantile; Monte Carlo simulation was used to deduce the mapping relationship between the attack cost coefficient and the direct loss multiplication coefficient; graph propagation algorithm was used to deduce the mapping relationship between the service dependency damage value and the business interruption loss index; and rule engine matching was used to deduce the mapping relationship between compliance deviations and regulatory penalty levels. A three-stage simulation mechanism is integrated for dynamic simulation and evaluation. The three-stage mechanism consists of: 1. Initial impact assessment: calculating single-point loss based on vulnerability exploitation difficulty; 2. Secondary spillover assessment: calculating impact spread through business flow topology; 3. Long-tail effect assessment: introducing an intelligence freshness decay factor; the expression is: ; ; ; in For single-point loss, To prevent the spread of the impact, For loss degree, Information freshness decay factor For the number of hours of delay, For asset value, Based on the severity of the vulnerability, This represents the attack cost coefficient. For the service dependency disruption value of the b-th simulated risk event, To simulate the number of risk events.

[0022] In this embodiment, the method for calculating the vulnerability of the information risk point based on the ease of attacking and defending the security risk characteristics includes: The attack complexity, vulnerability exploitability, intelligence freshness decay factor, control measure completeness rate, protection failure rate, and response lag coefficient are obtained. Attack complexity is the cumulative product of tool cost, technical threshold, and difficulty in evading detection. Vulnerability exploitability is the product of vulnerability disclosure rate and exploit path complexity. Control measure completeness rate is the product of deployment measures and intelligence freshness. Protection failure rate is the average number of failures of historical measures. Response lag coefficient is the threat detection time divided by the response time. Attack-related metrics include attack complexity, vulnerability exploitability, and intelligence freshness decay factor; defense-related metrics include control measure completeness rate, protection failure rate, and response lag coefficient. Calculate the vulnerability of information risk points based on attack and defense dimension indicators: ; in The vulnerability of the c-th information risk point, Let c be the threat capability level of the information risk point. For the resistance to the c-th information risk point, For the exploitability of the c-th information risk point, The inverse of the protection failure rate of the c-th information risk point; When the vulnerability is less than or equal to 0.3, seasonal monitoring is implemented; when the vulnerability is greater than 0.3 but less than or equal to 0.6, manual review is conducted within 15 days; when the vulnerability is greater than 0.6, automatic isolation and evidence collection and tracing are implemented.

[0023] In this embodiment, the method for constructing a topological network information security risk classification model based on the loss degree and the vulnerability degree includes: The objective weighting of loss degree, vulnerability degree, and loss function is used as the objective function of the topology network information security risk classification model. The topology network information security risk classification model includes feature extraction algorithms, dynamic time series analysis algorithms, graph neural network algorithms, and deep learning algorithms; Feature extraction algorithms extract network security feature nodes by quantifying discriminative patterns in input data that can characterize attack behavior, system vulnerability, and potential impact. The dynamic time series analysis algorithm analyzes the changing patterns of network security feature nodes over time and captures the spatiotemporal correlation between network security feature nodes and their topological neighbors, dynamically deducing risk feature nodes that represent real-time threat states. The graph neural network algorithm constructs a risk level determination matrix based on loss degree and vulnerability, obtains the network topology graph of risk feature nodes, node reachability relationships and general vulnerability database, generates a state attack and defense graph based on the network topology graph, node reachability relationships and general vulnerability database, and outputs the attack path set and success probability. Deep learning algorithms serialize and encode attack paths, use attention mechanisms to weight and aggregate attack paths and success probabilities, and achieve end-to-end security risk level classification by optimizing the objective function and combining it with the risk level judgment matrix. In actual assessments, the risk level determination criteria are shown in Table 1:

[0024] With a loss factor of 0.75 and a vulnerability factor of 0.65, the risk level is assessed as Level 1+ with network outage for evidence collection.

[0025] In this embodiment, the method for optimizing the information security risk classification model of the topology network based on a reward strategy includes: Risk management is applied to the output of the topology network information security risk classification model. A reward function is constructed based on the accuracy reward, false alarm penalty, and timeliness reward of risk classification. The reward function value of the output is calculated, and the classification scheme with the largest reward function value is taken as the optimal value. The risk level judgment of the risk feature node is adjusted, and the reward function value is recalculated. If the current reward function value is greater than the optimal value, the optimal value is updated; otherwise, the risk level judgment of the risk feature node is adjusted. The expression for the given reward function is: ; in The reward function for the z-th risk classification is... A reward is given for the accuracy of the z-th risk classification. For accuracy weighting coefficients, The penalty for a false positive in the z-th risk classification. The weighting coefficient for false alarm penalties. As a time-sensitive reward for the z-th risk classification, This is a timeliness weighting coefficient; Historical risk events are collected and converted into triplets of state, action, and reward. The topology network information security risk classification model is trained, and a combinatorial optimization algorithm is used to adjust the accuracy reward, false alarm penalty, and timeliness reward. The process is iterated until the reward function value reaches its maximum value, and the adjustment result is output.

[0026] Secondly, an information security risk classification system includes: Data acquisition module: used to collect network data and log data with preset information, and preprocess the network data and log data; the network risk data includes network traffic data, system-level data, security protection data, hardware layer data, business context data, open source component vulnerability versions, authentication data, behavioral data, and threat intelligence data; the log data includes boundary device logs, DNS / DHCP logs, security logs, BIOS / UEFI firmware logs, application logs, and cloud service API call logs; Risk location module: used to identify risks in the network data and the log data respectively, obtain network risk points and log risk points, and obtain information risk points by multi-source extraction of the network risk points and the log risk points; Risk assessment module: used to dynamically extract security risk features from the information risk points, perform inference and assessment based on the security risk features to obtain the loss degree, and calculate the vulnerability of the information risk points based on the attack and defense difficulty of the security risk features; Modeling and optimization module: used to construct a topology network information security risk classification model based on the loss degree and the vulnerability, optimize the topology network information security risk classification model based on the reward strategy, input the data to be identified into the topology network information security risk classification model, and output the classification result.

[0027] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for classifying information security risks, characterized in that, Includes the following steps: Collect network data and log data with preset information, and preprocess the network data and log data; The network risk data includes network traffic data, system-level data, security protection data, hardware layer data, business context data, open-source component vulnerability versions, authentication data, behavioral data, and threat intelligence data; the log data includes boundary device logs, DNS logs, security logs, BIOS / UEFI firmware logs, application logs, and cloud service API call logs. Risk identification is performed on the network data and the log data respectively to obtain network risk points and log risk points. Knowledge graph association analysis is then performed on the network risk points and log risk points to obtain information risk points. The information risk points are dynamically risk-featured to obtain security risk features. Based on the security risk features, the loss degree is obtained by extrapolation and evaluation. Based on the difficulty of attacking and defending the security risk features, the vulnerability of the information risk points is calculated. A topology network information security risk classification model is constructed based on the loss degree and the vulnerability degree. The topology network information security risk classification model is optimized based on a reward strategy. The data to be identified is input into the topology network information security risk classification model, and the classification result is output.

2. The information security risk classification method according to claim 1, characterized in that, A method for risk identification of the network data and the log data respectively includes: The system employs traffic entropy analysis combined with an IP reputation database to detect and identify abnormal traffic peaks in network data, thereby obtaining DDoS attack data. It also uses packet payload keyword matching to detect and identify large outbound traffic from non-business ports, obtaining leaked data. Furthermore, it uses deep protocol compliance testing to detect and identify abnormal protocol payloads in network data, obtaining hidden tunnel data. Finally, it uses timestamps to mark the start and end points of nodes in DDoS attack data, data leaks, and hidden tunnel data, outputting the marked nodes as network risk points. Firewall logs are detected using time-series mutation detection, with a sharp increase in DENY rule triggering frequency and dispersed source IPs identified as the first log risk point. VPN logs are detected using geofencing policies, with VPN logs showing successful logins outside of working hours and from different IPs identified as the second log risk point. DNS logs are detected using domain name generation algorithms, with DNS logs showing a large number of NXDOMAIN responses and abnormally shortened TTLs identified as the third log risk point. The first, second, and third log risk points are then output as the log risk points.

3. The information security risk classification method according to claim 1, characterized in that, A method for obtaining information risk points by performing knowledge graph association analysis on the network risk points and the log risk points includes: Risk entities of network risk points and log risk points are extracted by bidirectional long short-term memory network and BERT model. The risk entities are matched with the current node of network information knowledge graph. Risk entities with cosine similarity greater than 0.853 are merged with the current node to obtain risk point knowledge graph. Temporary nodes are automatically generated for unmatched valley risk nodes and potential relationships are linked. An improved DS evidence theory is adopted, and a time-series weighting factor is introduced to resolve conflicts. The expression is as follows: ； in For time series weighting factors, Let a be the total number of pieces of evidence for the a-th conflict. The time difference between when the evidence was generated and the present time. The credibility coefficient for the a-th evidence is set based on the authority of the evidence source and the cosine of the evidence type, and its value ranges from 0 to 1. Graph reasoning is performed based on a risk point knowledge graph to obtain information risk points. Graph reasoning includes path reasoning, semantic reasoning, and temporal reasoning. Path reasoning is performed using random walks combined with convolutional neural attention mechanisms to identify cross-system risk transmission. Knowledge graph embedding and completion are combined with a rule engine to automatically generate production risk transmission rules. Semantic reasoning is performed based on production risk transmission rules to predict unexposed risk points. Long short-term memory temporal graph network analysis is used to analyze the correlation between basic input / output system log firmware update time and subsequent attacks. Temporal reasoning is performed based on the correlation to capture low-frequency, long-cycle attacks. To obtain the asset value, severity score, and betweenness centrality of information risk points, and to enhance the risk quantification of these information risk points, the expression is as follows: ； in Let c be the asset value at the c-th information risk point. Score the severity of the c-th information risk point. Let c be the betweenness centrality of the information risk point; The risk level of the c-th information risk point; Mark the risk level at each information risk point and output the result.

4. The information security risk classification method according to claim 1, characterized in that, A method for dynamically extracting security risk features from the aforementioned information risk points includes: Information risk points are preprocessed and routed according to feature dimensions to obtain three dimensions: time series, business impact, and attack countermeasures. The first dynamic risk feature is obtained by using sliding window statistics to extract dynamic risk features in the time series dimension; the second dynamic risk feature is obtained by using asset dependency graph analysis to extract dynamic risk features in the business impact dimension; and the third dynamic risk feature is obtained by using red team / blue team adversarial data matching to extract dynamic risk features in the attack and adversarial dimension. The first dynamic risk characteristic includes volatility entropy, outbreak slope, and periodic intensity. The outbreak slope is the rate of increase in risk events per unit time, and the periodic intensity is the period matching a known attack pattern. The volatility entropy is calculated using the following formula: ； in The fluctuation entropy value within the time window t. Let i be the probability of the i-th risk event occurring; The second dynamic risk characteristic includes data lineage contamination and service dependency disruption value; where lineage contamination represents the proportion of affected data assets to key nodes in the business flow; and service dependency disruption value is the number of downstream systems associated with the threatened service. The third dynamic risk characteristic includes attack complexity, defense response strength, and countermeasure timeliness; where attack complexity is the vulnerability exploitation cost coefficient, defense response strength is the coverage of protective measures, and countermeasure timeliness is the threat intelligence freshness decay factor, expressed as: ,in The number of hours for intelligence delay; The first dynamic risk feature, the second dynamic risk feature, and the third dynamic risk feature are output as safety risk features.

5. The information security risk classification method according to claim 1, characterized in that, The method for calculating and assessing the degree of loss based on the aforementioned security risk characteristics includes: By inputting security risk characteristics into a three-dimensional quantitative simulation model, direct economic losses, indirect reputational losses, and compliance losses can be obtained. Direct economic losses include data asset restoration costs, business interruption losses, and fines; indirect reputational losses include the value of lost customers, brand value depreciation, and stock price fluctuations; compliance losses include the number and severity of violations of regulatory provisions. Based on the risk chain propagation model, the input security risk features are classified, and the attack cost coefficient, service dependency disruption value, and compliance deviation items of the classified security risk features are extracted. A conditional risk value model is then used to extrapolate the conditional risk value, expressed as follows: ； in For random loss variables, For confidence level, Confidence level Conditional Value at Risk The maximum loss at the u-quantile; Monte Carlo simulation was used to deduce the mapping relationship between the attack cost coefficient and the direct loss multiplication coefficient; graph propagation algorithm was used to deduce the mapping relationship between the service dependency damage value and the business interruption loss index; and rule engine matching was used to deduce the mapping relationship between compliance deviations and regulatory penalty levels. A three-stage simulation mechanism is integrated for dynamic simulation and evaluation. The three-stage mechanism consists of:

1. Initial impact assessment: calculating single-point loss based on vulnerability exploitation difficulty; 2. Secondary spillover assessment: calculating impact spread through business flow topology; 3. Long-tail effect assessment: introducing an intelligence freshness decay factor; the expression is: ； ； ； in For single-point loss, To prevent the spread of the impact, For loss degree, Information freshness decay factor For the number of hours of delay, For asset value, Based on the severity of the vulnerability, This represents the attack cost coefficient. For the service dependency disruption value of the b-th simulated risk event, To simulate the number of risk events.

6. The information security risk classification method according to claim 1, characterized in that, A method for calculating the vulnerability of an information risk point based on the ease of attacking and defending the security risk characteristics includes: The attack complexity, vulnerability exploitability, intelligence freshness decay factor, control measure completeness rate, protection failure rate, and response lag coefficient are obtained. Attack complexity is the cumulative product of tool cost, technical threshold, and difficulty in evading detection. Vulnerability exploitability is the product of vulnerability disclosure rate and exploit path complexity. Control measure completeness rate is the product of deployment measures and intelligence freshness. Protection failure rate is the average number of failures of historical measures. Response lag coefficient is the threat detection time divided by the response time. Attack-related metrics include attack complexity, vulnerability exploitability, and intelligence freshness decay factor; defense-related metrics include control measure completeness rate, protection failure rate, and response lag coefficient. Calculate the vulnerability of information risk points based on attack and defense dimension indicators: ； in The vulnerability of the c-th information risk point, Let c be the threat capability level of the information risk point. For the resistance to the c-th information risk point, For the exploitability of the c-th information risk point, The inverse of the protection failure rate of the c-th information risk point; When the vulnerability is less than or equal to 0.3, seasonal monitoring is implemented; when the vulnerability is greater than 0.3 but less than or equal to 0.6, manual review is conducted within 15 days; when the vulnerability is greater than 0.6, automatic isolation and evidence collection and tracing are implemented.

7. The information security risk classification method according to claim 1, characterized in that, A method for constructing a topological network information security risk classification model based on the loss degree and the vulnerability degree includes: The objective weighting of loss degree, vulnerability degree, and loss function is used as the objective function of the topology network information security risk classification model. The topology network information security risk classification model includes feature extraction algorithms, dynamic time series analysis algorithms, graph neural network algorithms, and deep learning algorithms; Feature extraction algorithms extract network security feature nodes by quantifying discriminative patterns in input data that can characterize attack behavior, system vulnerability, and potential impact. The dynamic time series analysis algorithm analyzes the changing patterns of network security feature nodes over time and captures the spatiotemporal correlation between network security feature nodes and their topological neighbors, dynamically deducing risk feature nodes that represent real-time threat states. The graph neural network algorithm constructs a risk level determination matrix based on loss degree and vulnerability, obtains the network topology graph of risk feature nodes, node reachability relationships and general vulnerability database, generates a state attack and defense graph based on the network topology graph, node reachability relationships and general vulnerability database, and outputs the attack path set and success probability. Deep learning algorithms serialize and encode attack paths, use attention mechanisms to weight and aggregate attack paths and success probabilities, and achieve end-to-end security risk level classification by optimizing the objective function and combining it with a risk level judgment matrix.

8. The information security risk classification method according to claim 1, characterized in that, A method for optimizing the information security risk classification model of the topology network based on a reward strategy includes: Risk management is applied to the output of the topology network information security risk classification model. A reward function is constructed based on the accuracy reward, false alarm penalty, and timeliness reward of risk classification. The reward function value of the output result is calculated, and the classification scheme with the largest reward function value is taken as the optimal value. The risk level judgment of the risk feature node is adjusted, and the reward function value is recalculated. If the current reward function value is greater than the optimal value, the optimal value is updated; otherwise, the risk level judgment of the risk feature node is adjusted. The expression for the given reward function is: ； in The reward function for the z-th risk classification is... A reward is given for the accuracy of the z-th risk classification. For accuracy weighting coefficients, The penalty for a false positive in the z-th risk classification. The weighting coefficient for false alarm penalties. As a time-sensitive reward for the z-th risk classification, This is a timeliness weighting coefficient; Historical risk events are collected and converted into triplets of state, action, and reward. The topology network information security risk classification model is trained, and a combinatorial optimization algorithm is used to adjust the accuracy reward, false alarm penalty, and timeliness reward. The process is iterated until the reward function value reaches its maximum value, and the adjustment result is output.

9. An information security risk classification system, used to perform the method according to any one of claims 1-8, characterized in that, include: Data acquisition module: used to collect network data and log data with preset information, and to preprocess the network data and log data; The network risk data includes network traffic data, system-level data, security protection data, hardware layer data, business context data, open-source component vulnerability versions, authentication data, behavioral data, and threat intelligence data; the log data includes border device logs, DNS / DHCP logs, security logs, BIOS / UEFI firmware logs, application logs, and cloud service API call logs. Risk location module: used to identify risks in the network data and the log data respectively, obtain network risk points and log risk points, and obtain information risk points by multi-source extraction of the network risk points and the log risk points; Risk assessment module: used to dynamically extract security risk features from the information risk points, perform inference and assessment based on the security risk features to obtain the loss degree, and calculate the vulnerability of the information risk points based on the attack and defense difficulty of the security risk features; Modeling and optimization module: used to construct a topology network information security risk classification model based on the loss degree and the vulnerability, optimize the topology network information security risk classification model based on the reward strategy, input the data to be identified into the topology network information security risk classification model, and output the classification result.

Images