A method and apparatus for vulnerability risk assessment in a network

Abstract

The application discloses a vulnerability risk assessment method and device in a network, relates to the technical field of network security, and mainly realizes accurate deployment of defense resources. The main technical scheme of the application is as follows: for each initial node to the target node in a target network attack graph, according to the conjunctive and disjunctive calculation rules, the vulnerability parameters of the attack path nodes, the vulnerability repair degree and the vulnerability exposure degree are combined to calculate the cumulative attack success rate; the cumulative attack gain is calculated in combination with the threat value of the node to the target network and the attack complexity; the node feature matrix is constructed based on the cumulative attack success rate and the cumulative attack gain; the node adjacency matrix of the node feature matrix is constructed according to the directed edge connection condition, and the product of the node adjacency matrix and the node feature matrix is determined as the target node feature matrix; the target node feature matrix is input into a graph convolution network model to output an attack probability value; and the vulnerability risk assessment results of each node in the target network are generated based on the attack probability value and the vulnerability parameters.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for assessing the vulnerability risk in a network. Background Technology

[0002] In today's society, networks carry massive amounts of data exchange and business operations. Vulnerabilities in networks can be exploited by malicious attackers, leading to data breaches or business service disruptions for enterprises. Therefore, it is crucial to conduct risk assessments of network vulnerabilities in order to proactively implement defenses.

[0003] However, current mainstream vulnerability risk assessment methods typically employ a static assessment model based on vulnerability scoring systems. This involves independently scoring vulnerabilities on each node, creating a simple "node-score" mapping. While this method reflects the inherent risk attributes of the vulnerability itself, this isolated assessment severs the connection between the vulnerability and the network topology. In real-world attack scenarios, a low-scoring vulnerability, if located at a critical hub in the network attack path (such as a location that can redirect to the core database), may pose a far greater threat than a higher-scoring vulnerability located at the network edge. Existing methods fail to capture this risk amplification effect caused by network location, thus directly leading to a misallocation of defense resources. Summary of the Invention

[0004] In view of the above problems, the present invention provides a method and apparatus for assessing the vulnerability risk in a network. The main purpose is to enable the obtained vulnerability risk assessment results to reflect the overall risk transmission logic of the vulnerability at the network level, so as to achieve accurate deployment of defense resources.

[0005] To solve the above-mentioned technical problems, the present invention proposes the following solution:

[0006] In a first aspect, the present invention provides a method for assessing the vulnerability risk in a network, the method comprising:

[0007] Obtain a preset attack graph corresponding to the target network. The attack graph includes nodes mapped to each host, directed edges connecting each node, and attack paths between the initial node and the target node.

[0008] For each initial node to each target node in the preset attack graph, the cumulative attack success rate is calculated based on the conjunction calculation rules and disjunction calculation rules, combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node.

[0009] For each initial node to each target node, the cumulative attack gain from each initial node to each target node is calculated by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity.

[0010] The node feature matrix in the preset attack graph is constructed based on the cumulative attack success rate and cumulative attack gain;

[0011] The node adjacency matrix is ​​constructed based on the directed edges in the preset attack graph, and the product of the node adjacency matrix and the node feature matrix is ​​determined as the target node feature matrix.

[0012] The target node feature matrix is ​​input into a pre-trained graph convolutional network model, and the attack probability value corresponding to each node is output.

[0013] Based on the attack probability value and vulnerability parameters of each node, a vulnerability risk assessment result for each node in the target network is generated.

[0014] Secondly, the present invention provides a vulnerability risk assessment device for networks, the device comprising:

[0015] The graph acquisition unit is used to acquire a preset attack graph corresponding to the target network. The attack graph includes nodes mapped to each host, directed edges connecting each node, and attack paths between the initial node and the target node.

[0016] The first calculation unit is used to calculate the cumulative attack success rate for each initial node to each target node in the preset attack graph obtained by the graph acquisition unit, based on the conjunctive calculation rules and disjunctive calculation rules, and combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node.

[0017] The second calculation unit is used to calculate the cumulative attack gain from each initial node to each target node in the preset attack graph obtained by the graph acquisition unit, by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity.

[0018] The first matrix construction unit is used to construct the node feature matrix in the preset attack graph based on the cumulative attack success rate obtained by the first calculation unit and the cumulative attack gain obtained by the second calculation unit.

[0019] The second matrix construction unit is used to construct the node adjacency matrix based on the directed edges in the preset attack graph, and to determine the target node feature matrix by multiplying the node adjacency matrix with the node feature matrix obtained by the first matrix construction unit.

[0020] The probability prediction unit is used to input the target node feature matrix obtained by the second matrix construction unit into the pre-trained graph convolutional network model and output the attack probability value corresponding to each node.

[0021] The risk assessment unit is used to generate vulnerability risk assessment results for each node in the target network based on the attack probability value corresponding to each node and the vulnerability parameters of each node obtained by the probability prediction unit.

[0022] To achieve the above objectives, according to a third aspect of the present invention, a storage medium is provided, the storage medium including a stored program, wherein, when the program is executed, the device where the storage medium is located is controlled to execute the vulnerability risk assessment method in the network described in the first aspect.

[0023] To achieve the above objectives, according to a fourth aspect of the present invention, a processor is provided for running a program, wherein the program executes the vulnerability risk assessment method in the network described in the first aspect.

[0024] By employing the above technical solution, this invention provides a method and apparatus for assessing the vulnerability risk in a network. First, a preset attack graph corresponding to the target network can be obtained. The attack graph includes nodes mapped from each host, directed edges connecting each node, and attack paths between initial nodes and target nodes. By incorporating isolated hosts and vulnerabilities into the network topology through the attack graph, the limitations of traditional isolated analysis of single-host vulnerabilities are broken, shifting the assessment perspective from a "single-machine perspective" to a "network-wide attack chain perspective." Subsequently, for each initial node to each target node in the preset attack graph, the cumulative attack success rate can be calculated based on the conjunction and disjunction rules, combined with the vulnerability parameters, vulnerability remediation levels, and vulnerability exposure levels of the nodes forming the attack paths between each initial node and each target node. Simultaneously, for each initial node to each target node, the cumulative attack gain is calculated based on the threat value and attack complexity of the nodes forming the attack paths between each initial node and each target node to the target network. Finally, a node feature matrix in a pre-defined attack graph can be constructed based on the cumulative attack success rate and cumulative attack gain. A node adjacency matrix is ​​then constructed based on the directed edges in the pre-defined attack graph, and the product of the adjacency matrix and the node feature matrix is ​​determined as the target node feature matrix. This target node feature matrix is ​​then input into a pre-trained graph convolutional network model, which outputs the attack probability value corresponding to each node. Based on the attack probability value and vulnerability parameters of each node, a vulnerability risk assessment result for each node in the target network is generated. By integrating the cumulative attack success rate and cumulative attack gain into a node feature matrix, and then combining it with the adjacency matrix to generate the target feature matrix, a deep fusion of the node's own risk attributes and the relationship with the network structure is achieved. This preserves the unique risk characteristics of each attack path while capturing the propagation between nodes through matrix operations. Furthermore, the introduction of a graph convolutional network model can automatically learn the global association patterns of nodes in the attack graph. The final output node attack probability value, combined with the assessment result formed by the vulnerability parameters, possesses both the accuracy of vulnerability risk at the micro level and includes the overall risk transmission logic of vulnerabilities at the macro level of the network. This effectively avoids resource misallocation and supports the precise deployment of defense resources.

[0025] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0026] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0027] Figure 1 This invention provides a flowchart of a vulnerability risk assessment method in a network.

[0028] Figure 2 This invention provides a flowchart of another vulnerability risk assessment method in a network.

[0029] Figure 3 This diagram illustrates the composition of a vulnerability risk assessment device in a network according to an embodiment of the present invention.

[0030] Figure 4 This invention provides a block diagram of another vulnerability risk assessment device in a network. Detailed Implementation

[0031] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0032] To address the current resource mismatch problem, we propose an innovative method for assessing the risk of network vulnerabilities. This method no longer examines individual vulnerabilities in isolation, but rather combines vulnerabilities with the risk propagation relationships within the actual network. This ensures that the assessment results not only reflect the inherent danger of the vulnerability but also reveal its overall risk level within the entire network topology.

[0033] It should be noted that the system executing this method can be a system deployed on any host within the network structure, or a system located outside the target network. As long as the system can collect host information and communication rules within the target network and possesses independent computing capabilities, it can generate the final vulnerability risk assessment result.

[0034] Next, combined Figure 1 This invention describes a method for assessing the vulnerability risk in a network, and its specific execution steps are as follows: Figure 1 As shown, it includes:

[0035] 101. Obtain the preset attack graph corresponding to the target network.

[0036] In this invention, vulnerability information of each host in the target network can be collected in advance using vulnerability scanning tools or manual input, including data such as vulnerabilities, open service ports, and protocols. Simultaneously, communication rules between hosts can be extracted using network traffic analysis tools or firewall policy logs, covering information such as IP addresses, port mapping relationships, access control policies (e.g., allow / deny), protocol types (e.g., HTTP, SSH), and communication direction (inbound / outbound).

[0037] Subsequently, based on the collected vulnerability information and inter-host communication rules, an attack graph corresponding to the target network is constructed. During the construction process, a pre-defined attack graph definition can be referenced, which includes:

[0038] 1) The attack graph consists of a quadruple (S, A, V, E), where S represents the set of state nodes, A represents the set of atomic attacks, V represents the set of vulnerabilities, and E represents the set of directed edges for state transitions. S = {S i The attack graph |i=1,2,L,n} consists of n state nodes, including three different types of nodes: initial nodes, transition nodes, and target nodes (absorbing state nodes). An initial node is the state node at the start of the attack, a target node is the state node the attack aims to reach at the end, and the remaining nodes are transition nodes. In an attack path containing multiple directed edges, transition nodes are responsible for connecting the nodes, but may also serve as target nodes or initial nodes in other attack paths.

[0039] 2) A represents an exploit of the vulnerability. If the attack is successful, a state transition occurs between nodes; otherwise, it is considered a state node accessing itself.

[0040] 3) V = {Vi | i = 1, 2, ..., m} VVi represents the host or server vulnerability exploited during the state transition process in the attack graph. Score(V i The exploit score for the vulnerability is also indicated.

[0041] 4) E = {E} i,j |i,j=1,2,L,n}E i,j E is from a node S i Pointing to another node S j A directed edge corresponds to one state transition process. If E i,j The existence of this directed edge indicates that it is possible to start from a certain state node S. i Transition to another state node S j .

[0042] 102. For each initial node to each target node in the preset attack graph, calculate the cumulative attack success rate based on the conjunction and disjunction calculation rules, combined with the vulnerability parameters, vulnerability remediation degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node.

[0043] In this step, the vulnerability parameters for each node can be extracted from the Common Vulnerability Scoring System (CVSS). These parameters include attack vector (AV), attack complexity (AC), permission requirements (PR), user interaction (UI), scope (S), and confidentiality (C), integrity (I), and usability (U). Since this vulnerability scoring system is existing technology, its working principle will not be repeated here.

[0044] The degree of vulnerability remediation and vulnerability exposure at each node can be evaluated using Weibull and Pareto distributions. The Weibull distribution is suitable for modeling the probability distribution of vulnerability remediation time. For example, the longer the remediation time, the probability of successful remediation may decrease exponentially (consistent with the "early failure" characteristic of the Weibull distribution), or the probability may drop sharply after a long period without remediation (consistent with the "late failure" characteristic).

[0045] Regarding the calculation of dynamic remediation level, a decay curve of remediation level is plotted using the Weibull distribution, combining the vulnerability disclosure time and the actual remediation time. For example, if a vulnerability is remediated within one month of disclosure, the remediation level can reach 100%; if it is delayed to three months, the remediation level may drop to 70% (based on the fitting results of the Weibull parameters).

[0046] The Pareto distribution describes the uneven distribution of vulnerability exposure. For example, 80% of the attack surface may be concentrated on 20% of high-risk vulnerabilities (following the Pareto 80 / 20 rule), while the remaining 80% of vulnerabilities contribute only 20% of the risk. The Pareto distribution identifies the "critical few" vulnerabilities (such as remote exploitability or high CVSS scores), allowing resources to be focused on prioritizing their protection.

[0047] After obtaining the above information, in this step, for each initial node to each target node in the preset attack graph, the cumulative attack success rate can be calculated based on the conjunctive and disjunctive calculation rules, combined with the vulnerability parameters, vulnerability repair level, and vulnerability exposure level of the nodes that form the attack path between each initial node and each target node.

[0048] The reason for using the conjunctive computation rule is that the attack path from the initial node to the target node may involve multiple directed edges, each representing an attack by one node on another. In this case, multiple nodes are involved, and each node has a corresponding vulnerability, thus requiring the application of the conjunctive computation rule.

[0049] The rationale for using disjunctive computation rules is that there may be multiple attack paths from the initial node to the target node. Disjunctive computation rules can determine the probability that at least one of these multiple attack paths will succeed. Finally, by combining conjunctive and disjunctive computation rules, as well as the vulnerability parameters, vulnerability remediation levels, and vulnerability exposure levels of the nodes in each attack path from the initial node to each target node, the cumulative attack success rate from each initial node to each target node is calculated.

[0050] In this process, the principle of ascending from small to large must be followed. That is, for cases with multiple directed edges, the success rate of a single-step attack on a single directed edge should first be calculated based on the vulnerability parameters, vulnerability remediation level, and vulnerability exposure level of the endpoint node pointed to by the directed edge. Next, according to the conjunctive rule, combined with the success rates of single-step attacks on multiple directed edges, the success rate of an attack path is derived. Of course, if multiple attack paths exist, the cumulative attack success rate from each initial node to each target node must ultimately be calculated using the disjunctive rule.

[0051] Of course, if there is only one attack path, the success rate of that path is the cumulative attack success rate from each initial node to each target node. Similarly, if there is only one directed edge, the single-step attack success rate of that directed edge is the success rate of the path, and the endpoint node pointed to by the directed edge is the target node. If a path contains multiple directed edges, the endpoint nodes connected by these directed edges are the transition nodes.

[0052] In other words, the "nodes that form the attack path from each initial node to each target node" mentioned here refer to the nodes that make up the attack path or directed edge.

[0053] 103. For each initial node to each target node, calculate the cumulative attack gain of each initial node to each target node by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity.

[0054] In the attack path, the threat value of each node vulnerability needs to be determined by comprehensively considering the vulnerability's potential destructiveness (e.g., CVSS score), the asset value of the target network (e.g., the sensitivity of core servers or databases), and the severity of the attack consequences (e.g., data breaches or business interruptions). Potential destructiveness is quantified by the impact sub-score in the CVSS scoring system, quantifying the extent to which the vulnerability compromises confidentiality, integrity, and availability. Asset value is assessed based on the target node's position in the path (e.g., whether it is a core node) and its business sensitivity (e.g., critical databases), evaluating its strategic importance after an attack. The severity of the attack consequences is determined based on historical cases or simulation analysis, judging the actual impact that vulnerability exploitation may cause (e.g., compliance risks).

[0055] Attack complexity characterizes the cost of attacking a node, with a value ranging from [1, 10]. The calculation combines the exploitability score from the CVSS scoring system with vulnerability exploitation thresholds (such as whether social engineering, specific privileges, or physical access are required). For example, remote vulnerabilities requiring no privileges have lower complexity (2-3 points), while vulnerabilities requiring custom tools or physical access have higher complexity (8-10 points).

[0056] This step involves the case where there are multiple attack paths from the initial node to the target node, and the case where each attack path contains multiple directed edges. A principle of ascending from smallest to largest can be adopted. First, the single-step attack gain of each directed edge is calculated based on the threat value of the two nodes connected by the directed edge to the target network and the attack complexity of the terminating node. Then, the attack gain of the entire path is calculated based on the single-step attack gain. Finally, the largest attack gain among the multiple paths is selected as the cumulative attack gain from each initial node to each target node.

[0057] Of course, for a single attack path, the attack gain of the entire path is the cumulative attack gain from each initial node to each target node. However, for a single directed edge, the attack gain of a single step on the single directed edge is the attack gain of the entire path.

[0058] 104. Construct a node feature matrix in the preset attack graph based on the cumulative attack success rate and cumulative attack gain.

[0059] 105. Construct the node adjacency matrix based on the directed edges in the preset attack graph, and determine the target node feature matrix by multiplying the node adjacency matrix and the node feature matrix.

[0060] 106. Input the target node feature matrix into the pre-trained graph convolutional network model and output the attack probability value corresponding to each node.

[0061] 107. Generate vulnerability risk assessment results for each node in the target network based on the attack probability value and vulnerability parameters of each node.

[0062] In step 104, it should be specifically noted that the calculation involves the cumulative attack gain and cumulative attack success rate of each initial node against each target node. More precisely, this refers to the cumulative attack gain and cumulative attack success rate generated by each initial node for attacking the target node. Therefore, strictly speaking, the cumulative attack success rate and cumulative attack gain should be considered characteristics of the target node. However, in the attack graph, each node may serve as both the initial node of one attack path and the target node of another path; thus, each node possesses its own corresponding cumulative attack success rate and cumulative attack gain.

[0063] Then, the features (cumulative attack success rate and cumulative attack gain) of all nodes in the attack graph can be arranged in order to form a feature matrix. For example, if there are 10 nodes in the network, the feature matrix contains 10 rows, with each row corresponding to the attack success rate and gain value of one node.

[0064] Subsequently, in step 105, a node adjacency matrix corresponding to the node feature matrix can be constructed based on the connection status of the directed edges, and the product of the node adjacency matrix and the node feature matrix is ​​determined as the target node feature matrix. The adjacency matrix is ​​used to describe the connection relationship between nodes in the attack graph. If there is a directed edge from node A to node B (i.e., the attacker can directly attack B from A), the corresponding position in the adjacency matrix is ​​marked as 1; otherwise, it is marked as 0. Further, for two nodes marked as 1, this can be replaced with the node coupling strength between the two nodes to characterize the correlation between them.

[0065] Subsequently, the adjacency matrix is ​​multiplied by the feature matrix to obtain the feature matrix of the target node. This process is equivalent to passing the feature information of each node to its neighboring nodes and weighted integrating the features of the neighboring nodes to form a new feature representation.

[0066] Furthermore, in step 106, the target node feature matrix can be input into a pre-trained graph convolutional network model to output the probability value of each node being attacked. The graph convolutional network model extracts node features and high-order associations of their connections through multi-layer neural networks. For example, the first layer combines the node's own features and the features of its neighbors to generate a new representation, while subsequent layers further fuse higher-order neighbor information.

[0067] Finally, the output layer will output an attack probability value for each node, which represents the likelihood that the node is vulnerable to attack. The higher the probability value, the more likely the node is to become a target.

[0068] Finally, in step 107, based on the attack probability value and vulnerability parameters of each node, the vulnerability risk assessment results of each node in the target network are generated.

[0069] Based on the above Figure 1 As can be seen from the implementation method, the vulnerability risk assessment method in the network provided by this invention first obtains a preset attack graph corresponding to the target network. The attack graph includes nodes mapped to each host, directed edges connecting each node, and attack paths between initial nodes and target nodes. By incorporating isolated hosts and vulnerabilities into the network topology through the attack graph, the limitations of traditional isolated analysis of single-host vulnerabilities are broken, and the assessment perspective is shifted from a "single-machine perspective" to a "full network attack chain perspective". Subsequently, for each initial node to each target node in the preset attack graph, the cumulative attack success rate can be calculated based on the conjunctive and disjunctive calculation rules, combined with the vulnerability parameters, vulnerability remediation degree, and vulnerability exposure degree of the nodes forming the attack paths between each initial node and each target node. At the same time, for each initial node to each target node, the cumulative attack gain is calculated based on the threat value and attack complexity of the nodes forming the attack paths between each initial node and each target node to the target network. Finally, a node feature matrix in a pre-defined attack graph can be constructed based on the cumulative attack success rate and cumulative attack gain. A node adjacency matrix is ​​then constructed based on the directed edges in the pre-defined attack graph, and the product of the adjacency matrix and the node feature matrix is ​​determined as the target node feature matrix. This target node feature matrix is ​​then input into a pre-trained graph convolutional network model, which outputs the attack probability value corresponding to each node. Based on the attack probability value and vulnerability parameters of each node, a vulnerability risk assessment result for each node in the target network is generated. By integrating the cumulative attack success rate and cumulative attack gain into a node feature matrix, and then combining it with the adjacency matrix to generate the target feature matrix, a deep fusion of the node's own risk attributes and the relationship with the network structure is achieved. This preserves the unique risk characteristics of each attack path while capturing the propagation between nodes through matrix operations. Furthermore, the introduction of a graph convolutional network model can automatically learn the global association patterns of nodes in the attack graph. The final output node attack probability value, combined with the assessment result formed by the vulnerability parameters, possesses both the accuracy of vulnerability risk at the micro level and includes the overall risk transmission logic of vulnerabilities at the macro level of the network. This effectively avoids resource misallocation and supports the precise deployment of defense resources.

[0070] Furthermore, as a response to Figure 1 Further refinement and extension of the illustrated embodiments, this invention also provides another method for assessing vulnerability risks in networks, such as... Figure 2 As shown, the specific steps are as follows:

[0071] 201. Obtain the preset attack graph corresponding to the target network.

[0072] 202. For each initial node to each target node in the preset attack graph, calculate the cumulative attack success rate based on the conjunction calculation rules and disjunction calculation rules, combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node.

[0073] Regarding the extent of vulnerability remediation (RE) i and vulnerability exposure level EX i The calculation can be performed using the Weibull and Pareto distributions, with the following formulas:

[0074]

[0075] In the formula: T i Let be the duration of vulnerability i's release; α and β are the parameters of the Weibull and Pareto distributions, respectively.

[0076] In this embodiment, if there are multiple exploitable attack paths between the initial node and the target node, the target attack success rate of each attack path is first calculated according to the conjunctive calculation rule, combining the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes in the attack paths from each initial node to each target node. Then, the cumulative attack success rate from the initial node to the target node is calculated based on the target attack success rate of multiple attack paths according to the disjunctive calculation rule.

[0077] If there is a single exploitable attack path between each initial node and each target node, the target attack success rate of the attack path is calculated according to the conjunctive calculation rule, combining the vulnerability parameters, vulnerability remediation degree and vulnerability exposure degree of the nodes in the attack path from each initial node to each target node, and the target attack success rate is determined as the cumulative attack success rate from the initial node to the target node.

[0078] Specifically, the steps used in "calculating the target attack success rate of the attack path based on the conjunctive calculation rules, combined with the vulnerability parameters, vulnerability remediation level, and vulnerability exposure level of the nodes in the attack path from each initial node to each target node" are as follows:

[0079] 1. Based on all the directed edges in the attack graph, determine the target directed edges that form the attack paths from each initial node to each target node, as well as the target termination nodes that connect the target directed edges.

[0080] 2. For each directed edge, calculate the single-step attack success rate of each directed edge based on the attack vector score, attack complexity score, permission requirement score, user interaction score, vulnerability remediation degree, and vulnerability exposure degree in the vulnerability parameters of the target termination node.

[0081] 3. The target attack success rate of the attack path is obtained based on the single-step attack success rate of each directed edge.

[0082] Specifically, for step 2, the steps are as follows:

[0083] 2.1 Calculate the probability of exploiting the vulnerability in the target termination node based on the attack vector score, attack complexity score, privilege requirement score, user interaction score, vulnerability remediation level, and vulnerability exposure level in the vulnerability parameters of the target termination node. The specific formula is as follows:

[0084] P i 1 =ωAV i +δAC i +γPR i +ξUI i +θRE i +λEX i (Formula 3)

[0085] Where: AV i AC i PR i UI i These represent the attack vector score, attack complexity score, privilege requirement score, and user interaction score of the vulnerability in CVSS's basic attribute group, respectively, all indicating the vulnerability's static characteristic score; RE i and EX i ω represents the vulnerability remediation level and the vulnerability exposure level, respectively, and represents the dynamic characteristic score of the vulnerability; ω, δ, γ, ξ, θ, and λ represent the weights of different factors on the probability of successful exploitation of the vulnerability.

[0086] 2.2. Based on the preset quantitative attack proficiency level, the total number of vulnerabilities in the attack graph, and the preset number of attacks, calculate the vulnerability exploitation capability of the target termination node, using the following formula:

[0087]

[0088] In equation (5): k represents the attacker's proficiency with the knowledge (i.e., the preset quantitative attack proficiency, which is obtained by human pre-setting in this step), and k∈[0,1]; N i t represents the total number of vulnerabilities; t represents the number of times an attacker attacks vulnerability i (i.e., the preset number of attacks).

[0089] 2.3. Calculate the single-step attack success rate of each directed edge based on the probability of vulnerability exploitation and the exploitation capability. The formula is:

[0090] P Si =P i 1 P i2 (Formula 5)

[0091] Among them, P i 1 P represents the probability that the vulnerability will be exploited. i 2 To utilize capabilities

[0092] The following steps can be used to "calculate the cumulative attack success rate from the initial node to the target node based on the target attack success rate of multiple attack paths according to the disjunction calculation rules":

[0093] Calculate the failure probability of each attack path based on the target attack success rate of each attack path;

[0094] The cumulative failure probability of multiple attack paths is obtained based on the failure probability of each attack path.

[0095] The success probability of one of the multiple attack paths between the initial node and the target node is obtained based on the cumulative failure probability, and the target probability is determined as the cumulative attack success rate from the initial node to the target node.

[0096] The above process can use the first formula in Formula 6, while the second formula in Formula 7 is the formula used in the above "step 3 to calculate the target attack success rate of the attack path based on the single-step attack success rate of each directed edge".

[0097]

[0098] Specifically, when a single attack path exists, This formula calculates the target attack success rate, i.e., the cumulative attack success rate; when multiple paths exist, the formula above in Formula Six is ​​used. To calculate the cumulative attack success rate.

[0099] 203. For each initial node to each target node, calculate the cumulative attack gain of each initial node to each target node by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity.

[0100] In this step, for each directed edge included in the attack path from each initial node to each target node, the starting node and the ending node corresponding to each directed edge are determined. Then, for each directed edge, the single-step attack gain of the directed edge is calculated based on the threat value of the starting node and the ending node to the target network and the attack complexity of the ending node.

[0101] If there is a single attack path from each initial node to each target node, the target attack gain of the corresponding attack path is obtained according to the single-step attack gains of all the directed edges included in the attack path, and the target attack gain is determined as the cumulative attack gain; if there are multiple attack paths from each initial node to each target node, the maximum target attack gain among the multiple attack paths is determined as the cumulative attack gain from each initial node to each target node.

[0102] Among them, the formula for "for each directed edge, calculating the single-step attack gain of the directed edge according to the threat value of the start node and the end node to the target network and the attack complexity of the end node" is as follows:

[0103]

[0104] In the formula: and are respectively the threat values of the intrusion system nodes S i and S i+1 to the network, and C si+1 is the attack complexity of the exploitable vulnerability i of the node S i+1 , and its value range is [1, 10], that is, the attack cost of attacking the node S i+1 .

[0105] Since an attacker usually selects the path with the greatest threat and the smallest cost (i.e., the path with the highest gain), taking the maximum value can simulate the optimal strategy of the attacker. By comparing the gains of multiple paths, the most dangerous attack path in the network can be identified, providing a priority reference for defense.

[0106] 204. Construct a node feature matrix in the preset attack graph based on the cumulative attack success rate and the cumulative attack gain.

[0107] 205. Construct a node adjacency matrix according to the directed edges in the preset attack graph, and determine the product of the node adjacency matrix and the node feature matrix as the target node feature matrix.

[0108] 206. Input the target node feature matrix into a pre-trained graph convolutional network model, and output the attack probability values corresponding to each node.

[0109] In this embodiment, before elaborating on steps 204 - 206, it is necessary to first introduce the graph convolutional network model.

[0110] For the attack graph defined above, assuming it contains n nodes and m edges, it is represented as a normalized Laplacian matrix L:

[0111]

[0112] Where W represents the adjacency matrix, I represents the identity matrix, D represents the degree matrix, and its diagonal elements D ii =∑ j W ij Let L be the degree of each node. Performing spectral decomposition on the real symmetric matrix L yields the following equation:

[0113] L=UΛU T (Formula Nine)

[0114] Here, it represents the orthogonal eigenvector U = [u1, L u] n ], where Λ represents the feature matrix of the target node. This orthogonal vector is chosen as the basis for the Fourier transform, and the Fourier transform on the graph is defined as:

[0115]

[0116] Representing the original feature, x passes through the orthogonal basis U T The representation projected onto the spectral domain. Defining the matrix dot product operator as `e`, the convolution of the spectral graphs of two features x and y is:

[0117] x*y=U((U T x)e(U T y)) (Formula Eleven)

[0118] For input feature x, U T y=[θ0,Lθ n-1 ] T It can be viewed as a convolution sum over the spectral domain. This parameter contains n vectors θ, from which a diagonal matrix g is defined. θ =diag([θ0,L,θ n-1 If ]) is the graph convolution kernel, then the formula for graph convolution over the spectral domain is:

[0119] x*y=Ug θ U T x (Formula Twelve)

[0120] Given the difficulty and computational complexity of explicitly solving for eigenvectors, we consider introducing Chebyshev polynomials to the graph convolution kernel g. θ An approximation is made to address the high cost of the Laplacian matrix, thereby obtaining the spectrogram convolution:

[0121]

[0122] β kWhere k represents the coefficient of the Chebyshev polynomial of order k. The order of the Chebyshev polynomial characterizes the receptive field of the graph convolution, and the k-th order polynomial determines the feature information of the k-th order neighboring nodes of the fused network. However, the larger the value of k, the greater the computational complexity. Therefore, most convolution kernels are currently limited to information within the first-order neighborhood (k-1), and multi-level neighbor dependencies are established by stacking multiple layers of graph convolutional networks.

[0123] Having clarified the above model, we can further demonstrate the node feature matrix mentioned in step 206:

[0124]

[0125] The adjacency matrix mentioned in step 207 is as follows:

[0126]

[0127] The elements of the adjacency matrix are shown in the following equation:

[0128]

[0129] Multiplying the node adjacency matrix X by the node feature matrix A yields the target node feature matrix Λ = XgA. This matrix is ​​used as input to the GCN model, and the output is the probability value evaluated by the Softmax function, as shown in the formula:

[0130] P(i,j)=softmax(x i,j (Formula 18)

[0131] 207. For vulnerabilities in each node, calculate the quantitative assessment results of exploitability and the quantitative assessment results of impact based on the vulnerability parameters of each node.

[0132] 208. Generate vulnerability risk assessment results for each node based on the availability quantification assessment results, impact quantification assessment results, and attack probability values.

[0133] After obtaining the probability values, in steps 207-208, for each node's vulnerabilities, the exploitability quantification assessment result in the attack evaluation results of each vulnerability can be calculated based on the attack path score, attack complexity, and user interaction score in the vulnerability parameters, as shown in the following formula:

[0134] E xpScore =8.22×A V ×A C ×U I (Formula 19)

[0135] Among them, A V A C U IThese represent the attack path score, attack complexity score, and user interaction score for the vulnerability, respectively.

[0136] Subsequently, the impact assessment results of each vulnerability are calculated based on the confidentiality score, integrity score, and availability score in the vulnerability parameters. The steps are as follows:

[0137] First, calculate temporary variables based on the confidentiality score, integrity score, and availability score, using the following formula:

[0138] I SCbase =1-((1-C)×(1-I)×(1-A))(Formula Twenty)

[0139] In the formula: I SCbase is a temporary variable; C, I, and A are the confidentiality score, integrity score, and availability score of the vulnerability, respectively.

[0140] After obtaining the temporary variables, the quantitative assessment results of the influence can be calculated based on the temporary variables, as shown in the following formula:

[0141] I mpScore =6.42×I SCbase (Formula 21)

[0142] Subsequently, in step 210, for each vulnerability, the sum of the exploitability quantification assessment result and the impact quantification assessment result can be used as a comprehensive static score. Then, the product between the comprehensive static score and the attack probability value is determined as the preliminary score. Subsequently, the minimum value between the preliminary score and the preset maximum score is determined as the target score for each vulnerability. Finally, the vulnerability risk assessment result for each node is determined based on the target score.

[0143] The specific formula is as follows:

[0144] B aseScore (i,j)=min((E xpScore +I mpScore )·P(i,j),10)(Formula Twenty-Two)

[0145] In the formula: min indicates taking the smaller value of the two, because CVSS limits the vulnerability score to within 10 points; P(i,j) is the probability value of successful attack (i.e., the attack probability value). B aseScore The higher the score, the more dangerous the vulnerability, meaning the higher the risk level of the system.

[0146] It should be clarified that, in this embodiment, the correspondence between the scores of each stage and the corresponding risk levels can be pre-defined. Thus, after obtaining the target score, the vulnerability risk assessment result of each node can be accurately determined based on this correspondence.

[0147] Finally, it should be emphasized that the content described in this invention is based on the assumption that each node has only a single vulnerability. If a node has multiple vulnerabilities, simply make corresponding modifications to the formulas in this invention.

[0148] Furthermore, as a response to the above Figure 1 In addition to the implementation of the method shown, this embodiment of the invention also provides a vulnerability risk assessment device in a network, used for assessing the aforementioned vulnerabilities. Figure 1 The method shown is implemented accordingly. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be clear that the device in this embodiment can implement all the contents of the foregoing method embodiment. Figure 3 As shown, the device includes:

[0149] The graph acquisition unit 301 is used to acquire a preset attack graph corresponding to the target network. The attack graph includes nodes mapped to each host, directed edges connecting each node, and attack paths between the initial node and the target node.

[0150] The first calculation unit 302 is used to calculate the cumulative attack success rate for each initial node to each target node in the preset attack graph obtained by the graph acquisition unit 301, based on the conjunctive calculation rules and disjunctive calculation rules, and combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node.

[0151] The second calculation unit 303 is used to calculate the cumulative attack gain from each initial node to each target node in the preset attack graph obtained by the graph acquisition unit 301, by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity.

[0152] The first matrix construction unit 304 is used to construct the node feature matrix in the preset attack graph based on the cumulative attack success rate obtained by the first calculation unit 302 and the cumulative attack gain obtained by the second calculation unit 303.

[0153] The second matrix construction unit 305 is used to construct the node adjacency matrix based on the directed edges in the preset attack graph, and to determine the target node feature matrix by multiplying the node adjacency matrix with the node feature matrix obtained by the first matrix construction unit 304.

[0154] The probability prediction unit 306 is used to input the target node feature matrix obtained by the second matrix construction unit 305 into the pre-trained graph convolutional network model and output the attack probability value corresponding to each node.

[0155] The risk assessment unit 307 is used to generate a vulnerability risk assessment result for each node in the target network based on the attack probability value corresponding to each node and the vulnerability parameters of each node obtained by the probability prediction unit 306.

[0156] Furthermore, as a response to the above Figure 2 In addition to the implementation of the method shown, this embodiment of the invention also provides another vulnerability risk assessment device in a network, used for assessing the aforementioned vulnerabilities. Figure 2 The method shown is implemented accordingly. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be clear that the device in this embodiment can implement all the contents of the foregoing method embodiment. Figure 4 As shown, the device includes:

[0157] The graph acquisition unit 301 is used to acquire a preset attack graph corresponding to the target network. The attack graph includes nodes mapped to each host, directed edges connecting each node, and attack paths between the initial node and the target node.

[0158] The first calculation unit 302 is used to calculate the cumulative attack success rate for each initial node to each target node in the preset attack graph obtained by the graph acquisition unit 301, based on the conjunctive calculation rules and disjunctive calculation rules, and combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node.

[0159] The second calculation unit 303 is used to calculate the cumulative attack gain from each initial node to each target node in the preset attack graph obtained by the graph acquisition unit 301, by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity.

[0160] The first matrix construction unit 304 is used to construct the node feature matrix in the preset attack graph based on the cumulative attack success rate obtained by the first calculation unit 302 and the cumulative attack gain obtained by the second calculation unit 303.

[0161] The second matrix construction unit 305 is used to construct the node adjacency matrix based on the directed edges in the preset attack graph, and to determine the target node feature matrix by multiplying the node adjacency matrix with the node feature matrix obtained by the first matrix construction unit 304.

[0162] The probability prediction unit 306 is used to input the target node feature matrix obtained by the second matrix construction unit 305 into the pre-trained graph convolutional network model and output the attack probability value corresponding to each node.

[0163] The risk assessment unit 307 is used to generate a vulnerability risk assessment result for each node in the target network based on the attack probability value corresponding to each node and the vulnerability parameters of each node obtained by the probability prediction unit 306.

[0164] In one optional implementation, the first computing unit 302 includes:

[0165] The first calculation module 3021 is used to calculate the target attack success rate of each attack path according to the conjunctive calculation rule, combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack paths between each initial node and each target node, if there are multiple usable attack paths between the initial node and the target node. Then, it calculates the cumulative attack success rate between the initial node and the target node based on the target attack success rate of multiple attack paths according to the disjunctive calculation rule.

[0166] The second calculation module 3022 is used to calculate the target attack success rate of the attack path according to the conjunctive calculation rules, combining the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node, if there is a single usable attack path between each initial node and each target node, and then determine the target attack success rate as the cumulative attack success rate between the initial node and the target node.

[0167] In one optional implementation, the second computing module 3022 is specifically used for:

[0168] Based on the directed edges in the preset attack graph, determine the target directed edges that form the attack paths from each initial node to each target node, and the target termination nodes that connect the target directed edges.

[0169] For each target directed edge, the single-step attack success rate of each directed edge is calculated based on the attack vector score, attack complexity, permission requirement score, user interaction score, vulnerability repair degree, and vulnerability exposure degree in the vulnerability parameters of the target termination node.

[0170] The target attack success rate of the attack path is obtained based on the single-step attack success rate of each directed edge.

[0171] In one optional implementation, when the second calculation module 3022 calculates the single-step attack success rate of each directed edge for each target based on the attack vector score, attack complexity, permission requirement score, user interaction score, vulnerability remediation degree, and vulnerability exposure degree in the vulnerability parameters of the target termination node, it is specifically used for:

[0172] The probability of the vulnerability of the target termination node being exploited is calculated based on the attack vector score, attack complexity, permission requirement score, user interaction score, vulnerability repair degree, and vulnerability exposure degree in the vulnerability parameters of the target termination node.

[0173] The exploitability of the target termination node is calculated based on the preset quantitative attack proficiency level, the total number of vulnerabilities in the attack graph, and the preset number of attacks.

[0174] The success rate of a single-step attack on each directed edge is calculated based on the probability of the vulnerability being exploited and the exploitation capability.

[0175] In one optional implementation, when the first calculation module 3021 calculates the cumulative attack success rate from the initial node to the target node based on the target attack success rate of multiple attack paths according to the disjunction calculation rules, it is specifically used for:

[0176] Calculate the failure probability of each attack path based on the target attack success rate of each attack path;

[0177] The cumulative failure probability of multiple attack paths is obtained based on the failure probability of each attack path.

[0178] Based on the cumulative failure probability, the target probability of one of the multiple attack paths between the initial node and the target node is obtained, and the target probability is determined as the cumulative attack success rate between the initial node and the target node.

[0179] In one optional implementation, the hazard assessment unit 307 is specifically used for:

[0180] For vulnerabilities in each node, the exploitability quantitative evaluation result in the attack evaluation result of each vulnerability is calculated based on the attack path score, attack complexity and user interaction score in the vulnerability parameters.

[0181] The impact quantification assessment result of each vulnerability is calculated based on the confidentiality score, integrity score, and availability score in the vulnerability parameters.

[0182] Based on the availability quantification assessment results, the impact quantification assessment results, and the attack probability values, vulnerability risk assessment results for each node are generated.

[0183] In one optional implementation, when the risk assessment unit 307 generates the vulnerability risk assessment results for each node based on the availability quantification assessment results, the impact quantification assessment results, and the attack probability values, it is specifically used for:

[0184] For each vulnerability, the sum of the exploitability quantitative assessment result and the impactability quantitative assessment result is used as a comprehensive static score;

[0185] The product of the comprehensive static score and the attack probability value is determined as the preliminary score;

[0186] The minimum value between the preliminary score and the preset maximum score is determined as the target score for each vulnerability.

[0187] The vulnerability risk assessment results for each node are determined based on the target score.

[0188] Furthermore, embodiments of the present invention also provide a storage medium for storing a computer program, wherein the computer program, when running, controls the device where the storage medium is located to execute the above-described... Figure 1-2 The vulnerability risk assessment method in the network described in the article.

[0189] Furthermore, embodiments of the present invention also provide a processor for running a program, wherein the program executes the above-described... Figure 1-2 The vulnerability risk assessment method in the network described in the article.

[0190] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0191] It is understood that the relevant features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of any particular embodiment.

[0192] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0193] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0194] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0195] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0196] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0197] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0198] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0199] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0200] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0201] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0202] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0203] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0204] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for assessing the vulnerability risk in a network, characterized in that, The method includes: Obtain a preset attack graph corresponding to the target network. The attack graph includes nodes mapped to each host, directed edges connecting each node, and attack paths between the initial node and the target node. For each initial node to each target node in the preset attack graph, the cumulative attack success rate is calculated based on the conjunction calculation rules and disjunction calculation rules, combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node. For each initial node to each target node, the cumulative attack gain from each initial node to each target node is calculated by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity. The node feature matrix in the preset attack graph is constructed based on the cumulative attack success rate and cumulative attack gain; The node adjacency matrix is ​​constructed based on the directed edges in the preset attack graph, and the product of the node adjacency matrix and the node feature matrix is ​​determined as the target node feature matrix. The target node feature matrix is ​​input into a pre-trained graph convolutional network model, and the attack probability value corresponding to each node is output. Based on the attack probability value and vulnerability parameters of each node, a vulnerability risk assessment result for each node in the target network is generated.

2. The method according to claim 1, characterized in that, For each initial node to each target node in the preset attack graph, the cumulative attack success rate is calculated based on the conjunction and disjunction rules, combined with the vulnerability parameters, vulnerability remediation levels, and vulnerability exposure levels of the nodes forming the attack paths between each initial node and each target node. This includes: If there are multiple exploitable attack paths between the initial node and the target node, the target attack success rate of each attack path is first calculated according to the conjunctive calculation rule, combined with the vulnerability parameters, vulnerability repair level and vulnerability exposure level of the nodes that form each attack path between the initial node and each target node. Then, the cumulative attack success rate between the initial node and the target node is calculated based on the target attack success rate of multiple attack paths according to the disjunctive calculation rule. If there is a single exploitable attack path between each initial node and each target node, the target attack success rate of the attack path is first calculated according to the conjunctive calculation rules, combined with the vulnerability parameters, vulnerability repair level and vulnerability exposure level of the nodes that form the attack path between each initial node and each target node, and the target attack success rate is determined as the cumulative attack success rate between the initial node and the target node.

3. The method according to claim 2, characterized in that, Based on the conjunctive calculation rules, the target attack success rate of each attack path is calculated by combining the vulnerability parameters, vulnerability remediation level, and vulnerability exposure level of the nodes that form the attack paths from each initial node to each target node, including: Based on the directed edges in the preset attack graph, determine the target directed edges that form the attack paths from each initial node to each target node, and the target termination nodes that connect the target directed edges. For each target directed edge, the single-step attack success rate of each directed edge is calculated based on the attack vector score, attack complexity, permission requirement score, user interaction score, vulnerability repair degree, and vulnerability exposure degree in the vulnerability parameters of the target termination node. The target attack success rate of the attack path is obtained based on the single-step attack success rate of each directed edge.

4. The method according to claim 3, characterized in that, For each directed edge targeting a target, the single-step attack success rate is calculated based on the attack vector score, attack complexity, permission requirement score, user interaction score, vulnerability remediation level, and vulnerability exposure level in the vulnerability parameters of the target's terminating node. This includes: The probability of the vulnerability of the target termination node being exploited is calculated based on the attack vector score, attack complexity, permission requirement score, user interaction score, vulnerability repair degree, and vulnerability exposure degree in the vulnerability parameters of the target termination node. The exploitability of the target termination node is calculated based on the preset quantitative attack proficiency level, the total number of vulnerabilities in the attack graph, and the preset number of attacks. The success rate of a single-step attack on each directed edge is calculated based on the probability of the vulnerability being exploited and the exploitation capability.

5. The method according to claim 2, characterized in that, Based on the disjunction calculation rules, the cumulative attack success rate from the initial node to the target node is calculated according to the target attack success rate of multiple attack paths, including: Calculate the failure probability of each attack path based on the target attack success rate of each attack path; The cumulative failure probability of multiple attack paths is obtained based on the failure probability of each attack path. The success probability of one of the multiple attack paths between the initial node and the target node is obtained based on the cumulative failure probability, and the target probability is determined as the cumulative attack success rate between the initial node and the target node.

6. The method according to claim 1, characterized in that, Based on the attack probability value and vulnerability parameters of each node, a vulnerability risk assessment result for each node in the target network is generated, including: For vulnerabilities in each node, the exploitability quantitative evaluation result in the attack evaluation result of each vulnerability is calculated based on the attack path score, attack complexity and user interaction score in the vulnerability parameters. The impact quantification assessment result of each vulnerability is calculated based on the confidentiality score, integrity score, and availability score in the vulnerability parameters. Based on the availability quantification assessment results, the impact quantification assessment results, and the attack probability values, vulnerability risk assessment results for each node are generated.

7. The method according to claim 6, characterized in that, Based on the availability quantification assessment results, the impact quantification assessment results, and the attack probability values, vulnerability risk assessment results for each node are generated, including: For each vulnerability, the sum of the exploitability quantitative assessment result and the impactability quantitative assessment result is used as a comprehensive static score; The product of the comprehensive static score and the attack probability value is determined as the preliminary score; The minimum value between the preliminary score and the preset maximum score is determined as the target score for each vulnerability. The vulnerability risk assessment results for each node are determined based on the target score.

8. A vulnerability risk assessment device for networks, characterized in that, The device includes: The graph acquisition unit is used to acquire a preset attack graph corresponding to the target network. The attack graph includes nodes mapped to each host, directed edges connecting each node, and attack paths between the initial node and the target node. The first calculation unit is used to calculate the cumulative attack success rate for each initial node to each target node in the preset attack graph obtained by the graph acquisition unit, based on the conjunctive calculation rules and disjunctive calculation rules, and combined with the vulnerability parameters, vulnerability repair degree and vulnerability exposure degree of the nodes that form the attack path between each initial node and each target node. The second calculation unit is used to calculate the cumulative attack gain from each initial node to each target node in the preset attack graph obtained by the graph acquisition unit, by combining the threat value of the node forming the attack path between each initial node and each target node to the target network and the attack complexity. The first matrix construction unit is used to construct the node feature matrix in the preset attack graph based on the cumulative attack success rate obtained by the first calculation unit and the cumulative attack gain obtained by the second calculation unit. The second matrix construction unit is used to construct the node adjacency matrix based on the directed edges in the preset attack graph, and to determine the target node feature matrix by multiplying the node adjacency matrix with the node feature matrix obtained by the first matrix construction unit. The probability prediction unit is used to input the target node feature matrix obtained by the second matrix construction unit into the pre-trained graph convolutional network model and output the attack probability value corresponding to each node. The risk assessment unit is used to generate vulnerability risk assessment results for each node in the target network based on the attack probability value corresponding to each node and the vulnerability parameters of each node obtained by the probability prediction unit.

9. A storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the vulnerability risk assessment method in the network as described in any one of claims 1 to 7.

10. A processor, characterized in that, The processor is used to run a program, wherein the program executes the vulnerability risk assessment method in the network as described in any one of claims 1 to 7.

Images