Network security level protection compliance assessment method based on automatic evaluation tool

Abstract

This invention relates to a method for cybersecurity level protection compliance assessment based on automated assessment tools, belonging to the field of compliance assessment. The method includes: receiving user-inputted assessment object information, determining the level protection baseline and compliance requirements, and generating an assessment list; subsequently, comprehensively scanning and classifying network assets, dynamically adjusting the compliance baseline to generate personalized standards; initiating multi-dimensional assessment tasks, preprocessing data and establishing correlations; outputting results through a compliance judgment model, and generating rectification plans for non-compliant items based on asset importance and business needs; and finally establishing a continuous monitoring mechanism to track rectification progress, reassess compliance status, and update the baseline. The advantages of this invention are: achieving intelligent management of the entire level protection compliance assessment process through automated tools, from accurate requirement collection, asset classification, and personalized baseline construction to multi-dimensional assessment, intelligent judgment, and closed-loop rectification, significantly improving assessment efficiency and accuracy while reducing labor costs.

Description

Technical Field

[0001] This invention relates to the field of compliance assessment, and in particular to a method for assessing compliance with cybersecurity level protection based on automated assessment tools. Background Technology

[0002] With the rapid development of information technology, cybersecurity threats are becoming increasingly severe, and the risks of data breaches and cyberattacks to critical information infrastructure and important information systems are constantly escalating. To address this challenge, my country has implemented a cybersecurity classification and protection system, requiring all organizations to classify, register, assess, and rectify their information systems. However, traditional manual assessment methods suffer from drawbacks such as low efficiency, strong subjectivity, and incomplete coverage, making it difficult to meet the needs of large-scale, high-frequency compliance assessments.

[0003] Current cybersecurity compliance assessment methods are heavily influenced by the professional level and experience of the assessors, making them highly subjective and prone to oversights, resulting in incomplete and inaccurate assessment results. For example, on-site equipment surveys often suffer from biases due to insufficient personnel experience, and records may contain inaccuracies and contradictions due to negligence or skill levels, severely impacting the quality of assessment reports. Regarding asset assessment, some methods struggle to comprehensively cover hardware, software, and data assets, and lack scientific algorithms for asset importance classification, failing to accurately focus on critical assets. Compliance baselines are often fixed templates, making it difficult to flexibly adjust to specific scenarios and asset characteristics, resulting in poor adaptability. Assessment dimensions are often singular, frequently focusing only on vulnerability scanning or configuration verification, lacking multi-dimensional collaboration and failing to provide a comprehensive understanding of system security. Furthermore, assessment data processing is often crude, failing to effectively establish correlations between data points, and compliance judgment models are simplistic, failing to balance asset importance weighting and risk adjustment, leading to imprecise judgment results. The rectification plans often lack specificity, fail to incorporate asset classification and business continuity requirements, and have weak continuous monitoring mechanisms, making it difficult to track rectification progress, reassess compliance status, and update baseline rules in a timely manner, thus limiting their effectiveness in ensuring compliance with cybersecurity level protection standards. Summary of the Invention

[0004] To improve existing methods, this paper provides a cybersecurity level protection compliance assessment method based on automated assessment tools. This method realizes intelligentization of the entire compliance assessment process through automation tools, from accurate requirement collection, asset classification, and personalized baseline construction to multi-dimensional assessment, intelligent judgment and closed-loop rectification, which greatly improves the assessment efficiency and accuracy and reduces labor costs.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: Cybersecurity compliance assessment methods based on automated testing tools include: Receive user-inputted assessment object information, initially identify the corresponding cybersecurity compliance benchmark level of the assessment object, obtain the user's specified compliance assessment cycle, key business continuity requirements and special compliance scenarios, and generate a compliance assessment requirement list. A comprehensive scan of the network assets belonging to the assessment object is conducted, collecting asset information including hardware assets, software assets, and data assets. The collected assets are then classified using an asset importance assessment algorithm. Based on the obtained information security compliance benchmark level and asset importance classification results, and combined with the needs of special compliance scenarios, the information security compliance baseline template is dynamically adjusted to generate a personalized information security compliance baseline that is precisely matched with the assessment object. Based on the obtained personalized compliance baseline, multi-dimensional assessment tasks are launched, including vulnerability scanning sub-tasks, configuration verification sub-tasks, log analysis sub-tasks, and real-time monitoring sub-tasks. The raw assessment data generated from each assessment sub-task is preprocessed, and the correlation between the assessment data and asset information and compliance baseline is generated. Based on the obtained correlations, a compliance judgment model is constructed, and the compliance judgment result of the information security compliance is generated through single compliance judgment and comprehensive compliance judgment. Based on the baseline clauses and related risk points that are deemed non-compliant or basically compliant according to the information security compliance assessment results, and in combination with asset importance classification and business continuity requirements, a personalized rectification plan is generated for each risk point. Based on the generated personalized rectification plan, a continuous monitoring mechanism is established, including rectification progress monitoring, compliance status review, and baseline and rule updates.

[0006] Preferably, the step of receiving the assessment object information input by the user, initially identifying the cybersecurity compliance benchmark level corresponding to the assessment object, obtaining the user's specified compliance assessment cycle, key business continuity requirements, and special compliance scenarios, and generating a compliance assessment requirement list specifically includes: The information of the assessment object includes the business type, data asset category, and service scope of the network system to be assessed; Based on the built-in information security level mapping rule library, the baseline information security level of the evaluation object is automatically and initially identified by combining basic information. Collect and obtain users' clear compliance assessment cycles, key business continuity requirements, and special compliance scenarios; By integrating the above information, a list of compliance assessment requirements for information security protection is formed, which clarifies the scope, level, cycle, and special requirements of the assessment.

[0007] Preferably, the step of comprehensively scanning the network assets to which the assessment object belongs, collecting asset information including hardware assets, software assets, and data assets, and classifying the collected assets through an asset importance assessment algorithm specifically includes: A comprehensive scan of the network assets belonging to the assessed entity was conducted, covering hardware assets, software assets, and data assets, collecting information on all assets within the assessment scope without omission. The hardware assets include servers, switches, firewalls, and storage devices. The collected hardware asset information includes model, hardware configuration, network address, and deployment location. The software assets include operating systems, databases, middleware, and application systems. The collected software asset information includes version number, installation path, and running status. The data assets include structured data and unstructured data, and the collected data asset information includes storage location, data volume, and data classification. The asset importance assessment algorithm is used to build an assessment model based on the coreness of the business carried by the asset, data sensitivity, and the scope of the impact of interruption. The collected assets are comprehensively scored and divided into three levels: core assets, key assets, and general assets. By integrating the above asset information and classification results, a list of assets of the assessed object and the classification results of their importance are generated.

[0008] Preferably, the step of dynamically adjusting the compliance baseline template based on the obtained compliance benchmark level and asset importance classification results, combined with the specific compliance scenario requirements, to generate a personalized compliance baseline that accurately matches the assessment object specifically includes: Based on the obtained baseline compliance level and asset importance classification results, the corresponding template is retrieved from the built-in compliance baseline template library. The baseline template is dynamically adjusted to meet the needs of specific compliance scenarios. For core assets, enhanced compliance requirements for such assets are added, and for specific compliance scenarios, special compliance requirements corresponding to the scenarios are added. The system performs conflict checks between newly added clauses and existing template clauses. If a conflict is found, it automatically prompts and displays the source of the conflicting clauses, and allows users to manually select to keep the clauses or modify the conflicting content. By integrating the above adjustments, a personalized compliance baseline for information security protection, including evaluation indicators and judgment criteria, is generated.

[0009] Preferably, the multi-dimensional assessment task initiated based on the acquired personalized compliance baseline includes vulnerability scanning subtasks, configuration verification subtasks, log analysis subtasks, and real-time monitoring subtasks, specifically including: The vulnerability scanning subtask calls the built-in vulnerability signature library to perform a deep scan of network assets, identify high-risk, medium-risk, and low-risk vulnerabilities, and record the vulnerability's CVSS score, impact range, and detailed description. The configuration verification subtask compares the configuration parameters of network devices, hosts, and application systems with the configuration requirements in the baseline and records any configuration discrepancies. The log analysis subtask collects security logs through a log collection agent, uses time series and event association rule algorithms to identify abnormal behavior, matches baseline log security requirements, and records log compliance non-compliance items. The real-time monitoring subtask monitors the operational and security status of core assets in real time and generates alarm records in real time by setting thresholds.

[0010] Preferably, the preprocessing of the raw assessment data generated based on each assessment sub-task, and the generation of the correlation between the assessment data and asset information and compliance baseline, specifically includes: A unified data collection pool is established based on the raw data generated from multi-dimensional assessment tasks. The collected raw data is cleaned to remove duplicate, invalid, and interfering data. For any data that was not collected, a second scan is initiated to supplement the collection. Convert the output data of different evaluation subtasks into a unified format, and convert text-based vulnerability descriptions and configuration mismatch statements into structured fields; The vulnerability data is associated with the asset importance classification to calculate the vulnerability distribution of assets of different importance levels. Configuration discrepancies and log compliance discrepancies are associated with the clauses in the personalized information security compliance baseline. The number of discrepancies for each baseline clause is counted. Alarm data is associated with the asset operating status to analyze the impact of alarms on assets and generate a standardized evaluation dataset and correlation relationships.

[0011] Preferably, the step of constructing a compliance determination model based on the acquired correlation, and generating a compliance determination result for information security compliance through single-item compliance determination and comprehensive compliance determination, specifically includes: Based on the obtained relationships, a compliance determination model is constructed, which includes single-item compliance determination and comprehensive compliance determination. The individual compliance determination is for each clause in the baseline, and a compliance score is calculated by combining the relevant assessment data, and the determination result is recorded for each clause. The comprehensive compliance assessment assigns weights based on the importance of assets, calculates a weighted average score for all clauses, and incorporates risk adjustments to classify the scores into three levels: fully compliant, basically compliant, and non-compliant.

[0012] Preferably, the baseline clauses and associated risk points that are deemed non-compliant or substantially compliant based on the information security compliance assessment results, combined with asset importance classification and business continuity requirements, generate personalized rectification plans for each risk point, specifically including: Based on the results of the compliance assessment of information security level protection, extract the baseline clauses that are non-compliant or basically compliant and the associated risk points, and obtain the asset information and business impact corresponding to each risk; The built-in knowledge base is invoked. The built-in knowledge base contains standardized rectification resources corresponding to various compliance non-compliance items. Based on the importance of assets, the level of vulnerability risk, and the impact on business, the rectification items are divided into four levels. For each rectification item, the responsible department is determined based on the asset owner information, the phased implementation steps are detailed, the required resource list is clarified, and the path for automated verification tools is matched. By integrating the above information, a personalized rectification plan is generated for each risk point, forming a list of compliance rectification plans for information security level protection.

[0013] Preferably, the establishment of a continuous monitoring mechanism based on the generated personalized rectification plan, including rectification progress monitoring, compliance status review, and baseline and rule updates, specifically includes: Based on the list of compliance rectification plans for information security protection, rectification data is collected daily by default. The collected data is compared with the planned progress in the plan, and warning information is generated for overdue rectification items that exceed the planned period. Based on the entire process from automatic review of duplicate assets during the assessment cycle, construction of compliance baselines, execution of automated assessments, processing of assessment data to compliance determination, the compliance status of the assessed objects is reassessed. By comparing the reassessment results with the previous assessment results, analyzing changes in compliance level and newly added or eliminated risk points, and generating iterative data on the compliance status of the information security level protection system; When the cybersecurity standards are revised, new industry regulatory requirements are added, or the business of the assessment target changes, the system will automatically detect and prompt updates to the baseline and rules.

[0014] Compared with the prior art, the advantages of the present invention are: During the data collection phase, information such as the business type and special compliance scenarios of the assessment targets is accurately captured. Combined with built-in rules, the basic compliance level is initially identified, generating a list tailored to specific needs and avoiding deviations in the assessment direction. Secondly, asset scanning comprehensively covers both hardware and software data assets, using algorithms to categorize core, critical, and general assets, laying a precise foundation for subsequent assessments. Thirdly, the compliance baseline template is dynamically adjusted, strengthening requirements for core assets, adding specific clauses for special scenarios, and enabling conflict verification to generate personalized baselines with strong adaptability. Multi-dimensional assessment tasks are carried out simultaneously, with sub-tasks such as vulnerability scanning and configuration verification operating efficiently. Combined with preprocessing and correlation analysis, the data becomes more valuable. The compliance judgment model considers both individual and comprehensive assessments, weighting scores according to asset importance for accurate results. The rectification plan is categorized based on asset importance and business requirements, clearly defining responsibilities and steps. Coupled with a continuous monitoring mechanism, it enables tracking of rectification progress, compliance review, and baseline updates, forming a closed-loop management system that significantly reduces labor costs and improves the timeliness and scientific nature of compliance management. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the method proposed in this invention; Figure 2 This is a schematic diagram illustrating the requirements for generating a compliance assessment list for information security level protection proposed in this invention. Figure 3 This is a schematic diagram of the asset grading proposed in this invention; Figure 4 This is a schematic diagram illustrating the generation of personalized information security compliance baselines proposed in this invention; Figure 5 This is a schematic diagram of the multi-dimensional assessment task proposed in this invention; Figure 6 This is a schematic diagram illustrating the generation of association relationships proposed in this invention; Figure 7 This is a schematic diagram illustrating the generation of compliance determination results for information security level protection proposed in this invention; Figure 8 This is a schematic diagram illustrating the generation of personalized rectification solutions proposed in this invention; Figure 9 This is a schematic diagram of the continuous monitoring mechanism proposed in this invention. Detailed Implementation

[0016] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0017] See Figure 1 As shown, the cybersecurity level protection compliance assessment method based on automated assessment tools includes: Step 1: Receive the assessment object information input by the user, initially identify the corresponding cybersecurity compliance benchmark level of the assessment object, obtain the user's specified compliance assessment cycle, key business continuity requirements and special compliance scenarios, and generate a list of compliance assessment requirements. Step 2: Conduct a comprehensive scan of the network assets belonging to the assessment object, collect asset information including hardware assets, software assets and data assets, and classify the collected assets through an asset importance assessment algorithm; Step 3: Based on the obtained information security compliance benchmark level and asset importance classification results, and combined with the specific compliance scenario requirements, dynamically adjust the information security compliance baseline template to generate a personalized information security compliance baseline that is precisely matched with the assessment object; Step 4: Based on the obtained personalized compliance baseline, launch multi-dimensional assessment tasks, including vulnerability scanning sub-tasks, configuration verification sub-tasks, log analysis sub-tasks, and real-time monitoring sub-tasks; Step 5: Preprocess the raw assessment data generated from each assessment sub-task, and generate the correlation between the assessment data and asset information and compliance baseline; Step Six: Based on the obtained relationships, construct a compliance assessment model, and generate the compliance assessment result for the information security compliance level by conducting individual compliance assessments and comprehensive compliance assessments. Step 7: Based on the baseline clauses and related risk points that are deemed non-compliant or basically compliant according to the information security compliance assessment results, and in conjunction with asset importance classification and business continuity requirements, generate a personalized rectification plan for each risk point; Step 8: Based on the generated personalized rectification plan, establish a continuous monitoring mechanism, including rectification progress monitoring, compliance status review, and baseline and rule updates.

[0018] See Figure 2 As shown, the system receives user-inputted assessment object information, initially identifies the corresponding cybersecurity compliance benchmark level for the assessment object, obtains the user's specified compliance assessment cycle, key business continuity requirements, and special compliance scenarios, and generates a compliance assessment requirement list, which specifically includes: The information of the assessment object includes the business type, data asset category, and service scope of the network system to be assessed; Based on the built-in information security level mapping rule library, the baseline information security level of the evaluation object is automatically and initially identified by combining basic information. Collect and obtain users' clear compliance assessment cycles, key business continuity requirements, and special compliance scenarios; By integrating the above information, a list of compliance assessment requirements for information security protection is formed, which clarifies the scope, level, cycle, and special requirements of the assessment.

[0019] Specifically, the collected business types, data asset categories, and service scopes are matched with key elements in the rule base. For example, if the business type is "core transaction business of financial institutions," the data assets include "core customer account data," and the service scope is "nationwide service," then the rule base element "involving the national economic lifeline, affecting the stability of the financial order, and data leakage or system interruption will cause significant economic losses and social impact" is matched. If the business type is "internal office system of small and medium-sized enterprises," the data assets are mainly "general business data," and the service scope is "local area network service," then the rule base element "only affects the daily office work of enterprises and has no significant external impact" is matched. Based on the core elements of the match, the classification logic in the rule base is triggered. The rule base is set with multi-dimensional judgment conditions according to the classification system of "Level 1 (Autonomous Protection Level), Level 2 (Guided Protection Level), Level 3 (Supervisory Protection Level), Level 4 (Mandatory Protection Level), and Level 5 (Special Control Protection Level)". Based on the combined results of element matching and rule triggering, a preliminary conclusion on the baseline security protection level is generated, along with the basis for the classification. If there is overlap of elements or unclear judgment boundaries, such as if the business involves both internal management and a small number of public services, the result will indicate "The preliminary recommended level is Level 2, which needs to be further confirmed based on the specific needs of subsequent users".

[0020] See Figure 3 As shown, a comprehensive scan of the network assets belonging to the assessment object is performed, collecting asset information including hardware assets, software assets, and data assets. The collected assets are then classified using an asset importance assessment algorithm, specifically including: A comprehensive scan of the network assets belonging to the assessment object was conducted, covering all types of assets including hardware, software, and data, and all asset information within the assessment scope was collected without omission. The hardware assets include the models, hardware configurations, network addresses, and deployment locations of servers, switches, firewalls, and storage devices; The software assets include the version number, installation path, and running status of the operating system, database, middleware, and application system. The data assets include the storage location, data volume, and data classification of structured and unstructured data; The asset importance assessment algorithm is used to build an assessment model based on the coreness of the business carried by the asset, data sensitivity, and the scope of the impact of interruption. The collected assets are comprehensively scored and divided into three levels: core assets, key assets, and general assets. By integrating the above asset information and classification results, a list of assets of the assessed object and the classification results of their importance are generated.

[0021] Specifically, an evaluation model is designed based on three dimensions: the degree to which the asset carries core business, data sensitivity, and the scope of impact of interruption. Weights are allocated to each dimension according to the business characteristics of the evaluated object. If the evaluated object is a financial transaction system, the weights for "degree to which the asset carries core business" are set at 40%, "data sensitivity" at 35%, and "scope of impact of interruption" at 25%. If it is an internal office system, the weights for "degree to which the asset carries core business" are set at 30%, "data sensitivity" at 25%, and "scope of impact of interruption" at 45%. Specific scoring rules are set for each assessment dimension. All collected assets are scored and graded one by one according to the established assessment model. Based on the determined dimension weights, the comprehensive score of each asset class is calculated. The level of each asset class is determined according to the comprehensive score and grading rules. The detailed information collected by asset scanning and the importance grading results are integrated to form a structured report.

[0022] See Figure 4As shown, based on the obtained information security compliance benchmark level and asset importance classification results, and combined with the needs of specific compliance scenarios, the information security compliance baseline template is dynamically adjusted to generate a personalized information security compliance baseline that precisely matches the assessment object. Specifically, this includes: Based on the obtained baseline compliance level and asset importance classification results, the corresponding template is retrieved from the built-in compliance baseline template library. The baseline template is dynamically adjusted to meet the needs of specific compliance scenarios. For core assets, enhanced compliance requirements for such assets are added, and for specific compliance scenarios, special compliance requirements corresponding to the scenarios are added. The system performs conflict checks between newly added clauses and existing template clauses. If a conflict is found, it automatically prompts and displays the source of the conflicting clauses, and allows users to manually select to keep the clauses or modify the conflicting content. By integrating the above adjustments, a personalized compliance baseline for information security protection, including evaluation indicators and judgment criteria, is generated.

[0023] Specifically, based on the core asset types in the asset importance classification list, supplementary strengthening clauses should be added to the corresponding modules of the basic template. For example, when the core asset is "bank core transaction server", the "host security" module should be supplemented with "the server must enable real-time intrusion detection function, and the detection log retention time shall not be less than 1 year" and "the server must adopt dual-machine hot standby deployment, and the switching time shall not exceed 30 seconds". The strengthening clauses should clearly indicate "core asset-specific strengthening requirements" and be associated with the corresponding core asset ID and name. Based on the special compliance scenarios collected in the early stages, special clauses have been added to the basic template. For example, when the special scenario is "compliance with the 'Administrative Measures for Cybersecurity of Commercial Banks'", the "Security Management" module will add "an external penetration test must be conducted every quarter, and the test report must be submitted to the People's Bank of China for filing"; when the special scenario is "involving cross-border data transmission", the "Data Security" module will add "personal data transmitted across borders must undergo data anonymization processing in advance, and a clear authorization document from the user must be obtained, and the authorization document must be retained for no less than 3 years"; the special clauses must be marked with "special requirements for special scenarios" and the corresponding scenario basis; A comprehensive conflict check is performed on the supplementary core asset enhancement clauses, special scenario clauses and the original clauses of the basic template. Inconsistencies in the clauses are identified and resolved in a timely manner to ensure the logical consistency of the baseline clauses. Two conflict handling methods are provided for users to choose from: one is "retain clauses", where users can directly choose to retain the original template clauses or the newly added clauses; the other is "modify conflicting content", where users can manually adjust the content of the clauses if they believe that both clauses should be partially retained.

[0024] See Figure 5As shown, based on the obtained personalized compliance baseline, a multi-dimensional assessment task is launched, including vulnerability scanning subtasks, configuration verification subtasks, log analysis subtasks, and real-time monitoring subtasks. Specifically, these include: The vulnerability scanning subtask calls the built-in vulnerability signature library to perform a deep scan of network assets, identify high-risk, medium-risk, and low-risk vulnerabilities, and record the vulnerability's CVSS score, impact range, and detailed description. The configuration verification subtask compares the configuration parameters of network devices, hosts, and application systems with the configuration requirements in the baseline and records any configuration discrepancies. The log analysis subtask collects security logs through a log collection agent, uses time series and event association rule algorithms to identify abnormal behavior, matches baseline log security requirements, and records log compliance non-compliance items. The real-time monitoring subtask monitors the operational and security status of core assets in real time and generates alarm records in real time by setting thresholds.

[0025] See Figure 6 As shown, the preprocessing of the raw assessment data generated from each assessment sub-task, and the generation of the correlation between the assessment data and asset information and compliance baseline, specifically include: A unified data collection pool is established based on the raw data generated from multi-dimensional assessment tasks. The collected raw data is cleaned to remove duplicate, invalid, and interfering data. For any data that was not collected, a second scan is initiated to supplement the collection. Convert the output data of different evaluation subtasks into a unified format, and convert text-based vulnerability descriptions, configuration mismatch explanations, etc. into structured fields; The vulnerability data is associated with the asset importance classification to calculate the vulnerability distribution of assets of different importance levels. Configuration discrepancies and log compliance discrepancies are associated with the clauses in the personalized information security compliance baseline. The number of discrepancies for each baseline clause is counted. Alarm data is associated with the asset operating status to analyze the impact of alarms on assets and generate a standardized evaluation dataset and correlation relationships.

[0026] Specifically, standardized data is linked with asset information and compliance baselines: vulnerability data is associated with asset importance classification, and the number and percentage of high-risk, medium-risk, and low-risk vulnerabilities in core, critical, and general assets are statistically analyzed, such as 60% of core assets being high-risk vulnerabilities; configuration discrepancies and log compliance discrepancies are associated with personalized compliance baseline clause numbers, and the number of discrepancies for each clause is statistically analyzed, such as "5 discrepancies in baseline clauses"; alarm data is associated with asset operational status indicators, such as CPU utilization and memory usage, and the impact of alarms on assets is analyzed, such as "core server CPU exceeding threshold alarm, causing transaction response delay"; finally, a standardized evaluation dataset containing data identifiers, asset information, baseline clauses, and association results is generated, clearly presenting the association logic of data in each dimension, providing support for the generation of subsequent compliance assessment reports.

[0027] See Figure 7 As shown, based on the obtained relationships, a compliance assessment model is constructed. Through single-item compliance assessment and comprehensive compliance assessment, the compliance assessment result for information security level protection is generated, specifically including: Based on the obtained relationships, a compliance determination model is constructed, which includes single-item compliance determination and comprehensive compliance determination. The individual compliance determination is for each clause in the baseline, and a compliance score is calculated by combining the relevant assessment data, and the determination result is recorded for each clause. The comprehensive compliance assessment assigns weights based on the importance of assets, calculates a weighted average score for all clauses, and incorporates risk adjustments to classify the scores into three levels: fully compliant, basically compliant, and non-compliant.

[0028] Specifically, based on the previously established assessment data and the correlation between assets and baselines, a model framework including "single-item compliance judgment" and "comprehensive compliance judgment" is built. The core inputs to the model are first defined as: 1) all clauses of the personalized compliance baseline; 2) the correlated assessment data; and 3) the asset importance grading weights. Judgment dimensions are set: single-item judgment focuses on the compliance of a single clause, while comprehensive judgment considers the overall compliance level and risk impact, ensuring the model covers all dimensions from clauses to the overall picture. The scoring formula for single-item compliance judgment is:

[0029] in, For the compliance score of a single baseline clause, The number of non-compliant items corresponding to this clause. The total number of objects covered by this clause. This represents the severity coefficient of the non-compliance item; The formula for the weighted score of the comprehensive compliance assessment is as follows:

[0030] in, The overall compliance weighted score is calculated, where n is the total number of clauses in the personalized compliance baseline. For the single compliance score of the i-th baseline clause, The importance weight of the asset associated with clause i, This is a risk adjustment factor.

[0031] See Figure 8 As shown, based on the baseline clauses and related risk points that are deemed non-compliant or basically compliant according to the information security compliance assessment results, and in conjunction with asset importance classification and business continuity requirements, a personalized rectification plan is generated for each risk point, specifically including: Based on the results of the compliance assessment of information security level protection, extract the baseline clauses that are non-compliant or basically compliant and the associated risk points, and obtain the asset information and business impact corresponding to each risk; The built-in knowledge base is invoked. The built-in knowledge base contains standardized rectification resources corresponding to various compliance non-compliance items. Based on the importance of assets, the level of vulnerability risk, and the impact on business, the rectification items are divided into four levels. For each rectification item, the responsible department is determined based on the asset owner information, the phased implementation steps are detailed, the required resource list is clarified, and the path for automated verification tools is matched. By integrating the above information, a personalized rectification plan is generated for each risk point, forming a list of compliance rectification plans for information security level protection.

[0032] Specifically, the built-in knowledge base is invoked, and the rectification items are divided into four levels based on asset importance, vulnerability risk level, and business impact. Level 1 rectification items: high-risk items related to core assets, such as "a high-risk vulnerability exists in the core transaction server, which may lead to the leakage of transaction data," which must be initiated within 24 hours; Level 2 rectification items: medium-risk items related to critical assets, such as "inconsistent configuration of branch office switches, which may affect regional business connectivity," which must be initiated within 3 working days; Level 3 rectification items: low-risk items related to general assets, such as "delayed patching of some office computers, with no direct business impact," which must be initiated within 15 working days; Level 4 rectification items: minor inconsistencies of non-core assets, such as "insufficient retention of printer logs, with no sensitive data associated," which must be completed within 30 working days. After classification, the time limit and risk consequences of each level of rectification item are marked, and the rectification priority is clarified. For each rectification item, the responsible department was identified, and the implementation steps were detailed in stages.

[0033] See Figure 9 As shown, based on the generated personalized rectification plan, a continuous monitoring mechanism is established, including rectification progress monitoring, compliance status review, and baseline and rule updates. Specifically, this includes: Based on the list of compliance rectification plans for information security protection, rectification data is collected daily by default. The collected data is compared with the planned progress in the plan, and warning information is generated for overdue rectification items that exceed the planned period. Based on the entire process from automatic review of duplicate assets during the assessment cycle, construction of compliance baselines, execution of automated assessments, processing of assessment data to compliance determination, the compliance status of the assessed objects is reassessed. By comparing the reassessment results with the previous assessment results, we can analyze changes in compliance level, newly added or eliminated risk points, and generate iterative data on the compliance status of the information security level protection system. When the cybersecurity standards are revised, new industry regulatory requirements are added, or the business of the assessment target changes, the system will automatically detect and prompt updates to the baseline and rules.

[0034] Specifically, based on the previously determined compliance assessment cycle, a full-process review is automatically triggered. The review process proceeds sequentially as follows: "automatic asset review, compliance baseline construction, automated assessment execution, assessment data processing, and compliance determination." First, network assets are rescanned to update the asset list. Second, based on the updated asset information and the existing baseline, the applicability of the baseline is confirmed. Next, assessment tasks such as vulnerability scanning and configuration verification are automatically executed to collect the latest assessment data. Then, data is cleaned and correlations are established according to standard procedures. Finally, the review results are generated through the compliance determination model. After the review is completed, the results of this assessment are compared with those of the previous assessment, with a focus on analyzing changes in compliance level, new risk points, and eliminated risk points. An iterative report on the compliance status is generated, clearly presenting the trend of compliance status changes. The system sets up multi-dimensional trigger conditions to achieve automatic detection and update prompts for baselines and rules. When the information security standard is revised, industry regulatory requirements are added, or the business of the assessment object changes, the system automatically detects the changes and triggers prompts by connecting to the regulatory announcement platform and monitoring the change records of the business system. At the same time, it provides update suggestions and allows compliance managers to directly enter the baseline editing interface by clicking on the prompts. Combined with the standardized clause templates in the built-in knowledge base, the system can quickly complete the update of the baseline and rules. After the update, it is synchronized to the assessment system and the rectification plan list to ensure that subsequent assessments and rectifications are carried out in accordance with the latest requirements.

[0035] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0036] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0037] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for assessing compliance with cybersecurity level protection standards based on automated assessment tools, characterized in that: include: The automated assessment tool receives user-inputted information about the assessment object, initially identifies the corresponding cybersecurity compliance benchmark level of the assessment object, obtains the user's specified compliance assessment cycle, key business continuity requirements, and special compliance scenarios, and generates a list of compliance assessment requirements. A comprehensive scan of the network assets belonging to the assessment object is conducted, collecting asset information including hardware assets, software assets, and data assets. The collected assets are then classified using an asset importance assessment algorithm. Based on the obtained information security compliance benchmark level and asset importance classification results, and combined with the needs of special compliance scenarios, the information security compliance baseline template is dynamically adjusted to generate a personalized information security compliance baseline that is precisely matched with the assessment object. Based on the obtained personalized compliance baseline, multi-dimensional assessment tasks are launched, including vulnerability scanning sub-tasks, configuration verification sub-tasks, log analysis sub-tasks, and real-time monitoring sub-tasks. The raw assessment data generated from each assessment sub-task is preprocessed, and the correlation between the assessment data and asset information and compliance baseline is generated. Based on the obtained correlations, a compliance judgment model is constructed, and the compliance judgment result of the information security compliance is generated through single compliance judgment and comprehensive compliance judgment. Based on the baseline clauses and related risk points that are deemed non-compliant or basically compliant according to the information security compliance assessment results, and in combination with asset importance classification and business continuity requirements, a personalized rectification plan is generated for each risk point. Based on the generated personalized rectification plan, a continuous monitoring mechanism is established, including rectification progress monitoring, compliance status review, and baseline and rule updates.

2. The network security level protection compliance assessment method based on automated assessment tools according to claim 1, characterized in that, The automated assessment tool receives user-inputted assessment object information, initially identifies the corresponding cybersecurity compliance benchmark level for the assessment object, obtains the user-defined compliance assessment cycle, key business continuity requirements, and special compliance scenarios, and generates a compliance assessment requirement list, specifically including: The information of the assessment object includes the business type, data asset category, and service scope of the network system to be assessed; Based on the built-in information security level mapping rule library, the information security benchmark level of the assessment object is automatically and initially identified in combination with basic information; Collect and obtain users' clear compliance assessment cycles, key business continuity requirements, and special compliance scenarios; By integrating the above information, a list of compliance assessment requirements for information security protection is formed, which clarifies the scope, level, cycle, and special requirements of the assessment.

3. The method for assessing network security level protection compliance based on automated assessment tools according to claim 1, characterized in that, The process of comprehensively scanning the network assets belonging to the assessment object, collecting asset information including hardware assets, software assets, and data assets, and classifying the collected assets using an asset importance assessment algorithm specifically includes: A comprehensive scan of the network assets belonging to the assessed entity was conducted, covering hardware assets, software assets, and data assets, collecting information on all assets within the assessment scope without omission. The hardware assets include servers, switches, firewalls, and storage devices. The collected hardware asset information includes model, hardware configuration, network address, and deployment location. The software assets include operating systems, databases, middleware, and application systems. The collected software asset information includes version number, installation path, and running status. The data assets include structured data and unstructured data, and the collected data asset information includes storage location, data volume, and data classification. The asset importance assessment algorithm is used to build an assessment model based on the coreness of the business carried by the asset, data sensitivity, and the scope of the impact of interruption. The collected assets are comprehensively scored and divided into three levels: core assets, key assets, and general assets. By integrating the above asset information and classification results, a list of assets of the assessed object and the classification results of their importance are generated.

4. The network security level protection compliance assessment method based on automated assessment tools according to claim 1, characterized in that, The process of dynamically adjusting the compliance baseline template based on the obtained information security level and asset importance classification results, combined with the specific compliance scenario requirements, to generate a personalized compliance baseline that precisely matches the assessment object, specifically includes: Based on the obtained information security compliance baseline level and asset importance classification results, the corresponding template is retrieved from the built-in information security compliance baseline template library; The baseline template is dynamically adjusted to meet the needs of specific compliance scenarios. For core assets, enhanced compliance requirements for such assets are added, and for specific compliance scenarios, special compliance requirements corresponding to the scenarios are added. The system performs conflict checks between newly added clauses and existing template clauses. If a conflict is found, it automatically prompts and displays the source of the conflicting clauses, and allows users to manually select to keep the clauses or modify the conflicting content. By integrating the above adjustments, a personalized compliance baseline for information security protection, including evaluation indicators and judgment criteria, is generated.

5. The network security level protection compliance assessment method based on automated assessment tools according to claim 4, characterized in that, The multi-dimensional assessment task initiated based on the obtained personalized compliance baseline includes vulnerability scanning subtasks, configuration verification subtasks, log analysis subtasks, and real-time monitoring subtasks, specifically including: The vulnerability scanning subtask calls the built-in vulnerability signature library to perform a deep scan of network assets, identify high-risk, medium-risk, and low-risk vulnerabilities, and record the vulnerability's CVSS score, impact range, and detailed description. The configuration verification subtask compares the configuration parameters of network devices, hosts, and application systems with the configuration requirements in the baseline and records any configuration discrepancies. The log analysis subtask collects security logs through a log collection agent, uses time series and event association rule algorithms to identify abnormal behavior, matches baseline log security requirements, and records log compliance non-compliance items. The real-time monitoring subtask monitors the operational and security status of core assets in real time and generates alarm records in real time by setting thresholds.

6. The method for assessing network security level protection compliance based on automated assessment tools according to claim 1, characterized in that, The preprocessing of the raw assessment data generated from each assessment sub-task, and the generation of the correlation between the assessment data and asset information and compliance baseline, specifically includes: A unified data collection pool is established based on the raw data generated from multi-dimensional assessment tasks. The collected raw data is cleaned to remove duplicate, invalid, and interfering data. For any data that was not collected, a second scan is initiated to supplement the collection. Convert the output data of different evaluation subtasks into a unified format, and convert text-based vulnerability descriptions and configuration mismatch statements into structured fields; The vulnerability data is associated with the asset importance classification to calculate the vulnerability distribution of assets of different importance levels. Configuration discrepancies and log compliance discrepancies are associated with the clauses in the personalized information security compliance baseline. The number of discrepancies for each baseline clause is counted. Alarm data is associated with the asset operating status to analyze the impact of alarms on assets and generate a standardized evaluation dataset and correlation relationships.

7. The network security level protection compliance assessment method based on automated assessment tools according to claim 1, characterized in that, The aforementioned compliance assessment model, constructed based on the acquired relationships, generates compliance assessment results for information security compliance through single-item compliance assessment and comprehensive compliance assessment, specifically including: Based on the obtained relationships, a compliance determination model is constructed, which includes single-item compliance determination and comprehensive compliance determination. The individual compliance determination is for each clause in the baseline, and a compliance score is calculated by combining the relevant assessment data, and the determination result is recorded for each clause. The comprehensive compliance assessment assigns weights based on the importance of assets, calculates a weighted average score for all clauses, and incorporates risk adjustments to classify the scores into three levels: fully compliant, basically compliant, and non-compliant.

8. The method for assessing network security level protection compliance based on automated assessment tools according to claim 1, characterized in that, Based on the baseline clauses and related risk points that are deemed non-compliant or substantially compliant according to the information security compliance assessment results, and in conjunction with asset importance classification and business continuity requirements, a personalized rectification plan is generated for each risk point, specifically including: Based on the results of the compliance assessment of information security level protection, extract the baseline clauses that are non-compliant or basically compliant and the associated risk points, and obtain the asset information and business impact corresponding to each risk; The built-in knowledge base is invoked. The built-in knowledge base contains standardized rectification resources corresponding to various compliance non-compliance items. Based on the importance of assets, the level of vulnerability risk, and the impact on business, the rectification items are divided into four levels. For each rectification item, the responsible department is determined based on the asset owner information, the phased implementation steps are detailed, the required resource list is clarified, and the path for automated verification tools is matched. By integrating the above information, a personalized rectification plan is generated for each risk point, forming a list of compliance rectification plans for information security level protection.

9. The method for assessing network security level protection compliance based on automated assessment tools according to claim 1, characterized in that, The aforementioned personalized rectification plan establishes a continuous monitoring mechanism, including rectification progress monitoring, compliance status review, and baseline and rule updates. Specifically, this includes: Based on the list of compliance rectification plans for information security protection, rectification data is collected daily by default. The collected data is compared with the planned progress in the plan, and warning information is generated for overdue rectification items that exceed the planned period. Based on the entire process from automatic review of duplicate assets during the assessment cycle, construction of compliance baselines, execution of automated assessments, processing of assessment data to compliance determination, the compliance status of the assessed objects is reassessed. By comparing the reassessment results with the previous assessment results, analyzing changes in compliance level and newly added or eliminated risk points, and generating iterative data on the compliance status of the information security level protection system; When the cybersecurity standards are revised, new industry regulatory requirements are added, or the business of the assessment target changes, the system will automatically detect and prompt updates to the baseline and rules.

Images