Method and system for evaluating network security event damage

Abstract

The invention discloses a network security event damage assessment method and system, relates to the technical field of network security, and solves the problem of inaccurate quantification of network security event damage in the prior art. According to the embodiment of the invention, the multi-source data of the target system is integrated through the multi-monitoring index system, so that the comprehensiveness of damage assessment is ensured, and the quantization deviation caused by data one-sided is avoided; index normalization and weight calculation are carried out by adopting an entropy weight method, and the uncertainty of subjective weighting is overcome, so that the real contribution of each dimension to the overall damage is accurately reflected; a damage perception value is calculated through weighted fusion, and multi-dimensional information is converted into accurate expression of a complex damage state of the system; and then a Markov chain is introduced, and pre-judgment on a future damage state is provided on the basis of the damage perception value, so that accurate grade judgment and early warning can be performed based on the damage perception value and the predicted damage state, and conversion from passive response to active early warning is realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for assessing damage from network security incidents. Background Technology

[0002] With the rapid development of information systems, industrial control networks, and the Internet of Things (IoT) architecture, cybersecurity threats and attack methods continue to evolve. Attacks have escalated from single-dimensional damage to multi-dimensional harm, manifesting as direct consequences such as performance degradation, data loss, and service interruption, and potentially triggering chain reactions such as business paralysis and reputational damage. Accurately quantifying the extent of damage from cybersecurity incidents is a core prerequisite for precise security risk assessment, scientific formulation of protection strategies, and efficient implementation of emergency responses, directly impacting the resilience of network systems and their ability to ensure business continuity.

[0003] Currently, various approaches to cybersecurity assessment and quantification have emerged in the industry, mainly falling into three categories: First, asset-value-based quantification methods, such as decomposing asset structures, calculating the quantifiable value of vulnerabilities in underlying assets, and combining asset weights to derive the overall risk value; second, probabilistic reasoning-based quantification methods, typically Bayesian network vulnerability assessment, which uses probabilistic models to handle uncertain information to quantify the degree of vulnerability; and third, comprehensive factor-based quantification methods, such as a two-factor risk model based on threat frequency and loss impact constructed from an insurance perspective, or a defense effectiveness quantification method that calculates attack damage effects through range simulation.

[0004] Most existing methods focus on quantifying the indirect correlation between risk probability and asset value, such as risk value calculation and vulnerability hazard scoring, failing to directly quantify the actual damage after an incident occurs. This makes it difficult for assessment results to reflect the true scope and severity of the damage. At the same time, static or phased assessment logic cannot adapt to the continuous evolution of the attack chain, further exacerbating the bias in damage quantification and ultimately failing to provide accurate and actionable quantitative basis for security decisions.

[0005] Therefore, a method and system for assessing the damage caused by cybersecurity incidents are needed. Summary of the Invention

[0006] To address the problem of inaccurate quantification of network security incident damage in existing technologies, this invention provides a method and system for assessing network security incident damage, which can improve the accuracy of quantifying network security incident damage. The specific technical solution is as follows: In a first aspect, embodiments of this application provide a method for assessing damage from network security incidents, comprising: Based on multiple preset monitoring indicators, corresponding monitoring indicator data are acquired in the target system. These monitoring indicators are used to monitor the operating status of the target system. Using the entropy weight method, the weight of each monitoring indicator is calculated based on the data. The monitoring indicator data is then weighted and fused based on this weight to obtain the damage perception value of the target system. A damage state transition model is constructed using a Markov chain, and based on the damage perception value and the damage state transition model, the predicted damage state of the target system within a preset future time period is predicted. Based on the damage perception value and the predicted damage state, the damage level of the target system is determined.

[0007] Preferably, the monitoring indicator data includes positive indicator data and negative indicator data, wherein the positive indicator data is directly proportional to the perceived damage value, and the negative indicator data is inversely proportional to the perceived damage value; the method of calculating the weight of the monitoring indicator based on the monitoring indicator data using the entropy weight method includes: normalizing the positive indicator data and the negative indicator data respectively to obtain a normalized probability distribution corresponding to the monitoring indicator; calculating the information entropy of the monitoring indicator based on the normalized probability distribution; and calculating the weight of the monitoring indicator based on the information entropy.

[0008] Preferably, the damage state transition model includes the state boundary of the damage state and the state transition matrix of the target system; the construction of the damage state transition model through a Markov chain includes: obtaining historical damage perception values; defining the state boundary of the damage state based on the mean and standard deviation of the historical damage perception values; generating the state transition probability matrix of the target system based on the state transition frequency of the historical damage perception values; wherein, the elements of the state transition probability matrix are the state transition probabilities of the target system.

[0009] Preferably, the method of predicting the predicted damage state of the target system within a preset time period based on the damage perception value and the damage state transition model includes: determining the probability distribution of the current damage state of the target system based on the damage perception value and a preset membership function; and calculating the probability distribution of the predicted damage state based on the probability distribution of the current damage state and the state transition probability matrix.

[0010] Preferably, the membership function includes a triangular membership function, a trapezoidal membership function, and a Gaussian membership function.

[0011] Preferably, after acquiring the historical damage perception value, the method further includes: weighting the state transition frequency based on the time difference between the state transition time in the historical damage perception value and the current time, wherein the weight used to weight the state transition frequency is inversely proportional to the magnitude of the time difference; generating the state transition probability matrix of the target system based on the state transition frequency of the historical damage perception value includes: generating the state transition probability matrix based on the weighted state transition frequency.

[0012] Preferably, after determining the damage level of the target system based on the damage perception value and the predicted damage state, the method further includes: executing corresponding defensive measures based on the damage level or the upward trend of the damage level.

[0013] Secondly, embodiments of this application provide a network security incident damage assessment system, applied to the method described in the first aspect, the system comprising: The acquisition module is used to acquire corresponding monitoring indicator data in the target system based on multiple preset monitoring indicators; wherein, the monitoring indicators are used to monitor the operating status of the target system. The calculation module is used to calculate the weight of the monitoring indicator based on the monitoring indicator data using the entropy weight method. The calculation module is also used to perform weighted fusion of the monitoring index data based on the weight to obtain the damage perception value of the target system. The prediction module is used to construct a damage state transition model through a Markov chain, and based on the damage perception value and the damage state transition model, predict the predicted damage state of the target system within a preset time period in the future. The evaluation module is used to determine the damage level of the target system based on the damage perception value and the predicted damage state.

[0014] Thirdly, embodiments of this application provide a computing device, including: a memory for storing a program; and a processor for loading the program to execute the method as described in the first aspect.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the method described in the first aspect.

[0016] Compared with existing technologies, the beneficial effects of this invention are as follows: By integrating multi-source data of the target system through a multi-monitoring indicator system, the comprehensiveness of damage assessment is ensured, avoiding quantitative deviations caused by incomplete data; the entropy weight method is used for indicator normalization and weight calculation, overcoming the uncertainty of subjective weighting, thereby accurately reflecting the true contribution of each dimension to the overall damage; by calculating the damage perception value through weighted fusion, multi-dimensional information is transformed into a precise expression of the complex damage state of the system; and by introducing a Markov chain, a prediction of the future damage state is provided based on the damage perception value, thereby enabling accurate level determination and early warning based on the damage perception value and the predicted damage state, realizing the transformation from passive response to proactive early warning. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0018] Figure 1 A flowchart illustrating a method for assessing damage from a network security incident, provided in an embodiment of this application; Figure 2 A schematic diagram of the structure of a network security incident damage assessment system provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0021] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0022] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0023] To address the problem of inaccurate quantification of cybersecurity incident damage in traditional methods, this invention provides a method and system for assessing cybersecurity incident damage, which can improve the accuracy of cybersecurity incident damage quantification.

[0024] Please see Figure 1 , Figure 1 This application provides a flowchart illustrating a method for assessing network security incident damage, which is applied to a computing device. Figure 1 As shown, the method includes: Step 101: The computing device acquires the corresponding monitoring indicator data in the target system based on multiple preset monitoring indicators.

[0025] The target system is the system whose cybersecurity incident damage needs to be assessed. Specifically, it can be a data-intensive system, a public service system, a critical business support system, an external interaction system, a basic equipment-related system, or any other system that requires a cybersecurity incident damage assessment.

[0026] The computing device can be a server or a terminal, specifically a server or terminal within the target system, which can communicate with other devices or subsystems within the target system to obtain the detection index data.

[0027] The monitoring indicators are used to monitor the operational status of the target system. The computing device can pre-acquire, connect to, or configure a unified indicator library. The monitoring indicators stored in this library cover multiple aspects of the target system, such as hardware resource utilization, network traffic characteristics, service quality performance, and the number of security alarms. The computing device can comprehensively analyze the operational status of the target system by acquiring the data corresponding to these monitoring indicators.

[0028] For example, in industrial control networks, monitoring metrics include CPU utilization, memory usage, response latency, throughput degradation rate, critical message loss rate, and intrusion detection trigger count.

[0029] After acquiring the monitoring indicator data, the computing device can construct a multi-dimensional indicator vector based on this data for subsequent calculations and processing. The expression for this multi-dimensional indicator vector X can be: ,in, It is the observed value of the i-th monitoring indicator at time t, and n is the number of indicator dimensions, which can be expanded based on actual scenarios.

[0030] Step 102: The computing device calculates the weight of the monitoring indicator based on the monitoring indicator data using the entropy weight method.

[0031] Because different monitoring indicators have significantly different numerical ranges and physical meanings—for example, CPU utilization typically ranges from 0% to 100%, while packet loss rate ranges from 0% to 10%—without normalization, the results will be dominated by the indicator with the higher numerical range. Computing devices can solve this problem by performing normalization calculations on each monitoring indicator.

[0032] Preferably, the monitoring indicator data includes positive indicator data and negative indicator data, wherein the positive indicator data is directly proportional to the damage perception value, and the negative indicator data is inversely proportional to the damage perception value; the computing device normalizes the positive indicator data and the negative indicator data respectively to obtain a normalized probability distribution corresponding to the monitoring indicator; based on the normalized probability distribution, the information entropy of the monitoring indicator is calculated; and based on the information entropy, the weight of the monitoring indicator is calculated.

[0033] Among them, for the positive index where the larger the observed value, the greater the damage, the normalized calculation formula for the positive index data by the computing device is as follows: ; in, It is the normalized observed value of the i-th monitoring indicator. These are the maximum and minimum observed values ​​of the i-th monitoring indicator in the historical data, respectively.

[0034] For the inverse index where larger observed values ​​result in less damage, the normalized calculation formula for the inverse index data by the computing device is as follows: .

[0035] After normalizing the monitoring indicators, the computing device can then calculate their normalized probability distribution. : Where m is the sample size, specifically, m can be the number of monitoring indicator data samples collected by the computing device within the current time window.

[0036] Then, the computing device can calculate the information entropy of the i-th monitoring indicator. This is used to measure the degree of information dispersion in monitoring indicator data; its calculation formula is: ;in, .

[0037] Then, the computing device can calculate the weight of the i-th monitoring indicator. : This avoids the subjectivity and non-repeatability of expert experience and enables adaptive weight allocation, meaning that indicators with high volatility and more discriminative information will receive higher weights.

[0038] Step 103: The computing device performs weighted fusion of the monitoring index data based on the weight to obtain the damage perception value of the target system.

[0039] Among them, damage perception value The calculation formula is as follows: .

[0040] This weighted approach integrates data from different dimensions, resulting in a unified fusion that reflects the contribution of individual indicators while preserving the overall structural balance. The key technical aspect of this step lies in efficient data fusion algorithms and a real-time computing engine, ensuring that damage perception values ​​are rapidly calculated as the collected data is updated.

[0041] Step 104: The computing device constructs a damage state transition model through a Markov chain, and based on the damage perception value and the damage state transition model, predicts the predicted damage state of the target system within a preset time period in the future.

[0042] While damage values ​​can reflect the state at a certain moment, they lack the ability to predict future trends. Therefore, this application introduces a Markov chain to construct a damage state transition model.

[0043] Preferably, the damage state transition model includes the state boundary of the damage state and the state transition matrix of the target system; the computing device can acquire historical damage perception values; the state boundary of the damage state is defined based on the mean and standard deviation of the historical damage perception values; the state transition probability matrix of the target system is generated based on the state transition frequency of the historical damage perception values; wherein, the elements of the state transition probability matrix are the state transition probabilities of the target system.

[0044] The computing device can first define the set of damage states S of the target system. ,in, ~ These correspond to four injury states: normal, mild, moderate, and severe.

[0045] Then, the computing device can perform statistical analysis on the historical damage perception values, including the mean μ and standard deviation σ of the historical damage perception values; and then define the damage state boundary based on the mean and standard deviation. Specifically as follows: Normal state ( ): D(t) ≤ μ + 0.5σ, corresponding to the normal fluctuations with high probability; Minor damage ( ): μ + 0.5σ < D(t) ≤ μ + 1.5σ, belonging to the abnormal with low probability but relatively minor degree; Moderate damage ( ): μ + 1.5σ < D(t) ≤ μ + 2.5σ, with the abnormal degree further increased; Severe damage ( ): D(t) > μ + 2.5σ, belonging to the extremely abnormal with very high probability.

[0046] Then, the computing device can map the damage perception values at consecutive time points into a state sequence, obtaining: {s( ), s( ),..., s( )}. Then extract the pairwise consecutive state transition pairs (s( ), s( + 1)), count the state transition frequencies, and obtain the observed number of times of transitioning from any state to another state. Then calculate the basic transition probability: ; Wherein, is the estimated probability of transitioning from state to state , is the observed number of times of transitioning from state to state . Taking as the matrix elements, the computing device can generate the state transition probability matrix.

[0047] Preferably, the computing device can assign higher weights to recent transitions and use exponential decay. Among them, the computing device can weight the state transition frequency based on the time difference between the state transition time and the current time in the historical damage perception values; wherein, the weight used to weight the state transition frequency is inversely proportional to the magnitude of the time difference; and then generate the state transition probability matrix based on the weighted state transition frequency.

[0048] Among them, the computing device can first calculate the time decay weight : , wherein, is the decay rate parameter, It is the time difference between the state transition time and the current time for each pair of consecutive state transition pairs. Then, for each state transition pair (s( ), s( The count base of +1) is weighted, and then the basic transition probability and the generated state transition probability matrix are calculated using the count base in the weighted count base.

[0049] For example, if the transition from state i to state j occurs twice, normally the increment would be 1 for each occurrence. With this optimized approach, the increment is based on the time of these two transitions. The earlier transition, being further from the current time, might accumulate an increment of 0.5; the later transition, being further from the current time, might accumulate an increment of 0.8. The resulting calculation... It is 1.3.

[0050] Preferably, the computing device can determine the probability distribution of the current damage state of the target system based on the damage perception value, the damage state boundary, and a preset membership function; and calculate the probability distribution of the predicted damage state based on the probability distribution of the current damage state and the state transition probability matrix.

[0051] When the damage perception value falls near the boundary between two states, it is inaccurate to directly classify it as one of the states. The computing device can solve this problem through a membership function.

[0052] Preferably, the membership function includes a triangular membership function, a trapezoidal membership function, and a Gaussian membership function.

[0053] Taking the membership function of a triangle as an example, it is defined as follows: ; in, , , These are the left boundary, the peak point (the midpoint between the left and right boundaries), and the right boundary of damage state i, respectively. It is the membership function of state i.

[0054] The computing device can substitute the loss perception value into the membership function of each state to obtain the membership degree of the loss perception value to each state, and obtain the probability distribution of the current loss state.

[0055] For uncertain states, computing devices can be described using probability distribution vectors: ,in, Let be the probability distribution vector. At time t, the state is... The probability of and satisfying .

[0056] Then, the computing device can predict the damage state of the target system after multiple time steps, and the corresponding calculation formula is as follows: ; Where k is the number of future time steps from the current time. The k-th power of the state transition probability matrix Let be the state probability distribution after k time steps.

[0057] Through continuous iteration, the evolution trend of damage level at multiple future time steps can be predicted, where the transition probability can be updated using historical data or online learning algorithms.

[0058] Step 105: The computing device determines the damage level of the target system based on the damage perception value and the predicted damage state.

[0059] The computing device can classify damage levels based on the numerical range of the perceived damage value. At the implementation level, this step links the damage level with the risk strategies of the business system. For example, when a damage value approaches 0.7, the system will trigger automated defense measures such as traffic scrubbing, access control isolation, or load balancing. Simultaneously, combining Markov chain prediction results, when the probability of a severe damage state shows an upward trend over several future time steps, the system will issue an early warning, allowing administrators response time.

[0060] Specifically, the computing device can calculate the membership degree of the perceived damage value to each state, and then determine the loss level by combining the predicted probability distribution of future states. For example, the state probability distribution vector corresponding to the current perceived damage value is [0, 0.5, 0.5, 0], which means that the current system state is on the boundary between mild and moderate damage; then the predicted probability distribution vector of future states is [0.205, 0.31, 0.38, 0.105]. The computing device can calculate that the probability of state improvement is 0.205 + 0.31 = 0.515, and the probability of state deterioration is 0.38 + 0.105 = 0.485. At this point, it can be determined that the probability of state improvement is greater, so the computing device determines that the current damage level of the target system is mild damage.

[0061] In some other possible implementations, the computing device may first obtain the two states with the highest probabilities in the current state probability distribution vector; then select the state with the higher probability in the future state distribution vector as the damage level.

[0062] It is understood that, apart from the two possible implementations mentioned above, any other solutions obtained by simply changing or replacing the approach to determining the loss level in the embodiments of this application are all within the protection scope of the embodiments of this application.

[0063] Preferably, after determining the damage level of the target system based on the damage perception value and the predicted damage state, the computing device can execute corresponding defensive measures based on the damage level or the upward trend of the damage level.

[0064] The computing device can output corresponding alarm signals based on the damage level to notify the administrator to take appropriate action.

[0065] The computing device can implement measures with different levels of defense based on the rate of increase in damage level.

[0066] In this embodiment, multiple monitoring indicator systems are used to integrate multi-source data from the target system, ensuring the comprehensiveness of damage assessment from the source and avoiding quantitative deviations caused by incomplete data. Entropy weighting is used for indicator normalization and weight calculation, overcoming the uncertainty of subjective weighting and accurately reflecting the true contribution of each dimension to the overall damage. Then, a weighted fusion calculation of the comprehensive damage perception value transforms multi-dimensional information into a precise expression of the complex damage state of the system. Furthermore, Markov chain dynamic modeling is introduced to provide predictions of future damage states based on the damage perception value. This enables accurate level determination and early warning based on the damage perception value and predicted damage state, realizing a shift from passive response to proactive early warning.

[0067] The method of this application will be described below with reference to a specific embodiment: Suppose that when an industrial control network is under external attack, the computing devices collect the following metrics: CPU utilization: 85% (historical range 30%~95%); average latency: 120ms (historical range 10ms~200ms); throughput decline rate: 15% (historical range 0%~40%); data loss rate: 3% (historical range 0%~10%); malicious traffic detection rate: 70% (historical range 0%~100%).

[0068] Then execute the following process: 1. Indicator normalization: Normalize different indicators. CPU utilization (positive indicator): ; Average latency (positive indicator): ; Throughput decline rate (positive indicator): ; Data loss rate (positive indicator): ; Malicious traffic detection rate (positive indicator): .

[0069] The normalized result is: X'(t)=[0.85,0.58,0.38,0.30,0.70].

[0070] 2. Calculation of indicator weights.

[0071] The index weights are calculated using the entropy weight method: W = [0.22, 0.18, 0.20, 0.15, 0.25].

[0072] Among them, CPU utilization has a weight of 0.22, indicating that it has high volatility and discriminative power; malicious traffic detection rate has the largest weight (0.25), reflecting its importance in attack detection.

[0073] 3. Calculation of comprehensive damage value.

[0074] Using the weighted summation formula: ; Substitute the data into the calculation: D(t) = 0.22 × 0.85 + 0.18 × 0.58 + 0.20 × 0.38 + 0.15 × 0.30 + 0.25 × 0.70 = 0.187 + 0.104 + 0.076 + 0.045 + 0.175 = 0.587. The overall damage value indicates that the system is in a state of moderate damage.

[0075] 4. Dynamic evolution prediction.

[0076] Let the current state distribution be: π(t)=[0.1,0.3,0.6,0.0], corresponding to the four states of normal, mild, moderate and severe.

[0077] The state transition matrix is: ; Predict the state distribution at the next time step: ; The calculation results are as follows: .

[0078] It can be seen that the probability of severe damage in the future increases by up to 10%, indicating a significant increase in risk.

[0079] 5. Damage Level and Early Warning Output Based on the determined moderate damage status, the system automatically triggers an early warning, indicating the risk of the damage worsening into severe damage in the future.

[0080] At the implementation level, early warning information can be linked to defense mechanisms, such as activating traffic filtering, isolating affected subnets, or escalating alarm levels to ensure that administrators have sufficient response time.

[0081] This application's embodiments achieve comprehensive perception of system damage through integrated analysis of system performance, business continuity, security protection, and user experience indicators; normalize and weightedly fuse multi-source heterogeneous indicators to generate a quantifiable comprehensive damage perception value, achieving horizontal and vertical comparability; perform time-series prediction of damage status based on Markov chain models, providing forward-looking judgments of future risk trends; automatically determine indicator weights using the entropy weight method, improving the objectivity and scientific nature of the evaluation results; multi-dimensional fusion effectively reduces the false alarm rate and improves the accuracy of system damage identification; and combined with dynamic prediction results triggering an early warning mechanism, it can instantly link security protection measures, improving system response efficiency.

[0082] The method provided in the embodiments of this application has been described above. The system provided in the embodiments of this application will be described below.

[0083] Please see Figure 2 , Figure 2 This application provides a schematic diagram of the structure of a network security incident damage assessment system, as shown in the embodiments of the present application. Figure 2 As shown, the system 20 includes: The acquisition module 201 is used to acquire corresponding monitoring indicator data in the target system based on multiple preset monitoring indicators; wherein, the monitoring indicators are used to monitor the operating status of the target system. The calculation module 202 is used to calculate the weight of the monitoring indicator based on the monitoring indicator data using the entropy weight method. The calculation module 202 is also used to perform weighted fusion of the monitoring index data based on the weight to obtain the damage perception value of the target system; The prediction module 203 is used to construct a damage state transition model through a Markov chain, and based on the damage perception value and the damage state transition model, predict the predicted damage state of the target system within a preset time period in the future. Evaluation module 204 is used to determine the damage level of the target system based on the damage perception value and the predicted damage state.

[0084] Preferably, the monitoring indicator data includes positive indicator data and negative indicator data, wherein the positive indicator data is directly proportional to the damage perception value, and the negative indicator data is inversely proportional to the damage perception value; the calculation module 202 is specifically used to normalize the positive indicator data and the negative indicator data respectively to obtain a normalized probability distribution corresponding to the monitoring indicator; based on the normalized probability distribution, calculate the information entropy of the monitoring indicator; and based on the information entropy, calculate the weight of the monitoring indicator.

[0085] Preferably, the damage state transition model includes the state boundary of the damage state and the state transition matrix of the target system; the prediction module 203 includes a modeling unit 2031, used to obtain historical damage perception values; define the state boundary of the damage state based on the mean and standard deviation of the historical damage perception values; and generate the state transition probability matrix of the target system based on the state transition frequency of the historical damage perception values; wherein, the elements of the state transition probability matrix are the state transition probabilities of the target system.

[0086] Preferably, the prediction module 203 further includes a prediction unit 2032, used to determine the probability distribution of the current damage state of the target system based on the damage perception value and a preset membership function; and to calculate the probability distribution of the predicted damage state based on the probability distribution of the current damage state and the state transition probability matrix.

[0087] Preferably, the membership function includes a triangular membership function, a trapezoidal membership function, and a Gaussian membership function.

[0088] Preferably, after acquiring the historical damage perception value, the modeling unit 2031 is further used to weight the state transition frequency based on the time difference between the state transition time in the historical damage perception value and the current time, and the weight of the state transition frequency is inversely proportional to the magnitude of the time difference; specifically, the modeling unit 2031 is used to generate the state transition probability matrix based on the weighted state transition frequency.

[0089] Preferably, the system 20 further includes a defense module 205 for performing corresponding defense measures based on the damage level or the upward trend of the damage level.

[0090] The network security incident damage assessment system provided in this application embodiment can be understood by referring to the relevant content in the foregoing method embodiment section, and will not be repeated here.

[0091] like Figure 3 As shown, Figure 3 This is a schematic diagram of a possible logical structure of a computing device provided in an embodiment of this application. The computing device 30 includes a processor 301, a communication interface 302, a memory 303, and a bus 304. The processor 301, the communication interface 302, and the memory 303 are interconnected via the bus 304. In an embodiment of this application, the processor 301 is used to control and manage the operation of the computing device 30. For example, the processor 301 is used to execute... Figure 1 The steps in the embodiments and / or other processes used in the techniques described herein. Communication interface 302 is used to support communication by computing device 30. Memory 303 is used to store program code and data of computing device 30.

[0092] The processor 301 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. The bus 304 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0093] In another embodiment of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the above-described... Figure 1 The method described in the embodiments.

[0094] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0095] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0096] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0097] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0098] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0099] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for assessing the damage caused by a cybersecurity incident, characterized in that, The method includes: Based on multiple preset monitoring indicators, corresponding monitoring indicator data are obtained in the target system; wherein, the monitoring indicators are used to monitor the operating status of the target system; The weights of the monitoring indicators are calculated based on the monitoring indicator data using the entropy weight method. The monitoring index data are weighted and fused based on the weights to obtain the damage perception value of the target system. A damage state transition model is constructed using Markov chains, and based on the damage perception value and the damage state transition model, the predicted damage state of the target system within a preset time period is predicted. Based on the perceived damage value and the predicted damage state, the damage level of the target system is determined.

2. The method according to claim 1, characterized in that, The monitoring indicator data includes positive indicator data and negative indicator data. The positive indicator data is directly proportional to the damage perception value, and the negative indicator data is inversely proportional to the damage perception value. The step of calculating the weight of the monitoring indicator based on the monitoring indicator data using the entropy weight method includes: The positive and negative indicator data are normalized respectively to obtain the normalized probability distribution of the corresponding monitoring indicator; Based on the normalized probability distribution, the information entropy of the monitoring indicator is calculated; The weights of the monitoring indicators are calculated based on the information entropy.

3. The method according to claim 1, characterized in that, The damage state transition model includes the state boundary of the damage state and the state transition matrix of the target system; the construction of the damage state transition model through a Markov chain includes: Obtain historical damage perception values; Based on the mean and standard deviation of the historical damage perception values, the state boundary of the damage state is defined. Based on the state transition frequency of the historical damage perception values, a state transition probability matrix of the target system is generated; wherein, the elements of the state transition probability matrix are the state transition probabilities of the target system.

4. The method according to claim 3, characterized in that, The step of predicting the predicted damage state of the target system within a preset time period based on the damage perception value and the damage state transition model includes: Based on the damage perception value, the state boundary of the damage state, and the preset membership function, the probability distribution of the current damage state of the target system is determined. Based on the probability distribution of the current damage state and the state transition probability matrix, the probability distribution of the predicted damage state is calculated.

5. The method according to claim 4, characterized in that, The membership functions include triangular membership functions, trapezoidal membership functions, and Gaussian membership functions.

6. The method according to claim 3, characterized in that, After acquiring the historical damage perception values, the method further includes: The state transition frequency is weighted based on the time difference between the state transition time and the current time in the historical damage perception value; wherein the weight used to weight the state transition frequency is inversely proportional to the magnitude of the time difference; The process of generating the state transition probability matrix of the target system based on the state transition frequency of the historical damage perception values ​​includes: The state transition probability matrix is ​​generated based on the weighted state transition frequency.

7. The method according to any one of claims 1-6, characterized in that, After determining the damage level of the target system based on the damage perception value and the predicted damage state, the method further includes: Based on the damage level or the upward trend of the damage level, corresponding defensive measures are implemented.

8. A system for assessing damage from cybersecurity incidents, characterized in that, The system, applied to the method of any one of claims 1-7, comprises: The acquisition module is used to acquire corresponding monitoring indicator data in the target system based on multiple preset monitoring indicators; wherein, the monitoring indicators are used to monitor the operating status of the target system; The calculation module is used to calculate the weight of the monitoring indicator based on the monitoring indicator data using the entropy weight method; The calculation module is also used to perform weighted fusion of the monitoring index data based on the weights to obtain the damage perception value of the target system. The prediction module is used to construct a damage state transition model through a Markov chain, and based on the damage perception value and the damage state transition model, predict the predicted damage state of the target system within a preset time period in the future. An evaluation module is used to determine the damage level of the target system based on the damage perception value and the predicted damage state.

9. A computing device, characterized in that, include: Memory, used to store programs; A processor for loading the program to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method of any one of claims 1-7.

Images