A vulnerability assessment method for network security protection systems
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANDONG UNIV
- Filing Date
- 2026-02-07
- Publication Date
- 2026-06-02
Smart Images
Figure CN122137589A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network and information security technology, and in particular to a method for assessing the vulnerability of a network security protection system. Background Technology
[0002] With the full arrival of the digital age, information systems have permeated all aspects of national infrastructure, enterprises, and social life. To ensure the continuous operation of critical systems and the integrity of data assets, various network security protection systems have emerged. These systems mainly include firewalls, intrusion detection and prevention systems (IDS / IPS), endpoint security protection systems (EDR), vulnerability scanning platforms, unified threat management systems (UTM), situational awareness platforms, and security information and event management systems (SIEM). Their goal is to detect security threats, block attacks, and mitigate potential risks at different stages of network system operation.
[0003] However, despite the deployment of various security protection systems, cyberattacks remain frequent. Attackers exploit system vulnerabilities, misconfigurations, and policy flaws to launch complex threats such as denial-of-service (DoS / DDoS) attacks, remote code execution, SQL injection, XSS attacks, privilege escalation, and persistent APT attacks. A prominent problem facing current security protection is that it is difficult to accurately assess "whether a system is truly secure, where its vulnerabilities lie, and how it might be breached" using traditional methods.
[0004] Currently, traditional vulnerability assessment methods mainly fall into two categories:
[0005] 1. Static evaluation method based on vulnerability scanning
[0006] These methods primarily rely on vulnerability databases (such as CVE / NVD), security baseline specifications, or general configuration checks, employing automated scanning tools to detect target systems. While this approach is efficient in identifying publicly known vulnerabilities, it suffers from the following drawbacks: it depends on the update frequency of the vulnerability knowledge base, rendering it ineffective against zero-day attacks and customized threats; it lacks contextual analysis capabilities, failing to assess the true severity of vulnerabilities in conjunction with business scenarios; and its assessment is "offline" and static, unable to reflect the exposure risks of the system during real-time operation.
[0007] 2. Subjective assessment method based on manual review and risk matrix
[0008] Security experts, combining experience or relying on standards such as graded protection systems and ISO / IEC 27001, classify and grade system assets, manually assessing asset value, threat probability, and impact level to form a risk level classification. While this method is instructive at the management level, it is highly subjective, inefficient, and difficult to scale to large-scale systems or dynamically changing environments.
[0009] On the other hand, with the development of network technology, the challenges facing network security have also changed significantly, mainly in the following aspects:
[0010] Attack methods are becoming more complex and automated: Advanced Persistent Threats (APTs), supply chain attacks, and fileless attacks are breaking through traditional detection mechanisms, making attack paths more covert and behaviors more flexible;
[0011] The frequency and scope of attacks are expanding: ransomware, worms, and other viruses can spread globally within minutes, causing business disruptions and economic losses.
[0012] The system composition is becoming increasingly complex: the organization's internal network includes traditional IT equipment, industrial control equipment, IoT devices, virtualization platforms, cloud resources, etc., and the security protection boundaries are blurred;
[0013] The surge in log data volume: Security devices generate a large amount of logs and alarm information every day. Manual screening and analysis is costly, inaccurate, and prone to missing key risk clues.
[0014] Attack chains are trending towards multi-hop, multi-stage, and multi-tool collaborative operations: Attackers often establish persistent control chains between multiple systems, gradually expanding the scope of control by using initial penetration points. Traditional point-to-point vulnerability assessments cannot cover risks across the entire chain.
[0015] To address these challenges, there is an urgent need to develop an intelligent, dynamic, and context-aware vulnerability assessment mechanism for cybersecurity protection systems, in order to overcome the limitations of traditional tools and methods. Summary of the Invention
[0016] The purpose of this invention is to provide a vulnerability assessment method for network security protection systems, which can achieve dynamic identification, quantitative assessment, and graded early warning of security weaknesses in the global scope of the network system.
[0017] The present invention adopts the following technical solution:
[0018] A vulnerability assessment method for a network security protection system includes the following steps:
[0019] S1: Collect and preprocess multi-source heterogeneous data generated in a network security environment;
[0020] S2: Generate log semantic vectors based on preprocessed multi-source heterogeneous data, and concatenate the semantic vectors with asset fields to form a complete event feature vector;
[0021] S3: Based on network topology and historical attack chain information, an attack path graph is constructed to simulate the attack paths that attackers may take to reach critical target assets;
[0022] S4: Based on the asset node attributes, attack behavior characteristics, external threat information and business scenario constraints in the attack path graph, vulnerability factor analysis is performed, and quantitative modeling is carried out according to standardized transformation rules and weight calibration logic to obtain the vulnerability factor vector of each asset node or event sample.
[0023] S5: Construct a rule-based weighted scoring model or vulnerability risk scoring model, and score the vulnerability of each asset node or event sample based on the vulnerability factor vector of each asset node or event sample.
[0024] S6: Based on the vulnerability score of each asset node or event sample obtained, identify high-risk nodes and classify risk levels, and output vulnerability assessment results.
[0025] In step S1, the multi-source heterogeneous data includes network traffic data, security logs, configuration files, known vulnerability databases, threat intelligence databases, and business system behavior data; and the multi-source heterogeneous data is subjected to unified standardized preprocessing, including field standardization processing, noise filtering processing, log merging processing, and asset association processing.
[0026] In step S3, the nodes in the attack path graph are asset components in the network. Service ports, protocol types, and security events serve as associated attributes or dynamic behavior identifiers of asset components and are embedded in the attribute descriptions of the corresponding asset nodes. The edges in the attack path graph represent the movement paths and vertical privilege escalation paths that attackers can utilize. The edge weights reflect the reachability probability of the path or the size of the attack overhead.
[0027] In step S3, the attack path graph is based on a directed graph and consists of a static graph and a dynamic graph. The static graph is built based on the network topology and asset configuration files. A set of nodes is formed by network scanning tools, and the initial edge relationships are generated by matching the vulnerabilities of the nodes according to the vulnerability database. The dynamic graph is expanded by learning from real-time logs and attack history. When a new attack attempt is detected, the corresponding edge is automatically added, and the path weight is adjusted by combining the historical attack chain. The static graph and the dynamic graph complement each other through infrastructure and dynamic updates, and are merged into a hybrid graph.
[0028] Edge weights are obtained by combining basic cost calculation and multi-factor weight correction. The basic cost is constructed based on attack cost, vulnerability complexity and network topology cost. The multi-factor weight correction is obtained by using the basic cost as the basic weight and further optimizing it based on a multi-factor model. The multi-factor model is constructed based on attack complexity, vulnerability exploitation probability and path historical occurrence frequency and corresponding weights.
[0029] In step S4, vulnerability factors include vulnerability severity, attack frequency, exploitation difficulty, asset importance, threat level, and access exposure. The above vulnerability factors are quantified and converted into standardized values in sequence using standardized conversion rules, and finally the factor vector of each asset node or event sample is obtained.
[0030] In step S5, the rule-based weighted scoring model is constructed based on each vulnerability factor of the asset node or event sample and the weight value of each vulnerability factor; the vulnerability risk scoring model can be constructed based on the multilayer perceptron model or other neural network models.
[0031] In step S6, the vulnerability score of each asset node or event sample obtained in the previous step is used to generate a comprehensive score by combining the attack path heat assessment results. By comparing the comprehensive score with the preset risk threshold, each asset node or event sample is divided into different risk levels. The attack path heat is calculated by superimposing the vulnerability scores of each node in the path with the edge weights.
[0032] In step S6, firstly, the comprehensive score of all nodes is calculated, and all nodes are sorted in descending order of comprehensive score; then, business weights are introduced for weighted adjustment; subsequently, the shortest attack path is found with the goal of minimizing the sum of edge weights or the most vulnerable attack path is found with the goal of minimizing the number of nodes, and a vulnerability distribution map and risk heat map are drawn based on the attack path graph, while marking critical paths, intersections, and high-frequency attack channels; then, high-risk points with comprehensive scores not less than a set score threshold are labeled and described, including the affected vulnerabilities, attack sources, and possible intrusion paths; finally, the identified high-risk nodes and their corresponding risk levels are used as the final vulnerability assessment results and output.
[0033] It also includes step S7: based on the node risk score and attack path coverage, a visualization and strategy suggestion are generated.
[0034] This invention combines multidimensional security event data with network topology, analyzes potential attack chains by constructing attack path diagrams, extracts vulnerability factors of system nodes, and integrates vulnerability information, asset value, attack frequency and other elements to construct an evaluation model, ultimately forming a visualized vulnerability distribution map and a systemic security recommendation report.
[0035] This invention uses graph computing to simulate possible attacker behavior paths, innovatively modeling system vulnerabilities from the attacker's perspective. It continuously tracks changes in the network environment, dynamically adjusts the attack path graph, accurately grasps potential attack routes, and provides strong evidence for proactive defense.
[0036] The multi-factor vulnerability risk scoring model constructed in this invention integrates multiple dimensions such as vulnerabilities, assets, and behaviors, achieving a leap from single-point analysis to overall risk quantification. It is no longer limited to single-factor assessment, but comprehensively considers multiple risk influencing factors, fully and accurately quantifying the vulnerability of network systems, and providing a more scientific method for risk assessment. Attached Figure Description
[0037] Figure 1 This is a schematic diagram of the process of the present invention. Detailed Implementation
[0038] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.
[0039] The present invention will now be described in detail with reference to the accompanying drawings and embodiments:
[0040] like Figure 1 As shown, the vulnerability assessment method for a network security protection system according to the present invention includes the following steps:
[0041] S1: Collect and preprocess multi-source heterogeneous data generated in a network security environment;
[0042] Multi-source heterogeneous data includes network traffic data (such as NetFlow, PCAP), security logs (such as firewall logs, IDS / IPS alarm logs, EDR behavior logs), configuration files (such as asset lists, protection policies), known vulnerability databases (such as CVE, CNVD), threat intelligence databases (IOC, blacklisted IPs, etc.), and business system behavior data (such as interface access records, database query operations), etc.
[0043] Due to the high heterogeneity and inconsistent formats of the aforementioned multi-source heterogeneous data, it is necessary to perform unified and standardized preprocessing on it, specifically as follows:
[0044] Standardize fields, such as unifying IP format, timestamp, and event type;
[0045] Noise filtering, such as removing irrelevant access, legitimate probes, and duplicate alarms;
[0046] Log merging processing, such as merging logs based on time windows and source / destination IPs;
[0047] Asset association processing, such as mapping events to specific assets.
[0048] In this embodiment, the preprocessing object is the multi-source heterogeneous raw data of the network security protection system, including firewall logs, IDS / IPS alarm logs, endpoint protection system (EDR) behavior records, network traffic data, asset topology and configuration files, various security device alarm events integrated by the SIEM system, and IOCs and attack patterns from the threat intelligence platform. Preprocessing includes merging log records using a sliding time window, extracting malicious behavior characteristic keywords using regular expressions, identifying core security event fields, identifying key information such as vulnerability and configuration defect associations, and using the Z-score method to remove abnormal data. This preprocessed multi-source heterogeneous data will serve as the basis for subsequent semantic modeling and attack graph construction.
[0049] In this invention, the multi-source heterogeneous data collected above each has its core value: firewall logs can accurately reflect the access control status of the network boundary; IDS / IPS alarm logs can promptly capture intrusion attempts; Endpoint Protection System (EDR) behavior records focus on the security dynamics of the endpoint; network traffic data contains the full picture of communication interactions; asset topology and configuration files lay the foundation for understanding the system architecture; alarm events integrated by the SIEM system realize the unified collection of warning information from multiple devices; and the IOC and attack patterns of the threat intelligence platform provide reference for external threats.
[0050] In this invention, a series of rigorous data preprocessing operations ultimately generate standardized multi-source security event data tables and asset inventory tables, laying a solid data foundation for subsequent analysis. For example, a unified time format ensures that different data sources are aligned for analysis along the time dimension; IP address normalization eliminates confusion caused by differences in IP representation; deduplication removes redundant data, reducing the burden of subsequent processing; outlier removal ensures data quality and avoids abnormal data interfering with assessment results; field standardization regulates data representation; and structured parsing of unstructured logs unlocks the value of unstructured data.
[0051] S2: Semantic modeling and feature vector construction;
[0052] Based on the preprocessed multi-source heterogeneous data, log semantic vectors are generated through an embedding learning model, and the semantic vectors are concatenated with asset fields to form a complete event feature vector, which is used for subsequent attack path graph construction and vulnerability factor scoring.
[0053] The embedding learning model can adopt Word2Vec, GloVe, and / or BERT, and asset fields such as the IP, port, protocol, etc. of the source device and the destination device.
[0054] In order to extract semantic features that can be used for machine understanding from the text-based logs in multi-source heterogeneous data, in this embodiment, natural language processing (NLP) technology is adopted, combined with the structured field parsing logic, to convert unstructured text and embedded structured identifiers (such as "External IP 203.0.113.45 attempts to log in to the SSH service (port 22) but fails, error code 401") into a vector form that can be calculated by a machine.
[0055] During the process of converting unstructured text into a vector form that can be calculated by a machine, it is necessary to tokenize and clean the unstructured text;
[0056] In this embodiment, during the tokenization stage, an existing tokenization tool that integrates the CVE vulnerability library and the attack technique dictionary (MITRE ATT&CK) is adopted to accurately identify security terms such as "SQL injection" and "buffer overflow", avoid mis-splitting complete attack behaviors or vulnerability names, and ensure the integrity of semantic units;
[0057] During the cleaning stage, stop words such as "of" and "in" without actual semantics are filtered, and at the same time, irrelevant information such as the device model prefix and redundant identification codes in the logs are removed to ensure that the core semantic information is retained, laying a foundation for generating accurate semantic vectors by the subsequent embedding learning model.
[0058] In this embodiment, the selected embedding learning model adopts a combination of Word2Vec, GloVe, and BERT. Among them, Word2Vec is suitable for the rapid training of large-scale log corpora and can capture the association relationships of words such as "vulnerability - exploitation - attack"; GloVe is better in word frequency statistics and is suitable for analyzing high-frequency attack patterns; BERT can accurately distinguish the semantic differences of ambiguous phrases (such as the semantic differences between "normal access" and "abnormal access") through context semantic understanding, and the generated word embedding dimension is usually set to 100 - 300 dimensions to balance computational efficiency and semantic accuracy.
[0059] For asset-related structured fields (such as source IP, destination IP, port, protocol type, and event type), feature encoding is required to convert them into machine-computable vector forms. Numerical fields such as IP addresses and ports are normalized to map numerical features of different magnitudes to the [0,1] interval, avoiding interference with model calculations due to magnitude differences. Categorical variables such as protocol types and event types are converted from discrete categories into binary vectors through one-hot encoding (e.g., TCP protocol is encoded as [1,0,0], and UDP protocol is encoded as [0,1,0]), ensuring that the model can identify category differences. Time-related fields (such as attack event timestamps) are embedded using time series to mine time-related features (e.g., high-frequency attack patterns of a certain IP within a fixed time period).
[0060] The structured field vector processed by the above method is concatenated with the log semantic vector generated by the embedding learning model mentioned above to form a complete event feature vector.
[0061] The construction of event feature vectors requires the implementation of a "field-semantic" mapping. Taking the log "203.0.113.45 attempted to access the backend management interface / admin / login and triggered a 403 error" as an example, its feature vector will include dimensions such as: attack source (IP address characteristics), attack target (sensitive path identifier / admin / login), behavior type (access attempt), and result label (authority denial corresponding to the 403 error code). Each dimension is weighted to highlight key information (e.g., sensitive paths have a higher weight than ordinary paths). These vectors can be directly used for attack behavior similarity calculation (e.g., identifying multiple accesses to sensitive paths from the same IP) and cluster analysis (e.g., classifying "authority bypass" attack events), laying the foundation for subsequent attack path identification.
[0062] Feature extraction leverages natural language processing technologies such as BERT and Word2Vec to deeply transform behavioral descriptions, attack information, and anomaly patterns in logs. Taking BERT as an example, it can understand the semantic context of text, accurately converting log content into vector form and capturing behavioral logic and attack features; Word2Vec can effectively mine semantic relationships between words, helping to accurately represent log information.
[0063] S3: Construct an attack graph based on network topology and historical attack chain information to simulate the attack paths that attackers may take to reach critical target assets;
[0064] The core of this invention lies in constructing an attack graph to simulate the attack paths an attacker might take to reach critical target assets. The nodes in the attack graph are core asset components in the network (including servers, databases, middleware, applications, and terminal devices). Service ports, protocol types, and security events serve as associated attributes or dynamic behavior identifiers of these asset components, embedded in the attribute descriptions of the corresponding asset nodes. The edges in the attack graph represent lateral movement paths and vertical privilege escalation paths that an attacker can exploit, such as vulnerabilities, weak passwords, and misconfigurations.
[0065] In the attack path graph, nodes are precisely focused on the asset components in the system, which are the possible targets of the attack; edges represent the paths that attackers can exploit, established based on vulnerabilities, default configurations, weak passwords, and other conditions. The existence of vulnerabilities provides potential entry points for attacks, while improper default configurations and weak passwords lower the attack threshold; edge weights reflect the reachability probability of the path or the size of the attack cost, quantifying the characteristics of the attack path.
[0066] In this invention, the network topology can be obtained through network scanning tools, asset configuration files, and the system's built-in topology discovery mechanism; historical attack chain information can be obtained through security logs, threat intelligence databases, and alarm correlation data merged from historical attack event records; the network topology can clearly present the physical and logical connections of the system, clarify the communication links and hierarchical relationships between assets, while the historical attack chain information traces back past attack trajectories, reconstructs the attacker's lateral movement path (after the attacker breaches the initial system, they spread control within the network), privilege escalation methods, and target directions. The combination of the two can provide a rich basis for the construction of attack path diagrams, including asset association and attack behavior references, ensuring the accuracy and comprehensiveness of attack path simulation.
[0067] In this invention, the attack path graph is based on a directed graph, composed of static and dynamic graphs. The static and dynamic graphs complement each other through infrastructure and dynamic update logic, ultimately merging into a hybrid graph that combines stability and timeliness, serving as the core modeling carrier for vulnerability assessment; wherein:
[0068] The static graph is constructed based on the network topology and asset configuration files. During the construction process, the IP, port, running services and other information of the assets are first obtained by network scanning tools (such as Nmap) to form a set of nodes (such as "Web server: port 80", "database: port 3306"). Then, the vulnerabilities existing in the nodes are matched according to the vulnerability database (such as the Web server having a CVE-2023-XXX vulnerability) to generate the initial edge relationship (such as "attacker → Web server (CVE-2023-XXX)").
[0069] The dynamic graph is expanded through real-time logs and attack history learning; when a new attack attempt is detected (such as "Terminal A successfully logs into Terminal B using a weak RDP password"), an edge "Terminal A → Terminal B (weak RDP password)" is automatically added; combined with historical attack chains (such as the lateral movement path "Web server → database"), the weight of frequently occurring paths is increased.
[0070] The hybrid graph is constructed by fusing static and dynamic graphs to form the final graph structure used for vulnerability assessment. Its fusion logic is as follows: based on the fixed architecture defined in the static graph, such as physical connections of assets and associations of core nodes, real-time updated content from the dynamic graph is overlaid. For example, the static graph defines the communication link between the server and the database, while the dynamic graph adjusts the connection weights based on the recent attack frequency (e.g., if there is an increase in recent SQL injection attacks, the weight of the "Web server → database" edge is increased).
[0071] In this invention, the attack path graph is based on a static graph, with a dynamic graph enabling real-time updates, and a hybrid graph forming the core structure, thus possessing dynamic update capabilities. When new log information is generated (such as the detection of new attack attempts or changes in attack frequency) or the topology changes (such as the addition or removal of devices or connection adjustments), the attack path graph is automatically updated. The specific method is as follows:
[0072] First, new attack edges are added to the dynamic graph, and the attack path weights are updated and adjusted based on attack frequency and threat intelligence. Then, based on the asset physical connections and core node associations defined in the static graph, the dynamically updated content is integrated to form a hybrid graph. During the update process, the basic cost calculation and multi-factor correction of edge weights (a part of the attack path weights) are performed simultaneously. Closed-loop attack paths are identified through strong connectivity component detection and risk values are merged. Low-weight paths are filtered out using dual thresholds, and high-risk key nodes are marked using both the scope of influence and the number of paths.
[0073] Through the above-mentioned dynamic updates throughout the entire process, the attack path map is ensured to not only reflect the real-time security situation but also focus on high-risk paths and core nodes, thus guaranteeing the timeliness, accuracy, and comprehensiveness of the assessment.
[0074] During the update process, the edge weights of the attack path graph are obtained using a combination of basic cost calculation and multi-factor weight correction, taking into account both subjective attributes and actual risks.
[0075] The base cost, based on attack cost, vulnerability complexity, and network topology cost, is calculated using the following formula:
[0076] ;
[0077] in, and Represents the nodes in the graph. Represents a node and The basic cost between This represents the severity score of the vulnerability corresponding to node u. For nodes and Inter-network hop count or link access cost (i.e., network topology cost). As an adjustment factor, it balances the weights of topology cost and vulnerability impact.
[0078] The multi-factor weight correction is obtained by using the acquired basic cost as the basic weight and further optimizing it through a multi-factor model, and is expressed as follows;
[0079] ;
[0080] in, Based on the cost, For the first Each factor weight, For the first One factor, This represents the total number of factors. For example, attack complexity (such as CVSS attack complexity score) has a weight of 40%, vulnerability exploitation probability (refer to vulnerability exploitation success rate in threat intelligence) has a weight of 30%, and the historical frequency of path occurrence has a weight of 30%, ultimately forming a side weight value that combines subjective attributes with actual attack trends.
[0081] During the update process, directed graph strongly connected component (SCC) detection technology is used to perform loop detection on the constructed attack path graph; the specific method is as follows:
[0082] Asset nodes (such as servers A / B) and service ports are mapped as graph nodes, and attack paths (such as vulnerability exploitation and weak password logins) are treated as directed edges. Existing SCC detection algorithms are used to identify strongly connected components (such as {A,B}) that can reach any two nodes, classifying them as closed-loop attack paths. After detection, loops are marked, and the risk of nodes within a loop is merged with the edge weights (taking the maximum or cumulative value). Duplicate calculations are removed, and low-risk loops are pruned to ensure evaluation efficiency and accuracy.
[0083] During the update process, path pruning can be performed on the constructed attack path graph by using a dual threshold of probability and comprehensive weights based on the edge weights of the attack path graph; the specific method is as follows:
[0084] First, the edge weights of each path are extracted. Paths with a utilization probability of less than 10% or a comprehensive weight lower than a preset threshold (such as 0.1) are defined as low-value paths. The entire graph is then traversed using a graph traversal algorithm (such as DFS / BFS) to automatically remove paths that meet the low-value criteria and associated redundant nodes, reducing unnecessary computation and ensuring that subsequent analysis focuses on high-risk paths, thus improving evaluation efficiency.
[0085] In this invention, critical path points can be determined from the constructed attack path map by linking two indicators: impact range quantification and intrusion path counting. The specific method is as follows:
[0086] First, the business impact scope of nodes is marked based on the asset list (e.g., nodes associated with core databases and multiple business systems are marked as high impact). Then, the number of intrusion paths for each node is counted through the attack path graph. When a node meets the criteria of "impact scope covering core business + number of intrusion paths ≥ 3", it is automatically marked as a high-risk critical node. At the same time, the judgment weight of cross-domain connection nodes (such as middleware and gateways) is strengthened in combination with the asset topology location to ensure accurate positioning of core risk hubs.
[0087] S4: Based on the asset node attributes, attack behavior characteristics, external threat information and business scenario constraints in the attack path graph, vulnerability factor analysis is performed, and quantitative modeling is carried out according to standardized transformation rules and weight calibration logic to obtain the vulnerability factor vector of each asset node or event sample.
[0088] Event samples are specific event records related to attack behaviors and security anomalies extracted from multi-source heterogeneous data. They contain clear attack characteristics and time attributes. Examples include abnormal access events blocked by firewalls, intrusion attempt alerts captured by IDS / IPS, and abnormal terminal behavior recorded by EDR.
[0089] In this invention, a multidimensional vulnerability factor matrix is constructed based on the asset node attributes, attack behavior characteristics, and external threat information in the attack path graph, wherein each asset node or event sample has the following characteristic dimensions:
[0090] CVSS score represents the severity score of a vulnerability's public disclosure, directly reflecting the level of harm caused by the vulnerability itself;
[0091] The probability indicates the degree to which the attack code is available, reflecting the feasibility of carrying out the attack;
[0092] Attack frequency indicates how frequently this type of attack has occurred in the recent period, reflecting the attack's popularity.
[0093] Exposure level indicates whether an asset is exposed to the public network and whether it has perimeter protection;
[0094] Functional importance indicates the position of a node in the business system;
[0095] Topological location indicates the number of hops or topological relationship between a node and the core asset, reflecting the potential scope of risk transmission;
[0096] Historical data is used to indicate whether an attack has occurred and whether any attack behavior characteristics remain, and this is integrated into the correlation with external threat intelligence.
[0097] Among the aforementioned feature dimensions, CVSS score, exposure level, functional importance, and topology location belong to asset node attributes; exploitability, attack frequency, and historical exploitation traces belong to attack behavior characteristics; historical exploitation traces belong to external threat information; and functional importance and topology location belong to business scenario constraints.
[0098] In this embodiment, the key vulnerability factors of each asset node or path are analyzed in depth by combining the feature dimensions of asset nodes or event samples.
[0099] Vulnerability severity (V) uses CVSS scoring or vendor vulnerability rating to intuitively reflect the degree of harm caused by the vulnerability, corresponding to the CVSS score in the feature dimension;
[0100] Attack frequency (T) is the number of attack events related to this node per unit of time, corresponding to the attack frequency in the feature dimension.
[0101] The difficulty (D) of exploiting this node is considered to assess the complexity of the attack, corresponding to the exploitability in the feature dimension.
[0102] Asset Importance (A) is scored based on the criticality of an asset in the business system, clarifying the asset value and corresponding to the functional importance in the feature dimension;
[0103] Threat level (W) combines external indicators of threat intelligence, introducing an external threat dimension, corresponding to historical exploitation traces in the feature dimension;
[0104] Access Exposure (E) assesses the probability that an asset is exposed to the external network or high-risk ports, determines the exposure risk faced by the asset, and corresponds to the exposure level in the feature dimension.
[0105] In obtaining the vulnerability factor vector of a node, it is necessary to use a standardization transformation rule to process each factor according to... The qualitative indicators are quantified sequentially and converted into standardized values of 0-1 (e.g., 0.9 for CVSS9.0 and 0.8 for high exposure level). This results in a factor vector for each asset node or event sample (e.g., [0.9, 0.8, 0.7, 0.9, 0.6, 0.8]). The standardized vectors can be directly input into the subsequently constructed vulnerability risk scoring model to make vulnerability computable.
[0106] The weights of the aforementioned key vulnerability factors can be determined according to actual application needs. For example, reasonable weights can be set based on expert experience, leveraging experts' deep understanding of cybersecurity and industry expertise; alternatively, they can be automatically adjusted using machine learning methods based on historical attack event samples to make the weights more closely match actual attack scenarios. The constructed vulnerability matrix is based on... It is in functional form; where, Indicates the severity of the vulnerability. Indicates the frequency of attacks. express, Indicates asset importance. Indicates the threat level. This represents the access exposure level. The functional form of the vulnerability matrix can be determined according to the actual application requirements. For example, the linear weighted model is simple and intuitive, while logistic regression, decision tree, random forest, or neural network models can handle more complex relationships and achieve accurate vulnerability quantification.
[0107] S5: Construct a rule-based weighted scoring model or vulnerability risk scoring model, and score the vulnerability of each asset node or event sample based on the vulnerability factor vector of each asset node or event sample.
[0108] In this invention, the following two different scoring methods can be set:
[0109] 1. Rule-based weighted scoring model:
[0110] ;
[0111] in, For the first Asset Nodes Vulnerability scores for event samples, For the first Asset Nodes or the first event sample A vulnerability factor, For the first The weights of each vulnerability factor are determined, and these weights can be automatically generated through expert experience or algorithms such as information gain. The score distribution range (0-1) is divided into low risk, medium risk, and high risk. This represents the total number of vulnerability factors.
[0112] 2. A vulnerability risk scoring model based on a neural network model;
[0113] The vulnerability risk scoring model can use a multilayer perceptron (MLP) model or other neural network models to construct a three-level network structure consisting of an input layer (vulnerability factor vector), a hidden layer (feature nonlinear interaction), and an output layer (normalized risk score). At the same time, it adopts a supervised learning method to train based on historical attack event samples and threat intelligence correlation data, and learns online to adapt to new threats, continuously iterating to improve the scoring accuracy.
[0114] The scoring function satisfies the following form: ;in, The vulnerability factor input vector, Represents an n-dimensional vector. The normalized risk score is used to classify asset vulnerability levels and formulate response strategies.
[0115] The two methods are complementary. Regardless of which method is used, the system can calculate the vulnerability score for each asset node or event sample for subsequent sorting and identification.
[0116] S6: Based on the vulnerability score of each asset node or event sample obtained, identify high-risk nodes and classify risk levels, and output vulnerability assessment results;
[0117] Using the vulnerability score of each asset node or event sample obtained in step S5, and comparing it with the attack path heat assessment results and the preset risk threshold, each asset node or event sample is divided into three risk levels: Critical, Warning, and Normal.
[0118] In this embodiment, the attack path heat is calculated by superimposing the vulnerability scores of each node in the path with the edge weights. The attack path heat function is:
[0119] ;
[0120] in, Indicates the attack path. Indicates the attack path The popularity Indicates the first in the path 1 node Represents a node Vulnerability score, Adjacent nodes and The attack edge weights between them; based on the obtained attack path popularity, the potential intrusion channels in the system can be prioritized and marked according to the path popularity, so as to identify which paths are the most dangerous and need to be defended first.
[0121] The specific process is as follows:
[0122] First, all nodes are sorted in descending order of their overall score, which is:
[0123]
[0124] in, Node vulnerability is scored, with a fusion weight of 0.5. The attack path heat normalization value is standardized to the 0-1 range using the min-max method:
[0125]
[0126] in, Heatmap for all attack paths The maximum value in, Heatmap for all attack paths The minimum value in.
[0127] Then, business weights are introduced for weighted adjustment (assigned according to asset business level: core assets 1.2-1.5, important assets 1.0-1.2, peripheral assets 0.7-0.9); subsequently, Dijkstra's algorithm is used to find the shortest attack path with the minimum sum of edge weights, or BFS algorithm is used to find the most vulnerable attack path with the fewest nodes. Based on the attack path graph, a vulnerability distribution map (node size maps to score, edge color maps to weight) and a risk heatmap are drawn (regional average score 0.8-1.0 red, 0.5-0.8 yellow, below 0.5 green), and critical paths, intersections, and high-intensity attack channels (intensity) are marked. Top 10%); finally, high-risk points (overall score) For vulnerabilities ≥0.8, provide a label description including the affected vulnerability, the source of the attack, and possible intrusion paths.
[0128] High-risk nodes often face extremely high risks of being attacked, and once breached, they may cause serious consequences and need to be repaired immediately; medium-risk nodes are controllable risks and need to be assessed and reinforced, and their risk situation needs to be analyzed in depth to formulate reasonable reinforcement strategies; low-risk nodes do not require immediate intervention, but they still need to be monitored continuously.
[0129] Finally, the identified high-risk nodes and their corresponding risk levels are used as the final vulnerability assessment results and output.
[0130] This invention also supports periodic automatic scoring and trend analysis, generating historical comparison charts and vulnerability evolution curves. Through historical comparison, it is possible to clearly see the changing trend of risks, whether they are rising, falling, or remaining stable; the vulnerability evolution curve shows the trajectory of risk development over time, helping operations and maintenance personnel to predict risks in advance and adjust protection strategies in a timely manner.
[0131] S7: Based on node risk scores and attack path coverage, provide visualization and generate strategy suggestions;
[0132] In this invention, the following visual content can be output through a web interface: vulnerability distribution map, attack path map and key node display, risk level report (supports PDF export), etc.
[0133] In this invention, based on node risk scores and attack path coverage, the following strategy recommendations can be output: close high-risk ports, patch critical vulnerabilities, add access control policies, and adjust intrusion prevention rules; and automatic response actions such as traffic isolation, asset isolation, and IP blocking can be issued in conjunction with API or SOAR platforms.
[0134] Considering the dynamic nature of the network environment, this invention also supports continuous updates and model iterations, as detailed below:
[0135] Regularly recollect data and rebuild the model, dynamically detect new assets and policy changes, use online learning methods to adapt to new threats, connect with threat intelligence sources, identify new attack methods in real time, and ensure that the assessment system has the ability to continuously evolve and adapt to complex network environments.
[0136] By combining the identified vulnerable nodes and attack paths, this invention comprehensively generates targeted strategy suggestions and coordinates responses:
[0137] First, optimize security policies, such as closing high-risk ports and adjusting ACL rules to strengthen access control, thereby reducing the risk of attack exposure at the network boundary and permission level.
[0138] Secondly, we will prioritize vulnerability patches and determine the order of patch implementation based on factors such as the severity and scope of impact of the vulnerabilities, so as to fix known vulnerabilities from the root cause.
[0139] Subsequently, the anomaly detection rules were strengthened to enhance the system's ability to identify covert attack behaviors and new intrusion patterns, enabling early detection and early warning of risks. When an intrusion incident occurs, the preset intrusion response process is automatically invoked to clarify the response steps and notify the relevant responsible persons to handle the matter, ensuring that responsibility is assigned to specific individuals and that a rapid response is achieved.
[0140] Building upon this foundation, the present invention also integrates deeply with the SOAR platform to trigger an automated response process. When a specific high-risk event is identified, it automatically blocks malicious IPs to disrupt the attack chain and enables asset isolation or traffic isolation strategies to prevent the spread of risks. Ultimately, it achieves efficient integration of the entire process from risk identification and assessment to response and handling, significantly improving the automation and intelligence level of network security protection.
[0141] This invention also supports a periodic assessment mechanism, which periodically recalculates asset risk scores, constructs risk trend curves by combining historical data, and uses sliding windows and time series analysis algorithms (such as ARIMA and LSTM) to identify abnormal fluctuations and issue early warnings.
[0142] This invention also supports multi-tenant or multi-business domain security assessment and isolation. The data, graph structures, and scoring models of different tenants or subsystems are independent of each other. It supports group assessment, domain authorization, and independent policy output on a unified platform, ensuring data security and clear business boundaries.
[0143] Those skilled in the art will also understand that the various illustrative logical blocks and steps listed in the embodiments of this application can be implemented by electronic hardware, computer software, or a combination of both. Whether such functionality is implemented through hardware or software depends on the specific application and the overall system design requirements. Those skilled in the art can implement the described functionality using various methods for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of this application.
[0144] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.
Claims
1. A vulnerability assessment method for a network security protection system, characterized in that: Includes the following steps: S1: Collect and preprocess multi-source heterogeneous data generated in a network security environment; S2: Generate log semantic vectors based on preprocessed multi-source heterogeneous data, and concatenate the semantic vectors with asset fields to form a complete event feature vector; S3: Based on network topology and historical attack chain information, an attack path graph is constructed to simulate the attack paths that attackers may take to reach critical target assets; S4: Based on the asset node attributes, attack behavior characteristics, external threat information and business scenario constraints in the attack path graph, vulnerability factor analysis is performed, and quantitative modeling is carried out according to standardized transformation rules and weight calibration logic to obtain the vulnerability factor vector of each asset node or event sample. S5: Construct a rule-based weighted scoring model or vulnerability risk scoring model, and score the vulnerability of each asset node or event sample based on the vulnerability factor vector of each asset node or event sample. S6: Based on the vulnerability score of each asset node or event sample obtained, identify high-risk nodes and classify risk levels, and output vulnerability assessment results.
2. The vulnerability assessment method according to claim 1, characterized in that: In step S1, the multi-source heterogeneous data includes network traffic data, security logs, configuration files, known vulnerability databases, threat intelligence databases, and business system behavior data; and the multi-source heterogeneous data is subjected to unified standardized preprocessing, including field standardization processing, noise filtering processing, log merging processing, and asset association processing.
3. The vulnerability assessment method according to claim 1, characterized in that: In step S3, the nodes in the attack path graph are asset components in the network. Service ports, protocol types, and security events are embedded in the attribute descriptions of the corresponding asset nodes as associated attributes or dynamic behavior identifiers of the asset components. The edges in the attack path graph represent the movement paths and vertical privilege escalation paths that the attacker can utilize. Edge weights reflect the reachability probability of a path or the size of the attack cost.
4. The vulnerability assessment method according to claim 1, characterized in that: In step S3, the attack path graph is based on a directed graph and consists of a static graph and a dynamic graph. The static graph is constructed based on the network topology graph and asset configuration file. A set of nodes is formed by a network scanning tool, and the initial edge relationship is generated by matching the vulnerabilities of the nodes according to the vulnerability database. The dynamic graph is expanded by learning from real-time logs and attack history. When a new attack attempt is detected, the corresponding edge is automatically added, and the path weight is adjusted by combining the historical attack chain. The static graph and the dynamic graph complement each other through infrastructure and dynamic updates, and are integrated into a hybrid graph.
5. The vulnerability assessment method according to claim 3, characterized in that: Edge weights are obtained by combining basic cost calculation and multi-factor weight correction. The basic cost is constructed based on attack cost, vulnerability complexity and network topology cost. The multi-factor weight correction is obtained by using the basic cost as the basic weight and further optimizing it based on a multi-factor model. The multi-factor model is constructed based on attack complexity, vulnerability exploitation probability and path historical occurrence frequency and corresponding weights.
6. The vulnerability assessment method according to claim 1, characterized in that: In step S4, vulnerability factors include vulnerability severity, attack frequency, exploitation difficulty, asset importance, threat level, and access exposure. The above vulnerability factors are quantified and converted into standardized values in sequence using standardized conversion rules, and finally the factor vector of each asset node or event sample is obtained.
7. The vulnerability assessment method according to claim 1, characterized in that: In step S5, the rule-based weighted scoring model is constructed based on each vulnerability factor of the asset node or event sample and the weight value of each vulnerability factor; the vulnerability risk scoring model can be constructed based on the multilayer perceptron model or other neural network models.
8. The vulnerability assessment method according to claim 1, characterized in that: In step S6, the vulnerability score of each asset node or event sample obtained in the previous step is used to generate a comprehensive score by combining the attack path heat assessment results. By comparing the comprehensive score with the preset risk threshold, each asset node or event sample is divided into different risk levels. The attack path heat is calculated by superimposing the vulnerability scores of each node in the path with the edge weights.
9. The vulnerability assessment method according to claim 8, characterized in that: In step S6, firstly, the comprehensive score of all nodes is calculated, and all nodes are sorted in descending order of comprehensive score; then, business weights are introduced for weighted adjustment; subsequently, the shortest attack path is found with the goal of minimizing the sum of edge weights or the most vulnerable attack path is found with the goal of minimizing the number of nodes, and a vulnerability distribution map and risk heat map are drawn based on the attack path graph, while marking critical paths, intersections, and high-frequency attack channels; then, high-risk points with comprehensive scores not less than a set score threshold are labeled and described, including the affected vulnerabilities, attack sources, and possible intrusion paths; finally, the identified high-risk nodes and their corresponding risk levels are used as the final vulnerability assessment results and output.
10. The vulnerability assessment method according to claim 1, characterized in that: It also includes step S7: based on the node risk score and attack path coverage, a visualization and strategy suggestion are generated.