Office terminal asset vulnerability analysis method and system based on clustering algorithm

Abstract

The present application relates to the field of data processing, more particularly, the present application relates to an office terminal asset vulnerability analysis method and system based on clustering algorithm, the method comprises: extracting the original asset vulnerability log of the office terminal, constructing a multi-dimensional feature system and converting it into a binary feature vector; calculate the causal relationship edge weight between any two features, and sum up the importance weight of each feature; calculate the weighted distance between terminals using the importance weight, divide the terminals into multiple clustering clusters using the clustering algorithm, calculate the Euclidean distance between each clustering cluster and the ideal safe state origin, and output the vulnerability level of each terminal according to the distance mapping. Through causal weighting and clustering analysis, the present application realizes dynamic and quantitative evaluation of terminal vulnerability, avoids dependence on static threshold, can accurately identify high-risk terminals, and improves security operation efficiency.

Description

Technical Field

[0001] This invention relates to the field of data processing. More specifically, this invention relates to a method and system for vulnerability analysis of office terminal assets based on clustering algorithms. Background Technology

[0002] With the deepening of digital transformation, the number of office terminals connected to the e-government network has been increasing year by year. These terminals face multiple security threats, including viruses, Trojans, ransomware, weak password attacks, and unauthorized external connections. Terminal vulnerability management has become a core challenge in security operations.

[0003] Existing vulnerability assessment methods for office terminals are mostly based on static rules, relying on manual experience to set fixed thresholds. However, in complex environments such as e-government networks, the security status of terminals changes dynamically with the threat landscape. Static threshold rules cannot adapt to this change, making it difficult for security operations personnel to accurately identify truly high-risk terminals that urgently need to be addressed from a large number of alerts, resulting in low remediation efficiency. Summary of the Invention

[0004] To address the technical problem that existing methods for assessing the vulnerability of office terminals are mostly based on static rules and rely on manual experience to set fixed thresholds, making it difficult to accurately identify truly high-risk terminals that urgently need to be addressed from a large number of alarms, this invention provides solutions in the following aspects.

[0005] In the first aspect, the vulnerability analysis method for office terminal assets based on clustering algorithms includes: Extract raw asset vulnerability log information from multiple office terminals, construct a multi-dimensional feature system covering network characteristics, system characteristics, virus characteristics, and user characteristics, and perform binary conversion on each feature of each terminal. The value is 1 when a risky behavior or state is matched, and 0 otherwise, a binary feature vector is obtained. Calculate the causal relationship edge weight between any two features, where the causal relationship edge weight represents the probability that the occurrence of one feature induces the occurrence of another feature, and sum the causal relationship edge weights of each feature to all other features as the importance weight of that feature; The weighted distance between terminals is calculated using the importance weights. A clustering algorithm is used to divide the terminals into multiple clusters. The Euclidean distance between each cluster and the origin of the ideal security state represented by the all-zero feature vector is then calculated. The vulnerability level of each terminal is output based on the Euclidean distance mapping.

[0006] Optionally, the calculation of the causal relationship weights between any two features includes: For any two distinct features, calculate the conditional probability that if one feature is 1, the other feature is also 1, as the first parameter; calculate the probability that the other feature is 1 in all terminals, as the second parameter; and use the ratio of the first parameter to the second parameter as the causal relationship weight between the two features.

[0007] Optionally, the calculation of the weighted distance between the terminals includes: For any two terminals, for each feature, the importance weight of that feature is multiplied by the value of the indicator function. The indicator function is 1 only if the two terminals have different values ​​for that feature, otherwise the indicator function is 0. The weighted distance is obtained by summing the products of the importance weights of all features and the indicator function and dividing by the total number of dimensions of the features.

[0008] Optionally, the clustering includes: The feature vectors of three terminals are randomly selected from all terminals as the initial cluster centers. The weighted distance between each terminal and the three cluster centers is calculated using the importance weights. Each terminal is assigned to the cluster to which the cluster center with the closest weighted distance belongs, forming three temporary clusters. The center point of each temporary cluster is recalculated. The iterative assignment and center point update steps are repeated until the clustering algorithm converges, resulting in three stable clusters.

[0009] Optionally, when repeating the iteration allocation and center point update steps, it is determined whether the Euclidean distance between the newly calculated center point and the center point of the previous round is greater than a preset distance threshold. If the center point change of any temporary cluster exceeds the distance threshold, all terminals are redistributed using the new center point to continue iteration. If the center point change of each temporary cluster is less than or equal to the distance threshold, or the preset maximum number of iterations is reached, it is determined that the clustering algorithm has converged.

[0010] Optionally, after obtaining the importance weights of each feature, the following also includes: For each terminal, all features are treated as nodes in a directed feature graph, and directed edges are established according to the causal relationship edge weights. The Louvain community detection algorithm is used to divide the directed feature graph into subgroups to obtain multiple feature subgroups. If the value of any original feature in a feature subgroup is 1, then the feature value of that feature subgroup is 1; otherwise, it is 0.

[0011] Optionally, the weighted distance between terminals is calculated using the importance weights. When the terminals are divided into three clusters using the K-means clustering algorithm, for any two feature subgroups of terminals, the Euclidean distance between the two feature subgroups is calculated. The Euclidean distance is then normalized by an exponential function to obtain the matching edge weight between the two feature subgroups. Using the feature subgroups of the two terminals as the two parts of the bipartite graph, and the matching edge weight as the edge weight, the Kuhn-Munkres algorithm is used to solve the problem and obtain the maximum matching degree between the two terminals. The reciprocal of the maximum matching degree is taken as the final distance between the two terminals. Three feature sub-clusters of terminals are randomly selected from all terminals as the initial cluster centers. The final distance is used to perform the assignment and iterative convergence steps to obtain three stable clusters.

[0012] Optionally, the cluster with the furthest Euclidean distance is classified as highly vulnerable, the cluster with the second furthest Euclidean distance is classified as moderately vulnerable, and the cluster with the closest Euclidean distance is classified as low vulnerable.

[0013] Secondly, an office terminal asset vulnerability analysis system based on clustering algorithm includes: a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the office terminal asset vulnerability analysis method based on clustering algorithm described in any one of the claims is implemented.

[0014] The present invention has the following beneficial effects: 1. This invention introduces importance weights based on causal relationships to quantify the probability of each feature triggering other features. These weights are then embedded into weighted distance calculation and cluster analysis, enabling the vulnerability assessment model to automatically adapt to the terminal risk distribution under different network environments. This method eliminates the need for manually setting risk thresholds, avoiding assessment distortions caused by human experience bias or environmental changes. It can dynamically and adaptively identify truly high-risk terminals requiring immediate attention from a large number of alarms, fundamentally solving the technical challenge of static rules being unable to cope with dynamic security situations.

[0015] 2. This invention uses the origin of the ideal security state represented by the all-zero feature vector as a benchmark. By calculating the Euclidean distance between each cluster and this origin, the clustering results are unsupervisedly mapped to three clearly separable vulnerability levels: high, medium, and low. This mapping method not only preserves the relative risk differences between terminals but also provides a directly implementable basis for graded rectification: high-vulnerability terminals are immediately blocked and forcibly repaired; medium-vulnerability terminals are subject to rectification within a specified period; and low-vulnerability terminals are incorporated into routine maintenance. Attached Figure Description

[0016] Figure 1 This is a flowchart of steps S1-S3 in the vulnerability analysis method for office terminal assets based on clustering algorithm according to an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0018] Example 1 Reference Figure 1 The vulnerability analysis method for office terminal assets based on clustering algorithms includes steps S1-S3, as follows: S1: Preprocess the collected multi-source security logs to generate binary feature vectors for office terminals.

[0019] First, we extract the original asset vulnerability log information of all office terminals within the e-government network from multiple security detection systems, including firewalls, threat intelligence sources, endpoint security operation platforms, and traffic probes.

[0020] Secondly, a multi-dimensional feature system is constructed. This system covers four major categories: network features, system features, virus features, and user features. Typical examples of each type of feature are as follows: network features include whether high-risk ports such as port 3389 are open, and whether there are overseas IP access records within the past 3 days; system features include whether there are high-risk system vulnerabilities, and whether there are weak passwords for startup; virus features include whether there are malicious domain name network access records within the past 3 days, and whether the virus database is updated to the latest version; user features include whether remote control software is installed, and whether it is a public computer.

[0021] Finally, the above multidimensional features are converted into binary features: for each terminal and each feature, if the terminal matches the risk behavior or state described by the feature, the feature is set to 1; if it does not match, the feature is set to 0.

[0022] Through the above operations, each office terminal is represented as a multi-dimensional binary feature vector, which transforms the originally isolated and unstructured multi-source security logs into a standardized data format with consistent structure and numerical representation.

[0023] S2: Perform causal calculations on the binary vector to obtain the importance weight of each feature.

[0024] Given that different features contribute differently to terminal vulnerability and that there are causal relationships between features (e.g., weak passwords may lead to brute-force attacks), directly using the raw features for analysis would treat all features equally, which would significantly deviate from the true logic of risk assessment. Therefore, it is necessary to pre-quantify the importance of each feature relative to other features, i.e., to calculate the importance weight of each feature.

[0025] First, for any two distinct features and characteristics Calculate when features Under the condition that the value is 1, the feature A conditional probability of 1 also appears, which is used as the first parameter; the feature is calculated. The probability of taking a value of 1 across all terminals is used as the second parameter; the ratio of the first parameter to the second parameter is used as the feature. With features The causal relationship between the two sides reflects the characteristics. Inducing characteristics when they appear The higher the probability of occurrence, the stronger the feature. Features The stronger the causal induction effect, the better. Additionally, to prevent division by zero errors when the denominator (the second parameter) is 0, the second parameter can be divided by a very small positive integer, such as... Add them together.

[0026] Secondly, for each feature The aforementioned causal boundary weights are used as causes to point to all other features. Summing the edge weights yields this feature. The importance weight; the larger the importance weight, the stronger the feature. The more critical a vulnerability is in the chain of transmission, the greater its contribution to the overall risk at the terminal.

[0027] Based on the above operations, each feature is assigned an importance weight.

[0028] S3: Cluster based on binary vectors and importance weights for each feature, and output a predefined vulnerability level for terminal mapping.

[0029] Following steps S1 and S2, we have obtained the binary feature vector for each terminal and the importance weight of each feature. Grouping these terminals according to their vulnerability characteristics allows us to discover their relative risk distribution within the overall network and provides clear remediation priorities for security operations.

[0030] First, the K-means clustering algorithm is used, with a preset number of clusters K of 3, corresponding to three risk levels: high vulnerability (urgently requiring rectification), medium vulnerability (urgently requiring rectification), and low vulnerability (requiring rectification). Feature vectors from three terminals are randomly selected from all terminals as initial cluster centers, each of which is a multi-dimensional real-valued vector.

[0031] For any two terminals and terminal Using the importance weights obtained from S2 above, the weighted distance between the two terminals is calculated, which can be expressed as: In the formula, For the terminal and terminal The weighted distance, The total number of dimensions of the features. Features Importance weights For the terminal feature The real value of , which takes the value 0 or 1. For the terminal feature The real value of , which takes the value 0 or 1. For indicator functions, only if the two terminals are in the characteristic When the values ​​of the above are different, the features Only contribute distance if it is not used; otherwise, it does not contribute distance.

[0032] Then, the weighted distance between each terminal and the three cluster centers defined above is calculated. Each terminal is assigned to the cluster to which the cluster center with the closest weighted distance belongs, forming three temporary clusters. The center point of each temporary cluster is recalculated, which is the mean vector of all terminals in each feature dimension within the temporary cluster.

[0033] Next, determine whether the newly calculated center point has changed from the initial center point: For each temporary cluster, if the position of the center point of any temporary cluster changes significantly, that is, if the Euclidean distance between the center point of the current round of the temporary cluster and the center point of the previous round of the cluster is greater than a preset distance threshold, the following condition is met: If the center point of the temporary cluster is not yet stable, the allocation step needs to be returned to, and all terminals should be redistributed using the new center point to start a new round of iteration.

[0034] If the Euclidean distance between the current cluster center and the previous cluster center of each temporary cluster is less than or equal to a preset distance threshold, or if the preset maximum number of iterations (e.g., 100) is reached, the clustering algorithm is considered to have converged, and the iteration is terminated. After convergence, three stable clusters are obtained.

[0035] Finally, the zero feature vector with all features set to 0 is defined as the origin of the ideal safe state, that is, a terminal that does not have any risk features at all. The Euclidean distance between the three stable clusters obtained and the origin of the ideal safe state is calculated. The cluster with the farthest Euclidean distance is judged as highly vulnerable, and the terminals inside it exhibit the most risk features. The cluster with the second farthest Euclidean distance is judged as moderately vulnerable, and the cluster with the closest Euclidean distance is judged as low vulnerable.

[0036] Through this step, weighted K-Means clustering was completed based on feature importance weights, and the three unlabeled clusters were mapped to three levels of vulnerability: high vulnerability, medium vulnerability, and low vulnerability, respectively, so that each terminal obtained a clear vulnerability classification label.

[0037] In addition, based on the above vulnerability levels, the following tiered response actions can be taken: For terminals identified as highly vulnerable, the rectification priority is the highest, and their network access is immediately blocked and forced repair is carried out; for terminals identified as moderately vulnerable, the rectification priority is the next highest, and a rectification plan with a time limit is formulated and the repair is completed within the specified time; for terminals identified as lowly vulnerable, they are included in the routine operation and maintenance process and routine maintenance is carried out.

[0038] Example 2 This embodiment, based on Embodiment 1, provides a more refined method for calculating inter-terminal distance. This embodiment fully considers the interactions between features, effectively eliminating spurious correlations in high-dimensional data and further improving classification accuracy.

[0039] This embodiment is basically the same as step 1 of embodiment 1, the only difference being the specific implementation of steps 2 and 3. The following is a detailed description of steps 2 and 3 in this embodiment.

[0040] S2: Construct a directed feature map for the binary feature vector of each terminal and divide it into subgroups to obtain multiple feature subgroups.

[0041] While S2 of Embodiment 1 calculates feature importance, each feature is still treated as an independent unit, failing to characterize the risk pattern formed by the combination of multiple features. In cybersecurity scenarios, the vulnerability of a single feature is often insufficient to pose a fatal threat, while the interaction of multiple features can amplify the risk. Therefore, it is necessary to aggregate features with strong causal relationships into feature subgroups to reflect the overall risk of the synergistic effect of multiple features.

[0042] First, as in S2 of Example 1, calculate the causal relationship edge weight between any two different features.

[0043] Secondly, for each terminal, all features across all dimensions are treated as nodes in a directed feature graph. For any two nodes in the directed feature graph... and nodes If the calculated causal relationship edge weight is greater than 0, then a path is established between these two nodes by nodes. Pointing to node A directed edge, the weight of the edge is equal to the weight of the node. and nodes The causal relationship between the two sides.

[0044] Then, the Louvain community detection algorithm is used to subgroup the directed feature graph, resulting in multiple feature subgroups. The core idea of ​​this algorithm is to maximize modularity, making the sum of the causal edge weights within a subgroup as large as possible, and the sum of the causal edge weights between subgroups as small as possible. Its physical meaning is: features within each feature subgroup have strong causal relationships, collectively forming a complete risk-inducing unit; feature relationships between different subgroups are relatively weak.

[0045] Finally, if the real value of any original feature within a feature subgroup is 1, then the feature value of that feature subgroup is 1; otherwise, it is 0.

[0046] Through the above operations, the multidimensional features of each terminal are aggregated into several feature subgroups, each representing a combination of risk features with a strong causal relationship. Furthermore, a set of feature subgroups can be defined corresponding to each terminal.

[0047] S3: Perform weighted clustering based on feature subgroup matching and output a predefined vulnerability level for terminal mapping.

[0048] First, for any two feature subgroups of terminals, the Euclidean distance between the two feature subgroups is calculated using the weighted distance formula for calculating the two terminals in S2 of Example 1. Then, the calculated Euclidean distance is inversely represented and normalized by an exponential function to obtain the matching edge weight between the two feature subgroups.

[0049] Next, the feature subgroups of these two terminals are the two parts of the bipartite graph. Using the matching edge weights between the feature subgroups as edge weights, the Kuhn-Munkres algorithm is used to solve for the maximum weight perfect matching of the bipartite graph, and the maximum matching degree of the two terminals is obtained. The larger the maximum matching degree, the more similar the vulnerability features of the two terminals are. Therefore, the reciprocal of the maximum matching degree is used as the final distance between the two terminals.

[0050] Then, the K-Means clustering algorithm is used, with a preset number of clusters K=3. Three feature subsets from all terminals are randomly selected as initial cluster centers. The distance based on feature subset matching is used instead of traditional Euclidean distance to perform sample allocation and iterative convergence steps.

[0051] For each cluster, calculate the Euclidean distance between the cluster's current round centroid and its previous round centroid. If there exists any cluster whose Euclidean distance between its current round centroid and its previous round centroid is greater than a preset distance threshold, then... If the distance between each cluster is less than or equal to the preset distance threshold, or if the preset maximum number of iterations, such as 100, is reached, then the algorithm converges, and three stable clusters are obtained.

[0052] The origin of the ideal safe state is defined as a zero feature vector where all features are zero, i.e., a terminal that has no risk features at all. The Euclidean distance between the three stable clusters and the origin of the ideal safe state is calculated. The cluster with the farthest Euclidean distance is judged as highly vulnerable, and the terminals inside it exhibit the most risk features. The cluster with the second farthest Euclidean distance is judged as moderately vulnerable, and the cluster with the closest Euclidean distance is judged as low vulnerable.

[0053] Through this step, the terminal distance calculation method based on feature subgroup matching completes the weighted K-Means clustering, and maps the three unlabeled clusters to three levels of vulnerability: high vulnerability, medium vulnerability, and low vulnerability, respectively, so that each terminal obtains a clear vulnerability classification label.

[0054] In addition, based on the above vulnerability levels, the following tiered response actions can be taken: For terminals identified as highly vulnerable, the rectification priority is the highest, and their network access is immediately blocked and forced repair is carried out; for terminals identified as moderately vulnerable, the rectification priority is the next highest, and a rectification plan with a time limit is formulated and the repair is completed within the specified time; for terminals identified as lowly vulnerable, they are included in the routine operation and maintenance process and routine maintenance is carried out.

[0055] This invention also provides a vulnerability analysis system for office terminal assets based on a clustering algorithm. The system includes a processor and a memory, the memory storing computer program instructions. When the processor executes the computer program instructions, it implements the vulnerability analysis method for office terminal assets based on a clustering algorithm according to the first aspect of this invention.

[0056] The system also includes other components well known to those skilled in the art, such as communication buses and communication interfaces, the settings and functions of which are known in the art and will not be described in detail here.

[0057] It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept, and these all fall within the scope of protection of this invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A vulnerability analysis method for office terminal assets based on clustering algorithms, characterized in that, include: Extract raw asset vulnerability log information from multiple office terminals, construct a multi-dimensional feature system covering network characteristics, system characteristics, virus characteristics, and user characteristics, and perform binary conversion on each feature of each terminal. The value is 1 when a risky behavior or state is matched, and 0 otherwise, a binary feature vector is obtained. For any two distinct features, calculate the conditional probability that if one feature is 1, the other feature is also 1, as the first parameter; calculate the probability that the other feature is 1 in all terminals, as the second parameter; use the ratio of the first parameter to the second parameter as the causal relationship weight between the two features; the causal relationship weight represents the probability that the appearance of one feature induces the appearance of another feature, and sum the causal relationship weights of each feature to all other features as the importance weight of that feature; The weighted distance between terminals is calculated using the importance weights. A clustering algorithm is used to divide the terminals into multiple clusters. The Euclidean distance between each cluster and the origin of the ideal security state represented by the all-zero feature vector is then calculated. The vulnerability level of each terminal is output based on the Euclidean distance mapping.

2. The vulnerability analysis method for office terminal assets based on clustering algorithm according to claim 1, characterized in that, The calculation of the weighted distance between the terminals includes: For any two terminals, for each feature, the importance weight of that feature is multiplied by the value of the indicator function. The indicator function is 1 only if the two terminals have different values ​​for that feature, otherwise the indicator function is 0. The weighted distance is obtained by summing the products of the importance weights of all features and the indicator function and dividing by the total number of dimensions of the features.

3. The vulnerability analysis method for office terminal assets based on clustering algorithm according to claim 1, characterized in that, The clustering includes: The feature vectors of three terminals are randomly selected from all terminals as initial cluster centers. The weighted distance between each terminal and each cluster center is calculated using the importance weight. Each terminal is assigned to the cluster to which the cluster center with the closest weighted distance belongs, forming three temporary clusters. The center point of each temporary cluster is recalculated. The iterative assignment and center point update steps are repeated until the clustering algorithm converges, resulting in three stable clusters.

4. The vulnerability analysis method for office terminal assets based on clustering algorithm according to claim 3, characterized in that, When iterating through the allocation and center point update steps, it is determined whether the Euclidean distance between the newly calculated center point and the center point of the previous round is greater than a preset distance threshold. If the change of the center point of any temporary cluster exceeds the distance threshold, all terminals are redistributed using the new center point to continue the iteration. If the change of the center point of each temporary cluster is less than or equal to the distance threshold, or the preset maximum number of iterations is reached, it is determined that the clustering algorithm has converged.

5. The vulnerability analysis method for office terminal assets based on clustering algorithm according to claim 1, characterized in that, After obtaining the importance weights for each feature, the following is also included: For each terminal, all features are treated as nodes in a directed feature graph, and directed edges are established according to the causal relationship edge weights. The Louvain community detection algorithm is used to divide the directed feature graph into subgroups to obtain multiple feature subgroups. If the value of any original feature in a feature subgroup is 1, then the feature value of that feature subgroup is 1; otherwise, it is 0.

6. The vulnerability analysis method for office terminal assets based on clustering algorithm according to claim 5, characterized in that, The weighted distance between terminals is calculated using the importance weights. When the terminals are divided into three clusters using the K-means clustering algorithm, for any two feature subgroups of terminals, the Euclidean distance between the two feature subgroups is calculated. The Euclidean distance is then normalized by an exponential function to obtain the matching edge weight between the two feature subgroups. Using the feature subgroups of the two terminals as the two parts of the bipartite graph, and the matching edge weight as the edge weight, the Kuhn-Munkres algorithm is used to solve the problem and obtain the maximum matching degree between the two terminals. The reciprocal of the maximum matching degree is taken as the final distance between the two terminals. Three feature sub-clusters of terminals are randomly selected from all terminals as the initial cluster centers. The final distance is used to perform the assignment and iterative convergence steps to obtain three stable clusters.

7. The vulnerability analysis method for office terminal assets based on clustering algorithm according to claim 1 or 5, characterized in that, The cluster with the furthest Euclidean distance is classified as highly vulnerable, the cluster with the second furthest Euclidean distance is classified as moderately vulnerable, and the cluster with the closest Euclidean distance is classified as low vulnerable.

8. A vulnerability analysis system for office terminal assets based on clustering algorithms, characterized in that: include: A processor and a memory, wherein the memory stores computer program instructions that, when executed by the processor, implement the vulnerability analysis method for office terminal assets based on clustering algorithms according to any one of claims 1-7.

Images