Intelligent detection method and system for network security level protection evaluation

Abstract

The application discloses an intelligent detection method and system for network security level protection evaluation, wherein the intelligent detection method normalizes device configuration, asset account, network topology, vulnerability scanning result, log and management file into evidence records with asset identification, field path, time and credibility; according to evaluation item rule records, the intelligent detection method generates constrained evidence pairs step by step through evidence type, asset range, field path and time window, executes field level conflict detection, and generates evidence gap vectors according to necessary evidence sets; the intelligent detection method controls compliance conclusion calculation by using conflict state and gap state, and forms detection results which can be reversely positioned to original evidence. The system can also position affected evaluation items according to change events and execute local recalculation, and is suitable for network security level protection evaluation and continuous compliance monitoring.

Description

Technical Field

[0001] This invention relates to the field of network security data detection and processing methods, specifically to an intelligent detection method and system for network security level protection assessment. Background Technology

[0002] Cybersecurity level protection assessment involves examining network devices, security devices, servers, business applications, and management processes within the information system under test. The sources of assessment data vary significantly: asset ledgers and network topology describe system boundaries; device configurations and logs reflect actual operational status; vulnerability scan results reveal security flaws; and policy documents, interview records, and rectification records illustrate management requirements and their implementation. Different sources typically use different field names, enumeration values, time formats, and asset identifiers, making direct comparison impossible.

[0003] For example, patent document CN110598198A discloses a method and tool for optimizing the review of network security level protection assessment reports. It constructs a review model based on the assessment report template and configures review rules to perform automated checks on the generated assessment reports. Similarly, existing auxiliary assessment methods and systems often use assessment items or report entries as indexes to match collected materials or report content with standard clauses and preset rules, thereby generating assessment records, reports, or review results. This approach can reduce repetitive data entry and manual checks, but when the same security fact appears in multiple sources, the system often needs to perform full pairwise comparisons of all evidence under the assessment item; as the amount of evidence increases, the number of combinations to be compared grows rapidly. Furthermore, existing systems typically treat "whether the evidence is contradictory" and "whether the evidence is sufficient to support the conclusion" as two independent prompts, which may still calculate and output a definitive conclusion when necessary evidence is missing, coverage is insufficient, or high-severity conflicts remain unresolved.

[0004] In addition, similar problems exist in the ongoing monitoring following the issuance of existing cybersecurity level protection assessment reports. After changes in asset, configuration, or vulnerability status, some systems re-execute all assessment items, with the computational load related to the total number of assessment items and the total amount of evidence; other systems only record the change event as an alarm, failing to pinpoint the specific assessment items affected by the change and the original chain of evidence.

[0005] In summary, the existing network security level protection assessment methods still have the following shortcomings: It is difficult to compare assessment evidence from different sources under a unified field path, and it is difficult to generate reliable conclusions when evidence is insufficient or conflicts have not been resolved.

[0006] In view of this, the applicant considers addressing the shortcomings of the aforementioned prior art. Summary of the Invention

[0007] In view of the shortcomings of the prior art, the technical problem to be solved by the present invention is: How can we provide an intelligent detection method and system for network security level protection assessment, enabling assessment evidence from different sources to be compared under a unified field path in a constrained manner, and preventing the system from generating a definitive conclusion without evidence support when evidence is insufficient or conflicts have not been resolved?

[0008] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A smart detection method for network security level protection assessment, characterized by comprising the following steps: The first step is to normalize the multi-source evaluation evidence of the information system under test into evidence records that include asset identification, evidence type, field path, standardized field value and time attribute; The second step is to read the evaluation item rule records, which include constraints on evidence type, scope of application, field path, time window, conflict rules, and sufficiency of evidence. The third step involves filtering evidence records step by step according to the aforementioned evidence type constraints, scope of application constraints, field path constraints, and time window constraints, and generating constrained evidence pairs based on the connection conditions of the conflict rules. Step 4: Perform field-level comparison on the normalized field values ​​of the constrained evidence pair to generate conflicting tuples; Step 5: Generate an evidence gap vector based on the aforementioned evidence sufficiency rules; Step 6: Determine the evidence quality status of the evaluation item based on the conflict tuple and the evidence gap vector, and control the generation of compliance conclusions accordingly. Associate the compliance conclusions with the corresponding evidence records to form traceable detection results.

[0009] Furthermore, the evaluation item rule record includes an evaluation item identifier, a set of applicable object types, a set of applicable levels, a set of necessary evidence types, a set of supplementary evidence types, a set of rebuttal evidence types, a minimum number of evidence, a coverage threshold, a validity window, a credibility threshold, a set of field paths, a set of conflict rules, a set of evidence sufficiency rules, a set of conclusion rules, and evaluation item weights; the evaluation item rule records corresponding to different applicable standard versions have mutually independent version identifiers, effective times, and expiration times.

[0010] Furthermore, the evidence record also includes evidence identifier, system boundary identifier, source type, source identifier, original field value, unit, collection time, effective deadline, evidence hash, credibility, and verifiability identifier; the normalized field value is obtained through at least one of field name mapping, enumeration value mapping, unit conversion, Boolean value mapping, and time format conversion, and the same security configuration fact is mapped to the same normalized field path in different evidence sources.

[0011] Furthermore, generating the constrained evidence pairs includes: obtaining a first evidence set and a second evidence set from the evidence type index according to the first evidence type and the second evidence type defined by the conflict rules; retaining evidence combinations with the same corresponding values ​​of asset connection keys or overlapping applicable scopes using the asset identification index and the system boundary index; retaining evidence combinations with field paths satisfying the conflict rules using the field path index; and retaining evidence combinations with collection time differences not exceeding the time window constraint and valid at the evaluation time point using the time index, so as to form a set of constrained evidence pairs for field-level comparison to be performed.

[0012] Furthermore, when mapping evidence records to evaluation item rule records, a mapping score between evidence records and evaluation items is calculated. The mapping score is a weighted sum of evidence type matching component, asset range matching component, field path matching component, field value matching component, time validity component, and source credibility component, minus the duplicate evidence deduction component, and then limited to a range of zero to one. Each weighting coefficient is a non-negative number, and the sum of the weighting coefficients participating in the weighted sum is one.

[0013] Furthermore, the conflict rules include a conflict rule identifier, a first evidence type, a second evidence type, a first field path, a second field path, an asset connection key, a range connection key, a time window, a comparison operator, and a conflict severity; the comparison operator includes at least one of equality, inequality, range inclusion, set inclusion, implication, mutual exclusion, and time sequence; the conflict tuple includes an evaluation item identifier, a first evidence identifier, a second evidence identifier, a conflict type, a first field path, a second field path, a first normalized field value, a second normalized field value, a conflict rule identifier, an affected asset set, a conflict severity, and a disposal status.

[0014] Furthermore, the conflict score Cj for evaluation item j is calculated according to Cj = 1 - ∏k (1 - sk × tak × tbk × rk × uk), where sk is the conflict severity of the k-th conflict tuple, tak and tbk are the credibility of the corresponding two evidence records, rk is the proximate factor coefficient, and uk is the handling status coefficient; the values ​​of sk, tak, tbk, rk, and uk are all in the range of zero to one. When there is no conflict tuple for evaluation item j, Cj is set to zero.

[0015] Furthermore, generating the evidence gap vector includes: The number of valid pieces of evidence for each type of necessary evidence is counted according to the set of necessary evidence types. The number of assets with valid evidence is counted according to the asset set applicable to the assessment items, and the coverage rate is calculated. Identify at least one gap state among the following: missing necessary evidence types, insufficient number of valid evidence, expired evidence, insufficient coverage, insufficient credibility, and unverifiable evidence; Write the gap status, corresponding evidence type, and corresponding asset set into the evidence gap vector.

[0016] Furthermore, the gap score Gsj for assessment item j is calculated according to Gsj = clip(p1×Missj+p2×Shortj+p3×max(0,Tcovj-Coverj)+p4×Expiredj+p5×LowTrustj+p6×Unverifyj,0,1), where Missj is the proportion of missing necessary evidence types, Shortj is the proportion of insufficient quantity, Tcovj is the coverage threshold, Coverj is the coverage rate, Expiredj is the proportion of expired evidence, LowTrustj is the proportion of low-credibility evidence, Unverifyj is the proportion of unverifiable evidence, p1 to p6 are non-negative weights and the sum of the weights is one, and clip indicates that the calculation result is limited to the range of zero to one.

[0017] This invention also discloses an intelligent detection system for network security level protection assessment, characterized in that it includes an evidence normalization module, a rule recording module, a constrained pairing module, a conflict detection module, a gap detection module, a state gating module, and a traceability output module; The evidence normalization module is data-connected to the constrained pairing module and is used to convert multi-source evaluation evidence into evidence records. The rule recording module is connected to the constrained pairing module and the gap detection module respectively, and is used to provide evaluation item rule recording; The constrained pairing module filters evidence records step by step according to evidence type constraints, scope of application constraints, field path constraints, and time window constraints, and generates constrained evidence pairs based on the connection conditions of the conflict rules. The conflict detection module performs field-level comparisons on the constrained evidence pairs and generates conflict tuples. The gap detection module generates an evidence gap vector according to the evidence sufficiency rule; The state gating module determines the evidence quality status and controls the generation of compliance conclusions based on conflict tuples and evidence gap vectors. The traceability output module associates compliance conclusions, conflict tuples, evidence gap vectors, and corresponding evidence records for output.

[0018] Compared with existing technologies, the intelligent detection method and system for network security level protection assessment of the present invention has at least the following technical effects: First, the constrained pairing module gradually narrows down the range of evidence combinations through a four-level index. Suppose there are nj evidence records under evaluation item j; a full pairwise comparison requires generating nj(nj-1) / 2 combinations. The actual number of comparisons in this invention is the size of the set of evidence pairs that satisfy the conflict rule connection conditions, and this set is a subset of all combinations. Therefore, the sparser the evidence type, asset, field path, or time condition, the more invalid combinations are excluded, and the fewer field reading and comparison operations are required for conflict detection.

[0019] Second, conflict tuples and evidence gap vectors are not two independent hints, but rather together form the evidence quality status. Hard gaps can block definitive conclusions before confidence calculation, and high-severity unresolved conflicts can be transferred to manual review, ensuring that every definitive compliant conclusion output by the system has an evidentiary basis that meets the rule requirements.

[0020] Third, the dependency indexes between field paths, asset types, vulnerability types, rule versions, and assessment items enable change events to be directly mapped to the set of affected assessment items. If the total number of assessment items is J, the number of affected assessment items is U, and U is less than J, then a change event only triggers the recalculation of U assessment items, without needing to repeatedly read and compare evidence for the remaining J-U assessment items.

[0021] Fourth, evidence identification and evidence hashing bind structured evidence records to the original evidence locations, and the review results retain the version relationship before and after the update. This allows for locating the source of evidence without repeatedly copying sensitive original text, and verifies whether the data before and after the review has been replaced. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the architecture of the intelligent detection system for network security level protection assessment of the present invention. Figure 2 This is a flowchart of the intelligent detection method for network security level protection assessment of the present invention; Figure 3 This is a schematic diagram illustrating the generation of constrained evidence pairs and field-level conflict detection in the intelligent detection method of the present invention; Figure 4 This is a schematic diagram of the dual-channel state gating for collisions and gaps in the intelligent detection method of the present invention; Figure 5 This is a schematic diagram of event-driven local recalculation in the intelligent detection method of the present invention.

[0023] Explanation of reference numerals in the attached figures: 100. Intelligent Detection System; 110. Evidence Normalization Module; 120. Rule Recording Module; 130. Constrained Pairing Module; 140. Conflict Detection Module; 150. Gap Detection Module; 160. State Gating Module; 170. Verification Module; 180. Dependency Index Module; 190. Local Recalculation Module; 200. Traceability Output Module. Detailed Implementation

[0024] The embodiments of the present invention are described below with reference to the accompanying drawings.

[0025] Figure 2 S1 to S8 are process node numbers, where S1 to S5 correspond to steps one through five in sequence, and S6 to S8 correspond to the determination of evidence quality status, the formation of status gating and traceable detection results in step six, and the update of evidence quality status by review results to form a feedback loop.

[0026] Example 1 (see) Figure 1 ): The intelligent detection system 100 is deployed on the testing organization's local server, dedicated security domain, or private cloud environment. It includes an evidence normalization module 110, a rule recording module 120, a constraint pairing module 130, a conflict detection module 140, a gap detection module 150, a state gating module 160, a verification module 170, a dependency indexing module 180, a local recalculation module 190, and a traceability output module 200. Each module can be implemented by different software processes on the same processor or deployed separately on computing nodes connected via a controlled network.

[0027] The evidence normalization module 110 receives asset ledgers, network topology, equipment configurations, operating system configurations, database configurations, vulnerability scan results, audit logs, policy documents, interview records, on-site photos, screenshots, and rectification records. For structured data, the module extracts fields through an interface field mapping table; for text or image data, it first uses text parsing or character recognition to obtain candidate fields, and then uses the field mapping table to determine the normalized field path. Candidate fields are only written to the structured evidence storage area after preserving the original evidence location and evidence hash.

[0028] An evidence record Ei can be represented as: {evidenceId, sourceType, sourceId, assetId, assetType, boundaryId, evidenceType, fieldPath, rawValue, normalizedValue, unit, collectTime, validUntil, hashValue, trustScore, verifiableFlag}. Here, evidenceId is the evidence identifier; assetId and boundaryId represent the asset and its system boundary, respectively; fieldPath uses a hierarchical path to represent security facts, such as config / auth / password / minLength, config / auth / mfa / enabled, policy / auth / mfa / required, and scan / vulnerability / status; trustScore is a value between zero and one; and verifiableFlag indicates whether the original evidence can be located and verified based on the evidence identifier.

[0029] Asset identification can be obtained through the mapping relationship between the device's unique number, managed address, hostname, and asset ledger number. When asset names from different sources are inconsistent, candidate asset connection relationships are first generated based on at least two stable attributes, and then a unified assetId is determined by manual confirmation or preset connection rules. Field value normalization includes at least: mapping "Enabled," "Yes," "true," and numerical values ​​to Boolean true; unifying different time formats to Coordinated Universal Time or project time zone time; unifying retention periods such as days and hours to the same unit; and mapping risk level enumeration to preset ordinal numbers.

[0030] The rule recording module 120 saves the evaluation item rule records Rj according to the applicable standard version. Rj can be represented as: {ruleId, ruleVersion, itemId, objectTypeSet, levelSet, requiredEvidenceTypes, optionalEvidenceTypes, counterEvidenceTypes, minEvidenceCount, coverageThreshold, validityWindow, trustThreshold, fieldPathSet, conflictRuleSet, sufficiencyRuleSet, conclusionRuleSet, itemWeight, effectiveTime, expireTime}. When the rule version changes, the old version is retained; reports that have already been issued continue to be associated with the original rule version; new projects use the rule version that is valid at the time of project evaluation.

[0031] It should be noted that while knowledge graphs can serve as an organizational method for rule records, they are not a necessary condition for implementing this invention. Rule records can be stored in graph databases, relational databases, or document databases. The core processing object of this invention is the evaluation item rule record with clearly defined field constraints and connection conditions, rather than the storage format of a graph database.

[0032] Example 2 (e.g.) Figure 2 and Figure 3 (as shown) The constrained pairing module 130 performs a four-level filtering for each conflict rule. A conflict rule cr can be represented as: {conflictRuleId, itemId, evidenceTypeA, evidenceTypeB, fieldPathA, fieldPathB, assetJoinKey, scopeJoinKey, timeWindow, operator, severity}.

[0033] The first level of filtering uses an evidence type index. The system reads the evidence identifier sets corresponding to evidenceTypeA and evidenceTypeB respectively, forming the first evidence set A and the second evidence set B. The second level of filtering uses an asset identifier index and a system boundary index: when the conflict rule requires comparison of the same asset, only combinations with the same assetJoinKey value are retained; when the rule allows comparison within the system boundary, combinations with the same boundaryId and whose applicable asset sets intersect are retained.

[0034] The third-level filter uses field path indexing, retaining only combinations where one field path matches fieldPathA and the other matches fieldPathB. Field paths can use exact matches or parent-child path matches. For example, the rule path `config / auth / mfa` can match `config / auth / mfa / enabled`, but the parent-child path matching method needs to be explicitly configured in the rule record.

[0035] The fourth level of screening uses a time index. Let the collection times of the two pieces of evidence be ta and tb, and the time window for the conflict rule be Δt. The combination is retained only if |ta-tb| is not greater than Δt, and both pieces of evidence have not exceeded validUntil at the evaluation time point. The combinations filtered through the fourth level are then used by the rule connection unit to generate a constrained evidence pair Pab. Evidence records not included in Pab are not subject to field value comparisons under this conflict rule.

[0036] When mapping evidence record Ei to evaluation rule record Rj, the mapping score can be calculated using the formula Mij = clip(w1×Tij + w2×Sij + w3×Fij + w4×Vij + w5×Pij + w6×Qij - w7×Dij, 0, 1). Tij, Sij, Fij, Vij, Pij, and Qij represent the evidence type, asset scope, field path, field value, time validity, and source credibility components, respectively. Dij is the component for deducting duplicate evidence. w1 to w6 are non-negative weights, and their sum is one. w7 is a non-negative deduction coefficient. The mapping score is used for ranking candidate evidence and calculating confidence levels, but it does not replace conflict rules or sufficiency of evidence rules.

[0037] Suppose there are nj pieces of evidence under evaluation item j. Direct pairwise comparison requires generating nj(nj-1) / 2 combinations. According to this embodiment, the actual number of combinations equals the number of duplicate evidence pairs generated by all conflict rules applicable to evaluation item j. Since each evidence pair must simultaneously satisfy type, join key, field path, and time conditions, the actual set of evidence pairs will not exceed the total set of combinations. The system can also serialize and deduplicate evidence identifier pairs in order of smaller identifier, avoiding duplicate calculations of identical evidence pairs.

[0038] In one optional implementation, inverted indexes are used for each index; in another, bitmap indexes are used for evidence type and field path, while partitioned indexes are used for asset identifier and time. Changes in the index structure do not affect the processing logic for progressively narrowing down the candidate range for level four constraints.

[0039] At the module implementation level, the constrained pairing module 130 can be divided into an evidence type index unit, an asset and system boundary index unit, a field path index unit, a time index unit, and a rule connection unit. The output of the previous level index unit serves as the input of the next level index unit. The rule connection unit generates constrained evidence pairs only for evidence combinations retained by each index unit. This unit division corresponds one-to-one with the aforementioned four-level screening. Each unit can be deployed in the same process or expanded independently according to the evidence size.

[0040] Example 3: The conflict detection module 140 reads the normalizedValue of the constrained evidence pair and compares it according to the operator. EQ indicates that the two values ​​should be equal, NE indicates that the two values ​​should not be equal, RANGE_IN indicates that the value should be within the target range, SET_CONTAIN indicates that the target set should contain the specified element, IMPLY indicates that the second field should meet the specified state when the first field is true, MUTEX indicates that the two states cannot be true at the same time, and TIME_ORDER indicates that the two events should meet the preset order.

[0041] When a field-level comparison violates a conflict rule, the module generates a conflict tuple Kk. Kk includes at least itemId, evidenceIdA, evidenceIdB, conflictType, fieldPathA, fieldPathB, valueA, valueB, conflictRuleId, affectedAssetSet, severity, and status. status can be unprocessed, confirmed, excluded, or corrected. Excluded conflict tuples are no longer included in subsequent conflict score calculations, but the reason for exclusion and review records are retained.

[0042] The conflict score for assessment item j can be calculated using the following formula: Cj=1-∏k(1-sk×tak×tbk×rk×uk) Where sk represents the conflict severity, tak and tbk represent the credibility of the two pieces of evidence, rk is the time recency coefficient, and uk is the handling status coefficient; all parameters are taken as zero to one. uk is one for unhandled conflicts, zero for resolved conflicts, and zero for confirmed but not yet rectified conflicts, according to the rules. When there are no conflict tuples, the product term is treated as one, and Cj is zero.

[0043] The gap detection module 150 counts the number of valid pieces of evidence and the number of assets covered for each of the necessary evidence types. Valid evidence must simultaneously meet the requirements for evidence type, scope of application, validity period, credibility threshold, and verifiability. If there is no valid evidence for any necessary evidence type, it is recorded as necessary evidence missing; if the number of valid pieces of evidence is less than minEvidenceCount, it is recorded as insufficient; if the evidence has exceeded validUntil, it is recorded as expired; if the ratio of the number of assets with valid evidence to the total number of applicable assets is less than coverageThreshold, it is recorded as insufficient coverage.

[0044] The gap vector Gj can be represented as: {missingTypes, shortageTypes, expiredTypes, coverageRate, scopeGapSet, lowTrustSet, unverifiableSet, hardGapMask, gapScore}. The hardGapMask is determined by the sufficiency of evidence rules. For example, authentication configurations, access control policies, and log retention configurations can be set as hard gap fields; general missing explanatory materials can be set as soft gaps. The setting of hard gaps varies depending on the evaluation items and applicable levels, and does not use a globally fixed list.

[0045] The gap score Gsj is calculated according to the following formula: Gsj=clip(p1×Missj+p2×Shortj+p3×max(0,Tcovj-Coverj)+p4×Expiredj+p5×LowTrustj+p6×Unverifyj, 0, 1).

[0046] Here, clip means restricting the calculation result to the range of zero to one.

[0047] Missj, Shortj, Expiredj, LowTrustj, and Unverifyj are the ratios of the corresponding gap quantity to the statistical base. Tcovj and Coverj are the coverage threshold and coverage rate, respectively. p1 to p6 are non-negative weights, and the sum of the weights is one. Each weight can be determined by the assessment organization based on verified historical projects, or it can be configured using approved fixed rules; the source and version of the weights are saved with the rule records.

[0048] like Figure 4As shown, the state gating module 160 determines the evidence quality status in the following order: hard gaps first, followed by unresolved high-conflict evidence, and evidence usable last. Hard gaps take precedence over conflicts because the absence of necessary evidence cannot be compensated for by comparing other evidence. When there is no hard gap but Cj reaches the conflict threshold, the system enters the conflict pending review state. Only when there is no hard gap and Cj is below the conflict threshold does the system enter the evidence usable state.

[0049] When evidence is available, the confidence level of an assessment item can be calculated using the following formula: Confj=clip(a1×AvgMj+a2×AvgTrustj+a3×Coverj-a4×Cj-a5×Gsj, 0, 1).

[0050] AvgMj represents the average mapping score of valid evidence, AvgTrustj represents the average credibility of valid evidence, and a1 to a5 are non-negative coefficients. For ease of comparison between different projects, the sum of a1, a2, and a3 can be set to one, and a4 and a5 represent the deduction strength for conflicts and gaps, respectively. The coefficients and thresholds are recorded in the rule version used.

[0051] Example: A certain assessment rule requires that the policy / auth / mfa / required in the policy document and the config / auth / mfa / enabled in the equipment configuration satisfy the IMPLY relationship (IMPLY as described above). The normalized value of the policy document evidence is true, and its credibility is 0.90; the normalized value of the configuration evidence for the same asset is false, and its credibility is 0.95; the conflict severity is 1.00, the proximate factor is 0.95, and the handling status factor is 1.00. This evidence generates an unhandled conflict tuple, with a corresponding conflict score of 1 - (1 - 1.00 × 0.90 × 0.95 × 0.95 × 1.00), which is 0.81225. If the conflict threshold is 0.60, then this assessment item enters a conflict pending review state, and a compliance conclusion is not directly output.

[0052] For example, a certain assessment item applies to ten assets with a coverage threshold of 0.80, but only seven assets have valid and verifiable necessary configuration evidence, resulting in a Coverj score of 0.70. If the rule marks this type of insufficient coverage as a hard gap, the state gating module directly outputs insufficient evidence and generates a supplementary collection task to cover at least one additional asset. Even if the average mapping score of other evidence is high, the calculation of a deterministic conclusion is not bypassed by calculating the hard gap.

[0053] In the absence of hard gaps and unresolved high-conflict conditions, if AvgMj is 0.90, AvgTrustj is 0.85, Coverj is 0.90, Cj is 0, Gsj is 0.05, and a1, a2, a3, a4, and a5 are 0.40, 0.25, 0.35, 0.30, and 0.20 respectively, then Confj is 0.8775. The conclusion rule can be further combined with evidence of contradiction and applicability conditions to output compliance, partial compliance, non-compliance, or inapplicability. The above values ​​are used to illustrate the calculation process and do not constitute a limitation on weights and thresholds.

[0054] The review module 170 displays the field paths, normalized field values, original evidence locations, collection times, credibility, and applicable assets on both sides of the conflicting tuple to the reviewers. Reviewers can confirm conflicts, exclude inapplicable evidence, correct normalized field values, or request re-collection. Each operation records the reviewer, time, reason, and previous / next values, and generates a new version of the evidence quality status without overwriting the original record.

[0055] The review task may include the assessment item identifier, triggering reason, affected asset set, associated conflict tuples, evidence gap vector, evidence record to be reviewed, and review deadline; the review result shall at least record the adopted evidence identifier, excluded evidence identifier, corrected normalized field value, conflict resolution status, reviewer identifier, and review time. The review result is used to update the evidence quality status of the corresponding assessment item, and the status versions before and after the update retain the correlation for reference by the traceability output module 200.

[0056] Example 4: The traceability output module 200 organizes the detection results using itemId as the primary key. Each compliance conclusion is associated with the rule version used, the set of valid evidence identifiers, the set of conflict tuple identifiers, the gap vector version, and the review record identifier. When a user initiates a traceability from the conclusion page, the system first reads the structured evidence record and then decides whether to allow access to the original evidence based on permissions.

[0057] The original evidence storage area stores un-anonymized configuration, logs, topology, and scan files, while the structured evidence storage area, in principle, only stores fields and anonymized values ​​required for compliance assessment. The two storage areas are linked via evidenceId and hashValue. If the hash obtained from rereading the original evidence is inconsistent with the hashValue, the system will mark the corresponding evidence as unverifiable and trigger a gap recalculation.

[0058] For account information, keys, network addresses, and exploit details, attributes needed for judgment, such as whether the data is enabled, length, algorithm type, and risk level, can be retained during field normalization, without saving the original sensitive values. Evidence viewing, exporting, reviewing, modifying, and deleting operations are written to the audit log storage area. This deployment method enables the calculation of structured fields required for conflict detection while limiting the scope of copying sensitive original text.

[0059] The system implements hierarchical authorization for different roles, with evaluators, reviewers, and project managers having different scopes of evidence access; sensitive fields in the structured evidence storage area are saved as anonymized values ​​or irreversible summaries, while the original sensitive values ​​are only stored in the original evidence storage area.

[0060] Example 5 (see Figure 5 ): After the evaluation is completed, the system creates an evaluation baseline snapshot Bt for the project. Bt must store at least the following fields and their values: baselineId, assetDigest, evidenceDigest, ruleVersionSet, itemStateSet, and timestamp. The dependency index module 180 establishes four types of inverted index relationships from the evaluation item rule records: fieldPath to itemId, assetType to itemId, vulnerabilityType to itemId, and ruleVersion to itemId.

[0061] At the module implementation level, the establishment and saving of the evaluation baseline snapshot can be undertaken by the baseline snapshot submodule, and the access and format verification of change events can be undertaken by the event receiving submodule. Together with the dependency index module 180 and the local recalculation module 190, they constitute a continuous monitoring path.

[0062] The change event Du includes eventId, eventType, assetId, assetType, fieldPath, oldValue, newValue, eventTime, sourceType, and relatedEvidenceId. eventType can be asset addition, asset removal, configuration change, vulnerability addition, vulnerability fix, log anomaly, evidence expiration, or rule version change.

[0063] The dependency indexing module 180 queries the corresponding inverted index for each non-empty fieldPath, assetType, vulnerabilityType, and ruleVersion in the change event, calculates the union of the matched itemIds, and filters them according to the system boundary and asset applicability scope of the event to obtain the set U of affected evaluation items. The local recalculation module 190 only reads the rule records and evidence records corresponding to set U and re-executes constraint pairing, conflict detection, gap detection, and state gating.

[0064] Assuming a project contains 180 evaluation items, and a configuration change event's field path matches three evaluation items, this processing will only recalculate those three evaluation items. The remaining 177 evaluation items will continue to reference the evidence quality status from the original baseline. This number is only used to explain the local recalculation mechanism and does not constitute a system capacity limitation.

[0065] The compliance drift value can be calculated based on changes in evidence quality status before and after recalculation, increases in conflict scores, increases in gap scores, importance of affected assets, and weights of assessment items. If an assessment item changes from an evidence-available state to a hard gap state, or if the newly added conflict score exceeds the single item threshold, a re-assessment recommendation is triggered directly; other changes can trigger alerts by comparing the weighted value with the drift threshold. After review, the system can write the confirmed new status to a new baseline snapshot while retaining the old baseline identifier to compare the status at the two assessment points.

[0066] In one calculation method, the drift value of the assessment item is defined as: Driftj = clip(b1 × StateDeltaj + b2 × max(0, Cj_new - Cj_base) + b3 × max(0, Gsj_new - Gsj_base) + b4 × AssetImpj + b5 × RuleChangej, 0, 1). StateDeltaj represents the change in the quality of evidence state, Cj_new and Cj_base are the conflict scores between the new state and the baseline state, Gsj_new and Gsj_base are the gap scores between the new state and the baseline state, AssetImpj is the importance of the affected asset, and RuleChangej indicates the rule version change marker; b1 to b5 are non-negative weights, and the sum of the weights is one. As an optional implementation, the state change can also be determined based on an audited grading table to determine the discrete drift level.

[0067] Unlike the first embodiment, partial recalculation can also be triggered by rule version changes. When the rule record corresponding to a certain standard clause is updated, the system locates the evaluation items that use the old version of the rule through the inverted index relationship from ruleVersion to itemId, and only re-evaluates the applicability and sufficiency of evidence for these evaluation items, without reprocessing evaluation items that are unrelated to the rule change.

[0068] In one embodiment of an electronic device, the device includes a processor, a memory, and a communication interface. The memory stores program instructions for implementing evidence normalization, constraint pairing, conflict detection, gap detection, state gating, and traceability output. The processor executes the program instructions and receives multi-source evaluation evidence or change events through the communication interface. The program instructions may be stored in a magnetic storage medium, an optical storage medium, a semiconductor storage medium, or other non-transitory computer-readable storage medium, or may be distributed as a computer program product via a controlled network.

[0069] The above embodiments illustrate the main implementation path of the present invention. Without changing the logic of constrained evidence generation, conflict and gap state gating, and local recalculation of changing events, the database type, index implementation method, and module deployment location can be adjusted according to the system scale.

Claims

1. An intelligent detection method for network security level protection assessment, characterized in that, Includes the following steps: The first step is to normalize the multi-source evaluation evidence of the information system under test into evidence records that include asset identification, evidence type, field path, standardized field value and time attribute; The second step is to read the evaluation item rule records, which include constraints on evidence type, scope of application, field path, time window, conflict rules, and sufficiency of evidence. The third step involves filtering evidence records step by step according to the aforementioned evidence type constraints, scope of application constraints, field path constraints, and time window constraints, and generating constrained evidence pairs based on the connection conditions of the conflict rules. Step 4: Perform field-level comparison on the normalized field values ​​of the constrained evidence pair to generate conflicting tuples; Step 5: Generate an evidence gap vector based on the aforementioned evidence sufficiency rules; Step 6: Determine the evidence quality status of the evaluation item based on the conflict tuple and the evidence gap vector, and control the generation of compliance conclusions accordingly. Associate the compliance conclusions with the corresponding evidence records to form traceable detection results.

2. The intelligent detection method according to claim 1, characterized in that, The evaluation item rule record includes an evaluation item identifier, a set of applicable object types, a set of applicable levels, a set of necessary evidence types, a set of supplementary evidence types, a set of rebuttal evidence types, a minimum number of evidence, a coverage threshold, a validity window, a credibility threshold, a set of field paths, a set of conflict rules, a set of evidence sufficiency rules, a set of conclusion rules, and evaluation item weights. Evaluation item rule records corresponding to different applicable standard versions have mutually independent version identifiers, effective times, and expiration times.

3. The intelligent detection method according to claim 1, characterized in that, The evidence record also includes evidence identifier, system boundary identifier, source type, source identifier, original field value, unit, collection time, effective deadline, evidence hash, credibility, and verifiability identifier; the normalized field value is obtained through at least one of field name mapping, enumeration value mapping, unit conversion, Boolean value mapping, and time format conversion, and the same security configuration fact is mapped to the same normalized field path in different evidence sources.

4. The intelligent detection method according to claim 1, characterized in that, Generating the constrained evidence pairs includes: obtaining a first evidence set and a second evidence set from the evidence type index according to the first evidence type and the second evidence type defined by the conflict rules; retaining evidence combinations with the same corresponding value of the asset connection key or with overlapping applicable scope using the asset identification index and the system boundary index; retaining evidence combinations with field paths that satisfy the conflict rules using the field path index; and retaining evidence combinations with collection time differences not exceeding the time window constraint and valid at the evaluation time point using the time index, so as to form a set of constrained evidence pairs to be performed for field-level comparison.

5. The intelligent detection method according to claim 4, characterized in that, When mapping evidence records to evaluation item rule records, a mapping score between the evidence records and the evaluation items is calculated. The mapping score is a weighted sum of evidence type matching component, asset scope matching component, field path matching component, field value matching component, time validity component, and source credibility component, minus the duplicate evidence deduction component, and then limited to the range of zero to one. Each weighting coefficient is a non-negative number, and the sum of the weighting coefficients participating in the weighted sum is one.

6. The intelligent detection method according to claim 1, characterized in that, The conflict rules include a conflict rule identifier, a first evidence type, a second evidence type, a first field path, a second field path, an asset connection key, a range connection key, a time window, a comparison operator, and a conflict severity. The comparison operator includes at least one of equality, inequality, range inclusion, set inclusion, implication, mutual exclusion, and time sequence; the conflict tuple includes an evaluation item identifier, a first evidence identifier, a second evidence identifier, a conflict type, a first field path, a second field path, a first normalized field value, a second normalized field value, a conflict rule identifier, an affected asset set, a conflict severity, and a disposal status.

7. The intelligent detection method according to claim 6, characterized in that, The conflict score Cj for assessment item j is calculated according to Cj = 1 - ∏k (1 - sk × tak × tbk × rk × uk), where sk is the conflict severity of the k-th conflict tuple, tak and tbk are the credibility of the corresponding two evidence records, rk is the proximate factor coefficient, and uk is the handling status coefficient. The values ​​of sk, tak, tbk, rk, and uk are all in the range of zero to one. When there are no conflict tuples in assessment item j, Cj is set to zero.

8. The intelligent detection method according to claim 1, characterized in that, Generating the evidence gap vector includes: The number of valid pieces of evidence for each type of necessary evidence is counted according to the set of necessary evidence types. The number of assets with valid evidence is counted according to the asset set applicable to the assessment items, and the coverage rate is calculated. Identify at least one gap state among the following: missing necessary evidence types, insufficient number of valid evidence, expired evidence, insufficient coverage, insufficient credibility, and unverifiable evidence; Write the gap status, corresponding evidence type, and corresponding asset set into the evidence gap vector.

9. The intelligent detection method according to claim 8, characterized in that, The gap score Gsj for assessment item j is calculated according to Gsj = clip(p1×Missj+p2×Shortj+p3×max(0,Tcovj-Coverj)+p4×Expiredj+p5×LowTrustj+p6×Unverifyj,0,1), where Missj is the proportion of missing necessary evidence types, Shortj is the proportion of insufficient quantity, Tcovj is the coverage threshold, Coverj is the coverage rate, Expiredj is the proportion of expired evidence, LowTrustj is the proportion of low-credibility evidence, Unverifyj is the proportion of unverifiable evidence, p1 to p6 are non-negative weights and the sum of the weights is one, and clip indicates that the calculation result is limited to the range of zero to one.

10. An intelligent detection system for network security level protection assessment, characterized in that, It includes an evidence normalization module, a rule recording module, a constraint pairing module, a conflict detection module, a gap detection module, a state gating module, and a traceability output module; The evidence normalization module is data-connected to the constrained pairing module and is used to convert multi-source evaluation evidence into evidence records. The rule recording module is connected to the constrained pairing module and the gap detection module respectively, and is used to provide evaluation item rule recording; The constrained pairing module filters evidence records step by step according to evidence type constraints, scope of application constraints, field path constraints, and time window constraints, and generates constrained evidence pairs based on the connection conditions of the conflict rules. The conflict detection module performs field-level comparisons on the constrained evidence pairs and generates conflict tuples. The gap detection module generates an evidence gap vector according to the evidence sufficiency rule; The state gating module determines the evidence quality status and controls the generation of compliance conclusions based on conflict tuples and evidence gap vectors. The traceability output module associates compliance conclusions, conflict tuples, evidence gap vectors, and corresponding evidence records for output.

Images