Operation and maintenance risk assessment method and system based on CMDB and local vulnerability library

Abstract

The application discloses a kind of based on CMDB and local vulnerability library operation and maintenance risk assessment method and system, belong to network security intelligent operation and maintenance field, aim at solving the defects of traditional scheme relying on external network vulnerability library, evaluation index distortion, LLM exists operation risk, no closed-loop self-optimizing mechanism.This application collects host asset snapshot and local vulnerability rule, determines risk state by three-level matching;Adopt five-dimensional weighted model to calculate comprehensive risk score, rely on RAG+LLM to generate rectification scheme and add security check;According to the repair result, iteratively update assets, knowledge base and scoring weight, supporting chain hash evidence chain realizes audit storage certificate.The system is divided into five function modules, and also provides equipment and storage medium.The application is adapted to isolated intranet environment, considers technical and business dimension risk, restricts large model output, forms evaluation-repair-iteration closed loop, and the evaluation accuracy and operation and maintenance safety are significantly improved.

Description

Technical Field

[0001] This invention relates to the fields of network security and intelligent operation and maintenance technology, specifically to an operation and maintenance risk assessment method and system based on CMDB and local vulnerability database. Background Technology

[0002] As enterprise IT architectures become increasingly complex, asset configuration management databases (CMDB), vulnerability management, risk assessment, and large language model (LLM) operations and maintenance are gradually becoming crucial for ensuring business stability. However, existing technologies have the following significant shortcomings: Asset profiling is superficial: Traditional CMDBs only record static attributes and lack semantic tags at the security risk level, resulting in the association between assets and vulnerabilities remaining on the surface.

[0003] Online dependency and privacy dilemma: Existing vulnerability assessments heavily rely on external vulnerability databases (such as NVDAPI), which cannot be used in isolated environments such as classified networks and industrial control networks, and pose a risk of data leakage.

[0004] Distorted risk assessment indicators: Over-reliance on a single CVSS score without combining multi-dimensional indicators such as asset criticality and business impact leads to assessment results that deviate from the current business situation.

[0005] LLM execution lacks security boundaries: existing solutions blindly grant large models the permission to directly generate scripts, and the illusion of LLM can easily lead to misoperation (such as accidentally deleting configurations).

[0006] The closed-loop management process is disrupted: the lack of automated verification and experience feedback mechanisms after repairs leads to repeated pitfalls.

[0007] Therefore, there is an urgent need for an intelligent operation and maintenance risk assessment method that can break down data silos, adapt to isolated environments, have security boundaries, and be self-evolving. Summary of the Invention

[0008] To address the shortcomings of the existing technologies, this invention proposes an operational risk assessment method, system, electronic device, and readable storage medium based on CMDB and a local vulnerability database.

[0009] The technical solution adopted in this invention is as follows: Firstly, this application provides an operational risk assessment method based on CMDB and a local vulnerability database, including the following steps: Obtain a snapshot of the target host's assets and vulnerability impact rules from the local vulnerability knowledge base; the snapshot of assets includes the host's operating system version, kernel version, and software package information; A multi-level matching strategy is adopted to compare the component information in the asset fact snapshot with the vulnerability impact rules to determine the risk status of the target host in relation to the vulnerability impact rules; the risk status includes affected, unaffected, or cannot be determined. If the risk status is affected, the comprehensive risk score of the target host is calculated based on the preset five-dimensional weighted scoring model, combined with the asset attributes and business attributes in the asset fact snapshot; Based on the comprehensive risk score and the asset fact snapshot, a draft rectification suggestion is generated by using retrieval enhancement generation technology to call a large language model, and the draft rectification suggestion is verified for security constraints. In response to the remediation verification results for the target host, the asset fact snapshot and local vulnerability knowledge base are updated, and the weight parameters of the five-dimensional weighted scoring model are adjusted according to the deviation between the remediation verification results and the comprehensive risk score.

[0010] Secondly, this application provides an operational risk assessment system based on CMDB and a local vulnerability database, including: The data acquisition module is used to obtain a snapshot of the target host's assets and vulnerability impact rules from the local vulnerability knowledge base; The intelligent matching module is used to compare the asset fact snapshot with the vulnerability impact rules using a multi-level matching strategy to determine the risk status; The risk assessment module is used to calculate a comprehensive risk score based on a five-dimensional weighted scoring model when the risk status is "affected". The decision support module is used to use retrieval enhancement generation technology to call a large language model to generate a draft of rectification suggestions, and to perform security constraint verification on the draft of rectification suggestions; The closed-loop evolution module is used to update the asset profile and knowledge base in response to the repair verification results, and to adjust the weight parameters of the five-dimensional weighted scoring model.

[0011] Thirdly, this application provides an electronic device, comprising: A processor, a memory, and a communication bus, wherein the processor and the memory communicate with each other via the communication bus; The memory stores program instructions that can be executed by the processor, which can invoke the program instructions to perform the method provided by the first aspect or any possible implementation thereof.

[0012] Fourthly, this application provides a computer-readable storage medium, characterized in that it stores a computer program thereon, wherein the computer program, when executed by a processor, implements the method provided by the first aspect or any possible implementation of the first aspect.

[0013] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: This invention relies on asset snapshots combined with local vulnerability rules to complete multi-level risk assessment. It uses a five-dimensional weighted model to quantitatively output standardized comprehensive risk scores, integrates RAG retrieval enhancement and large-scale model technology to generate specialized remediation plans with security constraint verification. Simultaneously, after vulnerability remediation, a closed-loop verification process is executed to iteratively update the asset ledger, vulnerability knowledge base, and scoring weights. Furthermore, an independent audit and evidence storage module generates an immutable, end-to-end evidence chain and connects to external compliance auditing. This integrated technical architecture can completely bypass external vulnerability databases to complete the entire process of host asset risk assessment in isolated internal network environments. It achieves refined, multi-dimensional, and accurate risk assessment while also implementing security constraint control over the output of the large-scale model. A closed-loop evolution mechanism continuously optimizes the accuracy of the assessment model, and completes the entire process operation log for compliance tracing and auditing. This fundamentally addresses several industry technical shortcomings of traditional vulnerability assessment methods, such as single evaluation dimensions, lack of security control over large-scale model remediation suggestions, lack of continuous iterative optimization mechanisms, and lack of standardized audit and evidence collection links. It comprehensively improves the accuracy of asset risk identification, the security of operation and maintenance remediation, the adaptive capability of risk assessment models, and the efficiency of enterprise network security compliance auditing in isolated internal network scenarios. Attached Figure Description

[0014] The present invention will be described by way of example and with reference to the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating the method in this invention; Figure 2 This is a block diagram of the system architecture in this invention; Figure 3 This is a block diagram of the hardware composition of the electronic device of the present invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0016] Example 1 This embodiment provides an intelligent operation and maintenance risk closed-loop assessment method based on CMDB asset profiling and a local vulnerability knowledge base, such as... Figure 1 As shown, the method includes the following steps: Step S100: Obtain a snapshot of the target host's assets and vulnerability impact rules from the local vulnerability knowledge base.

[0017] Specifically, the system uses CMDB as its asset foundation and acquires the host's runtime information through controlled read-only acquisition capabilities (such as SSH read-only accounts and Agent probes) to generate asset snapshots. The snapshot content includes the host IP, operating system version, kernel version, list of installed software packages (including version numbers), running services, and ports.

[0018] At the same time, the system reads the local vulnerability knowledge base. This knowledge base stores vulnerability numbers (CVE / CNVD), affected components, affected version ranges, patch versions, and mitigation measures.

[0019] The benefits of this step are: by using a "fact snapshot" to solidify the true state of an asset at a certain moment, providing a benchmark for subsequent comparisons; and by using a "local knowledge base" to eliminate reliance on the external network, ensuring availability in classified or isolated network environments.

[0020] Step S200: Using a multi-level matching strategy, the asset fact snapshot is compared with the vulnerability impact rules to determine the risk status.

[0021] The risk status includes: affected, not affected, or indeterminate.

[0022] The specific matching process uses a "funnel-style" filtering logic: If the snapshot is missing or expired, mark it as "cannot be determined" to avoid false alarms.

[0023] If a component is not within the scope of the vulnerability rules, it will be marked as "unaffected".

[0024] If the version and platform match, mark it as "affected".

[0025] Step S300: If the risk status is affected, calculate the comprehensive risk score (CRS) based on the five-dimensional weighted scoring model.

[0026] The system no longer relies solely on CVSS scores, but instead incorporates a business perspective. The calculation formula is as follows: CRS = i = 15(wi × Si) Among them, S1 represents the severity of the technical vulnerability (derived from CVSSBaseScore), S2 represents the criticality of the asset (derived from CMDB tags), S3 represents the business impact (derived from the business system SLA level), S4 represents the network exposure surface (derived from network area tags), and S5 represents the remediation complexity (derived from the remediation difficulty indicator in the knowledge base). wi represents the preset weight.

[0027] The beneficial effect of this step is that it transforms purely technical indicators into risk indicators that are more aligned with actual business operations, correcting the distortions in traditional assessments that result in "high scores for low-risk assets" or "low scores for high-risk assets."

[0028] Step S400: Based on the comprehensive risk score and asset fact snapshot, use the Retrieval Enhanced Generation (RAG) technology to call the Large Language Model (LLM) to generate a draft rectification suggestion and perform security constraint verification.

[0029] The system first retrieves historical remediation cases, official patch notes, and compliance requirements related to the vulnerability from the local vector database to construct a context. The context is then input into the LLM and a strict system prompt is set, requiring the LLM to output only natural language suggestions or structured JSON, and strictly prohibiting the output of executable code.

[0030] After generation, the system filters the output content through regular expression matching and schema validation to ensure that it does not contain dangerous commands (such as rm-rf, reboot).

[0031] Step S500: In response to the repair verification results, update the asset profile and knowledge base, and adjust the weight parameters of the five-dimensional weighted scoring model.

[0032] After maintenance personnel perform repairs, the system automatically triggers a rescan. If the rescan passes, the system records the repair experience. If the system score is corrected during manual review (e.g., the score is deemed too high by the human), the system will calculate the deviation step size to obtain the deviation step size between the actual risk level after manual review and the predicted risk level corresponding to the comprehensive risk score. Based on the deviation step size, the system uses the gradient descent algorithm to backpropagate the correction signal and dynamically fine-tune the weight coefficients wi of the associated dimensions in the five-dimensional weighted scoring model until the error between the predicted risk level and the actual risk level converges.

[0033] The calculation formula of the five-dimensional weighted scoring model is: CRS=∑(wi×Si); where S1 is the severity of technical vulnerabilities, S2 is the criticality of assets, S3 is the business impact, S4 is the network exposure surface, and S5 is the remediation complexity; wi is the weight coefficient corresponding to each dimension. The asset criticality S2 is determined based on the asset importance level recorded in the CMDB; the business impact S3 is determined based on the business system SLA level recorded in the CMDB; and the network exposure surface S4 is determined based on the network area labels in the asset profile.

[0034] The beneficial effect of this step is that it enables the system to "self-evolve," and the evaluation model will become more and more accurate as operational data accumulates.

[0035] Example 2 This embodiment is a further refinement of step S200 (multi-level matching strategy) in Embodiment 1. To address the risks of non-standard component naming and indirect dependencies, this embodiment employs a three-level progressive matching mechanism: Perform an L1-level CPE exact match, standardizing the software information in the host snapshot into a CPE 5-tuple, and comparing it precisely with the CPEURI in the vulnerability rules. If a match is successful, the confidence level is set to 1.0, and the vulnerability is directly identified as affected.

[0036] The system performs L2-level semantic similarity matching. If L1 fails (e.g., internally developed software lacks a standard CPE), the system uses the Levenshtein Distance algorithm and Jaccard coefficients to calculate the similarity of component names. Simultaneously, a VersionNormalizer handles version number heterogeneity (e.g., resolving 3.10.0-1160.el7 as 3.10.0) to determine if the version falls within the vulnerability's impact range. If the similarity is higher than a threshold (e.g., 0.85) and the version matches, the system is considered affected.

[0037] The system performs L3-level dependency propagation matching. If L2 fails, the system constructs a dynamic directed acyclic graph (DAG) of host assets. By parsing system-level binary dynamic link relationships (such as ldd) or language-level package manager dependency trees (such as pom.xml, package.json), when a vulnerability is detected in an underlying shared library (such as OpenSSL, Log4j), the system uses a reverse topology traversal algorithm to trace across levels and associate it with the top-level business process that depends on that underlying library.

[0038] The beneficial effects of this embodiment are that it effectively identifies the hidden risks brought about by "indirect dependencies" and solves the limitation of traditional methods that can only detect directly installed components.

[0039] Example 3 This embodiment is a further refinement of step S400 (LLM security boundary) in Embodiment 1. To prevent large language models from creating illusions that could lead to production accidents, this embodiment constructs a "strongly assisted, zero-execution" security architecture: The architecture is decoupled, and the LLM module is physically isolated from the execution engine. The output of the LLM cannot be directly converted into system instructions.

[0040] Output hard constraints, forcing LLM to output structured data conforming to a predefined JSON Schema, with fields including risk_summary, remediation_options, and human_review_checkpoints.

[0041] Furthermore, the draft rectification proposal described in step S400 is subjected to security constraint verification, including: The draft rectification proposal is scanned using regular expressions. If it contains executable command characters or system control instructions (including high-risk keywords such as sudo, rm, curl|bash, etc.), the draft rectification proposal is blocked. Verify that the JSON data structure of the draft rectification proposal contains all mandatory fields; Calculate the cosine similarity between the title of the proposed rectification suggestion and the historical suggestions in the local knowledge base. If the deviation is too large, mark it as an "unreliable suggestion" and trigger a manual review warning.

[0042] All suggestions must be approved by the administrator by clicking "Confirm" on the web interface before a work order or report can be generated. Example 4 This embodiment is a further refinement of step S100 (local vulnerability knowledge base update method) in Embodiment 1, and is applicable to isolated network environments.

[0043] The system adopts a "gateway transfer - self-resolution" mechanism: For the external network side, the proxy server regularly captures multi-source intelligence such as NVD and CNNVD, cleans it, and encapsulates it into incremental difference packets (JSON format) with digital signatures and AES-256 encryption.

[0044] For the transfer side, maintenance personnel import incremental packets into the internal network via a security gateway or CD transfer.

[0045] For the internal network side, the internal network system has a timed monitoring service deployed. Once a new file is detected, it automatically triggers signature verification, decryption, and conflict cleanup, and achieves dynamic hot loading of vulnerability data without restarting the service.

[0046] The beneficial effects of this embodiment are that it not only meets the security red line of physical isolation, but also achieves near real-time updates of the vulnerability database (with latency controlled at the weekly or even daily level).

[0047] Example 5 This embodiment provides a method for generating and solidifying a chain of evidence. After determining the risk state in step S200, the method further includes the step of generating an immutable chain of evidence. Record decision factors and jump branches during the matching process to generate a structured derivation log; A segmented chained hash structure is used to divide the structured derivation log into multiple data blocks; Within each data block, a Merkle tree is used for hash aggregation to generate the root hash within the block; The root hash within the current data block is concatenated and anchored with the global verification hash of the previous data block to generate the global verification hash of the current data block, forming a chained storage structure.

[0048] Furthermore, the implementation details of the proposed solution are as follows: Data collection timestamp solidification: At the initial node of data collection and transfer of host-running asset topology data, an irreversible timestamp is generated immediately using a hardware-level clock, and the integrity verification hash value (such as SHA-256) of all fact data is calculated simultaneously to establish a strong binding relationship between the original fact data and the generation time, preventing subsequent tampering.

[0049] Induction log appending: When the matching engine executes multi-level and multi-dimensional judgment logic (such as "L1 exact match failed, automatically trigger L2 semantic match"), it appends the decision factors, matching status and jump branches of each step as structured context fields to the current evidence chain's deduction_log dynamic array in real time, forming a fully reproducible inference path graph.

[0050] Segmented Chain Hash Anti-Tampering: The system adopts a time-sliced ​​rolling hash chain structure. In high-concurrency scenarios, audit logs are automatically divided into independent data chunks (DataChunk) according to preset thresholds (time or number of records). Within each chunk, a lightweight Merkle tree is used for lock-free fast hash aggregation, and a global verification hash is generated at the end of the chunk and anchored to the tail hash of the previous chunk. Through this segmented cascading structure, the rigid requirements of the Information Security Protection Standard 2.0 for audit log integrity are met, while also enabling asynchronous offline verification and cold / hot tiered storage of historical data, preventing system I / O performance bottlenecks caused by a surge in data volume.

[0051] The principle of non-deletion and overwrite tracking: The system base adopts a read-only append-only data writing strategy. Even if the risk status of an asset is subsequently corrected through manual review or new intelligence, the system strictly prohibits erasing or rewriting the original evidence chain record. Instead, the correction action, approval process, and new judgment result are asynchronously appended to the end of the chain as a "correction evidence chain," and linked to the original chain through logical pointers to ensure the absolute integrity and full traceability of the security audit flow.

[0052] The beneficial effects of this embodiment are: it ensures the immutability of the audit log and meets the compliance audit requirements of Information Security Level Protection 2.0 and ISO 27001.

[0053] Example 6 This embodiment provides an intelligent operation and maintenance risk closed-loop assessment system based on CMDB asset profiling and a local vulnerability knowledge base. (See also...) Figure 2 The system comprises six core functional modules that work together to complete the entire process of risk assessment and disposal. Each module has a clear division of labor and interconnected processes, specifically including: Data acquisition module: used to execute all the operation logic corresponding to the complete method step S100, collect complete and real asset fact snapshot data of the target host in real time, and at the same time retrieve various vulnerability impact judgment rules pre-stored in the local offline vulnerability knowledge base to provide complete raw data support for subsequent risk matching; The intelligent matching module is used to fully execute step S200 and the multi-level matching logic described in Example 2. It adopts a hierarchical and progressive multi-level matching strategy to compare and verify the complete asset fact snapshot collected with the vulnerability impact rules retrieved locally, and accurately distinguish between three risk states: host is not affected, cannot be determined, and affected by risk. Risk assessment module: used to fully execute step S300 and the standardized five-dimensional scoring calculation process. When the intelligent matching module outputs the host risk status judgment result as affected, it calls the preset five-dimensional weighted scoring model to complete the quantitative calculation and output a standardized and comparable host comprehensive risk score. Decision Support Module: Used to fully execute step S400 and the safety verification process of the rectification plan specified in Example 3. After relying on the search enhancement generation RAG technology to retrieve relevant safety information from the knowledge base, it calls the large language model to generate a targeted rectification suggestion draft, and conducts strict safety constraint verification on the content of the draft to filter out high-risk and non-compliant operation instructions. Closed-loop evolution module: used to fully execute step S500 and dynamic weight adaptive adjustment logic, receive feedback results from front-end repair verification as input, synchronously update CMDB asset profile ledger and local vulnerability knowledge base content, and synchronously iterate and optimize the weight parameters of each dimension in the five-dimensional weighted scoring model to achieve continuous self-iteration of assessment capabilities. Audit Evidence Storage Module: Used to fully execute the full-chain evidence chain solidification operation described in Example 5. It encrypts and solidifies the operation logs of the entire process of data collection, risk matching, score calculation, rectification generation, and repair verification, ensuring that the audit logs are tamper-proof and fully traceable, and fully meeting the compliance audit requirements in the Information Security Protection 2.0 and ISO27001 standards.

[0054] Example 7 This embodiment provides an electronic device capable of executing the methods described in any of Embodiments 1 to 5, applicable to data processing, intelligent control, equipment testing, and maintenance scenarios. (See also...) Figure 3 This electronic device includes a memory and a processor. The memory and processor communicate via an internal bus to achieve efficient data and instruction transmission. The memory can be at least one of ROM, RAM, flash memory, or solid-state memory, used to store system programs, configuration parameters, business data, and computer programs. It can completely preserve the program code and algorithm parameters required to implement the methods described in Embodiments 1 to 5, ensuring the continuous and stable execution of the methods. The processor can be a CPU, MCU, ASIC, or FPGA, serving as the core computing and control unit of the device. It can read and execute the computer programs stored in the memory, run the method flow described in any of Embodiments 1 to 5, and realize corresponding data processing and business functions. When the processor executes the program, it can schedule hardware resources such as device communication, data acquisition, and output to complete the complete business process, making up for the shortcomings of existing technologies and achieving corresponding technical effects. This electronic device is compatible with various hardware platforms such as servers, industrial control equipment, smart terminals, and IoT devices, and has strong versatility.

[0055] Example 8 This embodiment provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program can implement the method steps and algorithm logic described in any of Embodiments 1 to 5. This medium is compatible with various computers, smart terminals, and embedded devices.

[0056] The computer-readable storage media include USB flash drives, portable hard drives, disks, optical discs, flash memory, cloud storage media, etc., which can be stored independently or integrated into the internal storage program of the device and have good versatility and portability.

[0057] When the storage medium is connected to the computing device, the program stored in it can be read, parsed and executed by the processor, accurately realizing the technical functions and effects corresponding to any of the aforementioned embodiments.

[0058] This storage medium supports program copying, porting, and upgrades, and is compatible with various hardware architectures, effectively reducing deployment costs. It also persistently stores program data, preventing data loss in case of power failure, ensuring stable and repeated operation of the method, and possesses significant application and promotional value.

[0059] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for assessing operational risks based on CMDB and a local vulnerability database, characterized in that, Includes the following steps: Obtain a snapshot of the target host's assets and vulnerability impact rules from the local vulnerability knowledge base; A multi-level matching strategy is adopted to compare the component information in the asset fact snapshot with the vulnerability impact rules to determine the risk status of the target host in relation to the vulnerability impact rules; If the risk status is affected, the comprehensive risk score of the target host is calculated based on the preset five-dimensional weighted scoring model, combined with the asset attributes and business attributes in the asset fact snapshot; Based on the comprehensive risk score and the asset fact snapshot, a draft rectification suggestion is generated by using retrieval enhancement generation technology to call a large language model, and the draft rectification suggestion is verified for security constraints. In response to the remediation verification results for the target host, the asset fact snapshot and local vulnerability knowledge base are updated, and the weight parameters of the five-dimensional weighted scoring model are adjusted according to the deviation between the remediation verification results and the comprehensive risk score.

2. The method according to claim 1, characterized in that, The multi-level matching strategy compares the component information in the asset fact snapshot with the vulnerability impact rules, including: Perform L1 level matching: Standardize the component information in the asset fact snapshot into a CPE 5-tuple and compare it precisely with the CPEURI in the vulnerability impact rule; if the match is successful, the risk status is determined to be affected; If L1 level matching fails, L2 level matching is performed: the semantic similarity between the component information and the component name in the vulnerability impact rule is calculated based on the edit distance algorithm and Jaccard coefficient, and the version semantic parser is used to determine the range of the version number; if the similarity exceeds the preset threshold and the version is within the impact range, the risk status is determined to be affected. If L2 level matching fails, L3 level matching is performed: construct a dynamic dependency directed acyclic graph of host assets, and trace the underlying shared library that the component information depends on through a reverse topology traversal algorithm; if the underlying shared library exists in the vulnerability impact rules, the risk status is determined to be affected.

3. The method according to claim 1, characterized in that, The calculation formula of the five-dimensional weighted scoring model is: CRS=∑(wi×Si); where S1 is the severity of technical vulnerabilities, S2 is the criticality of assets, S3 is the business impact, S4 is the network exposure surface, and S5 is the remediation complexity; wi is the weight coefficient corresponding to each dimension. The asset criticality S2 is determined based on the asset importance level recorded in the CMDB; the business impact S3 is determined based on the business system SLA level recorded in the CMDB; and the network exposure surface S4 is determined based on the network area labels in the asset profile.

4. The method according to claim 1, characterized in that, After determining the risk status, the method further includes the step of generating an immutable chain of evidence: Record decision factors and jump branches during the matching process to generate a structured derivation log; A segmented chained hash structure is used to divide the structured derivation log into multiple data blocks; Within each data block, a Merkle tree is used for hash aggregation to generate the root hash within the block; The root hash within the current data block is concatenated and anchored with the global verification hash of the previous data block to generate the global verification hash of the current data block, forming a chained storage structure.

5. The method according to claim 1, characterized in that, The security constraint verification of the draft rectification proposal includes: The draft rectification proposal is scanned using regular expressions. If executable command characters or system control instructions are detected, the draft rectification proposal is blocked. Verify that the JSON data structure of the draft rectification proposal contains all mandatory fields; Calculate the cosine similarity between the title of the proposed rectification and the historical proposals in the local knowledge base. If the similarity is lower than a preset threshold, a manual review warning is triggered.

6. The method according to claim 1, characterized in that, The local vulnerability knowledge base is updated in the following ways: External proxy clients regularly capture vulnerability intelligence from multiple sources and package it into incremental difference packets with digital signatures and encryption. The incremental difference packets are transferred to the internal network environment via a network gateway; After the internal network monitoring service detects the incremental difference packet, it automatically triggers signature compliance audit and data decryption, and dynamically and incrementally adds the parsed vulnerability data to the database without restarting the system.

7. The method according to claim 1, characterized in that, The step of adjusting the weight parameters of the five-dimensional weighted scoring model based on the deviation between the repair verification result and the comprehensive risk score includes: Obtain the deviation step size between the actual risk level after manual review and the predicted risk level corresponding to the comprehensive risk score; Based on the aforementioned deviation step size, the correction signal is backpropagated using the gradient descent algorithm, and the weight coefficients wi of the associated dimensions in the five-dimensional weighted scoring model are dynamically fine-tuned until the error between the predicted risk level and the actual risk level converges.

8. An operational risk assessment system based on CMDB and a local vulnerability database, characterized in that, include: The data acquisition module is used to obtain a snapshot of the target host's assets and vulnerability impact rules from the local vulnerability knowledge base; The intelligent matching module is used to compare the asset fact snapshot with the vulnerability impact rules using a multi-level matching strategy to determine the risk status; The risk assessment module is used to calculate a comprehensive risk score based on a five-dimensional weighted scoring model when the risk status is "affected". The decision support module is used to use retrieval enhancement generation technology to call a large language model to generate a draft of rectification suggestions, and to perform security constraint verification on the draft of rectification suggestions; The closed-loop evolution module is used to update the asset profile and knowledge base in response to the repair verification results, and to adjust the weight parameters of the five-dimensional weighted scoring model.

9. An electronic device, comprising: A processor, a memory, and a communication bus, wherein the processor and the memory communicate with each other via the communication bus; The memory stores program instructions that can be executed by the processor, and the processor can execute the method as described in any one of claims 1 to 7 by calling the program instructions.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 7.

Images