System and method for cyberposture assessment risk analysis

Abstract

The application discloses an equal protection evaluation risk analysis system and method, which comprises the following steps: acquiring network topology data, asset list and equal protection evaluation result data, determining non-conformities; aggregating assets into nodes and determining reachable relations according to an access control strategy, constructing an attack graph and associating the non-conformities to corresponding nodes; calculating path reachable probabilities of attack source nodes to each node; combining asset value coefficients to calculate risk values of each non-conformity and determining risk grades; virtually eliminating the non-conformities one by one and recalculating attack path expectations, generating rectification priorities according to descending quantities, and outputting a risk analysis report. The application improves the objectivity of equal protection evaluation risk analysis and the utilization efficiency of rectification resources, and is suitable for equal protection evaluation risk analysis work of information systems at all levels.

Description

Technical Field

[0001] This invention belongs to the field of network security level protection assessment technology, and specifically relates to a risk analysis system and method for level protection assessment. Background Technology

[0002] The information security protection assessment is conducted by qualified assessment agencies based on standards such as GB / T22239 "Information Security Technology - Basic Requirements for Network Security Level Protection" and GB / T28448 "Information Security Technology - Assessment Requirements for Network Security Level Protection". For assessment items that are non-compliant or partially compliant, the assessment agency needs to conduct a security risk analysis, determine the risk level of each non-compliance item, and propose rectification suggestions. The risk analysis results are an important basis for the tested unit to carry out rectification and hardening.

[0003] In the prior art, patent application CN117273460A discloses a method, system, terminal device, and storage medium for graded protection security assessment. The method obtains security-related information of the system to be assessed, establishes a threat model corresponding to the graded protection level of the target, simulates target attack scenarios for threats that meet the preset threat classification standards, and executes simulated attacks to generate a first assessment result. For threats that do not meet the preset threat classification standards, the method obtains the corresponding threat intelligence, performs dynamic analysis, generates threat features, conducts security assessments, obtains the potential risk rate, formulates a periodic security assessment plan based on this, and generates a second assessment result. This solution improves the automation of graded protection assessment through threat modeling and simulated attacks, but it still has the following drawbacks: First, its risk assessment values ​​are derived from threat intelligence features and preset security analysis rules. It does not quantify the actual reachable path of an attacker from the attack source to the assets involved in each non-compliance based on the network topology and access control policies of the system under test. Non-compliance located deep within the internal network with no external reachable path may still receive similar evaluation results as non-compliance directly exposed to the Internet, resulting in insufficient objectivity of the risk analysis results. Second, its output consists of assessment results and periodic assessment plans, without considering the reduction effect of fixing a certain non-compliance on the overall attack path of the system. When rectification resources are limited, it cannot answer the question of which non-compliance should be rectified first to improve the overall security level the most. Third, the implementation of simulated attacks depends on the construction of attack scenarios and the execution of real attack actions, which has high implementation costs and may affect the business operation of the system under test.

[0004] Attack graphs are an analytical technique that models potential attack paths in a target network. By abstracting hosts, devices, and their reachability relationships into nodes and edges, it depicts the possible paths an attacker could take to penetrate a target asset from the attack source. Existing attack graph techniques are primarily geared towards vulnerability scanning data or intrusion detection scenarios, focusing on the exploit dependencies between vulnerabilities. They have not yet been integrated with the non-compliance system identified in cybersecurity compliance assessments. Firstly, non-compliance in these assessments includes not only technical vulnerabilities but also management issues related to policy configuration, identity authentication, and security auditing, making them difficult to directly incorporate into traditional attack graph models. Secondly, the reachability results obtained from attack graph calculations have not been used to guide risk assessment and remediation prioritization after the assessment; cybersecurity compliance risk analysis remains largely based on manual experience. With the updating of high-risk determination requirements in cybersecurity compliance assessments, the assessment work emphasizes the identification of potential attack chains and the analysis of the cumulative effects of systemic risks.

[0005] Therefore, how to quantify attack reachability based on network topology and access control policies, and on this basis calculate the risk value of each non-compliance item and determine the remediation priority that contributes the most to the overall attack path reduction, is a technical problem that urgently needs to be solved in this field. Summary of the Invention The purpose of this invention is to provide a risk analysis system and method for information security compliance assessment, in order to solve the problems in existing risk analysis of information security compliance assessment, such as the failure to consider attack reachable paths when assigning risk values ​​to non-conformities, the failure to consider the contribution of rectification to the reduction of overall attack paths when ranking rectification, and the lack of objectivity of results due to reliance on human experience in the analysis process.

[0006] The specific technical solution is as follows: On the one hand, the present invention provides a risk analysis system for information security level protection assessment, the system comprising: an assessment data acquisition module, an attack graph construction module, a risk quantification module, and a rectification ranking module.

[0007] The evaluation data acquisition module is used to acquire network topology data, asset list and information security compliance evaluation results data of the information system under test; the information security compliance evaluation results data includes the evaluation conclusions of each evaluation item, and evaluation items with evaluation conclusions of non-compliance or partial compliance are recorded as non-compliance items.

[0008] The attack graph construction module is used to aggregate assets in the asset list into nodes based on the network topology data, determine the reachability relationship between nodes based on the access control policy between each node, construct an attack graph based on the nodes and the reachability relationship, and associate each non-compliance item as an exploitable vulnerability attribute with the corresponding node.

[0009] The risk quantification module is used to set the attack source node, calculate the path reachability probability of the attack source node to each associated node with non-compliance along the attack graph, and calculate the risk value of each non-compliance based on the path reachability probability and the value coefficient of the asset corresponding to the node.

[0010] The rectification and sorting module is used to virtually eliminate each non-compliance item one by one and recalculate the expected number of attack paths in the attack graph. The non-compliance items are sorted according to the decrease in the expected number of attack paths, and rectification priorities are generated and a risk analysis report is output.

[0011] Furthermore, the attack graph construction module, based on the security domain division in the network topology data, aggregates assets belonging to the same security domain and with the same protection strategy into a single node; it parses the access control policies on the boundary devices of each security domain, and when there is an access control policy that allows access from the source node to the destination node, it establishes a directed reachability relationship between the source node and the destination node, and assigns a connectivity probability to the reachability relationship based on the vulnerability exploitation difficulty of the service corresponding to the allowed port.

[0012] Furthermore, when the rectification and sorting module virtually eliminates a non-compliance item, it removes the exploitable vulnerability attribute corresponding to the non-compliance item from the attack graph, recalculates the path reachability probability of each node, uses the weighted sum of the path reachability probabilities of each node as the expected number of attack paths, determines the difference between the expected number of attack paths before and after the non-compliance item is eliminated as the rectification contribution of the non-compliance item, and sorts each non-compliance item in descending order of rectification contribution.

[0013] On the other hand, the present invention provides a risk analysis method for information security compliance assessment. Based on the system implementation of the present invention, the method includes the following steps: Step S1: Obtain the network topology data, asset list, and information security compliance assessment results data of the information system under test. The information security compliance assessment results data includes the assessment conclusions of each assessment item. Assessment items with assessment conclusions of non-compliance or partial compliance are recorded as non-compliance items.

[0014] Step S2: Aggregate the assets in the asset list into nodes based on the network topology data, determine the reachability relationship between nodes based on the access control policy between each node, construct an attack graph based on the nodes and the reachability relationship, and associate each non-compliance item as an exploitable vulnerability attribute with the corresponding node.

[0015] Step S3: Set the attack source node and calculate the path reachability probability of the attack source node to each associated node with non-compliance along the attack graph.

[0016] Step S4: Calculate the risk value of each non-compliance item based on the path reachability probability and the value coefficient of the asset corresponding to the node, and determine the risk level of each non-compliance item according to the preset risk threshold.

[0017] Step S5: Virtually eliminate each non-compliance item one by one and recalculate the expected number of attack paths in the attack graph. Sort each non-compliance item according to the decrease in the expected number of attack paths, generate rectification priorities, and output a risk analysis report.

[0018] Furthermore, step S1 also includes: representing each non-compliance item in a structured form as a triple, wherein the triple includes an assessment item identifier, an associated asset identifier, and a severity value; the severity value is determined by the weight of the assessment item and the degree of compliance of the assessment conclusion.

[0019] Further, in step S2, the construction of the attack graph specifically includes: aggregating assets in the same security domain and with the same protection policy into a node; parsing the access control policies of each security domain boundary device, and establishing a directed edge when there is an access control policy that allows access from the source node to the destination node; assigning a connectivity probability to the directed edge based on the vulnerability exploitation difficulty of the service corresponding to the allowed port, and assigning an exploitation probability to the node based on the exploitation success rate of the non-compliance item associated with the destination node.

[0020] Further, in step S3, the method for calculating the path reachability probability includes: enumerating all attack paths from the attack source node to the target node, and calculating the path utilization probability of each attack path: And calculate the path reachability probability of the target node: In the formula: For the first The probability of exploiting a given attack path; For the first There are directed edges on the attack path. The connectivity probability; For the first There are directed edges on the attack path. The node it points to The probability of node utilization; This represents the total number of attack paths from the source node to the target node. For the target node The path reachability probability.

[0021] Further, in step S4, the formula for calculating the risk value is: In the formula: For the first Risk value of each non-conforming item; For the related number The path reachability probability of a node that does not meet the criteria; The value coefficient of the asset corresponding to this node is determined by the importance of the business carried by the asset; The business impact coefficient is determined by the first... Determine the extent to which a non-compliance will affect the scope of business if it is exploited.

[0022] Further, in step S5, the formula for calculating the expected number of attack paths is: In the formula: The expected number of attack paths; This represents the total number of nodes in the attack graph; For nodes The path reachability probability; For nodes The weight is determined by the value coefficient of the assets within the node.

[0023] Virtually eliminate each non-compliant item one by one, and calculate the first one according to the following formula. The decrease corresponding to each non-compliant item: In the formula: For the first The decrease corresponding to each non-compliant item; For virtual elimination of the first The expected number of attack paths is recalculated after each non-compliance item; each non-compliance item is sorted from largest to smallest by the decrease amount to generate a rectification priority.

[0024] Furthermore, in step S5, the risk analysis report includes the risk value, risk level and rectification priority ranking of each non-compliance item, as well as the critical attack path from the attack source node to the node associated with the non-compliance item with the highest risk level. The critical attack path is the attack path with the highest probability of path utilization.

[0025] Compared with the prior art, the beneficial effects of this invention are: This invention establishes the risk assessment of non-compliance items in security level protection assessments on the basis of quantitative calculation of attack reachability. By depicting the reachable paths from the attack source to each asset through attack graphs, it replaces manual experience scoring with path reachability probability, enabling non-compliance items with different exposure surfaces to obtain risk values ​​that correspond to their actual usability. This improves the objectivity of risk analysis and consistency among different assessment personnel. By virtually eliminating non-compliance items one by one and recalculating the expected number of attack paths, it generates remediation priorities based on the contribution to reducing the overall attack paths. This allows limited remediation resources to be prioritized for non-compliance items that have the greatest impact on improving the overall security level of the system, providing intuitive evidence for the remediation and hardening of the tested unit and for the risk assessment review by the assessment agency. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the structure of the information security level assessment risk analysis system provided in an embodiment of the present invention; Figure 2 A flowchart of the information security level assessment risk analysis method provided in this embodiment of the invention; Figure 3This is a schematic diagram illustrating attack graph construction and risk quantification provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention are described clearly and completely below. Obviously, the described embodiments are only a part of the embodiments of this invention, not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0028] like Figure 1 As shown, this embodiment provides a security level assessment risk analysis system. The system is deployed on an assessment analysis server, which includes a processor and a memory. The memory stores a computer program, and when the processor executes the computer program, it implements the security level assessment risk analysis method of Embodiment 2 below.

[0029] The system comprises a test data acquisition module, an attack graph construction module, a risk quantification module, and a rectification ranking module, connected sequentially. The input side of the test data acquisition module connects to the system under test via a data interface to acquire network topology data, asset list, and compliance assessment results data. The network topology data is obtained through Simple Network Management Protocol (SMLP) acquisition or device configuration capture, including the connection relationships and security domain division information of each network device. The asset list includes the IP addresses, open ports, and services carried by each asset. The compliance assessment results data is imported through the assessment management interface, including the assessment conclusions for each assessment item; assessment items with conclusions of non-compliance or partial compliance are marked as non-compliant. The test data acquisition module structures the above data and outputs it to the attack graph construction module.

[0030] After receiving structured data, the attack graph construction module aggregates assets belonging to the same security domain and with the same protection policy into a single node based on the security domain division in the network topology data. It parses the access control policies on the boundary devices of each security domain. When there is an access control policy that allows access from the source node to the destination node, a directed reachability relationship is established between the source and destination nodes. The module assigns a connectivity probability to the reachability relationship based on the exploitability difficulty of the service corresponding to the allowed port, and assigns an exploit probability to the destination node based on the exploit success rate of non-compliance items associated with it. The attack graph construction module constructs an attack graph using the nodes and the reachability relationships, associating each non-compliance item as an exploitable vulnerability attribute with the corresponding node or directed edge, and outputs the completed attack graph to the risk quantification module.

[0031] After receiving the attack graph, the risk quantification module sets the attack source node, enumerates the attack paths from the attack source node to each node associated with non-compliance items along the attack graph, calculates the path reachability probability of each node, and then calculates the risk value of each non-compliance item based on the path reachability probability, the value coefficient of the corresponding asset, and the business impact coefficient of the node. The risk level of each non-compliance item is determined according to the preset risk threshold, and the risk value and risk level are output to the rectification sorting module.

[0032] The rectification and sorting module virtually eliminates each non-compliance item one by one: When a non-compliance item is virtually eliminated, the exploitable vulnerability attribute corresponding to that non-compliance item is removed from the attack graph, the path reachability probability of each node is recalculated, and the weighted sum of the path reachability probabilities of each node is used as the expected number of attack paths. The difference between the expected number of attack paths before and after the elimination of the non-compliance item is determined as the rectification contribution of the non-compliance item. The non-compliance items are sorted from largest to smallest according to their rectification contribution, and a rectification priority is generated. Finally, a risk analysis report is output, which includes the risk value, risk level and rectification priority ranking of each non-compliance item, as well as the critical attack path from the attack source node to the node associated with the non-compliance item with the highest risk level.

[0033] The data transfer relationship between the modules is as follows: assessment data collection module → attack graph construction module → risk quantification module → rectification ranking module. The output of the previous module serves as the input of the next module. The processing of each module does not require manual intervention, thus automating the risk analysis of the information security assessment.

[0034] Example 2 This embodiment provides a risk analysis method for information security level protection assessment, using a Level 3 information system to be tested as an example for illustration.

[0035] The network structure of the system is as follows: Web server S1 is deployed in the Internet access domain, application server S2 is deployed in the application service domain, and database server S3 is deployed in the core data domain; a boundary firewall F1 is set between the Internet and the Internet access domain, and an internal firewall F2 is set between the Internet access domain and the application service domain, and between the application service domain and the core data domain.

[0036] like Figure 2 As shown, the method includes the following steps.

[0037] Step S1: Obtain the network topology data, asset list, and information security compliance assessment results data of the information system under test. The information security compliance assessment results data includes the assessment conclusions of each assessment item. Assessment items with assessment conclusions of non-compliance or partial compliance are recorded as non-compliance items.

[0038] Specifically, the system obtains the access control policy configurations of firewalls F1 and F2, asset information (IP address, open ports, services carried) of each server, and information security compliance assessment results. Each non-compliance item is structured as a triple, which includes the assessment item identifier corresponding to the non-compliance item, the associated asset identifier, and the severity value.

[0039] The severity value is determined by the weight of the evaluation item and the degree of conformity with the evaluation conclusion. The specific determination method is as follows: based on the degree of influence of the evaluation item on the security protection target in GB / T28448 "Information Security Technology - Network Security Level Protection Evaluation Requirements", the weight of the evaluation item is divided into four levels: the weight of the key evaluation item is 4, the weight of the important evaluation item is 3, the weight of the general evaluation item is 2, and the weight of the minor evaluation item is 1. The conformity coefficient of the evaluation conclusion is taken according to the evaluation conclusion, with 1.0 for non-compliance and 0.5 for partial compliance. The severity value is equal to the product of the weight of the evaluation item and the conformity coefficient.

[0040] In this embodiment, there are 4 non-compliance items in the information security compliance assessment results data, all of which are non-compliant, with a compliance coefficient of 1.0 for each: N1 (Assessment item: Access control; Related asset: F1; Severity value 3), specifically, F1 has a policy that allows access with both source and destination addresses being ANY. Access control is an important assessment item with a weight of 3 and a severity value of 3 × 1.0 = 3; N2 (Assessment item: Vulnerability and risk management; Related asset: S2; Severity value 4), specifically, S2 has an unpatched high-risk vulnerability that can be publicly exploited. Code, vulnerabilities, and risk management are key assessment items with a weight of 4 and a severity value of 4 × 1.0 = 4; N3 (assessment item: identity authentication; associated assets: S3; severity value 3), specifically, the default management account of S3 is not disabled, identity authentication is an important assessment item with a weight of 3 and a severity value of 3 × 1.0 = 3; N4 (assessment item: security audit; associated assets: S3; severity value 2), specifically, security audit is not enabled in S3, security audit is a general assessment item with a weight of 2 and a severity value of 2 × 1.0 = 2.

[0041] Step S2: Aggregate the assets in the asset list into nodes based on the network topology data, determine the reachability relationship between nodes based on the access control policy between each node, construct an attack graph based on the nodes and the reachability relationship, and associate each non-compliance item as an exploitable vulnerability attribute with the corresponding node.

[0042] like Figure 3As shown, assets belonging to the same security domain and with the same protection policy are aggregated into nodes: Internet access domain node D (including S1), application service domain node M (including S2), and core data domain node C (including S3), and an attack source node A0 (Internet side) is set. Access control policies F1 and F2 are parsed, and directed edges are established between node pairs with allow policies: A0→D, D→M, M→C, A0→M, D→C.

[0043] Connectivity probability of directed edges The probability of a port being allowed is assigned based on the ease of exploiting the vulnerability in the corresponding service. The specific assignment rules are as follows: if publicly available exploit code exists for the service corresponding to the allowed port, the connectivity probability is 0.8–0.9; if a known vulnerability exists but exploitation conditions are stringent, the probability is 0.5–0.7; if only the port is open and no known vulnerability has been discovered, the probability is 0.2–0.4. In an optional implementation, the vulnerability exploitability rating can be referenced: 0.8–0.9 corresponds to a vulnerability exploit maturity level of functional exploit code or automated exploitation tools; 0.5–0.7 corresponds to a vulnerability exploit maturity level of proof-of-concept; and 0.2–0.4 corresponds to a vulnerability exploit maturity level of no publicly available exploitation proof. Within each level, the probability is further determined based on the required permissions and user interaction for the attack. The upper limit is used for attacks requiring neither permissions nor user interaction, while the lower limit is used for attacks requiring either permissions or user interaction.

[0044] The process for determining the connectivity probability of each directed edge in this embodiment is as follows: Edge A0→D: S1's web service is publicly accessible and has a known vulnerability with publicly available exploit code. It does not require user permission to interact, so the score is 0.9. Edge D→M: Because F1 has an ANY allow policy, S2's application service port is directly accessible, and the corresponding service has functional exploit code, so the score is 0.8. Edge M→C: S3's database service port has a known vulnerability, but exploitation requires specific configuration conditions, so the score is 0.7. Edge A0→M: F1 only opens a few management ports in the application service domain direction, and no known vulnerabilities were found, so the score is 0.3. Edge D→C: F2 only opens backup ports, and no known vulnerabilities were found, so the score is 0.2.

[0045] Node utilization probability The value is assigned based on the success rate of exploitation of nonconformities associated with the node. The specific assignment rules are as follows: when the associated nonconformity is a vulnerability with publicly available exploit code, the value is 0.8 to 0.9; when it is a weak password or default account, the value is 0.6 to 0.8; when it is a configuration defect, the value is 0.4 to 0.6; when there are no associated nonconformities in the node, the base value of 0.1 to 0.5 is taken based on the patch update and baseline verification status of the assets within the node. If the patch update is timely and the baseline verification is passed in all cases, the value is 0.1; if the patch update is delayed or the baseline verification has failed items, the value is 0.3 to 0.5.

[0046] In this embodiment, node D has no associated non-compliance items, and its patch updates are generally timely, but the baseline check has failed items. Take a baseline value of 0.5; Node M is associated with N2, where N2 is a vulnerability class that does not meet the criteria for publicly available exploit code. Take 0.8; Node C is associated with N3, where N3 is a default account type non-compliance item. Its exploitation requires the attacker to first obtain internal network access conditions; therefore, take the lower limit value of this level. Take 0.6. Non-compliance item N1 is a boundary policy non-compliance item, associated with the directed edges D→M and A0→M affected by its allowance policy; non-compliance item N4 is an audit detection non-compliance item, associated with the business impact attribute of node C, and does not participate in the probability calculation of the attack path.

[0047] Step S3: Set the attack source node and calculate the path reachability probability of the attack source node to each associated node with non-compliance along the attack graph.

[0048] The method for enumerating attack paths is as follows: starting from the attack source node, perform a depth-first traversal along the directed edges. During the traversal, do not repeatedly visit the already visited nodes to avoid loops. When the target node is reached, record an attack path until all reachable branches have been traversed.

[0049] Node D has only one attack path A0→D, and the probability of path utilization is 0.9 × 0.5 = 0.45. .

[0050] There are two attack paths from attack source node A0 to node M: the probability of path A0→D→M. ; Path utilization probability of path A0→M The path reachability probability of node M. .

[0051] There are three attack paths from attack source node A0 to node C: the probability of using the path A0→D→M→C is 0.9×0.5×0.8×0.8×0.7×0.6≈0.1210; the probability of using the path A0→M→C is 0.3×0.8×0.7×0.6≈0.1008; and the probability of using the path A0→D→C is 0.9×0.5×0.2×0.6=0.054. The reachability probability of node C is... .

[0052] Step S4: Calculate the risk value of each non-compliance item based on the path reachability probability and the value coefficient of the asset corresponding to the node, and determine the risk level of each non-compliance item according to the preset risk threshold.

[0053] Asset value coefficient The asset value coefficient is determined by the importance of the business carried by the asset. Specifically, the business carried by the asset is graded and valued according to its importance: core business is assigned 1.0, important business is assigned 0.8, general business is assigned 0.6, and peripheral business is assigned 0.4. The data processed by the asset is graded and valued according to its sensitivity: highly sensitive data is assigned 1.0, sensitive data is assigned 0.8, general data is assigned 0.6, and publicly available data is assigned 0.4. The asset value coefficient is equal to the weighted sum of the business importance coefficient and the data sensitivity coefficient.

[0054] In this embodiment, the weights of both are each set to 0.5, that is: When a node contains multiple assets, the maximum value coefficient of each asset within the node is taken as the node's value coefficient.

[0055] In this embodiment, node C carries core business operations and processes highly sensitive data. Node M carries important business operations and processes sensitive data. Node D carries general business and processes general data. .

[0056] Business Impact Coefficient The value is determined by the extent to which the non-compliance is exploited and affects the business scope. The specific assignment rules are as follows: 0.8–1.0 for impacting the entire system's business; 0.5–0.7 for impacting a single business; and 0.2–0.4 for only causing localized impact. In this embodiment, after N2 is exploited, the attacker can control the application server, affecting a single application service. Take 0.7; if N3 is exploited, it can lead to the leakage or tampering of core data, affecting the entire system's operations. A value of 0.9 is used; N1 causes access control between the Internet and the application service domain to fail, affecting only the services carried by that access control channel. Taking 0.5; N4 makes safety incidents untraceable, affecting incident handling and evidence collection. Take 0.6.

[0057] The risk value of each non-conformity item is calculated as follows: calculate: ; N1 represents a non-compliance item in the boundary policy category, and its risk value is calculated based on the path reachability probability of the deepest reachable node affected by its permission policy. ; .

[0058] The preset risk thresholds are determined as follows: The risk value distribution of each non-conformity item in the historical assessment projects of the assessment agency is statistically analyzed. The upper quartile of the distribution is taken as the high-risk threshold, and the median of the distribution is taken as the lower limit of the medium-risk threshold. In this embodiment, the risk thresholds statistically determined based on historical projects are: a risk value not lower than 0.25 is considered high risk, 0.10 to 0.25 is medium risk, and below 0.10 is low risk. Accordingly, N2 is high risk, and N1, N3, and N4 are medium risk.

[0059] Step S5: Virtually eliminate each non-compliance item one by one and recalculate the expected number of attack paths in the attack graph. Sort each non-compliance item according to the decrease in the expected number of attack paths, generate rectification priorities, and output a risk analysis report.

[0060] Node weight The value coefficient of the assets within a node is used. When a node contains a single asset, the value coefficient of that asset is used. When multiple assets are aggregated within a node, the maximum value coefficient or a weighted sum of the value coefficients of each asset is used. In this embodiment, , , The expected number of attack paths in the current attack graph. .

[0061] The calculation method for virtual elimination of each non-compliance item is as follows: When virtually eliminating a non-compliance item of the vulnerability attribute type, the node utilization probability or directed edge connectivity probability corresponding to the non-compliance item is removed from the attack graph, or restored to the baseline value when there is no non-compliance item. The remaining parameters before and after elimination remain unchanged to ensure that the rectification contribution of each non-compliance item is comparable under the same calculation method.

[0062] Virtual elimination N2 (will) Removed): Node M is unusable. The only remaining path for the attack source to reach node C is A0→D→C. Recalculate Decrease .

[0063] Virtual elimination N1 (fixing the ANY allow policy of F1, reducing the connectivity probability of D→M to 0.3 and the connectivity probability of A0→M to 0.1): recalculate the path reachability probability of node M. The path reachability probability of node C , Decrease .

[0064] Virtual elimination N3 (will) Remove): , Decrease .

[0065] Virtual elimination of N4: N4 is an audit detection non-compliance item, which does not affect the attack path and reduces the amount of attack. If the risk value is 0, the rectification priority is listed last, and it is marked separately in the report according to its risk value.

[0066] Sort by the amount of reduction from largest to smallest, the rectification priorities are N2, N1, N3, and N4. It should be noted that if sorted by isolated risk value, the rectification order would be N2, N3, N1, and N4. However, after sorting by rectification contribution, N1 has a higher priority than N3, indicating that the "ANY allow" policy for fixing F1 has a greater effect on reducing the overall attack path of the system than disabling the default account for S3. Therefore, rectification resources should be prioritized for N1.

[0067] The risk analysis report includes the risk value, risk level, and rectification priority ranking of each non-compliance item, as well as the key attack paths: among the attack paths from the attack source node A0 to the node M associated with the high-risk non-compliance item N2, the attack path with the highest path utilization probability is A0→D→M (path utilization probability 0.288). The report marks and displays the nodes and directed edges on this path.

[0068] Furthermore, after the tested unit completes the rectification according to the rectification priority, it can re-enter the rectified configuration and evaluation data into this system for re-testing. For example, after fixing N2, node M is no longer associated with vulnerability-related non-compliance items, and is determined according to the baseline value rules. Taking 0.3, the path utilization probability of path A0→D→M is recalculated as 0.9×0.5×0.8×0.3=0.108, and the path utilization probability of path A0→M is 0.3×0.3=0.09. The path reachability probability of node M is... The value decreased significantly from 0.4589 before the repair, and the predicted ranking of the contribution of the rectification was consistent with the retest results, which verified the effectiveness of the rectification priority ranking of the present invention.

[0069] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A risk analysis system for information security compliance assessment, characterized in that, The system includes: an evaluation data acquisition module, an attack graph construction module, a risk quantification module, and a rectification ranking module; The evaluation data acquisition module is used to acquire network topology data, asset list and information security compliance evaluation results data of the information system under test; the information security compliance evaluation results data includes the evaluation conclusions of each evaluation item, and evaluation items with evaluation conclusions of non-compliance or partial compliance are recorded as non-compliance items; The attack graph construction module is used to aggregate assets in the asset list into nodes according to the network topology data, determine the reachability relationship between nodes according to the access control policy between each node, construct an attack graph with the nodes and the reachability relationship, and associate each non-compliance item as an exploitable vulnerability attribute with the corresponding node. The risk quantification module is used to set the attack source node, calculate the path reachability probability of the attack source node to each associated node with non-compliance along the attack graph, and calculate the risk value of each non-compliance based on the path reachability probability and the value coefficient of the asset corresponding to the node. The rectification sorting module is used to virtually eliminate each non-compliance item one by one and recalculate the expected number of attack paths in the attack graph. The non-compliance items are sorted according to the decrease in the expected number of attack paths, and a rectification priority is generated and a risk analysis report is output.

2. The system according to claim 1, characterized in that, The attack graph construction module divides assets in the same security domain and with the same protection policy into a single node based on the security domain division in the network topology data; it parses the access control policies of the boundary devices of each security domain, establishes a directed reachability relationship when there is an access control policy that allows access from the source node to the destination node, and assigns a connectivity probability to the reachability relationship based on the vulnerability exploitation difficulty of the service corresponding to the allowed port.

3. The system according to claim 1, characterized in that, When the rectification and sorting module virtually eliminates a non-compliance item, it removes the exploitable vulnerability attribute of the non-compliance item from the attack graph, recalculates the path reachability probability of each node, uses the weighted sum of the path reachability probabilities of each node as the expected number of attack paths, determines the rectification contribution of the non-compliance item by the difference between the expected number of attack paths before and after elimination, and sorts them in descending order of rectification contribution.

4. A method for risk analysis in information security compliance assessment, wherein the method is based on the system described in any one of claims 1-3, characterized in that, The method includes the following steps: Step S1: Obtain the network topology data, asset list and information security compliance assessment results data of the information system under test. The information security compliance assessment results data includes the assessment conclusions of each assessment item. Assessment items with assessment conclusions of non-compliance or partial compliance are recorded as non-compliance items. Step S2: Aggregate the assets in the asset list into nodes according to the network topology data, determine the reachability relationship between nodes according to the access control policy between each node, construct an attack graph with the nodes and the reachability relationship, and associate each non-compliance item as an exploitable vulnerability attribute with the corresponding node. Step S3: Set the attack source node and calculate the path reachability probability of the attack source node to each associated node with non-compliance along the attack graph. Step S4: Calculate the risk value of each non-compliance item based on the path reachability probability and the value coefficient of the asset corresponding to the node, and determine the risk level of each non-compliance item according to the preset risk threshold. Step S5: Virtually eliminate each non-compliance item one by one and recalculate the expected number of attack paths in the attack graph. Sort each non-compliance item according to the decrease in the expected number of attack paths, generate rectification priorities, and output a risk analysis report.

5. The method according to claim 4, characterized in that, Step S1 further includes: representing each non-compliance item in a structured form as a triple, wherein the triple includes an assessment item identifier, an associated asset identifier, and a severity value; the severity value is determined by the weight of the assessment item and the degree of compliance of the assessment conclusion.

6. The method according to claim 5, characterized in that, In step S2, the construction of the attack graph specifically includes: aggregating assets in the same security domain and with the same protection policy into a node; parsing the access control policies of each security domain boundary device, and establishing a directed edge when there is an access control policy that allows access from the source node to the destination node; assigning a connectivity probability to the directed edge based on the vulnerability exploitation difficulty of the service corresponding to the allowed port, and assigning a node exploitation probability to the destination node based on the exploitation success rate of the non-compliance item associated with the destination node.

7. The method according to claim 6, characterized in that, In step S3, the method for calculating the path reachability probability includes: enumerating all attack paths from the attack source node to the target node, and calculating the path utilization probability of each attack path. And calculate the path reachability probability of the target node: In the formula: For the first The probability of exploiting a given attack path; For the first There are directed edges on the attack path. The connectivity probability; For the first There are directed edges on the attack path. The node it points to The probability of node utilization; This represents the total number of attack paths from the source node to the target node. For the target node The path reachability probability.

8. The method according to claim 7, characterized in that, In step S4, the formula for calculating the risk value is: In the formula: For the first Risk value of each non-conforming item; For the related number The path reachability probability of a node that does not meet the criteria; The value coefficient of the asset corresponding to this node is determined by the importance of the business carried by the asset; The business impact coefficient is determined by the first... Determine the extent to which a non-compliance will affect the scope of business if it is exploited.

9. The method according to claim 8, characterized in that, In step S5, the formula for calculating the expected number of attack paths is: In the formula: The expected number of attack paths; This represents the total number of nodes in the attack graph; For nodes The path reachability probability; For nodes The weight is determined by the value coefficient of the assets within the node; Virtually eliminate each non-compliant item one by one, and calculate the first one according to the following formula. The decrease corresponding to each non-compliant item: In the formula: For the first The decrease corresponding to each non-compliant item; For virtual elimination of the first The expected number of attack paths is recalculated after each non-compliance item; each non-compliance item is sorted from largest to smallest by the decrease amount to generate a rectification priority.

10. The method according to claim 9, characterized in that, In step S5, the risk analysis report includes the risk value, risk level and rectification priority ranking of each non-compliance item, as well as the critical attack path from the attack source node to the node associated with the non-compliance item with the highest risk level. The critical attack path is the attack path with the highest probability of path utilization.

Images