Network exposure surface multi-dimensional quantitative evaluation method and system

Abstract

The application relates to a network exposure surface multi-dimensional quantitative evaluation method and system, which comprises the following steps: obtaining running data of a target network system within a preset time window; performing a pretreatment operation on the running data to generate a standardized data set; inputting the standardized data set into a pre-trained deep learning model to extract a multi-dimensional feature vector, including a network topology structure feature, an access control policy feature and a vulnerability distribution feature; calculating an exposure surface quantitative index based on the multi-dimensional feature vector by using a quantitative evaluation algorithm; and generating a risk evaluation report according to the exposure surface quantitative index and outputting the report. The application can solve the problem that the existing evaluation method cannot comprehensively and accurately reflect the real situation of the network exposure surface, and realizes accurate quantification of the network exposure surface risk.

Description

Technical Field

[0001] This application relates to the fields of network security and information technology, and in particular to a method and system for multi-dimensional quantitative assessment of network exposure surface. Background Technology

[0002] In today's digital age, cybersecurity has become a focal point across various industries. Network exposure surface assessment, as a crucial component of a cybersecurity protection system, is undeniably important. Traditional network exposure surface assessments often focus on single-dimensional information, such as analyzing only network topology or focusing solely on known vulnerabilities. This single-dimensional assessment approach fails to comprehensively and accurately grasp the potential threats facing the network system.

[0003] To overcome the shortcomings of traditional assessment methods, some emerging assessment approaches are beginning to integrate data from multiple sources for analysis. These methods attempt to assess network exposure from multiple perspectives by collecting operational data of the network system, such as network traffic and system configuration information. However, these methods still have significant limitations in practical applications.

[0004] One prominent issue is that these methods often lack in-depth data mining and effective integration. While data from various sources is collected, the synergistic effect of this data is not fully utilized during processing, resulting in assessments that fail to comprehensively reflect the true state of network exposure. For example, when analyzing network traffic data and system configuration data, the two are not organically combined, making it difficult to discover potential exploitation paths hidden behind the data. Summary of the Invention

[0005] The main purpose of this application is to provide a multi-dimensional quantitative assessment method for network exposure surface to solve the problem that existing assessment methods cannot fully and accurately reflect the true situation of network exposure surface, and to achieve precise quantification of network exposure surface risk.

[0006] To achieve the above objectives, embodiments of the present invention provide a multi-dimensional quantitative evaluation method for network exposure surfaces, the method comprising: Acquire operational data of the target network system within a preset time window, including network traffic log information, system configuration parameters, and external threat intelligence data; The runtime data is preprocessed to generate a standardized dataset; The standardized dataset is input into a pre-trained deep learning model, and the deep learning model extracts multi-dimensional feature vectors of the target network system. The multi-dimensional feature vectors include network topology features, access control policy features, and vulnerability distribution features. Based on the multi-dimensional feature vector, the exposure surface quantitative index of the target network system is calculated using a quantitative evaluation algorithm. The exposure surface quantitative index includes the number of exposed nodes, the path length for potential vulnerabilities to be exploited, and the probability of vulnerability exploitation. A risk assessment report for the target network system is generated based on the exposure surface quantification index, and the risk assessment report is output.

[0007] Accordingly, embodiments of this application also provide a multi-dimensional quantitative evaluation system for network exposure surfaces, the system comprising: The acquisition module is used to acquire the operational data of the target network system within a preset time window. The operational data includes network traffic log information, system configuration parameters, and external threat intelligence data. The preprocessing module is used to preprocess the running data to generate a standardized dataset; The feature extraction module is used to input the standardized dataset into a pre-trained deep learning model and extract multi-dimensional feature vectors of the target network system through the deep learning model. The multi-dimensional feature vectors include network topology features, access control policy features, and vulnerability distribution features. The indicator generation module is used to calculate the exposure surface quantitative indicator of the target network system based on the multi-dimensional feature vector and using a quantitative evaluation algorithm. The exposure surface quantitative indicator includes the number of exposed nodes, the length of the path for potential vulnerabilities to be exploited, and the probability of vulnerability exploitation. The risk report generation module is used to generate a risk assessment report for the target network system based on the exposure surface quantification index, and output the risk assessment report.

[0008] In summary, the technical solution of this application, by acquiring operational data of the target network system within a preset time window, including network traffic logs, system configuration parameters, and external threat intelligence data, provides a comprehensive and rich data foundation for assessment. Preprocessing the operational data to generate a standardized dataset improves data quality and ensures the accuracy of subsequent analysis. Inputting the standardized dataset into a pre-trained deep learning model extracts multi-dimensional feature vectors, including network topology features, access control policy features, and vulnerability distribution features, enabling in-depth analysis of the network exposure surface characteristics from multiple perspectives. Based on these multi-dimensional feature vectors, quantitative assessment algorithms are used to calculate exposure surface quantification indicators, such as the number of exposed nodes, the length of potential vulnerability exploitation paths, and the probability of vulnerability exploitation, accurately quantifying the risk level of the network exposure surface. Generating and outputting a risk assessment report based on the exposure surface quantification indicators provides network security managers with intuitive and effective decision-making support, enabling them to take timely and targeted protective measures to reduce network security risks and improve the security and reliability of the network system. Therefore, this solution addresses the problem that existing assessment methods cannot comprehensively and accurately reflect the true situation of the network exposure surface, achieving precise quantification of network exposure surface risks. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a schematic diagram of a scenario for the multi-dimensional quantitative evaluation method of network exposure surface in the embodiments of this application; Figure 2 A flowchart is provided for a multi-dimensional quantitative evaluation method of network exposure surface in the embodiments of this application; Figure 3 A schematic diagram illustrating the process of quantifying exposure surface indexes provided in an embodiment of this application; Figure 4 A flowchart illustrating the statistics of the number of exposed nodes provided in an embodiment of this application; Figure 5 A flowchart illustrating the process of determining the set of potential vulnerability exploitation paths provided in the embodiments of this application; Figure 6 A schematic diagram illustrating the process of correcting the actual utilization probability provided in the embodiments of this application; Figure 7 A flowchart illustrating the vulnerability status determination provided in an embodiment of this application; Figure 8A flowchart illustrating the actual utilization probability calculation is provided for the embodiments of this application; Figure 9 This is a schematic diagram of the structure of the network exposure surface multi-dimensional quantitative evaluation system provided in the embodiments of this application; Figure 10 A schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0011] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0012] This application provides a method and system for multi-dimensional quantitative evaluation of network exposure surface, which will be described in detail below.

[0013] In this embodiment, the multi-dimensional quantitative assessment method for network exposure surfaces is a method that comprehensively utilizes deep learning technology to accurately quantify and assess network exposure surfaces from multiple dimensions. This method aims to comprehensively and accurately identify potential penetration risks in network systems, providing a scientific and reliable basis for network security protection decisions. Specifically, the method first acquires operational data of the target network system within a preset time window. This data includes network traffic logs, system configuration parameters, and external threat intelligence data, comprehensively covering the operational status and potential threat information of the network system. Next, the acquired operational data undergoes preprocessing operations, including data cleaning, format standardization, and outlier removal, generating a standardized dataset to improve data quality and usability. Then, the standardized dataset is input into a pre-trained deep learning model to extract multi-dimensional feature vectors of the target network system, such as network topology features, access control policy features, and vulnerability distribution features, characterizing the network exposure surface from different perspectives. Based on the extracted multi-dimensional feature vectors, a quantitative assessment algorithm is used to calculate quantitative indicators of the target network system's exposure surface, such as the number of exposed nodes, the length of potential vulnerability exploitation paths, and the probability of vulnerability exploitation, accurately quantifying the risk level of the network exposure surface. Finally, a risk assessment report for the target network system is generated and output based on the quantitative indicators of the exposure surface, providing network security managers with intuitive and clear decision-making references. The entire process is a systematic, comprehensive, and accurate assessment that effectively improves the accuracy and reliability of network exposure surface assessment and enhances the security of network systems.

[0014] In this embodiment, the network exposure surface refers to the collection of all potential pathways and weaknesses in a network system that can be exploited by unauthorized personnel to launch penetration attacks, encompassing multiple dimensions such as hardware, software, network protocols, and human operation. On the hardware side, this may include chip design flaws or firmware vulnerabilities in devices such as servers and routers; on the software side, it may include security vulnerabilities in operating systems and applications, such as remote execution vulnerabilities in Windows systems and SQL injection vulnerabilities in web applications; regarding network protocols, it may include design and implementation defects in network protocols, such as security vulnerabilities in early WEP protocols, which can expose network communication to risks; and unreasonable or improperly configured network topology, such as opening unnecessary ports or using weak passwords, will increase the exposure to penetration risks.

[0015] As shown in Figure 1, a scenario for multi-dimensional quantitative assessment of network exposure surface is provided. In this scenario, the system mainly includes a data acquisition system, a data preprocessing module, a deep learning model training and application engine, a quantitative assessment algorithm module, and a risk assessment report generation system. The data acquisition system, the target network system (taking a large e-commerce enterprise network as an example), the data preprocessing module, the deep learning model training and application engine, the quantitative assessment algorithm module, and the risk assessment report generation system are interconnected and work together through the network.

[0016] Taking the network environment of a large e-commerce company as an example, this scenario involves a massive and complex network system. The company's network assets are diverse. On the server side, there are web servers responsible for handling product display and user browsing requests, ensuring users can smoothly browse product information; and transaction servers handling order transactions and payment settlements, ensuring the accuracy and security of each transaction. Database servers store massive amounts of product information, user information, and transaction records—data that is core to the company's operations. Terminal devices include office computers used by employees, mobile devices, and various client devices used by users. Employees use office equipment for daily operations management, while users use client devices for shopping. Network devices such as routers and switches construct the network's communication architecture, ensuring efficient data transmission between different departments, regions, and with external partners. These devices run various software and applications, such as operating systems (Linux, Windows, etc.), web server software (Apache, Nginx, etc.), database management systems (MySQL, Oracle, etc.), and e-commerce business-related applications, and frequently interact with external networks, including system integration with suppliers and communication with payment institutions.

[0017] The operational data acquisition system comprehensively acquires operational data of the target network system within a preset time window. For network traffic logs, traffic collectors are deployed on network devices to collect real-time communication traffic data between various devices and systems, including detailed information such as source address, destination address, port number, traffic volume, and transmission time. For example, when a user searches for or places an order for a product, the traffic collector records relevant network communication information. For system configuration parameters, various configuration information is extracted from servers, network devices, and business systems, such as firewall access control rules, server port open status, and database permission settings. For external threat intelligence data, collaboration with professional security intelligence agencies yields the latest network penetration trends, common penetration methods, and newly discovered security vulnerabilities. For example, when a new vulnerability is discovered in a popular web server software, the external threat intelligence data is updated promptly.

[0018] After receiving data from the running data acquisition system, the data preprocessing module performs preprocessing operations to generate a standardized dataset. The data cleaning phase removes noise and errors from the running data. For example, abnormal traffic records caused by network failures or erroneous parameters in system configuration files are identified and deleted. The format standardization phase converts data from different sources and in different formats into a unified format. For example, traffic logs generated by different network devices may have different formats; after format standardization, all traffic log data have the same fields and format. The outlier removal phase identifies and removes data that clearly does not conform to normal business patterns. For example, suddenly appearing abnormally high traffic or abnormal system configuration parameter values ​​are considered outliers and removed. Through these preprocessing operations, the quality and usability of the data are improved, providing a reliable data foundation for subsequent analysis.

[0019] The deep learning model training and application engine utilizes preprocessed standardized datasets for model training and application. During training, a deep learning model architecture suitable for network exposure feature extraction is constructed, such as a combination of Convolutional Neural Networks (CNNs) and Long Short-Term Memory Networks (LSTMs). CNNs are used to process spatially structured data, such as network topology features, and can extract local features of nodes and edges. LSTMs are suitable for processing sequential data; for time-series data such as network traffic logs, they can capture temporal dependencies. The standardized dataset is divided into training, validation, and test sets, and stochastic gradient descent (SGD) and its variants (such as the Adam optimizer) are used to learn and update the model parameters. In the application phase, the standardized dataset is input into the trained model, which outputs a multi-dimensional feature vector of the target network system, including network topology features, access control policy features, and vulnerability distribution features. For example, for network topology features, the model can extract information such as the connection relationships and hierarchical structure of devices and systems in the network; for access control policy features, it can analyze key information such as permission allocation rules and access path constraints; for vulnerability distribution features, it can indicate the device where the vulnerability is located, the type of vulnerability, and its severity.

[0020] The quantitative evaluation algorithm module, based on the multi-dimensional feature vectors output by the deep learning model, calculates the quantitative index of the exposure surface of the target network system. For the number of exposed nodes, it analyzes network topology characteristics to identify and statistically analyze nodes directly connected to the external network. For example, it determines which servers directly provide services to the internet and become potential exposed nodes. For the path length for potential vulnerability exploitation, it uses graph theory algorithms, such as Dijkstra's algorithm, to calculate the shortest path length from the external network to internal core nodes for unauthorized access. For example, it calculates the shortest path from the internet to the transaction server. For the probability of vulnerability exploitation, it comprehensively evaluates factors such as vulnerability severity, disclosure time, patch status, and network system protection measures. For example, a high-severity, unpatched vulnerability has a relatively high probability of exploitation.

[0021] The risk assessment report generation system generates a risk assessment report for the target network system based on the exposure surface quantification indicators calculated by the quantitative assessment algorithm module. The report details the specific values ​​of exposure surface quantification indicators such as the number of exposed nodes, the length of potential vulnerability exploitation paths, and the probability of vulnerability exploitation, and analyzes and interprets these indicators. For example, it identifies which exposed nodes pose a high security risk, which potential vulnerability exploitation paths are most easily exploited, and which vulnerabilities require priority remediation. Simultaneously, based on the degree of exposure surface risk, it proposes corresponding security recommendations and protective measures, such as strengthening access control to exposed nodes, monitoring potential vulnerability exploitation paths, and promptly remediating high-risk vulnerabilities. Finally, the risk assessment report is output to network security managers, providing them with intuitive and effective decision-making support to help them take targeted measures to reduce network security risks, ensure the secure and stable operation of e-commerce enterprise network systems, and guarantee user shopping experience and data security.

[0022] refer to Figure 2 , Figure 2 This is a flowchart illustrating a multi-dimensional quantitative assessment method for network exposure surface provided in this application embodiment. The execution subject of this method can be a computer device, which can be a single computer device or a cluster of multiple computer devices. The computer device can be a terminal device or a server, etc. The multi-dimensional quantitative assessment method for network exposure surface provided in this application embodiment specifically includes: S10: Obtain the operating data of the target network system within a preset time window. The operating data includes network traffic log information, system configuration parameters, and external threat intelligence data.

[0023] In this embodiment, network traffic log information is a detailed record of data transmission between various devices and systems in the network. For example, in an enterprise network, network traffic log information can record file transfers between employee computers and servers, business data interactions between different departments, etc. System configuration parameters refer to various configuration settings of network devices and systems, such as router routing tables, firewall access control rules, and server operating system configurations. External threat intelligence data comes from information from professional security intelligence agencies, including newly discovered security vulnerabilities, characteristics of malware, and hacker penetration trends. Obtaining this operational data allows for a comprehensive understanding of the target network system's operational status and potential threats. From a technical perspective, comprehensively and accurately obtaining operational data provides a rich information foundation for subsequent assessments, helping to more accurately identify risks on the network exposure surface.

[0024] In one embodiment, network traffic log information can be collected in real time by installing a traffic collector on the network device. The traffic collector can listen to the network interface, capture all data packets passing through that interface, and record information such as the source address, destination address, port number, and traffic volume of the data packets. System configuration parameters can be obtained from the network device and the system via network management protocols (such as SNMP). By sending a request command to the device, the device will return its current configuration information. For external threat intelligence data, a cooperative relationship can be established with professional security intelligence agencies to regularly obtain the latest threat intelligence data.

[0025] S20: Perform preprocessing operations on the running data to generate a standardized dataset. The preprocessing operations include data cleaning, format standardization, and outlier removal.

[0026] In this embodiment, data cleaning is the process of removing noise, errors, and duplicate information from runtime data. For example, network traffic logs may contain erroneous data packet records caused by network failures; data cleaning can remove these erroneous records. Format standardization converts data from different sources and in different formats into a unified format for subsequent analysis and processing. For example, system configuration parameters generated by different devices may have different formats; format standardization can convert them into the same format. Outlier removal identifies and removes data that clearly does not conform to normal business patterns. For example, in network traffic, a sudden surge in abnormally high traffic may be caused by penetration testing or malfunctions; outlier removal can remove these abnormal traffic records. Generating standardized datasets through preprocessing operations improves data quality and usability. From a technical perspective, high-quality standardized datasets can improve the accuracy and reliability of subsequent analysis.

[0027] In one embodiment, for data cleaning, data mining algorithms, such as cluster analysis, can be used to group similar data, identify and remove abnormal data records. For format standardization, data conversion scripts can be written to convert data of different formats into a unified format according to predefined rules. For outlier removal, threshold ranges for normal business patterns can be set, such as upper and lower limits for normal network traffic, to remove data records that exceed the threshold range.

[0028] S30: Input the standardized dataset into a pre-trained deep learning model, and extract multi-dimensional feature vectors of the target network system through the deep learning model. The multi-dimensional feature vectors include network topology features, access control policy features, and vulnerability distribution features.

[0029] In this embodiment, the deep learning model is a machine learning model based on artificial neural networks, which has powerful data analysis and feature extraction capabilities.

[0030] In this application embodiment, network topology features are a comprehensive description of the connection relationships between various network devices and services in the target network system. It reflects the physical and logical layout of the network, demonstrating how nodes (such as servers, routers, switches, and other network devices) and their interconnections (communication lines) are linked together. For example, in an enterprise network, network topology features can show how data center servers are connected to branch office routers, and how departmental LANs are interconnected via switches. Network topology features can also include the network's hierarchical structure, such as the distribution of the core layer, aggregation layer, and access layer. Different network topologies affect network performance, reliability, and security.

[0031] In this application embodiment, access control policy features describe the rules and restrictions on users, processes, or devices accessing network resources in a target network system. It specifies who can access which resources and under what conditions access is permitted. Access control policy features cover multiple aspects, including permission allocation rules, which clearly define the access permissions of different users or roles, such as administrators having system configuration and management rights while ordinary users can only access specific business data; and access path constraints, such as restricting certain users to accessing resources only through specific network interfaces or within specific time periods. For example, in a financial institution's network, access control policy features might stipulate that only authorized employees can access sensitive customer information through the internal network during working hours. The rationality and effectiveness of access control policy features directly affect network security.

[0032] In this embodiment, vulnerability distribution characteristics refer to the distribution of security vulnerabilities in the target network system, including information such as vulnerability type, location, and severity. Vulnerability types can be categorized into various types, such as buffer overflow vulnerabilities and SQL injection vulnerabilities. Different types of vulnerabilities have different exploitation methods and degrees of harm. Vulnerability location information clarifies the specific network device, system, or application where the vulnerability exists, such as a vulnerability in a specific version of server software, database management system, or network device firmware. Severity is a quantitative assessment of the potential harm caused by the vulnerability, typically categorized into high, medium, and low levels. High-severity vulnerabilities may lead to major security incidents such as system paralysis and data breaches. For example, in the network of a large e-commerce platform, vulnerability distribution characteristics might show that some web servers have high-severity SQL injection vulnerabilities, while some internal office systems have low-severity configuration vulnerabilities.

[0033] In one embodiment, the deep learning model can employ a convolutional neural network (CNN) or a recurrent neural network (RNN). When training the deep learning model, a large amount of historical data can be used as a training set. By adjusting the model's parameters, the model can accurately extract multi-dimensional feature vectors. When a standardized dataset is input into the model, the model analyzes and processes the data layer by layer, ultimately outputting multi-dimensional feature vectors.

[0034] In one embodiment, during the model training phase, the first step is to construct a deep learning model architecture suitable for extracting network exposure surface features. A hybrid architecture combining Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) can be chosen. CNNs excel at processing data with spatial structure, effectively extracting features from data with spatial relationships, such as network topology features. For example, after representing the network topology as a graph, CNNs can extract local features of nodes and edges in the graph through convolutional operations. RNNs, on the other hand, are suitable for processing sequential data. For data with time-series characteristics, such as network traffic log information, RNNs can capture the temporal dependencies in the data.

[0035] The preprocessed, standardized dataset is divided into training, validation, and test sets. The training set is used for model parameter learning, the validation set is used to adjust hyperparameters such as learning rate and batch size during training to prevent overfitting, and the test set is used to evaluate the model's performance. During training, stochastic gradient descent (SGD) and its variants, such as the Adam optimizer, are used to update the model's parameters. Through multiple iterations of training, the model learns the mapping relationship between the input data and multi-dimensional feature vectors.

[0036] In the model application phase, when applying the trained deep learning model to extract actual network exposure surface features, a standardized dataset is first input into the model. The model processes the input data layer by layer according to the mapping relationships learned during training. For network topology features, the model extracts node and edge features through convolutional and pooling layers, and then combines these local features into a global network topology feature vector through fully connected layers. For access control policy features, the model analyzes the rules and conditions in the policy to extract key feature information, such as permission allocation patterns and access path restrictions. For vulnerability distribution features, the model extracts feature vectors reflecting the vulnerability distribution based on vulnerability-related information, such as vulnerability type, location, and severity.

[0037] During feature extraction, the model outputs multi-dimensional feature vectors of the target network system. These feature vectors contain rich information and can describe the characteristics of the network exposure surface from multiple perspectives. For example, network topology feature vectors can reflect the tightness of connections between devices and systems in the network, whether there are single points of failure, etc.; access control policy feature vectors can reflect whether the network's security access rules are reasonable and whether there is a risk of privilege abuse; vulnerability distribution feature vectors can indicate which areas in the network have more vulnerabilities and the distribution of vulnerability severity, etc.

[0038] S40: Based on the multi-dimensional feature vector, use a quantitative evaluation algorithm to calculate the exposure surface quantitative index of the target network system. The exposure surface quantitative index includes the number of exposed nodes, the path length for potential vulnerabilities to be exploited, and the probability of vulnerability exploitation.

[0039] In this embodiment, the number of exposed nodes refers to the number of devices and systems in the target network system directly exposed to the external network. These exposed nodes may be potential penetration targets for unauthorized personnel. The potential vulnerability exploitation path length refers to the shortest path length from the external network to the core node inside the target network system; the shorter the path, the higher the probability of penetration. The vulnerability exploitation probability refers to the likelihood that unauthorized personnel will successfully exploit vulnerabilities existing in the network system for penetration. Calculating these exposure surface quantification indicators using quantitative evaluation algorithms can accurately quantify the exposure surface risk of the target network system. From a technical perspective, the exposure surface quantification indicators can intuitively reflect the degree of risk of the network exposure surface, providing a scientific basis for network security decisions.

[0040] In one embodiment, the number of exposed nodes can be determined by analyzing network topology characteristics to identify and statistically analyze nodes directly connected to the external network. For the path length of potential exploitable vulnerabilities, graph theory algorithms, such as Dijkstra's algorithm, can be used to calculate the shortest path length from the external network to the internal core node for unauthorized access. The probability of vulnerability exploitation can be comprehensively evaluated based on factors such as the severity of the vulnerability, its public disclosure time, patch status, and the network system's security measures.

[0041] S50: Generate a risk assessment report for the target network system based on the exposure surface quantification index, and output the risk assessment report.

[0042] In this embodiment, the risk assessment report is a comprehensive summary and analysis of the exposure surface risks of the target network system. The report may include specific numerical values ​​for quantitative indicators of the exposure surface, such as the number of exposed nodes, the length of potential vulnerability exploitation paths, and the probability of vulnerability exploitation, along with analysis and explanations of these indicators. Simultaneously, the report will propose corresponding security recommendations and protective measures based on the degree of exposure surface risk. Generating and outputting a risk assessment report provides network security managers with intuitive and effective decision-making support. From a technical perspective, the risk assessment report helps network security managers understand the risk situation of the network exposure surface in a timely manner, take targeted measures to reduce risks, and ensure the secure and stable operation of the network system.

[0043] In one embodiment, when generating a risk assessment report, the exposure surface quantification indicators are first analyzed and integrated in detail. Taking an enterprise-level target network system as an example, the number of exposed nodes in the exposure surface quantification indicators shows that 5 server nodes are directly exposed to the external network. For these exposed nodes, the report will list their specific information in detail, including the purpose of the server (e.g., web server, mail server), the network area where it is located, and the types of external penetration it may face. Regarding the potential vulnerability exploitation path length, the calculated average potential vulnerability exploitation path length is 4 hops, indicating that unauthorized access personnel need to pass through an average of 4 network nodes to reach the internal core business system. The report will further analyze the key nodes and network devices traversed by these potential vulnerability exploitation paths, as well as the risk level of each path. The vulnerability exploitation probability shows that the exploitation probability of 3 vulnerabilities exceeds 80%, and the report will describe in detail the vulnerability number, the scope of impact (e.g., potential data leakage, system paralysis, etc.), and the current remediation status of these vulnerabilities.

[0044] In one embodiment, the risk level of the target network system can also be classified based on exposure surface quantification indicators. For example, based on a combination of factors such as the number of exposed nodes, the length of the potential vulnerability exploitation path, and the probability of vulnerability exploitation, the risk level of the network system can be divided into three levels: high, medium, and low. Due to the existence of multiple high-probability exploitation vulnerabilities and a certain number of exposed nodes, the overall risk level is rated as "high." Specific recommendations will be given for different risk situations in the report. For high-risk exposed nodes, it is recommended to immediately adjust firewall rules to restrict external access; for high-probability exploitation vulnerabilities, it is recommended to arrange for technical personnel to update patches as soon as possible. The report will also provide a risk response timeline, clearly defining the completion time nodes for each remedial measure to ensure that the risk can be controlled in a timely and effective manner.

[0045] In one embodiment, a report generation tool can be used to populate a predefined template with exposure surface quantification indicators and analysis results to generate a risk assessment report. The report can be output as an electronic document, such as PDF or Excel, for easy viewing and sharing by cybersecurity administrators.

[0046] In one embodiment, reference Figure 2 Step S40, based on the multi-dimensional feature vector, calculates the exposure surface quantification index of the target network system using a quantization evaluation algorithm, which may include steps S41-S44, as detailed below: Step S41: Extract the node connection matrix of the target network system from the network topology features, and count the number of nodes in the node connection matrix that are exposed to the external network.

[0047] In this embodiment, the node connection matrix is ​​a matrix used to represent the connection relationships between nodes in a network. The elements in the matrix can indicate whether a connection exists between nodes and the strength of that connection. For example, in a simple network, if node A and node B are directly connected, the corresponding element in the node connection matrix can be represented as 1; otherwise, it is 0. By counting the number of nodes exposed to external networks in the node connection matrix, the number of nodes in the target network system directly exposed to external penetration risks can be clearly identified. From a technical perspective, accurately counting the number of exposed nodes helps assess the degree of external penetration risk of the network system.

[0048] In one embodiment, a node connection matrix can be constructed by analyzing network topology characteristics. First, all nodes in the network are identified, and then the matrix elements are filled according to the connection relationships between the nodes. For nodes exposed to external networks, they can be identified and counted based on external connection information in the network topology.

[0049] Step S41: Extract the node connection matrix of the target network system from the network topology features, and count the number of nodes in the node connection matrix that are exposed to the external network.

[0050] In one embodiment, reference Figure 4 Step S41 may include steps S411-S414, which will be described in detail below: Step S411: Based on the network topology characteristics, construct a node connection graph of the target network system, where each node represents a network device or service, and each edge represents the communication relationship between nodes.

[0051] In this embodiment, network topology features describe the physical and logical connections between various devices and services in the network. By constructing a node connection graph, the network topology can be presented graphically. Each node represents a specific network device or service, such as a router, server, or client, and edges represent communication links between these nodes. For example, an edge can represent a data transmission channel between two servers. Constructing a node connection graph helps to intuitively understand the network structure and communication patterns. From a technical perspective, the node connection graph provides a visual basis for subsequent extraction of the node connection matrix and counting of exposed nodes, facilitating a more accurate analysis of the network's topological characteristics.

[0052] In one embodiment, a network topology discovery tool can be used to automatically discover devices and connections in the network, and then this information can be imported into a drawing tool to construct a node connection diagram. Alternatively, a node connection diagram can be constructed manually based on network planning and configuration information.

[0053] Step S412: Extract all nodes that have direct communication relationships with the external network from the node connection graph to form an initial exposed node set.

[0054] In this embodiment, nodes that have direct communication relationships with external networks refer to devices or services directly connected to external network interfaces. These nodes are the contact points between the network system and the outside world and may face more security risks. Extracting these nodes from the node connection diagram to form an initial exposed node set can preliminarily determine the range of nodes in the network that may be subject to external penetration. From a technical perspective, the initial exposed node set provides a basis for further screening and accurate counting of exposed nodes, helping to quickly locate security weaknesses in the network.

[0055] In one embodiment, initially exposed nodes can be determined by examining the edges connecting nodes to the external network in the node connectivity graph. For example, if a node has an edge directly connecting to a node representing the external network, then that node belongs to the initial set of exposed nodes. A script can be written to automatically traverse the node connectivity graph and extract nodes that meet the criteria.

[0056] Step S413: For each node in the initial exposed node set, further analyze its location attributes and access permission configuration in the network topology, and remove nodes that cannot be accessed by the external network due to access control policy restrictions.

[0057] In this embodiment, the location attributes in the network topology include the node's hierarchical structure within the network and its connection methods with other nodes. Access permission configuration specifies whether a node is allowed external network access. Some nodes may appear physically exposed to the external network, but due to access control policies, they are actually inaccessible. For example, a firewall might block external connection requests from certain nodes. By further analyzing the node's location attributes and access permission configuration, and eliminating these inaccessible nodes, a more accurate number of exposed nodes can be obtained. Technically, accurately filtering exposed nodes improves the accuracy of network exposure assessment and avoids misjudging security risks.

[0058] In one embodiment, the nodes in the initial exposed node set can be analyzed one by one by combining the permission allocation rules and access path constraints in the access control policy features. The access permission settings of each node are checked, such as whether there are access restriction rules and whether it is within a permitted access time period. If a node does not meet the access conditions, it is removed from the initial exposed node set.

[0059] Step S414: Count the number of nodes remaining after analysis, and use this number as the number of nodes in the target network system exposed to the external network.

[0060] In this embodiment, after the screening and analysis steps, the remaining nodes are those truly exposed to the external network and potentially vulnerable to penetration. Counting these nodes accurately quantifies the external exposure of the network system. This number is a crucial indicator for assessing network exposure; the more exposed nodes, the higher the risk of external penetration. From a technical perspective, accurately counting the number of exposed nodes provides critical data for network security decision-making and helps in developing targeted protection strategies.

[0061] Step S42: Analyze the permission allocation rules and access path constraints in the access control policy features, construct a set of potential vulnerability exploitation paths in the target network system, and calculate the average path length of each vulnerability exploitation path.

[0062] In this embodiment, the permission allocation rules specify which users or roles can access which resources, and the access permission levels. Access path constraints are rules and conditions that restrict the paths through which users or roles can access resources. By analyzing these rules and conditions, a set of potential vulnerability exploitation paths is constructed, identifying access paths that unauthorized personnel might use. Calculating the average path length of each vulnerability exploitation path can assess the ease of penetration; the shorter the path, the easier the penetration. From a technical perspective, clearly defining the set of potential vulnerability exploitation paths and the average path length helps assess the internal penetration risk of a network system.

[0063] In one embodiment, graph theory can be used to represent the nodes and connections in the network as a graph. Based on permission allocation rules and access path constraints, possible exploitable paths are found in the graph. For each exploitable path, the number of nodes or connecting edges it contains is calculated as the path length, and then the average path length of all exploitable paths is calculated.

[0064] In one embodiment, reference Figure 5 Step S42 may include steps S421-S423, which will be described in detail below: Step S421: Extract permission allocation rules and access path constraints from the access control policy features; construct the access relationship graph of the target network system based on the permission allocation rules and access path constraints.

[0065] In this embodiment, the permission allocation rules specify the access permissions of different users or roles to network resources. For example, which users can access specific servers and which operations are permitted. Access path constraints restrict the ways users can access resources, such as only being able to access them through specific network interfaces or within specific time periods. After extracting this information from the access control policy features, constructing an access relationship graph can intuitively display the access relationships between various nodes in the network. The access relationship graph uses nodes to represent network devices or resources and edges to represent access paths between nodes. By constructing an access relationship graph, the access rules and possible access paths in the network can be clearly seen. From a technical perspective, the access relationship graph provides a visual model for subsequent identification of potential vulnerability exploitation paths, helping to analyze and discover security vulnerabilities in the network more efficiently.

[0066] In one embodiment, an access graph can be constructed using a graph database or drawing tools. First, devices and resources in the network are abstracted as nodes. The connections between nodes are determined based on permission allocation rules and access path constraints, and these connections are represented by edges. For example, if a user role is allowed to access a specific server, an edge is added between the node representing that user role and the server node.

[0067] Step S422: Traverse all nodes and edges in the access relationship graph to identify all possible paths from the external network to the internal core node.

[0068] In this embodiment, the external network refers to the network environment outside the network system boundary, which typically harbors numerous security threats. Internal core nodes are critical devices or resources within the network system, such as data center servers and core business systems. Identifying all possible paths from the external network to internal core nodes helps uncover potential penetration routes that unauthorized personnel might exploit. By traversing the access relationship graph, all possible connection paths can be systematically searched. From a technical perspective, comprehensively identifying possible paths allows for the early detection of potential penetration risks, providing targeted measures for network security protection.

[0069] In one embodiment, a depth-first search (DFS) or breadth-first search (BFS) algorithm can be used to traverse and access the relationship graph. Taking the DFS algorithm as an example, starting from the entry node of the external network, the algorithm continuously visits nodes along the edges until it reaches the internal core node or can no longer be accessed, recording the path traversed. This process is repeated until all possible paths have been traversed.

[0070] In one embodiment, step S422 may include the following steps, which will be described in detail below: B1: Determine the set of entry nodes for the external network and the set of target nodes for the internal core nodes from the access relationship graph.

[0071] In this embodiment, the set of entry nodes for the external network refers to the interface nodes connecting the network system to the external network; these nodes are potential entry points for unauthorized external personnel to enter the network. The set of target nodes for the internal core nodes consists of the most important devices or service nodes in the network system, such as core database servers and critical business application servers; these nodes are the targets that unauthorized personnel attempt to penetrate. Determining these two sets of nodes from the access relationship graph clearly identifies the starting and ending points of the path for searching potential vulnerabilities. From a technical perspective, accurately determining the set of entry nodes and the set of target nodes provides a clear scope for subsequent path searches, improving search efficiency and accuracy.

[0072] In one embodiment, entry nodes of the external network and core nodes of the internal network can be manually marked based on the network topology and access control policies. Alternatively, the set of entry nodes and the set of target nodes can be automatically identified by analyzing node attributes in the access relationship graph, such as the network address range of the nodes and the network types they are connected to.

[0073] B2: Based on the depth-first search algorithm or the breadth-first search algorithm, traverse the access relationship graph sequentially starting from each entry node and record all paths that can reach the set of target nodes.

[0074] In this embodiment, depth-first search (DFS) and breadth-first search (BFS) are two graph traversal algorithms. DFS visits nodes as deeply as possible along a path until it cannot continue or reach the target node, then backtracks to try other paths. BFS expands its access to nodes layer by layer, visiting nodes closer to the starting point first, then visiting nodes further away in sequence. By traversing the access graph from each entry node using these two algorithms, all possible paths can be systematically searched. Recording all paths that can reach the target node set allows for a comprehensive identification of potential vulnerability exploitation paths from the external network to internal core nodes. Technically, using these two algorithms to traverse the access graph ensures that no possible paths are missed, providing complete data for subsequent analysis of the risk of potential vulnerability exploitation paths.

[0075] In one embodiment, the calculation of the average path length of each exploited vulnerability path in step S42 can be achieved in the following way: C1: Calculate the path length for each path, where path length is defined as the number of edges contained in the path; sort all paths according to their path length, and filter out paths whose path length is less than a preset threshold to form a set of paths that could potentially be exploited.

[0076] In this embodiment, path length is measured by the number of edges in the path. The more edges, the longer the path, the more intermediate nodes unauthorized personnel need to traverse, and the greater the difficulty of penetration. Calculating the path length for each path quantifies the ease with which each potential vulnerability can be exploited. Sort all paths by path length and filter those with a length less than a preset threshold because shorter paths mean unauthorized personnel can reach internal core nodes faster and more directly, increasing the likelihood of successful penetration. These paths constitute a more threatening set of potential vulnerability exploitation paths. Technically, by calculating path length and performing filtering, more dangerous vulnerability exploitation paths can be focused on, providing key areas of focus for subsequent risk assessment and protective measure development, thus improving the targeting of network security protection.

[0077] In one embodiment, a program can be written to traverse each path and count the number of edges as the path length. A sorting algorithm is used to sort all paths by length, with a preset reasonable threshold, such as determined based on network size and security policies. Paths with lengths less than this threshold are filtered out and stored in a new set as a set of potential exploitable vulnerabilities.

[0078] C2: Calculate the average path length of all paths in the set of potential vulnerability exploitation paths.

[0079] In this embodiment, calculating the average path length of all paths in the set of potential vulnerability exploitation paths allows for a comprehensive measurement of the average ease with which unauthorized personnel can reach internal core nodes. A shorter average path length indicates that unauthorized personnel can more easily reach core nodes, and the network faces a higher penetration risk. This average path length is an important quantitative indicator that directly reflects the risk status of the network's exposure surface in terms of paths. From a technical perspective, the average path length provides network security managers with a concise and effective evaluation metric, helping them quickly understand the network's security posture and formulate corresponding protection strategies.

[0080] In one embodiment, the average path length is obtained by summing the lengths of all paths in the set of potential exploit paths and then dividing by the number of paths. For example, Python's built-in functions can be used to calculate the sum of path lengths and divide by the number of paths.

[0081] Step S423: Store all possible paths as a set of potential exploitable vulnerabilities in the target network system.

[0082] In this embodiment, all identified possible paths from the external network to the internal core node are stored as a set of potential vulnerability exploitation paths, facilitating subsequent analysis and evaluation of these paths. This set contains all potential penetration routes that unauthorized personnel might exploit. Technically, storing the set of potential vulnerability exploitation paths provides a foundation for further calculating the risks of these paths and taking corresponding protective measures, thus contributing to improved network system security.

[0083] In one embodiment, a database or file system can be used to store the set of paths from which potential vulnerabilities can be exploited. Each path is represented using a suitable data structure, such as a sequence of nodes, and then stored in a database table or file. This facilitates querying, statistics, and analysis of the paths.

[0084] Step S43: Combining the vulnerability type and vulnerability location information in the vulnerability distribution characteristics, evaluate the probability of each vulnerability being successfully exploited, and calculate the weighted average exploit probability of all vulnerabilities.

[0085] In this application embodiment, vulnerability types can be categorized into different types, such as buffer overflow vulnerabilities and SQL injection vulnerabilities. Different types of vulnerabilities have different exploitation difficulties and severity levels. Vulnerability location information can indicate the device or system where the vulnerability is located. Assessing the probability of successful exploitation of each vulnerability requires considering factors such as the severity of the vulnerability, the time of disclosure, the status of patching, and the network system's protection measures. Calculating the weighted average exploitation probability of all vulnerabilities can comprehensively assess the overall risk of vulnerabilities in the network system. From a technical perspective, accurately assessing the exploitation probability of vulnerabilities helps to take targeted vulnerability remediation and protection measures.

[0086] In one embodiment, a vulnerability assessment model can be established, assigning an exploit probability value to each vulnerability based on various factors such as severity, disclosure time, and patching status. Then, based on the importance or scope of impact of the vulnerability, a weight is assigned to each vulnerability, and the weighted average exploit probability of all vulnerabilities is calculated.

[0087] In one embodiment, reference Figure 6 Step S43 may include steps S431-S433, which will be described in detail below: Step S431: Extract the severity score, disclosure time, and remediation status information of each vulnerability from the vulnerability distribution characteristics.

[0088] In this embodiment, the severity score is a quantitative assessment of the severity of a vulnerability, typically categorized into high, medium, and low levels based on the potential harm it may cause. The disclosure time refers to the date the vulnerability is first publicly disclosed. The remediation status information indicates whether the vulnerability has been patched. Extracting this information helps to more accurately assess the probability of each vulnerability being successfully exploited. From a technical perspective, a comprehensive understanding of the vulnerability's severity, disclosure time, and remediation status provides crucial information for subsequent probability assessments, improving their accuracy.

[0089] In one embodiment, information related to each vulnerability can be obtained through a vulnerability management system or an external threat intelligence platform. These platforms typically record and categorize vulnerabilities in detail, including severity scores, disclosure dates, and remediation status. Data extraction scripts can be written to automatically extract the required information from these platforms.

[0090] In one embodiment, reference Figure 7 Step S431 may include steps S4311-S4314, which will be described in detail below: Step S4311: Obtain detailed descriptions of known vulnerabilities in the target network system from external threat intelligence data, wherein the detailed descriptions include the vulnerability severity score, disclosure time, and current remediation status.

[0091] In this embodiment, the external threat intelligence data is collected and organized by professional security intelligence agencies, containing a wealth of detailed information about known vulnerabilities. This information is crucial for assessing the risk of vulnerabilities in a target network system. The severity score directly reflects the potential harm caused by the vulnerability, the publication time reflects the duration for which unauthorized personnel have been aware of and studied the vulnerability, and the current remediation status indicates whether the vulnerability has been patched. Obtaining this detailed description from external threat intelligence data provides accurate data support for subsequent vulnerability exploitation probability assessment. From a technical perspective, accurately obtaining detailed description information helps to more precisely assess the risk of vulnerabilities, providing a reliable basis for cybersecurity decisions.

[0092] In one embodiment, a data interface can be established with a professional security intelligence agency to periodically obtain detailed descriptions of vulnerabilities related to the target network system from its database. Alternatively, web crawling technology can be used to scrape relevant information from publicly available security intelligence websites.

[0093] Step S4312: Based on the preset scoring mapping rules, convert the severity score into a numerical score value.

[0094] In this embodiment, different security intelligence agencies may use different methods to represent vulnerability severity scores, such as textual descriptions (high, medium, low) or different scoring systems. To facilitate subsequent calculation and analysis, these different forms of severity scores need to be converted into unified numerical scores. The preset scoring mapping rules are formulated based on industry standards and experience, enabling accurate conversion of various forms of severity scores into numerical values. Numerical scores facilitate mathematical calculations and comparisons. From a technical perspective, numerical scores improve the consistency and computability of vulnerability severity assessments, helping to more accurately calculate vulnerability exploitation probabilities.

[0095] In one embodiment, a rating mapping table can be established to map different severity rating representations to their corresponding numerical values. For example, a "high" severity rating can be mapped to a numerical range of 80-100, "medium" to 50-79, and "low" to 0-49. A program can then be written to convert the obtained severity ratings into numerical scores based on this mapping table.

[0096] Step S4313: Calculate the disclosure duration of the vulnerability based on the disclosure time, where the disclosure duration is defined as the time difference between the current time and the time when the vulnerability was first disclosed.

[0097] In this embodiment, the duration of disclosure is a crucial factor in assessing the likelihood of a vulnerability being exploited by unauthorized personnel. A longer disclosure period allows unauthorized personnel more time to research and develop penetration methods targeting the vulnerability, thus increasing the probability of exploitation. The disclosure duration, calculated by the time difference between the current time and the initial disclosure time, quantifies the degree of vulnerability disclosure. From a technical perspective, accurately calculating the disclosure duration helps in more reasonably assessing the exploitation risk of vulnerabilities, providing a reference for vulnerability management and the development of protective measures.

[0098] Step S4314: Determine whether the vulnerability has been patched based on the patching status information. If it has been patched, mark the vulnerability as inactive; if it has not been patched, mark the vulnerability as active.

[0099] In this embodiment, the patching status information clarifies whether a vulnerability has been patched. Patched vulnerabilities, under normal circumstances, will no longer be exploited by unauthorized personnel, and are therefore marked as inactive; unpatched vulnerabilities still pose a risk of exploitation and are marked as active. By marking the status of vulnerabilities, the risk level of vulnerabilities can be quickly distinguished, facilitating subsequent focused attention and handling of active vulnerabilities. From a technical perspective, marking the status of vulnerabilities helps improve the efficiency of vulnerability management, enabling network security administrators to concentrate their efforts on handling risky vulnerabilities.

[0100] In one embodiment, a program can be written to determine the vulnerability based on the repair status information. If the repair status information indicates that the vulnerability has been repaired, an "inactive" flag is added to the vulnerability information database; if it has not been repaired, an "active" flag is added.

[0101] Step S432: Calculate the initial exploit probability for each vulnerability based on the severity score, disclosure time, and remediation status information.

[0102] In this embodiment, the severity score reflects the degree of harm that a vulnerability may cause. Generally, the higher the severity score, the greater the damage to the network system after the vulnerability is exploited, and correspondingly, the higher its initial exploit probability. For example, high-severity vulnerabilities may lead to serious consequences such as system paralysis and data leakage, and unauthorized personnel are more likely to exploit such vulnerabilities. The disclosure time refers to the time from the vulnerability's first public disclosure to the present. The longer the disclosure time, the more time unauthorized personnel have to study the exploitation methods, thus increasing the likelihood of the vulnerability being exploited. The patching status information indicates whether the vulnerability has been patched; unpatched vulnerabilities are obviously more easily exploited by unauthorized personnel. By comprehensively considering these three factors, the initial exploit probability of each vulnerability can be calculated more accurately. From a technical perspective, calculating the initial exploit probability by comprehensively considering these key factors can preliminarily and relatively accurately predict the risk of vulnerability exploitation, providing a reasonable basis for further probability adjustments and helping to more scientifically assess the security status of the network system.

[0103] In one embodiment, corresponding weights can be assigned to severity score, disclosure time, and remediation status. For severity score, different weight values ​​are assigned based on its level, such as high, medium, and low, with higher severity scores corresponding to higher weights. For disclosure time, it can be segmented according to duration, with each segment corresponding to a weight value; the longer the duration, the higher the weight. For remediation status, remediated vulnerabilities are assigned lower weight values, while unremediated vulnerabilities are assigned higher weight values. These factors and their corresponding weight values ​​are combined to calculate the initial exploit probability for each vulnerability. For example, suppose the initial exploit probability = severity score weight × severity score corresponding coefficient + disclosure time weight × disclosure time corresponding coefficient + remediation status weight × remediation status corresponding coefficient.

[0104] Step S433: Based on the real-time protection status of the target network system, the initial exploit probability is corrected to obtain the actual exploit probability of each vulnerability.

[0105] In this embodiment, the real-time protection status of the target network system refers to the operational status of various security protection measures currently employed by the system, including firewall rule activation status, intrusion detection system alarm status, and patch update records. These protection measures can reduce the probability of vulnerabilities being exploited to a certain extent. For example, firewall rules can block unauthorized external access, intrusion detection systems can promptly detect and warn of potential penetration behaviors, and timely patch updates can fix known vulnerabilities. By combining the real-time protection status with adjustments to the initial exploit probability, a more realistic vulnerability exploit probability can be obtained. From a technical perspective, considering the impact of real-time protection measures makes the assessment of vulnerability exploit probability more accurate, providing a more reliable basis for network security decisions.

[0106] In one embodiment, a protection strength value can be assigned to each protection measure based on its effectiveness and coverage. For each vulnerability, the number of protection measures it is protected against is counted, and the overall protection strength is calculated based on the protection strength value. The corrected actual exploit probability is obtained by multiplying the initial exploit probability by the reciprocal of the overall protection strength. For example, if a vulnerability is protected by multiple effective protection measures, its overall protection strength is high, and the actual exploit probability will decrease accordingly.

[0107] In one embodiment, reference Figure 8 Step S433, which modifies the initial exploit probability based on the real-time protection status of the target network system, may include steps S4331-S4334, which are described in detail below: S4331: Obtain the real-time protection status of the target network system, including the firewall rule activation status, intrusion detection system alarm status, and patch update records.

[0108] In this embodiment, the firewall rule's activation status determines the access control situation at the network boundary. If the firewall rules are set reasonably and are enabled, they can effectively block unauthorized external access. For example, the firewall can filter network packets based on conditions such as source address, destination address, and port number to block unauthorized connections. The intrusion detection system's alarm status reflects whether the system has detected potential penetration behavior; an alarm will be issued when abnormal activity is detected. The patch update log shows the system's status in fixing known vulnerabilities; timely patch updates can reduce the risk of vulnerabilities being exploited. Obtaining this real-time protection measure status information allows for a comprehensive understanding of the current security protection status of the network system. From a technical perspective, accurately obtaining the real-time protection measure status provides a reliable basis for subsequent probability correction, helping to improve the accuracy of vulnerability exploitation probability assessment.

[0109] In one embodiment, the real-time status of protective measures can be obtained through a network management system or a Security Information and Event Management (SIEM) system. These systems can monitor the operational status of devices such as firewalls and intrusion detection systems in real time and record patch update information. Scripts can be written to periodically extract the required status information from these systems.

[0110] S4332: Determine the protection strength coefficient corresponding to each vulnerability based on the real-time protection measures status.

[0111] In this embodiment, the protection strength coefficient is a quantitative indicator that measures the effectiveness of each protection measure against a specific vulnerability. Different protection measures have different capabilities in protecting against different vulnerabilities. For example, firewalls may provide better protection for certain types of vulnerabilities, while intrusion detection systems may be more effective for others. Determining the protection strength coefficient for each vulnerability based on the real-time status of protection measures can accurately reflect the impact of protection measures on the probability of vulnerability exploitation. From a technical perspective, reasonably determining the protection strength coefficient can make probability correction more accurate and more realistically reflect the actual exploitability of vulnerabilities under the current protection system.

[0112] In one embodiment, a protection strength assessment table can be established, with corresponding protection strength coefficients pre-set for each protection measure and different types of vulnerabilities. Based on the real-time status of protection measures, it is determined which protection measures each vulnerability is protected by, and then the corresponding protection strength coefficient is selected from the assessment table. For example, if a vulnerability is protected by both a firewall and an intrusion detection system, the protection strength coefficients for these two protection measures for the vulnerability are obtained from the assessment table respectively, and then a comprehensive calculation is performed.

[0113] In one embodiment, step S4332 may include steps D1-D4, which will be described in detail below: D1: Obtain the real-time protection status of the target network system, including the firewall rule activation status, intrusion detection system alarm status, and patch update records.

[0114] In this embodiment, the firewall rule activation status determines the access control capability of the network boundary. Appropriately activated firewall rules can effectively block unauthorized external access to the vulnerable device. The intrusion detection system alarm status reflects the system's monitoring of abnormal behavior; if a penetration attempt targeting the vulnerability is detected, an alarm will be issued promptly. The patch update record reflects the system's progress in fixing known vulnerabilities; timely patch updates can eliminate security risks. Obtaining this real-time protection measure status information allows for a comprehensive understanding of the network system's protection status against vulnerabilities. From a technical perspective, accurately obtaining the real-time protection measure status provides a basis for determining the protection strength coefficient and helps to more accurately assess the actual probability of vulnerability exploitation.

[0115] In one embodiment, the monitoring interface of the network management system can be used to obtain the firewall rule activation status and view the firewall device's configuration information and operation logs. The management interface of the intrusion detection system can be used to obtain the alarm status and check for any vulnerability-related alarm records. Patch update records can be obtained from the system's patch management tool to determine whether the vulnerability has been patched.

[0116] D2: For each vulnerability, analyze the coverage of protection measures on the network device or service where it is located, and count the number of protection measures covering the vulnerability.

[0117] In this embodiment, different vulnerabilities may exist in different network devices or services, and each device or service may employ different protective measures. Analyzing the coverage of protective measures on the device or service where the vulnerability resides, and counting the number of protective measures covering the vulnerability, can intuitively reflect the degree of protection the vulnerability receives. The more protective measures there are, the more difficult it is to exploit the vulnerability. From a technical perspective, counting the number of protective measures provides an important reference for determining the protection strength coefficient, helping to more reasonably assess the actual probability of vulnerability exploitation.

[0118] In one embodiment, based on real-time protection measure status information, for each vulnerability, it can be checked whether the device or service it resides on is protected by firewall rules, intrusion detection systems, patch updates, and other protective measures. The number of these protective measures is counted; for example, if the device containing a vulnerability is protected by both firewall rules and an intrusion detection system, the number of protective measures is 2.

[0119] D3: Based on the preset protection strength weight table, assign a corresponding protection strength weight value to each protection measure.

[0120] In this embodiment, the preset protection strength weight table is formulated based on the effectiveness of different protection measures and their ability to protect against vulnerabilities. Different protection measures have different protective effects on vulnerabilities. For example, firewall rules can control access at the network boundary, intrusion detection systems can monitor penetration behavior in real time, and patch updates can directly fix vulnerabilities. Assigning a corresponding protection strength weight value to each protection measure can more accurately measure the contribution of each protection measure to reducing the probability of vulnerability exploitation. From a technical perspective, reasonably allocating protection strength weight values ​​helps to calculate the protection strength coefficient more accurately and improve the accuracy of vulnerability exploitation probability assessment.

[0121] In one embodiment, a protection strength weighting table can be developed based on the experience of security experts and historical data statistics. For example, the protection strength weighting value for firewall rules can be set to 0.6, the protection strength weighting value for intrusion detection systems can be set to 0.3, and the protection strength weighting value for patch updates can be set to 0.8. A corresponding weighting value is then assigned to each protection measure according to this weighting table.

[0122] D4: Calculate the overall protection strength coefficient of the vulnerability based on the number of protective measures covering the vulnerability and their corresponding protection strength weight values.

[0123] In this embodiment, the comprehensive protection strength coefficient is a quantitative indicator that measures the overall protection effect on the vulnerability. The comprehensive protection strength coefficient is obtained by comprehensively calculating the protection strength weight values ​​of each protection measure covering the vulnerability. The more protection measures and the higher the protection strength weight values, the larger the comprehensive protection strength coefficient, and the lower the probability of the vulnerability being exploited. From a technical perspective, accurately calculating the comprehensive protection strength coefficient can more realistically reflect the actual exploitability of the vulnerability under the current protection system, providing a more scientific basis for network security decisions.

[0124] In one embodiment, the protection strength weights of each protection measure covering the vulnerability can be summed to obtain the overall protection strength coefficient of the vulnerability. For example, if a vulnerability is protected by firewall rules (weight value 0.6) and intrusion detection systems (weight value 0.3), the overall protection strength coefficient is 0.6 + 0.3 = 0.9.

[0125] S4333: Multiply the initial exploit probability by the protection strength coefficient to obtain the actual exploit probability of each vulnerability.

[0126] In this embodiment, the initial exploit probability is a preliminary estimate of the likelihood of a vulnerability being exploited without considering real-time protection measures, while the protection strength coefficient reflects the inhibitory effect of real-time protection measures on vulnerability exploitation. Multiplying the two together allows for a comprehensive consideration of the vulnerability's inherent characteristics and the impact of protection measures, yielding a more realistic and practical exploit probability. From a technical perspective, this calculation method is simple and intuitive, effectively combining the initial state of the vulnerability with the effectiveness of protection measures, making the probability assessment more accurate and reasonable.

[0127] In one embodiment, the actual exploit probability of each vulnerability can be obtained by directly multiplying the calculated initial exploit probability with the determined protection strength coefficient. For example, if the initial exploit probability of a vulnerability is 0.8 and its corresponding protection strength coefficient is 0.5, then the actual exploit probability of the vulnerability is 0.8 × 0.5 = 0.4.

[0128] S4334: If the actual utilization probability is less than the first set value, then the actual utilization probability is set to zero; if the actual utilization probability is greater than the second set value, then the actual utilization probability is set to one.

[0129] In this embodiment, the first and second preset values ​​are predetermined thresholds used to reasonably limit the actual exploitation probability. When the actual exploitation probability is less than the first preset value, it indicates that under the current protection measures, the possibility of the vulnerability being exploited is extremely low, and it can be approximately considered that it will not be exploited, so it is set to zero. When the actual exploitation probability is greater than the second preset value, it indicates that the possibility of the vulnerability being exploited is extremely high, and it is almost certain that it will be exploited, so it is set to one. This approach makes the probability results more consistent with the actual situation and avoids unreasonable probability values. From a technical perspective, adjusting the actual exploitation probability by setting thresholds makes the evaluation results clearer and more explicit, providing more valuable information for network security decisions.

[0130] In one embodiment, a first set value and a second set value are determined based on the network system's security policy and historical data statistics. For example, the first set value is set to 0.1, and the second set value is set to 0.9. When the calculated actual utilization probability is less than 0.1, it is set to zero; when it is greater than 0.9, it is set to one.

[0131] Step S44: Use the number of exposed nodes, the path length for potential vulnerability exploitation, and the probability of vulnerability exploitation as quantitative indicators of the exposure surface of the target network system.

[0132] In this embodiment, the number of exposed nodes, the length of the potential vulnerability exploitation path, and the probability of vulnerability exploitation are used as quantitative indicators of the exposure surface. This allows for a comprehensive quantification of the exposure surface risk of the target network system from multiple perspectives. These indicators are interrelated and collectively reflect the security status of the network system. From a technical perspective, comprehensively considering multiple quantitative indicators of the exposure surface helps to more accurately assess the exposure surface risk of the network system, providing a more scientific basis for network security decisions.

[0133] In one embodiment, these exposure surface quantification metrics can be normalized to have the same magnitude, and then combined into a comprehensive exposure surface risk score according to predefined weights to more intuitively assess the security status of the network system.

[0134] Accordingly, to better implement the above methods, embodiments of this application also provide a multi-dimensional quantitative evaluation system for network exposure surfaces. For example... Figure 9 As shown, the multi-dimensional quantitative evaluation system 80 for network exposure includes: The acquisition module 801 is used to acquire the operating data of the target network system within a preset time window. The operating data includes network traffic log information, system configuration parameters, and external threat intelligence data. Preprocessing module 802 is used to preprocess the running data to generate a standardized dataset; The feature extraction module 803 is used to input the standardized dataset into a pre-trained deep learning model and extract multi-dimensional feature vectors of the target network system through the deep learning model. The multi-dimensional feature vectors include network topology features, access control policy features, and vulnerability distribution features. The indicator generation module 804 is used to calculate the exposure surface quantitative indicator of the target network system based on the multi-dimensional feature vector and using a quantitative evaluation algorithm. The exposure surface quantitative indicator includes the number of exposed nodes, the path length for potential vulnerabilities to be exploited, and the probability of vulnerability exploitation. The risk report generation module 805 is used to generate a risk assessment report for the target network system based on the exposure surface quantification index, and output the risk assessment report.

[0135] The implementation details of each module are provided in the preceding method embodiments and will not be repeated here. The technical effects achieved by each module and device are described in the foregoing method embodiments.

[0136] like Figure 10As shown, this application embodiment also provides a computer device 90, which includes a processor 901 and a memory 902, wherein the memory 902 stores a computer program, and when the computer program is executed by the processor 901, the processor 901 performs the steps of any of the methods described above.

[0137] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or otherwise.

[0138] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application are still within the scope of this application.

Claims

1. A multi-dimensional quantitative evaluation method for network exposure surface, characterized in that, Includes the following steps: Acquire operational data of the target network system within a preset time window, including network traffic log information, system configuration parameters, and external threat intelligence data; The runtime data is preprocessed to generate a standardized dataset; The standardized dataset is input into a pre-trained deep learning model, and the deep learning model extracts multi-dimensional feature vectors of the target network system. The multi-dimensional feature vectors include network topology features, access control policy features, and vulnerability distribution features. Based on the multi-dimensional feature vector, the exposure surface quantitative index of the target network system is calculated using a quantitative evaluation algorithm. The exposure surface quantitative index includes the number of exposed nodes, the path length for potential vulnerabilities to be exploited, and the probability of vulnerability exploitation. A risk assessment report for the target network system is generated based on the exposure surface quantification index, and the risk assessment report is output.

2. The method according to claim 1, characterized in that, Based on the multi-dimensional feature vectors, a quantitative evaluation algorithm is used to calculate the exposure surface quantification index of the target network system, including: Extract the node connection matrix of the target network system from the network topology features, and count the number of nodes in the node connection matrix that are exposed to the external network. Analyze the permission allocation rules and access path constraints in the access control policy features, construct a set of potential vulnerability exploitation paths in the target network system, and calculate the average path length of each vulnerability exploitation path; By combining the vulnerability type and vulnerability location information in the vulnerability distribution characteristics, the probability of each vulnerability being successfully exploited is evaluated, and the weighted average exploit probability of all vulnerabilities is calculated. The number of exposed nodes, the length of the path for potential vulnerabilities to be exploited, and the probability of vulnerability exploitation are used as quantitative indicators of the exposure surface of the target network system.

3. The method according to claim 2, characterized in that, Based on the vulnerability type and location information in the vulnerability distribution characteristics, the probability of successful exploitation of each vulnerability is assessed, including: Extract the severity score, disclosure time, and remediation status information for each vulnerability from the vulnerability distribution characteristics; Based on the severity score, disclosure time, and remediation status information, calculate the initial exploit probability for each vulnerability; By combining the real-time protection status of the target network system, the initial exploit probability is corrected to obtain the actual exploit probability of each vulnerability.

4. The method according to claim 3, characterized in that, The initial exploit probability is corrected based on the real-time protection status of the target network system, including: Obtain the real-time protection status of the target network system, including the firewall rule activation status, intrusion detection system alarm status, and patch update records; Based on the real-time protection measures status, determine the protection strength coefficient corresponding to each vulnerability; Multiply the initial exploit probability by the protection strength coefficient to obtain the actual exploit probability of each vulnerability; If the actual utilization probability is less than the first set value, the actual utilization probability is set to zero; if the actual utilization probability is greater than the second set value, the actual utilization probability is set to one.

5. The method according to claim 2, characterized in that, Analyzing the permission allocation rules and access path constraints in the access control policy features, a set of potential vulnerability exploitation paths in the target network system is constructed, including: Extract permission allocation rules and access path constraints from the access control policy features; Based on the permission allocation rules and access path constraints, construct the access relationship graph of the target network system; Traverse all nodes and edges in the access graph to identify all possible paths from the external network to the internal core node; All possible paths are stored as a set of potential exploitable vulnerabilities in the target network system.

6. The method according to claim 2, characterized in that, Extract the node connection matrix of the target network system from the network topology features, and count the number of nodes in the node connection matrix exposed to the external network, including: Based on the network topology characteristics, a node connection graph of the target network system is constructed, where each node represents a network device or service, and each edge represents the communication relationship between nodes. Extract all nodes that have direct communication relationships with the external network from the node connection graph to form an initial exposed node set; For each node in the initial set of exposed nodes, further analyze its location attributes in the network topology and access permission configuration, and remove nodes that cannot be accessed by the external network due to access control policy restrictions; The number of nodes remaining after analysis is counted, and this number is taken as the number of nodes in the target network system exposed to the external network.

7. The method according to claim 5, characterized in that, Traverse all nodes and edges in the access graph to identify all possible paths from the external network to the internal core nodes, including: The set of entry nodes for the external network and the set of target nodes for the internal core nodes are determined from the access relationship graph. Based on the depth-first search algorithm or the breadth-first search algorithm, the access relationship graph is traversed sequentially starting from each entry node, and all paths that can reach the set of target nodes are recorded. The calculation of the average path length for each exploited vulnerability includes: Calculate the path length for each path, where the path length is defined as the number of edges contained in the path; Sort all paths by path length, filter out paths whose length is less than a preset threshold, and form a set of paths that could potentially be exploited. Calculate the average path length of all paths in the set of potential exploit paths.

8. The method according to claim 3, characterized in that, Extract the severity score, disclosure time, and remediation status information for each vulnerability from the vulnerability distribution characteristics, including: Obtain detailed descriptions of known vulnerabilities in the target network system from external threat intelligence data, including the vulnerability severity score, disclosure date, and current remediation status. Based on a preset scoring mapping rule, the severity score is converted into a numerical score value; The disclosure duration of the vulnerability is calculated based on the disclosure time, where the disclosure duration is defined as the time difference between the current time and the time when the vulnerability was first disclosed. Based on the repair status information, it is determined whether the vulnerability has been repaired. If it has been repaired, the vulnerability is marked as inactive; if it has not been repaired, the vulnerability is marked as active.

9. The method according to claim 4, characterized in that, Based on the real-time protection measures status, determine the protection strength coefficient corresponding to each vulnerability, including: Obtain the real-time protection status of the target network system, wherein the real-time protection status includes firewall rule activation status, intrusion detection system alarm status, and patch update records; For each vulnerability, analyze the coverage of protection measures for the network devices or services where it is located, and count the number of protection measures covering the vulnerability; Based on the preset protection strength weight table, a corresponding protection strength weight value is assigned to each protection measure; The overall protection strength coefficient of the vulnerability is calculated based on the number of protective measures covering the vulnerability and their corresponding protection strength weight values.

10. A multi-dimensional quantitative evaluation system for network exposure surface, characterized in that, The system includes: The acquisition module is used to acquire the operational data of the target network system within a preset time window. The operational data includes network traffic log information, system configuration parameters, and external threat intelligence data. The preprocessing module is used to preprocess the running data to generate a standardized dataset; The feature extraction module is used to input the standardized dataset into a pre-trained deep learning model and extract multi-dimensional feature vectors of the target network system through the deep learning model. The multi-dimensional feature vectors include network topology features, access control policy features, and vulnerability distribution features. The indicator generation module is used to calculate the exposure surface quantitative indicator of the target network system based on the multi-dimensional feature vector and using a quantitative evaluation algorithm. The exposure surface quantitative indicator includes the number of exposed nodes, the length of the path for potential vulnerabilities to be exploited, and the probability of vulnerability exploitation. The risk report generation module is used to generate a risk assessment report for the target network system based on the exposure surface quantification index, and output the risk assessment report.

Images