A network security risk assessment early warning method and system and a storage medium

Abstract

The present application relates to the field of network security, and relates to a network security risk assessment and early warning method and system and a storage medium. The present application identifies the open port service name and version number of each host, matches whether there is a vulnerability, when there is a vulnerability, based on the vulnerability exploitation condition, filters the associated host that meets the vulnerability exploitation condition from all associated hosts, and establishes a directed attack path pointing to the filtered associated host; starting from the external attack entry node, combining the vulnerability exploitation condition of each host and the directed attack path to construct an attack node sequence, calculating the path depth and path structure importance based on the attack node sequence, calculating the risk transmission coefficient of each host node based on the path reachability, and calculating the current risk value based on the node value weight and the recent activity factor of the vulnerability on the node, when the current risk value of a certain node exceeds the preset alarm threshold, an early warning signal is generated, improving the timeliness and accuracy of risk warning.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to a network security risk assessment and early warning method, system, and storage medium. Background Technology

[0002] With the rapid development of computer network technology, the scale of network systems in enterprises and various organizations is constantly expanding, and network topologies are becoming increasingly complex. Service programs running on hosts inevitably contain security vulnerabilities. Attackers can exploit these vulnerabilities to gradually penetrate laterally along network connections, achieving a tiered attack from external entry points to critical internal asset nodes. Once attackers establish multiple attack links using vulnerabilities, the risk will continue to propagate and spread along network nodes, easily causing serious security incidents such as damage to core business operations and leakage of sensitive data. Therefore, conducting accurate network security risk assessments and early warnings for each host node within the network has become a crucial aspect of network security protection.

[0003] However, existing technologies have the following problems: 1. Existing technologies usually only perform isolated matching and scoring of open ports, service versions and vulnerability information of a single host, without taking into account the directed attack paths formed between hosts based on vulnerability exploitation conditions and network reachability, and without taking into account the path reachability and path structure importance of different host nodes in the attack node sequence, which makes it impossible to accurately measure the network security risks formed by the propagation and accumulation of vulnerabilities between hosts.

[0004] 2. Existing technologies mostly rely on static asset value or the severity of a single vulnerability, without taking into account the combined effects of recent activity factors, host node value weights, and risk transmission coefficients within a set time period. This results in risk assessment results not being able to dynamically change with the attack path structure and real-time threat intelligence, making it difficult to generate effective early warnings before the risk changes from quantitative to qualitative. Summary of the Invention

[0005] This invention aims to address the shortcomings of existing technologies by providing a method, system, and storage medium for network security risk assessment and early warning. The invention generates an attack node sequence by constructing a directed attack path, calculates the reachability and importance of the node path structure to obtain a risk transmission coefficient, and combines asset value weights and vulnerability activity to calculate the node risk value, thereby achieving a quantitative assessment of network chain-like penetration risk.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a network security risk assessment and early warning method, comprising: identifying the open port service name and version number of each host; matching the service name and version number to determine if a vulnerability exists; when a vulnerability exists, filtering out associated hosts that meet the vulnerability exploitation conditions from all associated hosts based on the vulnerability and vulnerability exploitation conditions of each host with a vulnerability; and establishing a directed attack path to the filtered associated hosts.

[0007] Starting from the external attack entry node, and combining the vulnerability exploitation conditions of each host with the directed attack path, an attack node sequence is constructed. The number of attack node sequences passing through each host node and the length of each attack node sequence are counted, and the path reachability is calculated.

[0008] The path structure importance of each host node is calculated based on its in-degree and out-degree, and the risk transmission coefficient of each host node is calculated in combination with the path reachability.

[0009] The system obtains the recent activity factor of each vulnerability, calculates the current risk value based on the risk transmission coefficient of each host and the node value weight, combined with the recent activity factor of the vulnerability on the node, and generates an early warning signal when the current risk value of a node exceeds the preset alarm threshold.

[0010] Secondly, this invention provides a network security risk assessment and early warning system, comprising: an attack path establishment module, a path reachability analysis module, a risk transmission coefficient analysis module, and a risk early warning module. The modules are connected as follows: the attack path establishment module is connected to the path reachability analysis module, and the risk transmission coefficient analysis module is connected to both the path reachability analysis module and the risk early warning module.

[0011] The attack path establishment module identifies the open port service names and version numbers of each host, matches the service names and version numbers to see if there are vulnerabilities, and when vulnerabilities are found, it filters out the associated hosts that meet the vulnerability exploitation conditions from all associated hosts based on the vulnerabilities and vulnerability exploitation conditions, and establishes a directed attack path to the filtered associated hosts.

[0012] The path reachability analysis module starts from the external attack entry node, combines the vulnerability exploitation conditions of each host with the directed attack path to construct an attack node sequence, counts the number of attack node sequences passing through each host node and the length of each attack node sequence, and calculates the path reachability.

[0013] The risk transmission coefficient analysis module calculates the importance of the path structure of each host node based on the in-degree and out-degree of each host node, and calculates the risk transmission coefficient of each host node in combination with the path reachability.

[0014] The risk warning module obtains the recent activity factor of each vulnerability, calculates the current risk value based on the risk transmission coefficient of each host and the node value weight, combined with the recent activity factor of the vulnerability on the node. When the current risk value of a node exceeds the preset alarm threshold, an early warning signal is generated.

[0015] Thirdly, the present invention provides a storage medium comprising: a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the network security risk assessment and early warning method of the present invention.

[0016] Compared with the prior art, the present invention has the following beneficial effects: (1) Based on the vulnerabilities and vulnerability exploitation conditions of each host with vulnerabilities, the present invention filters out the associated hosts that meet the vulnerability exploitation conditions from all associated hosts, establishes a directed attack path to the filtered associated hosts, restores the real reachable attack link for lateral penetration of the internal network, avoids general judgment of vulnerability risk, and provides a real and effective topological basis for subsequent attack path analysis.

[0017] (2) This invention constructs an attack node sequence by taking the external attack entry node as the starting point and combining the vulnerability exploitation conditions of each host with the directed attack path, counts the number of attack node sequences passing through each host node and the length of each attack node sequence, calculates the path reachability, quantifies the scale and depth of the attack path in which the host participates as a penetration springboard, objectively reflects the probability that the node is used by the attacker as an intermediate jump node, and improves the accuracy of identifying key attack paths and the scope of risk propagation.

[0018] (3) This invention calculates the path structure importance of each node based on the in-degree and out-degree of each host node, and calculates the risk transmission coefficient of each host node in combination with the path reachability, thereby quantifying the structural importance and risk transmission capability of host nodes in the attack path and improving the accuracy and comprehensiveness of risk transmission assessment.

[0019] (4) This invention obtains the recent activity factor of each vulnerability, calculates the current risk value based on the risk transmission coefficient of each host and the node value weight combined with the recent activity factor of the vulnerability on the node, and generates an early warning signal when the current risk value of a node exceeds the preset alarm threshold, thereby realizing a comprehensive dynamic assessment of static asset value, attack path structure and real-time threat intelligence, and improving the timeliness and accuracy of network security risk early warning. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the method steps of the present invention.

[0022] Figure 2This is a schematic diagram illustrating the specific steps of the method for constructing the attack node sequence in this invention.

[0023] Figure 3 This is a schematic diagram of the steps in the current risk value analysis method of the present invention.

[0024] Figure 4 This is a schematic diagram of the system structure of the present invention. Detailed Implementation

[0025] Various exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the invention. Furthermore, it should be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale.

[0026] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use. Techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and apparatus should be considered part of the specification.

[0027] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0028] Please see Figure 1 As shown, the present invention provides a network security risk assessment and early warning method, including: S1, identifying whether a vulnerability exists, and if so, establishing a directed attack path.

[0029] Physical connectivity between network hosts does not equate to lateral movement in attacks. Even if two hosts are network reachable, if the permissions and access consequences after exploiting an upstream vulnerability do not meet the triggering prerequisites for a downstream vulnerability, the attacker will still be unable to complete the penetration. Relying solely on topological connectivity to generate attack chains will create numerous unusable paths, leading to inflated subsequent path analysis results. Therefore, this invention combines exploit prerequisites and post-exploitation consequences from a vulnerability database for secondary filtering, eliminating theoretically connected but unusable false chains, thus providing a reliable topological foundation for generating attack node sequences.

[0030] The specific implementation steps of S1 include: S11, identifying the open port service names and version numbers of each host, and matching the service names and version numbers to determine if vulnerabilities exist. The specific implementation steps include:

[0031] S111. Perform port scanning on the target network system to obtain open port information for each host, initiate service probes on each open port, and extract the service name and version number corresponding to each open port. In this embodiment, TCP SYN half-open scanning is used to obtain open ports for each host, and service identification information for each open port is obtained by sending protocol probe packets. Based on the service fingerprint database, the service name and version number corresponding to each open port are extracted from the service identification information.

[0032] S112. Match the service name and version number corresponding to each open port with the affected version range corresponding to each service name in the preset vulnerability database. The preset vulnerability database contains the identifier, service name, affected version range, and exploitation conditions of all vulnerabilities already included. The exploitation conditions include the consequences of successful exploitation and the prerequisites for exploitation.

[0033] S113. If the service name of an open port matches a service name in a preset vulnerability database, determine whether the version number of the open port is within the range of affected versions of the service name. If it is within the range, determine that the port has a vulnerability; otherwise, determine that the port does not have a vulnerability.

[0034] S12. When a vulnerability exists, based on the vulnerability and exploitation conditions of each host with a vulnerability, select the associated hosts that meet the exploitation conditions from all associated hosts, and establish a directed attack path to the selected associated hosts.

[0035] The method for matching associated hosts that meet the exploit conditions includes: W1, performing a network topology scan on the target network system to obtain the network connectivity between each host, and based on the network connectivity between each host, recording two hosts with network reachable links as associated hosts.

[0036] W2. Obtain from the preset vulnerability database the consequences and prerequisites for successful exploitation of vulnerabilities on each host.

[0037] W3. Filter out the associated hosts with vulnerabilities from all associated hosts of each host with vulnerabilities and record them as the corresponding candidate hosts.

[0038] W4. If the consequences of successfully exploiting a vulnerability on a host with a vulnerability satisfy the exploitation prerequisites for a vulnerability on a corresponding candidate host, then the candidate host is determined to be an associated host of the host with the vulnerability that satisfies the vulnerability exploitation conditions. The method for establishing the directed attack path is as follows: If a candidate host is an associated host of the host with the vulnerability that satisfies the vulnerability exploitation conditions, then a directed attack path is established from the host with the vulnerability to the candidate host.

[0039] This invention identifies vulnerabilities and exploitation conditions on each vulnerable host, filters out host associations that meet the exploitation conditions from all associated hosts, establishes a directed attack path to the filtered host associations, reconstructs the real reachable attack link for lateral penetration of the internal network, avoids general judgment of vulnerability risk, and provides a real and effective topological basis for subsequent attack path analysis.

[0040] S2. Construct the attack node sequence and calculate the path reachability.

[0041] A single internal network node can be situated on multiple attack links. The ease with which an attacker reaches a node depends on both the number of attack paths leading to it and the number of hops along those paths. Longer paths require more penetration steps and increase the cost of the attack. Simply counting the number of paths while ignoring differences in hop counts overestimates the attack risk of nodes along long paths. This embodiment analyzes path reachability by comprehensively considering both the number and length of paths, ensuring that the calculation results reflect real-world conditions.

[0042] The specific implementation steps of S2 include:

[0043] S21. Starting from the external attack entry point, construct an attack node sequence by combining the vulnerability exploitation conditions of each host and the directed attack path. For example... Figure 2 As shown, the specific implementation steps are as follows: S211, Starting from the external attack entry node, select vulnerable hosts and their open ports that are reachable from the external attack entry node network in the target network system.

[0044] S212. If the vulnerability of a selected host is exploited under conditions that include external reachability requirements, then a directed edge is established from the external attack entry node to the host, and the directed attack path starting from the host is traversed in a depth-first manner.

[0045] S213. During the traversal, if a host has multiple directed paths pointing to other hosts, then continue traversing along each directed path and record the order of the nodes traversed.

[0046] S214. When a host is encountered where no directed path points to other hosts, this host is marked as the termination node, the traversal of the current branch is stopped, and the complete node sequence from the external attack entry node to the termination node is taken as an attack node sequence. It should be noted that during depth-first traversal, if the host node to be visited is already in the set of visited nodes of the current traversal branch, then that host node is skipped, and the traversal of the current branch is stopped.

[0047] S215. After traversing all branches, a complete sequence of attack nodes from the external attack entry node to the corresponding termination node is obtained. It should be noted that if no attack node sequence exists, it is determined that there is no risk, and subsequent steps are not continued; the process returns to step S1 for vulnerability monitoring.

[0048] S22. Count the number of attack node sequences passing through each host node and the length of each attack node sequence, and calculate the path reachability. The specific implementation steps are as follows: S221. Record each attack node sequence passing through a certain node as the relevant sequence of that node, obtain the length of all relevant sequences of each node, obtain the minimum value of the length of all attack node sequences, and record it as the representative minimum attack sequence length.

[0049] S222. Calculate the ratio of the minimum attack sequence length to the length of all related sequences of each node, and record the maximum ratio as the normalized length feature value.

[0050] S223. Obtain the ratio of the total number of relevant sequences of each node to the total number of sequences of all attacking nodes, and record it as the normalized path quantity feature value. Record the product of the normalized path quantity feature value and the normalized length feature value as the path reachability.

[0051] The path reachability is used to characterize how easily an attacker can reach the host node from an external entry point. The higher the path reachability of a node, the more attack paths pass through the node and the shorter those paths are. This means the cost for an attacker to reach the node is lower, and the node should be prioritized for protection.

[0052] This invention constructs an attack node sequence by starting with an external attack entry node, combining the vulnerability exploitation conditions of each host, and a directed attack path. It counts the number of attack node sequences passing through each host node and the length of each attack node sequence, calculates path reachability, quantifies the scale and depth of attack paths in which hosts participate as penetration springboards, objectively reflects the probability that nodes are used by attackers as intermediate jump nodes, and improves the accuracy of identifying key attack paths and the scope of risk propagation.

[0053] S3. Analyze the importance of the path structure of each node and calculate the risk transmission coefficient of each host node.

[0054] In an attack topology, a high in-degree indicates that the node is easily reached by external attacks, while a high out-degree indicates that once the node is compromised, it can act as a springboard to penetrate multiple downstream nodes, making it a pivotal node for risk propagation. The two do not contribute equally to the transmission of risk across the entire network, with the out-degree having a greater impact on lateral diffusion. Therefore, this invention calculates the importance of the path structure by weighting the two.

[0055] Furthermore, considering that the importance of a simple topological structure only reflects the hub attribute on the graph and does not take into account the actual ease or difficulty of an attacker to reach it, this invention uses the product of the path structure importance and the path reachability as the risk transmission coefficient to quantify the ease or difficulty of risk transmission.

[0056] The specific implementation steps of S3 include:

[0057] S31. Calculate the path structure importance of each node based on the in-degree and out-degree of each host node. The specific steps are as follows: S311. Obtain the number of all attack paths pointing to other nodes for each node, and record them as the node's out-degree. Obtain the number of attack paths pointed to by other nodes for each node, and record them as the corresponding node's in-degree.

[0058] S312. The ratio of the out-degree of each node to the maximum out-degree of all nodes is recorded as the out-degree coefficient, and the ratio of the in-degree of each node to the maximum in-degree of all nodes is recorded as the in-degree coefficient.

[0059] S313. The path structure importance is obtained by weighted summing of the out-degree and in-degree coefficients of each node. The path structure importance is used to characterize the degree of structural hub status of a node in the attack propagation topology.

[0060] It should be further explained that in a network attack, the attacker's ultimate goal is to reach core assets. A high in-degree only indicates that the node is easily reached by the attacker; if its out-degree is low, the attacker cannot penetrate further after controlling the node, thus limiting the harm. A high out-degree, on the other hand, indicates that the node is a key stepping stone for the attacker's lateral movement. Once controlled, the attacker can spread to multiple downstream nodes, posing a greater threat to the entire network. Therefore, the out-degree weight coefficient should be greater than the in-degree weight coefficient. In a preferred embodiment of the present invention, the weights of the in-degree coefficient and the out-degree coefficient are set to 0.3 and 0.7, respectively. Those skilled in the art can also set other specific values.

[0061] S32. Calculate the risk transmission coefficient of each host node based on path reachability. The specific implementation steps include: recording the product of the path structure importance and path reachability of each host node as the risk transmission coefficient for that host node. The risk transmission coefficient ranges from [0,1] and is used to characterize the overall risk transmission capability of the host node in the attack propagation chain; the higher the risk transmission coefficient, the stronger the ability of the host node to spread risk to the entire network after being compromised. By calculating the product, the lower risk in one dimension of path structure importance and path reachability is avoided from offsetting the higher risk in another dimension, thus preventing misjudgment of the overall risk transmission coefficient.

[0062] This invention calculates the path structure importance of each host node based on its in-degree and out-degree, and combines this with the path reachability to calculate the risk transmission coefficient of each host node. This enables the quantification of the structural importance and risk transmission capability of host nodes in the attack path, thereby improving the accuracy and comprehensiveness of risk transmission assessment.

[0063] S4. Obtain the recent activity factor of each vulnerability, calculate the current risk value based on the risk transmission coefficient of each host and the node value weight combined with the recent activity factor of the vulnerability on the node, and generate an early warning signal when the current risk value of a node exceeds the preset alarm threshold.

[0064] Different vulnerabilities exhibit varying degrees of attack activity. Vulnerabilities frequently exploited in recent attacks, as indicated in threat intelligence, represent a higher probability of actual exploitation by attackers. Different hosts carry varying levels of business and data importance; the higher the asset value weight, the greater the potential loss when attacked, thus resulting in a higher risk value. Therefore, this invention calculates the current risk value by fusing the value weight of each host node, the risk transmission coefficient, and the recent activity factor of vulnerabilities on the corresponding host node.

[0065] like Figure 3 As shown, the analysis method for the current risk value includes:

[0066] S41. Obtain the number of successful attacks on all vulnerabilities within a set time period from real-time threat intelligence data. Record the ratio of the number of successful attacks on each vulnerability within the set time period to the total number of successful attacks on all vulnerabilities within the set time period as the recent activity factor for the corresponding vulnerability. The set time period refers to the past month. A higher number of successful attacks indicates higher vulnerability activity, a greater probability of successful attack on the node, and a higher risk value. Those skilled in the art can set other time periods according to actual circumstances; for example, the time period can be appropriately shortened for network environments with frequent threat changes, and appropriately increased for relatively stable environments.

[0067] S42. Obtain the asset value score of each host node, and record the ratio of the asset value score of each host node to the sum of the asset value scores of all host nodes as the value weight of the corresponding node. The asset value score of the host node is pre-set by the operations and maintenance personnel based on the importance of the services and data carried by the host node. Priorities can be sorted according to importance, for example, from low to high, and then assigned ascending asset value scores such as 1, 2, 3… The value weight of the corresponding node is calculated based on the above steps.

[0068] S43. The current risk value is the product of the value weight of each host node, the risk transmission coefficient, and the maximum recent activity factor of the vulnerability on the corresponding host node. Specifically, the higher the value weight of the host node, the higher the risk transmission coefficient, and the higher the recent activity factor of the vulnerability on the corresponding host node, the higher the current risk value.

[0069] Furthermore, it should be noted that the current risk value range is [0,1]. In a preferred embodiment of the present invention, the preset alarm threshold can be determined based on the historical security operation data statistics of the target network system. Specifically, this includes: collecting the time points in the next 24 hours where no security events causing host compromise, data leakage, or service interruption have occurred in the target network system, recording these as security operation data sampling points, obtaining the risk value of each host node corresponding to each security operation data sampling point, recording these as risk value samples, and then using 3... After removing outliers, the remaining risk values ​​are sorted from largest to smallest, and the 99th percentile is used as the preset alarm threshold. This represents the standard deviation of the risk value sample. Those skilled in the art may set other quantiles, but they should not be too small, which would result in excessively low preset alarm thresholds and frequent warnings.

[0070] This invention obtains the recent activity factor of each vulnerability, calculates the current risk value based on the risk transmission coefficient of each host and the node value weight, combined with the recent activity factor of the vulnerability on the node. When the current risk value of a node exceeds the preset alarm threshold, an early warning signal is generated, realizing a comprehensive dynamic assessment of static asset value, attack path structure and real-time threat intelligence, and improving the timeliness and accuracy of network security risk warning.

[0071] like Figure 4 As shown, this invention provides a network security risk assessment and early warning system, including: an attack path establishment module, a path reachability analysis module, a risk transmission coefficient analysis module, and a risk early warning module. The modules are connected as follows: the attack path establishment module is connected to the path reachability analysis module, and the risk transmission coefficient analysis module is connected to both the path reachability analysis module and the risk early warning module.

[0072] The attack path establishment module identifies the open port service names and version numbers of each host, matches the service names and version numbers to see if there are vulnerabilities, and when vulnerabilities are found, it filters out the associated hosts that meet the vulnerability exploitation conditions from all associated hosts based on the vulnerabilities and vulnerability exploitation conditions, and establishes a directed attack path to the filtered associated hosts.

[0073] The path reachability analysis module starts from the external attack entry node, combines the vulnerability exploitation conditions of each host with the directed attack path to construct an attack node sequence, counts the number of attack node sequences passing through each host node and the length of each attack node sequence, and calculates the path reachability.

[0074] The risk transmission coefficient analysis module calculates the importance of the path structure of each host node based on the in-degree and out-degree of each host node, and calculates the risk transmission coefficient of each host node in combination with the path reachability.

[0075] The risk warning module obtains the recent activity factor of each vulnerability, calculates the current risk value based on the risk transmission coefficient of each host and the node value weight, combined with the recent activity factor of the vulnerability on the node. When the current risk value of a node exceeds the preset alarm threshold, an early warning signal is generated.

[0076] In a preferred embodiment of the present invention, a storage medium storing a computer program is also provided, characterized in that the computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the network security risk assessment and early warning method of the present invention.

[0077] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0078] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0079] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0080] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0081] Finally, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for assessing and warning network security risks, characterized in that, include: Identify the open port service names and version numbers of each host, match the service names and version numbers to see if there are vulnerabilities, and when vulnerabilities exist, filter out the associated hosts that meet the vulnerability exploitation conditions from all associated hosts based on the vulnerabilities and vulnerability exploitation conditions, and establish a directed attack path to the filtered associated hosts. Starting from the external attack entry point, and combining the vulnerability exploitation conditions and directed attack paths of each host, an attack node sequence is constructed. The number of related sequences for each host node and the length of each attack node sequence are counted, and the path reachability is calculated. The path structure importance of each host node is calculated based on its in-degree and out-degree, and the risk transmission coefficient of each host node is calculated in combination with the path reachability. The system obtains the recent activity factor of each vulnerability, calculates the current risk value based on the risk transmission coefficient of each host and the node value weight, combined with the recent activity factor of the vulnerability on the node, and generates an early warning signal when the current risk value of a node exceeds the preset alarm threshold.

2. The network security risk assessment and early warning method according to claim 1, characterized in that, The method for matching whether a vulnerability exists includes: Perform port scanning on the target network system to obtain open port information of each host, initiate service probes on each open port, and extract the service name and version number corresponding to each open port; Match the service name and version number corresponding to each open port with the range of affected versions corresponding to each service name in the preset vulnerability database; If the service name of an open port matches a service name in a preset vulnerability database, then it is determined whether the version number of the open port is within the range of affected versions of the service name. If it is within the range, then the port is determined to have a vulnerability; otherwise, the port is determined not to have a vulnerability.

3. The network security risk assessment and early warning method according to claim 1, characterized in that, The method for matching associated hosts that meet the exploit conditions includes: Perform a network topology scan on the target network system to obtain the network connectivity relationships between each host. Based on the network connectivity relationships between each host, two hosts with network reachable links are recorded as associated hosts. Obtain the consequences and prerequisites for successful exploitation of vulnerabilities on each host containing vulnerabilities from the preset vulnerability database. Filter out the associated hosts with vulnerabilities from all associated hosts of each host with vulnerabilities, and record them as the corresponding candidate hosts; If the consequences of successfully exploiting a vulnerability on a host with a vulnerability satisfy the exploitation prerequisites for a vulnerability on a corresponding candidate host, then the candidate host is determined to be an associated host of the host with the vulnerability that satisfies the vulnerability exploitation conditions.

4. The network security risk assessment and early warning method according to claim 3, characterized in that, The method for constructing the attack node sequence includes: Starting from the external attack entry point node, filter out vulnerable hosts and their open ports that are reachable from the external attack entry point node network in the target network system. If the vulnerability of a selected host is exploited in a condition that includes external reachability requirements, then a directed edge is established from the external attack entry node to the host, and the directed attack path starting from the host is traversed in a depth-first manner. During the traversal, if a host has multiple directed paths pointing to other hosts, then continue traversing along each directed path and record the order of the nodes traversed. When a host is found to have no directed path to other hosts, the host is marked as the termination node, the traversal of the current branch is stopped, and the complete node sequence from the external attack entry node to the termination node is taken as an attack node sequence. After traversing all branches, a complete sequence of attack nodes is obtained, starting from the external attack entry node and ending at the corresponding termination node.

5. The network security risk assessment and early warning method according to claim 1, characterized in that, The methods for calculating the path reachability of each node include: The sequence of each attack node that passes through a certain node is recorded as the relevant sequence of that node. The length of all relevant sequences of each node is obtained. The minimum value of the length of all attack node sequences is obtained and recorded as the minimum attack sequence length. The ratio of the minimum attack sequence length to the length of all related sequences of each node is calculated, and the maximum ratio is recorded as the normalized length feature value. The ratio of the total number of relevant sequences of each node to the total number of sequences of all attacking nodes is obtained and recorded as the normalized path quantity feature value. The product of the normalized path quantity feature value and the normalized length feature value is recorded as the path reachability.

6. The network security risk assessment and early warning method according to claim 1, characterized in that, The method for obtaining the importance of the path structure includes: Get the number of all attack paths pointing to other nodes for each node, and record them as the node's out-degree. Get the number of attack paths that other nodes point to for each node, and record them as the corresponding node's in-degree. The ratio of the out-degree of each node to the maximum out-degree of all nodes is called the out-degree coefficient, and the ratio of the in-degree of each node to the maximum in-degree of all nodes is called the in-degree coefficient. The importance of the path structure is obtained by weighted summation of the out-degree and in-degree coefficients of each node.

7. The network security risk assessment and early warning method according to claim 6, characterized in that, The calculation method for the risk transmission coefficient of each host node includes: The product of the path structure importance and path reachability of each host node is recorded as the risk transmission coefficient of the corresponding host node.

8. The network security risk assessment and early warning method according to claim 1, characterized in that, The analysis methods for the current risk value include: The number of successful attacks on all vulnerabilities within a set time period is obtained from real-time threat intelligence data. The ratio of the number of successful attacks on each vulnerability within a set time period to the total number of successful attacks on all vulnerabilities within a set time period is recorded as the recent activity factor of the corresponding vulnerability. Obtain the asset value score of each host node, and record the ratio of the asset value score of each host node to the sum of the asset value scores of all host nodes as the value weight of the corresponding node. The current risk value is the product of the value weight of each host node, the risk transmission coefficient, and the maximum value of the recent activity factor of the vulnerability on the corresponding host node.

9. A network security risk assessment and early warning system, characterized in that, include: The attack path establishment module identifies the open port service names and version numbers of each host, matches the service names and version numbers to see if there are vulnerabilities, and when vulnerabilities exist, it filters out the associated hosts that meet the vulnerability exploitation conditions from all associated hosts based on the vulnerabilities and vulnerability exploitation conditions, and establishes a directed attack path to the filtered associated hosts. The path reachability analysis module starts from the external attack entry node, combines the vulnerability exploitation conditions of each host with the directed attack path to construct an attack node sequence, counts the number of attack node sequences passing through each host node and the length of each attack node sequence, and calculates the path reachability. The risk transmission coefficient analysis module calculates the path structure importance of each node based on the in-degree and out-degree of each host node, and calculates the risk transmission coefficient of each host node in combination with the path reachability. The risk warning module obtains the recent activity factor of each vulnerability, calculates the current risk value based on the risk transmission coefficient of each host and the node value weight, combined with the recent activity factor of the vulnerability on the node. When the current risk value of a node exceeds the preset alarm threshold, an early warning signal is generated.

10. A storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the network security risk assessment and early warning method as described in any one of claims 1 to 8.

Images