Cybersecurity Comprehensive Risk Assessment Methods and Systems

Abstract

A comprehensive cybersecurity risk assessment method, executed by a system, includes the following steps: (A) collecting multiple log data and obtaining current anomaly information based on the log data; (B) obtaining at least one related target historical anomaly information from multiple historical anomaly information based on the current anomaly information, wherein at least one of the source resource, target resource, and attack characteristics of each target historical anomaly information is the same as the source resource, target resource, and attack characteristics of the current anomaly information; (C) treating the current anomaly information and the at least one target historical anomaly information as multiple related anomaly information, and calculating a comprehensive risk score based on the related anomaly information.

Claims

1. A comprehensive cybersecurity risk assessment method, executed by a system storing multiple historical anomaly event information, each historical anomaly event information including a risk score, a source resource, a target resource, and an attack characteristic, the method comprising the following steps: (A) collecting multiple log data and obtaining current anomaly event information based on the log data, the current anomaly event information including a risk score, a source resource, a target resource, and an attack characteristic; (B) obtaining at least one relevant target historical anomaly event information from the historical anomaly event information based on the current anomaly event information, wherein... (C) The source resources, target resources, and attack characteristics of each historical anomaly event information are the same as those of the current anomaly event information; and (C) the current anomaly event information and the at least one historical anomaly event information are treated as multiple related anomaly event information, and a comprehensive risk score is calculated based on the related anomaly event information; wherein, in step (C), for each related anomaly event information, a reputation level is obtained based on the source resources of the related anomaly event information, and a reputation weight is obtained based on the reputation level; a number of related attack stages is obtained based on the attack characteristics of the related anomaly event information, and a stage crossing weight is obtained based on the number of stages; then the risk score, the reputation weight, and the stage crossing weight of the related anomaly event information are multiplied together to obtain a weighted risk score, and the comprehensive risk score is the sum of all weighted risk scores.

2. The comprehensive cybersecurity risk assessment method as described in claim 1, wherein, Step (A) includes the following sub-steps: (A-1) collecting the log data; (A-2) generating an alarm data using at least one of an association rule algorithm and a machine learning model for identifying abnormal events; (A-3) extracting key metadata from the alarm data to obtain key metadata; and (A-4) converting the key metadata into a preset data format to obtain the current abnormal event information.

3. As described in Request 1, the comprehensive cybersecurity risk assessment method further includes a trigger time for each historical anomaly event, wherein... In step (A), the current abnormal event information also includes a trigger time. In step (C), for each piece of related abnormal event information, a time weight is obtained based on the trigger time of the related abnormal event information and a current time. Then, the risk score, reputation weight, cross-stage weight, and time weight of the related abnormal event information are multiplied together to obtain the weighted risk score. The comprehensive risk score is the sum of all weighted risk scores.

4. As described in Request 1, the comprehensive cybersecurity risk assessment method further includes a trigger time for each historical anomaly event, wherein... In step (A), the current abnormal event information also includes a trigger time. In step (C), for each piece of related abnormal event information, a trigger frequency weight is obtained based on one of the trigger time, source resource, and target resource of the related abnormal event information. Then, the risk score, reputation weight, cross-stage weight, and trigger frequency weight of the related abnormal event information are multiplied together to obtain the weighted risk score. The comprehensive risk score is the sum of all weighted risk scores.

5. The comprehensive cybersecurity risk assessment method as described in claim 1, wherein, In step (C), for each piece of related abnormal event information, the risk score, reputation weight, cross-stage weight, and recent intrusion weight of the related abnormal event information are multiplied together to obtain the weighted risk score. The comprehensive risk score is the sum of all weighted risk scores.

6. The comprehensive cybersecurity risk assessment method as described in claim 1, wherein, In step (C), a non-repeating event type weight is obtained based on the attack characteristics of the associated abnormal event information. For each piece of associated abnormal event information, the risk score, reputation weight, cross-stage weight, and non-repeating event type weight of the associated abnormal event information are multiplied together to obtain the weighted risk score. The comprehensive risk score is the sum of all weighted risk scores.

7. The cybersecurity comprehensive risk assessment method as described in claim 1, wherein each historical anomaly event information entry for the target resource has victim host information, wherein, In step (C), for each associated abnormal event information, an agility weight related to the agility of the victim host is obtained based on the victim host information of the target resource of the associated abnormal event information. Then, the risk score, reputation weight, and cross-stage weight of the associated abnormal event information are multiplied together and added to the agility weight to obtain the weighted risk score. The comprehensive risk score is the sum of all weighted risk scores.

8. The comprehensive cybersecurity risk assessment method as described in claim 1, wherein, In step (C), for each piece of related abnormal event information, a high harm weight is obtained based on the attack characteristics of the related abnormal event information. Then, the risk score, reputation weight, and cross-stage weight of the related abnormal event information are multiplied together and added to the high harm weight to obtain the weighted risk score. The comprehensive risk score is the sum of all weighted risk scores.

9. A comprehensive cybersecurity risk assessment system, comprising: a storage unit storing multiple historical anomaly event information, each historical anomaly event information including a risk score, a source resource, a target resource, and an attack characteristic; and a processing unit electrically connected to the storage unit; the processing unit performing the comprehensive cybersecurity risk assessment method as described in any one of claims 1 to 8.

Images