WO2019218874A1

WO2019218874A1 - Network risk assessment method and system

Info

Publication number: WO2019218874A1
Application number: PCT/CN2019/085189
Authority: WO
Inventors: 涂大志; 郭景楠; 王新成; 王志
Original assignee: 深圳市联软科技股份有限公司
Priority date: 2018-05-14
Filing date: 2019-04-30
Publication date: 2019-11-21
Also published as: CN108650133A

Abstract

Provided in the present invention are a network risk assessment method and system. The method comprises the following steps: respectively setting weight values of various types of network devices in a network to be tested; detecting device risk levels of all the network devices in the network to be tested and scoring the device risk levels to obtain device risk scores; computing the weights of the network devices respectively according to the device risk scores of the network devices and the corresponding weight values; and computing a network risk score of the network to be tested, wherein the network risk score is a weighted sum of all the network devices in the network to be tested. According to the method, corresponding weight values are set according to the importance degree of network devices, and after device risk scores of various network devices are weighted by using the weight values, the risk of a network to be tested is evaluated by solving a weighted sum of all the network devices in the network to be tested, such that the importance degree of different types of devices in a network can be introduced into an evaluation range, making an evaluation result more comprehensive.

Description

Network risk assessment method and system

Technical field

The invention belongs to the field of internet technology, and particularly relates to a network risk assessment method and system.

Background technique

In the prior art, the enterprise network risk assessment mainly has the following methods:

1. Set the detection rules. Set a plurality of detection items, and perform detection on all the single network devices according to the detection items, and comprehensively determine the risk level by using all the detection results as a network risk measurement index;

2. Set the inspection items, set the scores for all inspection items, take the deduction mechanism, check the network according to the inspection items, and deduct the points according to the threat level if the inspection items are not qualified.

The evaluation granularity of the above two methods is too coarse, and the importance of the equipment in the network cannot be evaluated differently.

Summary of the invention

In view of the deficiencies in the prior art, the present invention provides a network risk assessment method and system, which can introduce the importance degree of different types of devices in the network into the evaluation scope, and the evaluation result is more comprehensive.

In a first aspect, a method for network risk assessment includes the following steps:

Set the weight values of each type of network device in the network to be tested.

Detecting the device risk level of all network devices in the network to be tested, and scoring the device risk level to obtain the device risk score;

Calculating the weight of the network device according to the device risk score of the network device and the corresponding weight value;

Calculating a network risk score of the network to be tested; the network risk score is a weighted sum of all network devices in the network to be tested.

Further, the weighting calculation method of the network device is as follows:

Device_weight _i =cat_weight _i ×device_assess _i ;

The device_weight _i is the weight of the i-th network device, the cat_weight _i is the weight of the i-th network device, and the device_assess _i is the device risk score of the i-th network device.

Further, the calculation method of the network risk score enterprise_assess of the network to be tested is as follows:

Among them, category is the number of devices in the network to be tested. Further, the network device type of the network to be tested includes a server device, a network device, a computer device, a mobile device, an IoT device, and/or an ICS device.

Further, the device risk score of the server device is a maximum value of the device risk score detected by the server device during the evaluation time preset by the network to be tested;

The device risk score of the network device is a maximum value of the device risk score detected by the network device during the evaluation time preset by the network to be tested;

The device risk score of the computer device is an average value of the device risk scores detected by the computer device during the evaluation time preset by the network to be tested;

The device risk score of the mobile device is an average value of the device risk scores detected by the mobile device during the evaluation time preset by the network to be tested;

The device risk score of the IoT device is an average value of the device risk scores detected by the IoT device during the evaluation time preset by the network to be tested;

The device risk score of the ICS device is an average value of the device risk scores detected by the ICS device during the evaluation time preset by the network to be tested.

The second aspect is a network risk assessment system, including:

Setting unit: used to separately set the weight value of each type of network device in the network to be tested;

The device detecting unit is configured to detect the device risk level of all the network devices in the network to be tested, and score the device risk level to obtain the device risk score;

The evaluation unit is configured to calculate the weight of the network device according to the device risk score of the network device and the corresponding weight value, and also calculate the network risk score of the network to be tested; the network risk score is the network to be tested. The weighted sum of all in-network devices.

Further, the weighting calculation method of the network device is as follows:

Device_weight _i =cat_weight _i ×device_assess _i ;

Among them, category is the number of devices in the network to be tested.

Further, the network device type of the network to be tested includes a server device, a network device, a computer device, a mobile device, an IoT device, and/or an ICS device.

It can be seen from the above technical solution that the network risk assessment method and system provided by the present invention sets the corresponding weight value according to the importance degree of the network device, and uses the weight value to weight the device risk scores of each network device, and obtains the The weighted sum of all network devices in the network is measured to assess the risk of the network under test, and the importance of different types of devices in the network can be introduced into the evaluation scope, and the evaluation result is more comprehensive.

DRAWINGS

In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the specific embodiments or the description of the prior art will be briefly described below. In all the figures, like elements or parts are generally identified by like reference numerals. In the figures, elements or parts are not necessarily drawn to scale.

FIG. 1 is a flowchart of a method provided in Embodiment 1.

2 is a block diagram of a system provided by Embodiment 4.

Detailed ways

The embodiments of the technical solution of the present invention will be described in detail below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention, and thus are only examples, and are not intended to limit the scope of the present invention. It should be noted that the technical terms or scientific terms used herein should be used in the ordinary meaning as understood by those skilled in the art to which the invention belongs, unless otherwise stated.

The use of the terms "comprising", "comprising", "","," The presence or addition of a plurality of other features, integers, steps, operations, elements, components, and/or collections thereof.

As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "on" or "in response to determining" or "in response to detecting" depending on the context. . Similarly, the phrase "if determined" or "if detected [condition or event described]" may be interpreted in context to mean "once determined" or "in response to determining" or "once detected [condition or event described] ] or "in response to detecting [conditions or events described]".

It is further understood that the term "and/or" used in the description of the invention and the appended claims means any combination and all possible combinations of one or more of the associated listed items, .

Embodiment 1:

Referring to FIG. 1, Embodiment 1 provides a network risk assessment method, including the following steps:

S1: respectively setting weight values of each type of network device in the network to be tested;

Specifically, the network device type of the network to be tested includes a server device, a network device, a computer device, a mobile device, an IoT device (abbreviation of Internet of Things), an ICS device (abbreviation of Industrial Control System), and/or other devices. . For the more important online device weight value is set higher, for example: the server device weight value is 0.6, the network device weight value is 0.25. For general network device weight value can be set lower, for example: computer equipment The mobile device and other devices have a weight of 0.05. When setting the weight value, the sum of the weight values of all the network devices in the network to be tested is required to be 1. The greater the weight value, the greater the impact of the network risk score of the network to be tested. Conversely, the smaller the weight value, the smaller the impact of the network risk score of the network to be tested.

S2: detecting a device risk level of all network devices in the network to be tested, and scoring the device risk level to obtain a device risk score;

Specifically, the device risk level of the network device can be detected periodically, for example, it can be detected once in one hour, so that the risk of the network device can be detected in real time. The network device can use the following methods to evaluate the risk: 1. Set the detection rule, set multiple detection items, detect the network devices according to the detection items, and manually determine the risk level by the threat level of each detection item. The equipment risk level of the equipment. 2. Set the equipment inspection item, set the score for all inspection items, and obtain the equipment risk level of the equipment on the network according to the score of all inspection items. When scoring equipment risk levels, the greater the risk level of the equipment, the higher the score. The lower the risk level of the equipment, the lower the score.

S3: calculating the weight of the network device according to the device risk score of the network device and the corresponding weight value respectively;

S4: Calculate a network risk score of the network to be tested; the network risk score is a weighted sum of all network devices in the network to be tested.

Specifically, the network risk score of the network to be tested includes the risk level of all the network devices, and the importance of each network device is reflected by the weighting.

The method can set the corresponding weight value according to the importance degree of the network device, weight the device risk score of each network device by using the weight value, and obtain the weighted sum of all the network devices in the network to be tested to evaluate the test. The risk of the network can introduce the importance of different types of devices in the network into the evaluation scope, and the evaluation results are more comprehensive.

Embodiment 2:

The method provided in the second embodiment adds the following content on the basis of the first embodiment:

The weighting calculation method of the network device is as follows:

Device_weight _i =cat_weight _i ×device_assess _i ;

Specifically, the weight value can be defined by the user, and the user can set the weight according to the situation of the respective enterprise.

Among them, category is the number of devices in the network to be tested.

The method provided by the embodiment of the present invention is a brief description, and the part of the embodiment is not mentioned, and the corresponding content in the first embodiment can be referred to.

The method of the embodiment implements comprehensive evaluation on the basis of the risk assessment of the network equipment, introduces the importance degree of different types of equipment into the scope of investigation, and realizes the comprehensive evaluation of the enterprise network risk, and the network security administrator can clearly determine the network environment status according to the result. , develop appropriate security strategies.

Embodiment 3:

The method provided in the third embodiment adds the following content on the basis of other embodiments:

The device risk score of the server device is a maximum value of the device risk score detected by the server device during the evaluation time preset by the network to be tested;

The device risk score of the mobile device is an average value of the device risk scores detected by the mobile device during the evaluation time preset by the network to be tested.

Specifically, since the "server device" and "network device" risks have characteristics of being propagated between devices within the network, the device risk scores of the most severe values in the network devices are used for weighting. The "computer device", "mobile device", "other device", "IoT device", and "ICS device" are weighted by the average value of the device risk scores in the network device. The evaluation time is set by the user. When the evaluation time is reached, a network risk assessment is performed to calculate the network risk score of the network to be tested.

The method provided by the embodiment of the present invention is a brief description, and the part of the embodiment is not mentioned, and the corresponding content in the first embodiment and the second embodiment can be referred to.

Embodiment 4:

Referring to FIG. 2, Embodiment 4 provides a network risk assessment system, including:

The device detecting unit is configured to detect a device risk level of all the network devices in the network to be tested, and score the device risk level to obtain a device risk score;

Further, the weighting calculation method of the network device is as follows:

Device_weight _i =cat_weight _i ×device_assess _i ;

Among them, category is the number of devices in the network to be tested.

The implementation principle and the technical effects of the device provided by the embodiments of the present invention are the same as those of the foregoing method embodiments. For a brief description, where the device embodiment is not mentioned, reference may be made to the corresponding content in the foregoing method embodiments.

In the several embodiments provided herein, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention contributes in essence or to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. The instructions include a plurality of instructions for causing a computer device (which may be a personal computer, a server, or a single network device, etc.) to perform all or part of the steps of the methods of the various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. The scope is intended to be included within the scope of the claims and the description of the invention.

Claims

A network risk assessment method, comprising the steps of:

Set the weight values of each type of network device in the network to be tested.

Detecting the device risk level of all network devices in the network to be tested, and scoring the device risk level to obtain the device risk score;

Calculating the weight of the network device according to the device risk score of the network device and the corresponding weight value;

Calculating a network risk score of the network to be tested; the network risk score is a weighted sum of all network devices in the network to be tested.
A network risk assessment method according to claim 1, wherein

The weighting calculation method of the network device is as follows:

Device_weight i =cat_weight i ×device_assess i ;

The device_weight i is the weight of the i-th network device, the cat_weight i is the weight of the i-th network device, and the device_assess i is the device risk score of the i-th network device.
The network risk assessment method according to claim 2, characterized in that

The calculation method of the network risk score enterprise_assess of the network to be tested is as follows:

Among them, category is the number of devices in the network to be tested.
A network risk assessment method according to claim 1, wherein

The types of network devices of the network to be tested include server devices, network devices, computer devices, mobile devices, IoT devices, and/or ICS devices.
A network risk assessment method according to claim 4, characterized in that

The device risk score of the server device is a maximum value of the device risk score detected by the server device during the evaluation time preset by the network to be tested;

The device risk score of the network device is a maximum value of the device risk score detected by the network device during the evaluation time preset by the network to be tested;

The device risk score of the computer device is an average value of the device risk scores detected by the computer device during the evaluation time preset by the network to be tested;

The device risk score of the mobile device is an average value of the device risk scores detected by the mobile device during the evaluation time preset by the network to be tested;

The device risk score of the IoT device is an average value of the device risk scores detected by the IoT device during the evaluation time preset by the network to be tested;

The device risk score of the ICS device is an average value of the device risk scores detected by the ICS device during the evaluation time preset by the network to be tested.
A network risk assessment system, comprising:

Setting unit: used to separately set the weight value of each type of network device in the network to be tested;

The device detecting unit is configured to detect a device risk level of all the network devices in the network to be tested, and score the device risk level to obtain a device risk score;

The evaluation unit is configured to calculate the weight of the network device according to the device risk score of the network device and the corresponding weight value, and also calculate the network risk score of the network to be tested; the network risk score is the network to be tested. The weighted sum of all in-network devices.
A network risk assessment system according to claim 6 wherein:

The weighting calculation method of the network device is as follows:

Device_weight i =cat_weight i ×device_assess i ;

The device_weight i is the weight of the i-th network device, the cat_weight i is the weight of the i-th network device, and the device_assess i is the device risk score of the i-th network device.
A network risk assessment system according to claim 7, wherein

The calculation method of the network risk score enterprise_assess of the network to be tested is as follows:

Among them, category is the number of devices in the network to be tested.
A network risk assessment system according to claim 6 wherein:

The types of network devices of the network to be tested include server devices, network devices, computer devices, mobile devices, IoT devices, and/or ICS devices.
A network risk assessment system according to claim 9, wherein

The device risk score of the server device is a maximum value of the device risk score detected by the server device during the evaluation time preset by the network to be tested;

The device risk score of the network device is a maximum value of the device risk score detected by the network device during the evaluation time preset by the network to be tested;

The device risk score of the computer device is an average value of the device risk scores detected by the computer device during the evaluation time preset by the network to be tested;

The device risk score of the IoT device is an average value of the device risk scores detected by the IoT device during the evaluation time preset by the network to be tested;

The device risk score of the ICS device is an average value of the device risk scores detected by the ICS device during the evaluation time preset by the network to be tested;

The device risk score of the mobile device is an average value of the device risk scores detected by the mobile device during the evaluation time preset by the network to be tested.