WO2021082966A1 - 资产脆弱性的计算方法、装置、存储介质及服务器 - Google Patents

资产脆弱性的计算方法、装置、存储介质及服务器 Download PDF

Info

Publication number
WO2021082966A1
WO2021082966A1 PCT/CN2020/121862 CN2020121862W WO2021082966A1 WO 2021082966 A1 WO2021082966 A1 WO 2021082966A1 CN 2020121862 W CN2020121862 W CN 2020121862W WO 2021082966 A1 WO2021082966 A1 WO 2021082966A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
vulnerability
asset
score
threat
Prior art date
Application number
PCT/CN2020/121862
Other languages
English (en)
French (fr)
Inventor
袁军
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2021082966A1 publication Critical patent/WO2021082966A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the embodiments of the present disclosure relate to the field of network security technology, and in particular to a method, device, storage medium, and server for calculating asset vulnerability.
  • Risk assessment in the field of network security is to use scientific methods to systematically analyze the threats faced by assets and their existing vulnerabilities, and to assess the degree of harm that a threat event may cause once it occurs. Risk assessment involves the calculation of asset vulnerability, which is used to assess the severity of asset vulnerability, so as to provide a reference for security operation and maintenance personnel to maintain assets.
  • an expert team can be formed first, so that each expert in the expert team can assess the asset’s impact from several dimensions such as the level of data stored on the asset, the important level of the business system running on the asset, and the trust relationship between the assets. Vulnerability is scored, and then the asset vulnerability score is calculated based on the scores of each expert.
  • the scoring dimensions of asset vulnerability are vague or relatively single, and difficult to quantify. Therefore, experts are required to perform subjective scoring, and whether the expert’s experience is rich will affect the accuracy of the scoring. In addition, with the increase of assets, the workload of asset vulnerability calculation is larger, which affects the efficiency of asset vulnerability calculation.
  • the embodiments of the present disclosure provide a method, device, storage medium, and server for calculating asset vulnerability, which are used to solve the problem of inaccurate assessment of asset vulnerability and low calculation efficiency.
  • the technical solution is as follows:
  • a method for calculating the vulnerability of an asset includes: obtaining attribute information of the asset, the attribute information including vulnerability information of unfixed vulnerabilities in the asset, port information for opening ports, and operating system information And at least one of security defense information; calculating the vulnerability score of the asset according to the attribute information.
  • an asset vulnerability calculation device includes: an acquisition module for acquiring attribute information of the asset, the attribute information including vulnerability information of unfixed vulnerabilities in the asset, and port opening ports At least one of information, operating system information, and security defense information; a calculation module for calculating the vulnerability score of the asset according to the attribute information.
  • a computer-readable storage medium stores at least one instruction, at least one program, code set, or instruction set, the at least one instruction, the at least one program, the code set Or the instruction set is loaded and executed by the processor to implement the method for calculating the vulnerability of the asset as described above.
  • a server in one aspect, includes a processor and a memory, and at least one instruction is stored in the memory, and the instruction is loaded and executed by the processor to realize the above-mentioned asset vulnerability calculation method.
  • Fig. 1 is a method flowchart of a method for calculating asset vulnerability provided by an embodiment of the present disclosure
  • FIG. 2 is a method flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • FIG. 4 is a method flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • FIG. 5 is a method flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • FIG. 6 is a schematic flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • FIG. 7 is a structural block diagram of an asset vulnerability calculation device provided by still another embodiment of the present disclosure.
  • Fig. 8 is a structural block diagram of a computing system provided by an embodiment of the present disclosure.
  • Network security is not only related to the information resources and asset risks of institutions and individual users, but also related to national security and social stability, it is necessary to conduct a risk assessment of network security.
  • Risk assessment in the field of network security is to use scientific methods to systematically analyze the threats faced by networks and information systems and their existing vulnerabilities, and to assess the degree of harm that a threat event may cause once it occurs.
  • Security operation and maintenance personnel can formulate targeted protection countermeasures and rectification measures against threats based on the risk assessment report, so as to prevent and resolve information security risks or control the risks to an acceptable level.
  • risk assessment involves the three elements of asset value, threat, and vulnerability. Each element has its own attributes. Among them, asset value attribute is the importance of asset value; threat attribute is the frequency of asset threats; vulnerability attribute is the severity of asset vulnerability. Risk assessment mainly involves asset value identification, vulnerability identification, and threat identification. This embodiment mainly focuses on asset vulnerability identification, that is, calculating the asset's vulnerability score.
  • this embodiment provides a calculation method of asset vulnerability.
  • the calculation method is based on IT ( Internet Technology (Internet Technology)
  • IT Internet Technology (Internet Technology)
  • the asset management system obtains the attribute information of the asset, classifies the attribute information according to different dimensions, and then calculates the asset vulnerability score to complete the identification of the asset vulnerability.
  • the calculation method will be used in several embodiments below. Make an introduction.
  • FIG. 1 shows a method flowchart of a method for calculating asset vulnerability provided by an embodiment of the present disclosure.
  • the method for calculating asset vulnerability can be applied to a server.
  • the method for calculating the vulnerability of the asset may include the following steps.
  • Step 101 Obtain attribute information of an asset, where the attribute information includes at least one of vulnerability information of unfixed vulnerabilities in the asset, port information for opening ports, operating system information, and security defense information.
  • the asset is a piece of equipment, which can be a terminal, a server, etc., which is not limited in this embodiment.
  • the server can obtain attribute information of the asset from the IP asset management system, and the attribute information is related to the vulnerability of the asset itself.
  • the attribute information includes but is not limited to: vulnerability information of unfixed vulnerabilities in the asset, port information of the ports opened in the asset, operating system information of the operating system installed in the asset, and security such as anti-virus programs and firewalls installed in the asset The security defense information of the defense program.
  • the server may also classify the attribute information.
  • the server can classify the vulnerability information of unfixed vulnerabilities as an attribute factor for asset vulnerability calculation.
  • the attribute factor represents the hazard of the vulnerability, referred to as RV; it can categorize the port information that opens the port as an attribute factor for asset vulnerability calculation.
  • Attribute factor the attribute factor represents the open port, referred to as RP;
  • the operating system information can be classified as an attribute factor for asset vulnerability calculation, the attribute factor represents the operating platform, referred to as RS;
  • the security defense information can be classified as asset vulnerability
  • RV includes information about unfixed vulnerabilities, which can indicate the dangers of vulnerabilities, etc., and it can indicate which security vulnerability areas that an asset can follow in threat intelligence.
  • the vulnerability information may include identification information of the vulnerability, and the identification information may include at least one of an identification (ID) and a name (name).
  • ID an identification
  • name a name
  • the vulnerability information may also include other information, which is not limited in this embodiment. Assuming that the ID of one vulnerability is cve_10001 and the name is Flash leak; the ID of the other vulnerability is cve_20004 and the name is Explorerrisk, the RV table is shown in Table 1 below.
  • RP includes the port number of the asset's opening port and the services provided by the port, which can indicate whether an asset's exposed interface is likely to be exploited or intruded. Unlike RV, vulnerabilities are known information that has been found to be exploited by attackers, while RP is just a possible inference of vulnerability. After all, a certain service is turned on and it is not necessarily harmful.
  • the port information may include identification information of the port, and the identification information may include the name of the port.
  • the port number since the port is used to provide services, the port number may also include service information, and the service information may include the name of the service.
  • the port information may also include other information, which is not limited in this embodiment. Assuming that the name of the port in the port information is 3201 and the name of the service is telnet, the RP table is shown in Table 2 below.
  • RS includes operating system information, which can indicate the attributes of the system platform.
  • the operating system information may include the type information of the operating system, and the operating system may be Windows or Linux.
  • the operating system information may also include the version number of the operating system, so that the vulnerability of the operating system is indicated through the version number. For example, the xp system is no longer officially maintained, so its vulnerability is relatively large; and linux also has many derivative system versions with different vulnerabilities. Assuming that a Linux system with the version number of 3.16.001 is installed in the asset, the RS table is as shown in the first row in the following table three; if the asset is installed with a Windows system with the version number of 10.01, the RS table is as in the following table three Shown in the second line.
  • RD includes security defense information, which can indicate the protection capabilities of assets, such as whether to install anti-virus programs, whether to open the firewall, or whether there are other defense measures, etc. It can explain the defensive ability and robustness of an asset, and the stronger the defensive ability, the stronger the ability to resist possible attacks, and the less risk.
  • Security defense information can include type (defence_TYPE), name (name), status (status) and update mode (Update_mode), assuming the firewall (firewall) status is strict (strict); the name of the anti-virus program (Anti-virus) is mcAfee , The status is open, and the update mode is daily, then the RD table is shown in Table 4 below.
  • Step 102 Calculate the vulnerability score of the asset according to the attribute information.
  • the score of the attribute factor is calculated, and the score is used as the score of the vulnerability of the asset; when the attribute information is classified into multiple attribute factors, each attribute factor is calculated The product of multiplying all the scores is used as the score of the vulnerability of the asset.
  • the method for calculating asset vulnerability obtains property information of the asset, which includes vulnerability information of unfixed vulnerabilities in the asset, port information for opening ports, operating system information, and security defenses. At least one of the information. Since the above attribute information includes four dimensions of information, and the attribute information of each dimension can be quantified, the vulnerability score of the asset can be automatically calculated based on the attribute information without subjective experts Scoring can avoid the problem of inaccurate scoring by experts and improve the accuracy of asset vulnerability calculation. In addition, even if the workload of asset vulnerability calculation is large, the score can be automatically calculated based on attribute information, so the asset is also improved. Calculation efficiency of vulnerability calculation.
  • the attribute information can be classified into multiple attribute factors, different calculation methods can be used for different attribute factors, so that the scoring of the attribute factors is more reasonable.
  • the server when the attribute information includes at least one of vulnerability information, port information, and operating system information, the server also needs to obtain threat information, and calculate the vulnerability score of the asset based on the attribute information and threat information; when the attribute information includes security defense information
  • the server does not need to obtain threat information, it directly calculates the vulnerability score of the asset based on the attribute information. The following describes how to obtain threat information.
  • the server can obtain threat information from the threat intelligence system.
  • the threat intelligence system can be an external threat intelligence system (such as a common vulnerability scoring system CVSS), an internal proprietary threat intelligence system, or a threat intelligence system composed of multiple threat intelligence systems. This implementation The examples are not limited.
  • the server can classify the threat information with reference to the attribute factor, and the threat information can be classified into vulnerability-related threat information, port-related threat information, and operating system-related threat information.
  • the threat information can be classified into vulnerability-related threat information, port-related threat information, and operating system-related threat information.
  • the following is an example of the above three types of threat information.
  • the threat information related to the vulnerability can indicate the threat level of the vulnerability, and the threat level can be represented by the two dimensions of the source of the vulnerability and the damage level.
  • the source of the vulnerability may be an operating system or an application program, and generally speaking, the vulnerability of the operating system is more harmful than the vulnerability of the application program.
  • the hazard level can be converted from the threat level of the threat intelligence system. For example, if the threat level in the threat intelligence system is fatal, severe, high, intermediate, or low, the corresponding hazard level can be 5, 4, 3, 2, 1. That is, the greater the hazard level, the greater the hazard.
  • this embodiment only uses 5 threat levels as an example.
  • the threat level can be greater than 5 levels or less than 5 levels, which is not limited in this embodiment.
  • this embodiment only uses the positive correlation between the threat level and the hazard level for illustration. In actual implementation, the threat level and the hazard level may also have a negative correlation, which is not limited in this embodiment.
  • the threat information includes the name, source, and damage level of the vulnerability
  • the threat information can be shown in Table 5 below.
  • the server can read the identifier or name of the vulnerability in the vulnerability information, and then find the threat information of the vulnerability in the threat information according to the identifier or name.
  • Threat information related to the port can indicate the threat level of the port, and the threat level can be represented by the hazard level. That is, the hazard level can be converted from the threat level of the threat intelligence system. For details, please refer to the above description, which will not be repeated here.
  • the threat information includes the port number and the hazard level
  • the threat information can be as shown in Table 6 below.
  • the server can read the port number of the port in the port information, and then search for the threat information of the port in the threat information according to the port number.
  • the threat information related to the operating system can indicate the threat level of the operating system, and the threat level can be represented by the two dimensions of the number of vulnerabilities that have not been repaired in the operating system and the maximum damage level. Among them, the maximum hazard level can be obtained from the threat level conversion of the threat intelligence system. See the description above for details, and will not be repeated here.
  • the threat information includes the system version, the number of vulnerabilities, and the maximum damage level
  • the threat information can be shown in Table 7 below.
  • the server can read the type and version number of the operating system in the operating system information, and then search for the threat information of the operating system in the threat information according to the type and version number.
  • FIG. 2 shows a method flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • the method for calculating asset vulnerability can be applied to a server, and the attribute information includes vulnerability information and threat information Including threat information related to vulnerabilities.
  • the method for calculating the vulnerability of the asset may include the following steps.
  • Step 201 Obtain attribute information of an asset, where the attribute information includes vulnerability information of unfixed vulnerabilities in the asset.
  • Step 202 Obtain threat information matching the vulnerability information, where the threat information is used to indicate the threat level corresponding to the vulnerability information.
  • Step 203 Calculate the first weight value of all the vulnerabilities according to the vulnerability information and the threat information, and the first weight value is used to indicate the vulnerability level of the corresponding vulnerability.
  • the calculation process of the first weight value may include the following sub-steps:
  • Sub-step 2031 for each vulnerability indicated by the vulnerability information, obtain the source code value and the first hazard level of the vulnerability from the threat information.
  • the source code value is obtained by encoding the source of the vulnerability
  • the first hazard The level is obtained by coding the threat level of the vulnerability.
  • the source can be an operating system or an application program. Therefore, the server also needs to encode (also called quantization) the source to obtain the source code value. For example, if the operating system is coded as 2 and the application program is coded as 1, then the source code value derived from the operating system is 2 and the source code value derived from the application program is 1.
  • the threat level in the threat intelligence system can be fatal, severe, high, intermediate, or low. Therefore, the server needs to encode (also known as quantification) the threat level to obtain the corresponding first hazard level. For example, if the fatal code is 5, the severe code is 4, the high level is coded 3, the middle level is coded 2, and the low level is coded 1, then when the threat level of a certain vulnerability is high, the vulnerability’s first hazard The level is 3.
  • step 2032 the source code value is multiplied by the first hazard level to obtain the first weight value of the vulnerability.
  • Wi source code value*first hazard level.
  • the value range of Wi is [1,10].
  • the server can calculate the first weight value of all vulnerabilities through steps 2031-2032. Assuming that there are N (N ⁇ 1) vulnerabilities, the first weight value set ⁇ W1, W2,..., WN ⁇ is obtained.
  • Step 204 Calculate the first average value of all the first weight values.
  • Step 205 Multiply the first average value and the largest first weight value among all the first weight values and perform normalization processing to obtain a score of the vulnerability of the asset.
  • the server may combine the first average value and the largest first weight value to form a score pair ⁇ RVprime, RVmean>.
  • the value calculated in step 205 can be used as the vulnerability score of the asset.
  • the method for calculating asset vulnerability obtains the attribute information of the asset, and the attribute information includes vulnerability information of unfixed vulnerabilities in the asset. Since the above attribute information can be quantified, it can be based on this The attribute information automatically calculates the asset vulnerability score without the need for experts to perform subjective scoring, which can avoid the problem of inaccurate expert scores and improve the accuracy of asset vulnerability calculation; in addition, even if the workload of asset vulnerability calculation is relatively large , Since the score can be automatically calculated based on the attribute information, the calculation efficiency of the asset vulnerability calculation is also improved.
  • FIG. 3 shows a method flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • the method for calculating asset vulnerability can be applied to a server, and the attribute information includes port information and threat information. Including port-related threat information.
  • the method for calculating the vulnerability of the asset may include the following steps.
  • Step 301 Obtain attribute information of the asset, where the attribute information includes port information for opening the port.
  • Step 302 Obtain threat information matching the port information, where the threat information is used to indicate the threat level corresponding to the port information.
  • Step 303 Calculate a second weight value of all open ports according to the port information and the threat information, where the second weight value is used to indicate the vulnerability level of the corresponding port.
  • the calculation process of the second weight value may include the following sub-steps:
  • a second hazard level of the port is obtained from the threat information, where the second hazard level is obtained by encoding the threat level of the port.
  • the threat level in the threat intelligence system can be fatal, severe, high, intermediate, or low. Therefore, the server needs to encode (also known as quantification) the threat level to obtain the corresponding second hazard level. For example, if the fatal code is 5, the severe code is 4, the high level is coded 3, the middle level is coded 2, and the low level is coded 1, then when the threat level of a certain port is high, the port’s second hazard The level is 3.
  • step 3032 the first value is added to the second hazard level to obtain the second weight value of the port.
  • the first value is an empirical value or a value calculated according to a formula, which is not limited in this embodiment.
  • the value range of WPi is [6,10].
  • the server can calculate the second weight value of all ports through steps 3031-3032. Assuming that there are M (M ⁇ 1) vulnerabilities, the second weight value set ⁇ W1, W2,..., WM ⁇ is obtained.
  • Step 304 Calculate the second average value of all the second weight values.
  • Step 305 Multiply the second average value and the largest second weight value among all the second weight values and perform normalization processing to obtain a score of the vulnerability of the asset.
  • the server may form a score pair ⁇ RPprime, RPmean> by combining the second average value and the largest second weight value.
  • the value calculated in step 305 may be used as the vulnerability score of the asset.
  • the method for calculating asset vulnerability obtains property information of the asset.
  • the property information includes the port information of the open port. Since the above property information can be quantified, it can be automatically based on the property information. Calculate asset vulnerability scores without the need for experts to perform subjective scoring, thereby avoiding the problem of inaccurate scoring by experts and improving the accuracy of asset vulnerability calculation; in addition, even if the workload of asset vulnerability calculation is relatively large, it can be The score is automatically calculated based on the attribute information, so the calculation efficiency of the asset vulnerability calculation is also improved.
  • FIG. 4 shows a method flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • the method for calculating asset vulnerability can be applied to a server, and the attribute information includes operating system information, threats
  • the information includes threat information related to the operating system.
  • the method for calculating the vulnerability of the asset may include the following steps.
  • Step 401 Obtain attribute information of an asset, where the attribute information includes operating system information.
  • Step 402 Obtain threat information that matches the operating system information.
  • the threat information includes the number of vulnerabilities in the operating system, the total number of vulnerabilities in all operating systems, and the third degree of harm of the operating system.
  • the threat level of the system is coded.
  • Step 403 Multiply the quotient obtained by dividing the number of vulnerabilities by the total number of vulnerabilities by the second value.
  • the server divides the number of vulnerabilities of the asset's operating system by the total number of vulnerabilities to obtain the percentage of the asset's operating system vulnerabilities to the total number of vulnerabilities, and then multiplies the percentage by the second value.
  • the second value is an empirical value or a value calculated according to a formula, such as 5, which is not limited in this embodiment.
  • step 404 the third hazard level is added to the obtained product to obtain the vulnerability score of the asset.
  • RS (number of vulnerabilities of the asset's operating system/total number of vulnerabilities) * second value + third damage level.
  • the value calculated in step 404 can be used as the asset's vulnerability score.
  • the method for calculating asset vulnerability obtains property information of the asset, which includes operating system information. Since the above property information can be quantified, the asset can be automatically calculated based on the property information. Without the need for subjective scoring by experts, the problem of inaccurate scoring by experts can be avoided, and the accuracy of asset vulnerability calculation can be improved. In addition, even if the workload of asset vulnerability calculation is relatively large, it can be based on attributes. The information automatically calculates the score, so the calculation efficiency of the asset vulnerability calculation is also improved.
  • FIG. 5 shows a method flowchart of a method for calculating asset vulnerability provided by another embodiment of the present disclosure.
  • the method for calculating asset vulnerability can be applied to a server, and the attribute information includes security defense information.
  • the method for calculating the vulnerability of the asset may include the following steps.
  • Step 501 Obtain attribute information of an asset, the attribute information includes security defense information, and the security defense information includes first configuration information of an antivirus program installed in the asset and second configuration information of a firewall installed in the asset.
  • Step 502 Acquire first configuration information, and calculate a first score of the antivirus program according to the first configuration information.
  • the process of acquiring the first score may include: acquiring the first score corresponding to each type of configuration information in the first configuration information; adding all the first scores to obtain the first score.
  • the server can preset the first score corresponding to each type of configuration information, which will be explained in the following three aspects: the brand of the anti-virus program, whether the anti-virus program is set to scan regularly, and whether the anti-virus program is set to update the virus database regularly.
  • the anti-virus program is set to scan regularly: assuming that the first score of this item is recorded as R2 (AV), you can set different values for the configuration information of "Yes” and “No", and it is set for "Yes” The value is less than the value set for "No", and this embodiment does not limit the specific value. For example, the first score corresponding to "Yes” is set to 0, and the first score corresponding to "No” is set to 3.
  • R2 AV
  • the antivirus program is set to update the virus database regularly: assuming that the first score of this item is recorded as R3 (AV), you can set different values for the configuration information of "Yes” and “No", and it is "Yes”
  • the set value is less than the value set for "No", and this embodiment does not limit the specific value. For example, the first score corresponding to "Yes” is set to 0, and the first score corresponding to "No” is set to 2.
  • the server can add up all the first scores to obtain the first score. Assuming that the first score is recorded as R(AV), then Among them, the value range of R(AV) is [1,10].
  • the first score can be calculated according to any one or more of the above three configuration information, or the second score can also be calculated according to other configuration information.
  • a score is not limited in this embodiment.
  • Step 503 Obtain second configuration information, and calculate a second score of the firewall according to the second configuration information.
  • the process of obtaining the second score may include: obtaining the second score corresponding to each type of configuration information in the second configuration information; adding all the second scores to obtain the second score.
  • the server may preset the second score corresponding to each type of configuration information. The following describes whether the firewall is turned on and the ACL (Access Control List) policy situation that the firewall is turned on.
  • the policy of the ACL opened by the firewall assuming that the second score of this item is recorded as R2 (FW), the server can analyze the policy of the ACL. If the policy of the ACL is too loose, such as any->any, allow In the case of any service, the firewall configuration is not suitable, and a higher second score can be set; if the ACL policy is very strict, a lower second score can be set. Among them, the value range of the second score is [1,5].
  • the second score can be calculated based on any one or both of the above two configuration information, or the second score can also be calculated based on other configuration information. Second, the score is not limited in this embodiment.
  • step 504 the maximum value of the first score and the second score is used as a score of the vulnerability of the asset.
  • the value calculated in step 504 can be used as the vulnerability score of the asset.
  • the method for calculating asset vulnerability obtains property information of the asset, which includes security defense information. Since the above property information can be quantified, the asset can be automatically calculated based on the property information. Without the need for subjective scoring by experts, the problem of inaccurate scoring by experts can be avoided, and the accuracy of asset vulnerability calculation can be improved. In addition, even if the workload of asset vulnerability calculation is relatively large, it can be based on attributes. The information automatically calculates the score, so the calculation efficiency of the asset vulnerability calculation is also improved.
  • the server can also combine the calculation process of the embodiment shown in Figures 2-5, and the server can calculate the score of the attribute factor RV, the score of the attribute factor RP, the score of the attribute factor RS, and the score of the attribute factor RD. Score, and then perform fusion calculation on the above four scores to get the score of asset vulnerability, please refer to Figure 6.
  • asset vulnerability scores can be multiplicatively combined with the scores of various attribute information, taking into account the mutual superposition of various dimensions, it can be more comprehensively evaluated than the asset vulnerability score calculated by the addition of each dimension The vulnerability of the entire asset.
  • FIG. 7 shows a structural block diagram of an asset vulnerability calculation device provided by an embodiment of the present disclosure.
  • the asset vulnerability calculation device can be applied to a server.
  • the calculation device for the vulnerability of the asset may include:
  • the obtaining module 710 is configured to obtain attribute information of the asset.
  • the attribute information includes at least one of vulnerability information of unfixed vulnerabilities in the asset, port information for opening ports, operating system information, and security defense information;
  • the calculation module 720 is used to calculate the vulnerability score of the asset according to the attribute information.
  • the computing module 720 is further configured to: obtain threat information that matches each type of attribute information, and the threat information is used for Indicate the threat level corresponding to the attribute information; calculate the score according to the attribute information and threat information.
  • the calculation module 720 is further configured to: calculate the first weight value of all vulnerabilities according to the vulnerability information and threat information, and the first weight value is used to indicate the vulnerability level of the corresponding vulnerability ; Calculate the first average value of all the first weight values; multiply the first average value and the largest first weight value among all the first weight values and perform normalization processing to obtain a score.
  • the calculation module 720 is also used to: for each vulnerability indicated by the vulnerability information, obtain the source code value and the first hazard level of the vulnerability from the threat information, the source code value is to code the source of the vulnerability The first hazard level is obtained by encoding the threat level of the vulnerability; the source code value is multiplied by the first hazard level to obtain the first weight value of the vulnerability.
  • the calculation module 720 is further configured to: calculate the second weight value of all open ports according to the port information and the threat information, and the second weight value is used to indicate the corresponding port Vulnerability level; calculate the second average value of all second weight values; multiply the second average value and the largest second weight value among all the second weight values and perform normalization processing to obtain a score.
  • the calculation module 720 is further configured to: for each port indicated by the port information, obtain the second hazard level of the port from the threat information, where the second hazard level is obtained by encoding the threat level of the port ; Add the second hazard level to the first value to obtain the second weight value of the port.
  • the threat information when the attribute information includes operating system information, includes the number of vulnerabilities in the operating system, the total number of vulnerabilities in all operating systems, and the third degree of harm of the operating system, which is the third degree of harm to the operating system. If the threat level is coded, the calculation module 720 is also used to: multiply the quotient obtained by dividing the number of vulnerabilities by the total number of vulnerabilities by the second value; add the obtained product to the third hazard level to obtain a score.
  • the computing module 720 is further configured to : Obtain the first configuration information, calculate the first score of the antivirus program according to the first configuration information; obtain the second configuration information, calculate the second score of the firewall according to the second configuration information; calculate the maximum value of the first score and the second score As a score.
  • the calculation module 720 is further configured to: obtain a first score corresponding to each type of configuration information in the first configuration information; add all the first scores to obtain the first score.
  • the calculation module 720 is further configured to: obtain a second score value corresponding to each type of configuration information in the second configuration information; add all the second score values to obtain a second score.
  • the asset vulnerability calculation device obtains the attribute information of the asset, and the attribute information includes the vulnerability information of the unfixed vulnerabilities in the asset, the port information of the open port, the operating system information, and the security defense. At least one of the information. Since the above attribute information includes four dimensions of information, and the attribute information of each dimension can be quantified, the vulnerability score of the asset can be automatically calculated based on the attribute information without subjective experts Scoring can avoid the problem of inaccurate scoring by experts and improve the accuracy of asset vulnerability calculation. In addition, even if the workload of asset vulnerability calculation is large, the score can be automatically calculated based on attribute information, so the asset is also improved. Calculation efficiency of vulnerability calculation.
  • An embodiment of the present disclosure provides a computer-readable storage medium that stores at least one instruction, at least one program, code set, or instruction set, the at least one instruction, the at least one program, the The code set or instruction set is loaded and executed by the processor to implement the method for calculating asset vulnerability as described above.
  • An embodiment of the present disclosure provides a server, the server includes a processor and a memory, and at least one instruction is stored in the memory, and the instruction is loaded and executed by the processor to realize the asset vulnerability as described above Calculation method.
  • the computing system includes a server and a threat intelligence system.
  • the server may include an asset vulnerability computing device as shown in FIG. 7.
  • the asset vulnerability calculation device provided in the above embodiment performs the calculation of asset vulnerability
  • only the division of the above functional modules is used as an example for illustration. In actual applications, the above function can be allocated according to needs. Different functional modules are completed, that is, the internal structure of the asset vulnerability calculation device is divided into different functional modules to complete all or part of the functions described above.
  • the device for calculating asset vulnerability provided by the foregoing embodiment and the embodiment of the method for calculating asset vulnerability belong to the same concept. For the specific implementation process, please refer to the method embodiment, which will not be repeated here.
  • the attribute information includes at least one of the vulnerability information of the unfixed vulnerability in the asset, the port information of the open port, the operating system information, and the security defense information.
  • the vulnerability score of the asset can be automatically calculated based on the attribute information, without the need for subjective scoring by experts, so The problem of inaccurate scoring by experts is avoided, and the accuracy of asset vulnerability calculation is improved; in addition, even if the workload of asset vulnerability calculation is large, since the score can be automatically calculated based on attribute information, the calculation of asset vulnerability is also improved. Computational efficiency.
  • the program can be stored in a computer-readable storage medium.
  • the storage medium mentioned can be a read-only memory, a magnetic disk or an optical disk, etc.

Abstract

本公开实施例公开了一种资产脆弱性的计算方法、装置、存储介质及服务器，属于网络安全技术领域。所述方法包括：获取资产的属性信息，所述属性信息包括所述资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种；根据所述属性信息计算所述资产的脆弱性的评分。

Description

资产脆弱性的计算方法、装置、存储介质及服务器
相关申请的交叉引用
本公开要求享有2019年10月31日提交的名称为“资产脆弱性的计算方法、装置、存储介质及服务器”的中国专利申请CN201911050203.0的优先权，其全部内容通过引用并入本公开中。
技术领域
本公开实施例涉及网络安全技术领域，特别涉及一种资产脆弱性的计算方法、装置、存储介质及服务器。
背景技术
网络安全领域的风险评估是运用科学的手段，系统的分析资产所面临的威胁及其存在的脆弱性，评估威胁事件一旦发生可能造成的危害程度。风险评估涉及资产脆弱性的计算，用于评估资产脆弱性的严重程度，从而为安全运维人员维护资产提供参考。
相关技术中，可以先组建专家团队，使专家团队中的每个专家从资产上存放的数据等级、资产上运行的业务系统的重要级别、资产之间的信任关系等几个维度，对资产的脆弱性进行打分，再根据每个专家的打分计算资产脆弱性的评分。
资产脆弱性的打分维度模糊不清或比较单一，且较难量化，所以，需要专家进行主观打分，而专家的经验是否丰富会影响打分的准确性。另外，随着资产的增多，资产脆弱性计算的工作量较大，从而影响资产脆弱性的计算效率。
发明内容
本公开实施例提供了一种资产脆弱性的计算方法、装置、存储介质及服务器，用于解决资产的脆弱性的评分不准确且计算效率低的问题。所述技术方案如下：
一方面，提供了一种资产脆弱性的计算方法，所述方法包括：获取资产的属性信息，所述属性信息包括所述资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种；根据所述属性信息计算所述资产的脆弱性的评分。
一方面，提供了一种资产脆弱性的计算装置，所述装置包括：获取模块，用于获取资产的属性信息，所述属性信息包括所述资产中未修复漏洞的漏洞信息、开启端口的端口信 息、操作系统信息和安全防御信息中的至少一种；计算模块，用于根据所述属性信息计算所述资产的脆弱性的评分。
一方面，提供了一种计算机可读存储介质，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现如上所述的资产脆弱性的计算方法。
一方面，提供了一种服务器，所述服务器包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现如上所述的资产脆弱性的计算方法。
附图说明
为了更清楚地说明本公开实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本公开一个实施例提供的资产脆弱性的计算方法的方法流程图；
图2是本公开另一实施例提供的资产脆弱性的计算方法的方法流程图；
图3是本公开另一实施例提供的资产脆弱性的计算方法的流程示意图；
图4是本公开另一实施例提供的资产脆弱性的计算方法的方法流程图；
图5是本公开另一实施例提供的资产脆弱性的计算方法的方法流程图；
图6是本公开另一实施例提供的资产脆弱性的计算方法的流程示意图；
图7是本公开再一实施例提供的资产脆弱性的计算装置的结构框图；
图8是本公开一个实施例提供的计算系统的结构框图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合附图对本公开实施方式作在实施例中详细描述。
由于网络安全不仅关系到机构和个人用户的信息资源和资产风险，也关系到国家安全和社会稳定，所以，需要对网络安全进行风险评估。网络安全领域的风险评估是运用科学的手段，系统的分析网络与信息系统所面临的威胁及其存在的脆弱性，评估威胁事件一旦 发生可能造成的危害程度。安全运维人员可以根据风险评估报告制定有针对性的抵御威胁的防护对策和整改措施，从而防范和化解信息安全风险或将风险控制在可以接受的水平内。
通常，风险评估涉及资产价值、威胁性、脆弱性这三个要素。每个要素有各自的属性。其中，资产价值属性是资产价值重要性；威胁性属性是资产威胁出现频率；脆弱性属性是资产脆弱性的严重程度。风险评估主要涉及到资产价值识别、脆弱性识别和威胁识别，本实施例主要关注资产的脆弱性识别，也即，计算资产的脆弱性的评分。
由于相关技术中资产脆弱性的计算方法存在的主观性，评估方法过于复杂难以实施，评估维度模糊不清问题，所以，本实施例提供一种资产脆弱性的计算方法，该计算方法从IT(Internet Technology，互联网技术)资产管理系统获取资产的属性信息，将该属性信息按照不同维度进行分类，再计算资产脆弱性的评分来完成资产脆弱性的识别，下面通过几个实施例对该计算方法进行介绍。
请参考图1，其示出了本公开一个实施例提供的资产脆弱性的计算方法的方法流程图，该资产脆弱性的计算方法可以应用于服务器中。该资产脆弱性的计算方法，可以包括以下步骤。
步骤101，获取资产的属性信息，该属性信息包括资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种。
资产是一台设备，可以是终端、服务器等等，本实施例不作限定。
本实施例中，服务器可以从IP资产管理系统获取资产的属性信息，该属性信息与资产自身的脆弱性相关。其中，属性信息包括但不限于：资产中未修复漏洞的漏洞信息、资产中开启的端口的端口信息、资产中安装的操作系统的操作系统信息和资产中安装的杀毒程序、防火墙之类的安全防御程序的安全防御信息。
在一个实施方式中，服务器还可以对属性信息进行分类。比如，服务器可以将未修复漏洞的漏洞信息分类为资产脆弱性计算的一个属性因子，该属性因子表示漏洞的危害性，简称为RV；可以将开启端口的端口信息分类为资产脆弱性计算的一个属性因子，该属性因子表示开启端口，简称为RP；可以将操作系统信息分类为资产脆弱性计算的一个属性因子，该属性因子表示操作平台，简称为RS；可以将安全防御信息分类为资产脆弱性计算的一个属性因子，该属性因子表示防护能力，简称为RD，下面对上述四种属性因子进行举例说明。
1、RV包括未修复漏洞的相关信息，可以指示漏洞的危害性等，其可以表明一个资产 自身存在哪些在威胁情报中可循的安全脆弱地带。
漏洞信息可以包括漏洞的标识信息，该标识信息可以包括身份标识(ID)和名称(name)中的至少一种。当然，漏洞信息还可以包括其他信息，本实施例不作限定。假设一个漏洞的漏洞信息中ID为cve_10001、name为Flash leak；另一个漏洞的漏洞信息中ID为cve_20004、name为Explorerrisk，则RV表如下表一所示。
表一
ID name
cve_10001 Flash leak
cve_20004 Explorerrisk
2、RP包括资产开启端口的端口号以及该端口提供的服务等，其可以表明一个资产暴露在外的接口是否有被利用或者入侵的可能性。与RV不同，漏洞是已经被发现有攻击方利用过的已知信息，而RP只是一个脆弱性可能的推断，毕竟某个服务被开启，并不一定有危害。
端口信息可以包括端口的标识信息，该标识信息可以包括端口的名称(name)。在一种实施方案中，由于端口用于提供服务，所以，端口号还可以包括服务信息，该服务信息可以包括服务的名称(name)。当然，端口信息还可以包括其他信息，本实施例不作限定。假设端口信息中端口的名称为32001、服务的名称为telnet，则RP表如下表二所示。
表二
TYPE name
port 32001
service telnet
3、RS包括操作系统信息，可以指示系统平台的属性。
操作系统信息可以包括操作系统的类型信息，该操作系统可以是Windows或Linux。另外，由于不同版本的操作系统的漏洞数和漏洞的危害性是不同的，所以，操作系统信息还可以包括操作系统的版本号，从而通过版本号来指示操作系统的脆弱性。比如，xp系统目前已经不再被官方维护，因此，其脆弱性较大；而linux也有很多衍生的系统版本，具有不同的脆弱性。假设资产中安装有版本号为3.16.001的Linux系统，则RS表如下表三中的第一行所示；假设资产中安装有版本号为10.01的Windows系统，则RS表如下表三中的第二行所示。
表三
Sys_TYPE Sys_version
Linux 3.16.001
Windows 10.01
4、RD包括安全防御信息，可以指示资产的防护能力，如是否安装杀毒程序，是否开启防火墙、或者是否有其他防御措施等等。其可以说明一个资产的防御能力和健壮性，而防御能力越强，抵御可能攻击的能力也就越强，风险就较小。
安全防御信息可以包括类型(defence_TYPE)、名称(name)、状态(status)和更新模式(Update_mode)，假设防火墙(firewall)的状态为严格(strict)；杀毒程序(Anti-virus)的名称为mcAfee，状态为开启(open)，更新模式为每天更新(daily)，则RD表如下表四所示。
表四
defence_TYPE name status Update_mode
firewall   strict  
Anti-virus mcAfee open daily
步骤102，根据属性信息计算资产的脆弱性的评分。
本实施例中，当属性信息分类为一种属性因子时，计算该属性因子的评分，将该评分作为资产的脆弱性的评分；当属性信息分类为多种属性因子时，计算每种属性因子的评分，将所有评分相乘得到的乘积作为资产的脆弱性的评分。
综上所述，本公开实施例提供的资产脆弱性的计算方法，通过获取资产的属性信息，该属性信息包括资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种，由于上述属性信息包括四个维度的信息，且每个维度的属性信息都能够量化，所以，可以根据该属性信息自动计算资产的脆弱性的评分，而无需专家进行主观打分，从而可以避免专家打分不准确的问题，提高了资产脆弱性计算的准确性；另外，即使资产脆弱性计算的工作量较大，由于可以根据属性信息自动计算评分，所以，也提高了资产脆弱性计算的计算效率。
需要说明的是，由于属性信息可以分类为多个属性因子，可以针对不同的属性因子采用不同的计算方法，从而使对属性因子的评分更加合理。比如，当属性信息包括漏洞信息、端口信息和操作系统信息中的至少一种时，服务器还需要获取威胁信息，根据属性信 息和威胁信息计算资产的脆弱性的评分；当属性信息包括安全防御信息时，服务器不需要获取威胁信息，直接根据属性信息计算资产的脆弱性评分。下面对威胁信息的获取方式进行说明。
本实施例中，服务器可以从威胁情报系统获取威胁信息。其中，威胁情报系统可以是外部的威胁情报系统(比如通用漏洞评分系统CVSS)，也可以是内部专有的威胁情报系统，或者是由多种威胁情报系统组合而成的威胁情报系统，本实施例不作限定。
在获取到威胁信息后，服务器可以参照属性因子对威胁信息进行分类，则威胁信息可以分类为漏洞相关的威胁信息、端口相关的威胁信息和操作系统相关的威胁信息。下面对上述三种威胁信息进行举例说明。
1、漏洞相关的威胁信息可以指示漏洞的威胁等级，且该威胁等级可以由漏洞的来源和危害等级这两个维度表示。其中，漏洞的来源可以是操作系统或应用程序，且通常来说，操作系统面上的漏洞的危害性比应用程序面上的漏洞的危害性大。危害等级可以由威胁情报系统的威胁等级转换得到，比如，威胁情报系统中的威胁等级为致命、严重、高级、中级、低级，则对应的危害等级可以是5、4、3、2、1，即危害等级越大危害性越大。
需要说明的是，本实施例仅以威胁等级为5个等级进行举例说明，在实际实现时，威胁等级可以大于5个等级，也可以小于5个等级，本实施例不作限定。另外，本实施例仅以威胁等级与危害等级呈正相关关系进行举例说明，在实际实现时，威胁等级与危害等级也可以呈负相关关系，本实施例不作限定。
当威胁信息包括漏洞的名称、来源和危害等级时，该威胁信息可以如下表五所示。
表五
名称 来源 危害等级
漏洞1 2-操作系统 1
漏洞2 1-应用程序 2
漏洞3 1-应用程序 3
需要说明的是，服务器可以读取漏洞信息中漏洞的标识或名称，再根据该标识或名称在威胁信息中查找该漏洞的威胁信息。
2、端口相关的威胁信息可以指示端口的威胁等级，且该威胁等级可以由危害等级表示。即，危害等级可以由威胁情报系统的威胁等级转换得到，详见上文中的描述，此处不 作赘述。
当威胁信息包括端口号和危害等级时，该威胁信息可以如下表六所示。
表六
端口号 危害等级
10045 2
2345 3
需要说明的是，服务器可以读取端口信息中端口的端口号，再根据该端口号在威胁信息中查找该端口的威胁信息。
3、操作系统相关的威胁信息可以指示操作系统的威胁等级，且该威胁等级可以由操作系统中未修复漏洞的漏洞数和最大危害等级这两个维度表示。其中，最大危害等级可以由威胁情报系统的威胁等级转换得到，详见上文中的描述，此处不作赘述。
当威胁信息包括系统版本、漏洞数和最大危害等级时，该威胁信息可以如下表七所示。
表七
系统版本 漏洞数 最大危害等级
Linux3.6 10 2
Windows10 100 3
需要说明的是，服务器可以读取操作系统信息中操作系统的类型和版本号，再根据该类型和版本号在威胁信息中查找该操作系统的威胁信息。
请参考图2，其示出了本公开另一实施例提供的资产脆弱性的计算方法的方法流程图，该资产脆弱性的计算方法可以应用于服务器中，且属性信息包括漏洞信息，威胁信息包括漏洞相关的威胁信息。该资产脆弱性的计算方法，可以包括以下步骤。
步骤201，获取资产的属性信息，该属性信息包括资产中未修复漏洞的漏洞信息。
属性信息的解释详见步骤101中的描述，此处不作赘述。
步骤202，获取与该漏洞信息相匹配的威胁信息，该威胁信息用于指示该漏洞信息对应的威胁等级。
威胁信息的解释详见上文中的描述，此处不作赘述。
步骤203，根据漏洞信息和威胁信息计算所有漏洞的第一权重值，该第一权重值用于指示对应的漏洞的脆弱等级。
第一权重值的计算流程可以包括如下几个子步骤：
子步骤2031，对于漏洞信息所指示的每个漏洞，从威胁信息中获取该漏洞的来源编码值和第一危害等级，该来源编码值是对该漏洞的来源进行编码得到的，该第一危害等级是对该漏洞的威胁等级进行编码得到的。
来源可以是操作系统或应用程序，所以，服务器还需要对来源进行编码(也称量化)，以得到来源编码值。比如，可以将操作系统编码为2，将应用程序编码为1，则来源于操作系统的来源编码值为2，来源于应用程序的来源编码值为1。
威胁情报系统中的威胁等级可以是致命、严重、高级、中级、低级，所以，服务器需要对威胁等级进行编码(也称量化)，以得到对应的第一危害等级。比如，将致命编码为5，将严重编码为4，将高级编码为3，将中级编码为2，将低级编码为1，则当某一个漏洞的威胁等级为高级时，该漏洞的第一危害等级为3。
在步骤2032，将来源编码值乘以第一危害等级，得到该漏洞的第一权重值。
若将第一权重值记为Wi，则Wi＝来源编码值*第一危害等级。
若来源编码值的取值为[1,2]，第一危害等级的取值为[1,5]，则Wi的取值范围为[1,10]。
服务器可以通过步骤2031-2032来计算所有漏洞的第一权重值，假设存在N(N≥1)个漏洞，得到第一权重值集合{W1，W2，…，WN}。
步骤204，计算所有第一权重值的第一平均值。
若将第一平均值记为RVmean，则
Figure PCTCN2020121862-appb-000001
步骤205，将第一平均值和所有第一权重值中最大的第一权重值相乘后进行归一化处理，得到资产的脆弱性的评分。
服务器可以从第一权重值集合中选择最大的第一权重值，记为RVprime＝max{W1，W2，…，WN}。
服务器可以将第一平均值和最大的第一权重值组成一个分数对<RVprime，RVmean>。
服务器可以将第一平均值乘以最大的第一权重值，即X＝RVprime*RVmean；再对X 进行归一化处理，即
Figure PCTCN2020121862-appb-000002
得到RV＝trans(RVprime*RVmean)。其中，1.04是实验值。
本实施例中以属性信息为漏洞信息为例进行举例说明，则可以将步骤205中计算得到的数值作为资产的脆弱性的评分。
综上所述，本公开实施例提供的资产脆弱性的计算方法，通过获取资产的属性信息，该属性信息包括资产中未修复漏洞的漏洞信息，由于上述属性信息能够量化，所以，可以根据该属性信息自动计算资产的脆弱性的评分，而无需专家进行主观打分，从而可以避免专家打分不准确的问题，提高了资产脆弱性计算的准确性；另外，即使资产脆弱性计算的工作量较大，由于可以根据属性信息自动计算评分，所以，也提高了资产脆弱性计算的计算效率。
通过计算第一权重值的最大值和平均值，既可以体现漏洞的最严重量化值对资产的脆弱性的影响，也可以体现出该漏洞的平均量化值对资产的整体脆弱性的影响，这种量化方式从多个角度全面体现了资产的脆弱性。
请参考图3，其示出了本公开另一实施例提供的资产脆弱性的计算方法的方法流程图，该资产脆弱性的计算方法可以应用于服务器中，且属性信息包括端口信息，威胁信息包括端口相关的威胁信息。该资产脆弱性的计算方法，可以包括以下步骤。
步骤301，获取资产的属性信息，该属性信息包括开启端口的端口信息。
属性信息的解释详见步骤101中的描述，此处不作赘述。
步骤302，获取与该端口信息相匹配的威胁信息，该威胁信息用于指示该端口信息对应的威胁等级。
威胁信息的解释详见上文中的描述，此处不作赘述。
步骤303，根据端口信息和威胁信息计算所有开启的端口的第二权重值，该第二权重值用于指示对应的端口的脆弱等级。
第二权重值的计算流程可以包括如下几个子步骤：
子步骤3031，对于端口信息所指示的每个端口，从威胁信息中获取该端口的第二危害等级，该第二危害等级是对该端口的威胁等级进行编码得到的。
威胁情报系统中的威胁等级可以是致命、严重、高级、中级、低级，所以，服务器需要对威胁等级进行编码(也称量化)，以得到对应的第二危害等级。比如，将致命编码为5，将严重编码为4，将高级编码为3，将中级编码为2，将低级编码为1，则当某一个端口 的威胁等级为高级时，该端口的第二危害等级为3。
在步骤3032，将第二危害等级加上第一数值，得到端口的第二权重值。
若将第二权重值记为WPi，则WPi＝第二危害等级+第一数值。其中，第一数值为经验值或根据公式计算得到的数值，本实施例不作限定。
若第一数值为5，第二危害等级的取值为[1,5]，则WPi的取值范围为[6,10]。
服务器可以通过步骤3031-3032来计算所有端口的第二权重值，假设存在M(M≥1)个漏洞，得到第二权重值集合{W1，W2，…，WM}。
步骤304，计算所有第二权重值的第二平均值。
若将第二平均值记为RPmean，则
Figure PCTCN2020121862-appb-000003
步骤305，将第二平均值和所有第二权重值中最大的第二权重值相乘后进行归一化处理，得到资产的脆弱性的评分。
服务器可以从第二权重值集合中选择最大的第二权重值，记为RPprime＝max{W1，W2，…，WM}。
服务器可以将第二平均值和最大的第二权重值组成一个分数对<RPprime，RPmean>。
服务器可以将第二平均值乘以最大的第二权重值，即X＝RPprime*RPmean；再对X进行归一化处理，即
Figure PCTCN2020121862-appb-000004
得到RP＝trans(RPprime*RPmean)。其中，1.04是实验值。
本实施例中以属性信息为端口信息为例进行举例说明，则可以将步骤305中计算得到的数值作为资产的脆弱性的评分。
综上所述，本公开实施例提供的资产脆弱性的计算方法，通过获取资产的属性信息，该属性信息包括开启端口的端口信息，由于上述属性信息能够量化，所以，可以根据该属性信息自动计算资产的脆弱性的评分，而无需专家进行主观打分，从而可以避免专家打分不准确的问题，提高了资产脆弱性计算的准确性；另外，即使资产脆弱性计算的工作量较大，由于可以根据属性信息自动计算评分，所以，也提高了资产脆弱性计算的计算效率。
通过计算第二权重值的最大值和平均值，既可以体现端口的最严重量化值对资产的脆弱性的影响，也可以体现出该端口的平均量化值对资产的整体脆弱性的影响，这种量化方式从多个角度全面体现了资产的脆弱性。
请参考图4，其示出了本公开另一实施例提供的资产脆弱性的计算方法的方法流程图，该资产脆弱性的计算方法可以应用于服务器中，且属性信息包括操作系统信息，威胁信息包括操作系统相关的威胁信息。该资产脆弱性的计算方法，可以包括以下步骤。
步骤401，获取资产的属性信息，该属性信息包括操作系统信息。
属性信息的解释详见步骤101中的描述，此处不作赘述。
步骤402，获取与该操作系统信息相匹配的威胁信息，该威胁信息包括操作系统中的漏洞数、所有操作系统的总漏洞数和操作系统的第三危害等级，该第三危害等级是对操作系统的威胁等级进行编码得到的。
威胁信息的解释详见上文中的描述，此处不作赘述。
步骤403，将漏洞数除以总漏洞数得到的商乘以第二数值。
服务器将资产的操作系统的漏洞数除以总漏洞数，得到资产的操作系统的漏洞占总漏洞的百分比，再将该百分比乘以第二数值。其中，第二数值为经验值或根据公式计算得到的数值，比如为5，本实施例不作限定。
步骤404，将得到的乘积加上第三危害等级，得到资产的脆弱性的评分。
RS＝(资产的操作系统的漏洞数/总漏洞数)*第二数值+第三危害等级。
本实施例中以属性信息为操作系统信息为例进行举例说明，则可以将步骤404中计算得到的数值作为资产的脆弱性的评分。
综上所述，本公开实施例提供的资产脆弱性的计算方法，通过获取资产的属性信息，该属性信息包括操作系统信息，由于上述属性信息能够量化，所以，可以根据该属性信息自动计算资产的脆弱性的评分，而无需专家进行主观打分，从而可以避免专家打分不准确的问题，提高了资产脆弱性计算的准确性；另外，即使资产脆弱性计算的工作量较大，由于可以根据属性信息自动计算评分，所以，也提高了资产脆弱性计算的计算效率。
请参考图5，其示出了本公开另一实施例提供的资产脆弱性的计算方法的方法流程图，该资产脆弱性的计算方法可以应用于服务器中，且属性信息包括安全防御信息。该资产脆弱性的计算方法，可以包括以下步骤。
步骤501，获取资产的属性信息，该属性信息包括安全防御信息，该安全防御信息包括资产中安装的杀毒程序的第一配置信息和资产中安装的防火墙的第二配置信息。
属性信息的解释详见步骤101中的描述，此处不作赘述。
步骤502，获取第一配置信息，根据该第一配置信息计算杀毒程序的第一评分。
第一评分的获取流程可以包括：获取第一配置信息中每种配置信息对应的第一分值；将所有第一分值相加，得到第一评分。
本实施例中，服务器可以预先设置每种配置信息对应的第一分值，下面分别从杀毒程序的品牌、杀毒程序是否设置定时扫描和杀毒程序是否设置定时更新病毒库这三个方面进行说明。
1.杀毒程序的品牌：不同的杀毒程序的品牌的能力和作用通常不同，所以，可以参考用户反馈以及专业有公信力的机构给出的评价来设置品牌的第一分值。假设将本项的第一分值记为R1(AV)，则可以设置R1(AV)和不同品牌的配置信息的第一对应关系，并设置R1(AV)的取值范围为[1,5]，且第一分值越低，该品牌的杀毒程序的综合评价越高。
2.杀毒程序是否设置定时扫描：假设将本项的第一分值记为R2(AV)，则可以为“是”和“否”的配置信息设置不同的数值，且为“是”设置的数值小于为“否”设置的数值，本实施例不对具体的数值作限定。比如，将“是”对应的第一分值设为0，将“否”对应的第一分值设置为3。
3.杀毒程序是否设置定时更新病毒库：假设将本项的第一分值记为R3(AV)，则可以为“是”和“否”的配置信息设置不同的数值，且为“是”设置的数值小于为“否”设置的数值，本实施例不对具体的数值作限定。比如，将“是”对应的第一分值设为0，将“否”对应的第一分值设置为2。
在得到R1(AV)、R2(AV)和R3(AV)后，服务器可以将所有第一分值相加，得到第一评分。假设第一评分记为R(AV)，则
Figure PCTCN2020121862-appb-000005
其中，R(AV)的取值范围为[1,10]。
本实施例仅以上述三个方面的配置进行举例说明，在实际实现时，可以根据上述三种配置信息中的任意一种或多种计算第一评分，或者，还可以根据其他配置信息计算第一评分，本实施例不作限定。
步骤503，获取第二配置信息，根据该第二配置信息计算防火墙的第二评分。
第二评分的获取流程可以包括：获取第二配置信息中每种配置信息对应的第二分值；将所有第二分值相加，得到第二评分。
本实施例中，服务器可以预先设置每种配置信息对应的第二分值，下面分别从防火墙是否开启和防火墙开启的ACL(Access Control List，访问控制列表)的策略情况这两个方面进行说明。
1.防火墙是否开启：假设将本项的第二分值记为R1(FW)，则可以为“是”和“否”的配置信息设置不同的数值，且为“是”设置的数值小于为“否”设置的数值，本实施例不对具体的数值作限定。比如，将“是”对应的第二分值设为0，将“否”对应的第二分值设置为5。
2.防火墙开启的ACL的策略情况：假设将本项的第二分值记为R2(FW)，则服务器可以分析ACL的策略情况，如果ACL的策略过于松弛，如出现any->any，allow any service的情况，说明防火墙的配置不太合适，可设置较高的第二分值；如果ACL的策略非常严格，则可设置较低的第二分值。其中，第二分值的取值范围为[1,5]。
在得到R1(FW)和R2(FW)后，服务器可以将所有第二分值相加，得到第二评分。假设第二评分记为R(FW)，则R(FW)＝R1(FW)+R2(FW)。其中，R(FW)的取值范围为[1,10]。
本实施例仅以上述两个方面的配置进行举例说明，在实际实现时，可以根据上述两种配置信息中的任意一种或两种计算第二评分，或者，还可以根据其他配置信息计算第二评分，本实施例不作限定。
步骤504，将第一评分和第二评分中的最大值作为资产的脆弱性的评分。
RD＝max(R(AV)，R(FW))。
本实施例中以属性信息为安全防御信息为例进行举例说明，则可以将步骤504中计算得到的数值作为资产的脆弱性的评分。
综上所述，本公开实施例提供的资产脆弱性的计算方法，通过获取资产的属性信息，该属性信息包括安全防御信息，由于上述属性信息能够量化，所以，可以根据该属性信息自动计算资产的脆弱性的评分，而无需专家进行主观打分，从而可以避免专家打分不准确的问题，提高了资产脆弱性计算的准确性；另外，即使资产脆弱性计算的工作量较大，由于可以根据属性信息自动计算评分，所以，也提高了资产脆弱性计算的计算效率。
需要说明的是，服务器还可以将图2-5所示的实施例的计算流程相结合，则服务器可以计算属性因子RV的评分、属性因子RP的评分、属性因子RS的评分和属性因子RD的评分，再对上述四个评分进行融合计算，得到资产的脆弱性的评分，请参考图6。
若将资产的脆弱性评分记为Rfeatures，则先通过公式Y＝RV*RP*RS*RD对上述四个评分进行整合，Y的取值范围为[1,104]；再对Y进行归一化处理，使得到的计算结果Rfeatures的取值范围为[1,10]。其中，归一化公式为
Figure PCTCN2020121862-appb-000006
且1.0003为实验值。
由于资产的脆弱性的评分可以通过乘法融合各种属性信息的评分，考虑了各个维度相互叠加的影响，相比各个维度相加计算出的资产的脆弱性的评分来说，更能全面评估出整个资产的脆弱性。
请参考图7，其示出了本公开一个实施例提供的资产脆弱性的计算装置的结构框图，该资产脆弱性的计算装置可以应用于服务器中。该资产脆弱性的计算装置，可以包括：
获取模块710，用于获取资产的属性信息，属性信息包括资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种；
计算模块720，用于根据属性信息计算资产的脆弱性的评分。
在一实施方式中，当属性信息包括漏洞信息、端口信息和操作系统信息中的至少一种时，计算模块720，还用于：获取与每种属性信息相匹配的威胁信息，威胁信息用于指示属性信息对应的威胁等级；根据属性信息和威胁信息计算评分。
在一实施方式中，当属性信息包括漏洞信息时，计算模块720，还用于：根据漏洞信息和威胁信息计算所有漏洞的第一权重值，第一权重值用于指示对应的漏洞的脆弱等级；计算所有第一权重值的第一平均值；将第一平均值和所有第一权重值中最大的第一权重值相乘后进行归一化处理，得到评分。
在一实施方式中，计算模块720，还用于：对于漏洞信息所指示的每个漏洞，从威胁信息中获取漏洞的来源编码值和第一危害等级，来源编码值是对漏洞的来源进行编码得到的，第一危害等级是对漏洞的威胁等级进行编码得到的；将来源编码值乘以第一危害等级，得到漏洞的第一权重值。
在一实施方式中，当属性信息包括端口信息时，计算模块720，还用于：根据端口信息和威胁信息计算所有开启的端口的第二权重值，第二权重值用于指示对应的端口的脆弱等级；计算所有第二权重值的第二平均值；将第二平均值和所有第二权重值中最大的第二权重值相乘后进行归一化处理，得到评分。
在一实施方式中，计算模块720，还用于：对于端口信息所指示的每个端口，从威胁信息中获取端口的第二危害等级，第二危害等级是对端口的威胁等级进行编码得到的；将第二危害等级加上第一数值，得到端口的第二权重值。
在一实施方式中，当属性信息包括操作系统信息时，威胁信息包括操作系统中的漏洞数、所有操作系统的总漏洞数和操作系统的第三危害等级，第三危害等级是对操作系统的 威胁等级进行编码得到的，则计算模块720，还用于：将漏洞数除以总漏洞数得到的商乘以第二数值；将得到的乘积加上第三危害等级，得到评分。
在一实施方式中，当属性信息包括安全防御信息，且安全防御信息包括资产中安装的杀毒程序的第一配置信息和资产中安装的防火墙的第二配置信息时，计算模块720，还用于：获取第一配置信息，根据第一配置信息计算杀毒程序的第一评分；获取第二配置信息，根据第二配置信息计算防火墙的第二评分；将第一评分和第二评分中的最大值作为评分。
在一实施方式中，计算模块720，还用于：获取第一配置信息中每种配置信息对应的第一分值；将所有第一分值相加，得到第一评分。
在一实施方式中，计算模块720，还用于：获取第二配置信息中每种配置信息对应的第二分值；将所有第二分值相加，得到第二评分。
综上所述，本公开实施例提供的资产脆弱性的计算装置，通过获取资产的属性信息，该属性信息包括资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种，由于上述属性信息包括四个维度的信息，且每个维度的属性信息都能够量化，所以，可以根据该属性信息自动计算资产的脆弱性的评分，而无需专家进行主观打分，从而可以避免专家打分不准确的问题，提高了资产脆弱性计算的准确性；另外，即使资产脆弱性计算的工作量较大，由于可以根据属性信息自动计算评分，所以，也提高了资产脆弱性计算的计算效率。
本公开一个实施例提供了一种计算机可读存储介质，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现如上所述的资产脆弱性的计算方法。
本公开一个实施例提供了一种服务器，所述服务器包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现如上所述的资产脆弱性的计算方法。
请参考图8，本公开一个实施例提供了一种计算系统，所述计算系统包括服务器和威胁情报系统，该服务器可以包括如图7所示的资产脆弱性的计算装置。
需要说明的是：上述实施例提供的资产脆弱性的计算装置在进行资产脆弱性的计算时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将资产脆弱性的计算装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的资产脆弱性的计算装 置与资产脆弱性的计算方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
综上所述，在本公开提供的技术方案中，通过获取资产的属性信息，该属性信息包括资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种，由于上述属性信息包括四个维度的信息，且每个维度的属性信息都能够量化，所以，可以根据该属性信息自动计算资产的脆弱性的评分，而无需专家进行主观打分，从而可以避免专家打分不准确的问题，提高了资产脆弱性计算的准确性；另外，即使资产脆弱性计算的工作量较大，由于可以根据属性信息自动计算评分，所以，也提高了资产脆弱性计算的计算效率。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述并不用以限制本公开实施例，凡在本公开实施例的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开实施例的保护范围之内。

Claims (13)

  1. 一种资产脆弱性的计算方法，其中，所述方法包括：
    获取资产的属性信息，所述属性信息包括所述资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种；
    根据所述属性信息计算所述资产的脆弱性的评分。
  2. 根据权利要求1所述的方法，其中，当所述属性信息包括所述漏洞信息、所述端口信息和所述操作系统信息中的至少一种时，所述根据所述属性信息计算所述资产的脆弱性的评分，包括：
    获取与每种属性信息相匹配的威胁信息，所述威胁信息用于指示所述属性信息对应的威胁等级；
    根据所述属性信息和所述威胁信息计算所述评分。
  3. 根据权利要求2所述的方法，其中，当所述属性信息包括所述漏洞信息时，所述根据所述属性信息和所述威胁信息计算所述评分，包括：
    根据所述漏洞信息和所述威胁信息计算所有漏洞的第一权重值，所述第一权重值用于指示对应的漏洞的脆弱等级；
    计算所有第一权重值的第一平均值；
    将所述第一平均值和所有第一权重值中最大的第一权重值相乘后进行归一化处理，得到所述评分。
  4. 根据权利要求3所述的方法，其中，所述根据所述漏洞信息和所述威胁信息计算所有漏洞的第一权重值，包括：
    对于所述漏洞信息所指示的每个漏洞，从所述威胁信息中获取所述漏洞的来源编码值和第一危害等级，所述来源编码值是对所述漏洞的来源进行编码得到的，所述第一危害等级是对所述漏洞的威胁等级进行编码得到的；
    将所述来源编码值乘以所述第一危害等级，得到所述漏洞的第一权重值。
  5. 根据权利要求2所述的方法，其中，当所述属性信息包括所述端口信息时，所述根据所述属性信息和所述威胁信息计算所述评分，包括：
    根据所述端口信息和所述威胁信息计算所有开启的端口的第二权重值，所述第二权重值用于指示对应的端口的脆弱等级；
    计算所有第二权重值的第二平均值；
    将所述第二平均值和所有第二权重值中最大的第二权重值相乘后进行归一化处理，得到所述评分。
  6. 根据权利要求5所述的方法，其中，所述根据所述端口信息和所述威胁信息计算所有开启的端口的第二权重值，包括：
    对于所述端口信息所指示的每个端口，从所述威胁信息中获取所述端口的第二危害等级，所述第二危害等级是对所述端口的威胁等级进行编码得到的；
    将所述第二危害等级加上第一数值，得到所述端口的第二权重值。
  7. 根据权利要求2所述的方法，其中，当所述属性信息包括所述操作系统信息时，所述威胁信息包括所述操作系统中的漏洞数、所有操作系统的总漏洞数和所述操作系统的第三危害等级，所述第三危害等级是对所述操作系统的威胁等级进行编码得到的，则所述根据所述属性信息和所述威胁信息计算所述评分，包括：
    将所述漏洞数除以所述总漏洞数得到的商乘以第二数值；
    将得到的乘积加上所述第三危害等级，得到所述评分。
  8. 根据权利要求1至7中任一项所述的方法，其中，当所述属性信息包括所述安全防御信息，且所述安全防御信息包括所述资产中安装的杀毒程序的第一配置信息和所述资产中安装的防火墙的第二配置信息时，所述根据所述属性信息计算所述资产的脆弱性的评分，包括：
    获取所述第一配置信息，根据所述第一配置信息计算所述杀毒程序的第一评分；
    获取所述第二配置信息，根据所述第二配置信息计算所述防火墙的第二评分；
    将所述第一评分和所述第二评分中的最大值作为所述评分。
  9. 根据权利要求8所述的方法，其中，所述根据所述第一配置信息计算所述杀毒程序的第一评分，包括：
    获取所述第一配置信息中每种配置信息对应的第一分值；
    将所有第一分值相加，得到所述第一评分。
  10. 根据权利要求8所述的方法，其中，所述根据所述第二配置信息计算所述防火墙的第二评分，包括：
    获取所述第二配置信息中每种配置信息对应的第二分值；
    将所有第二分值相加，得到所述第二评分。
  11. 一种资产脆弱性的计算装置，其中，所述装置包括：
    获取模块，用于获取资产的属性信息，所述属性信息包括所述资产中未修复漏洞的漏洞信息、开启端口的端口信息、操作系统信息和安全防御信息中的至少一种；
    计算模块，用于根据所述属性信息计算所述资产的脆弱性的评分。
  12. 一种计算机可读存储介质，其中，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现如权利要求1至10任一所述的资产脆弱性的计算方法。
  13. 一种服务器，其中，所述服务器包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现如权利要求1至10任一所述的资产脆弱性的计算方法。
PCT/CN2020/121862 2019-10-31 2020-10-19 资产脆弱性的计算方法、装置、存储介质及服务器 WO2021082966A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911050203.0A CN112751809A (zh) 2019-10-31 2019-10-31 资产脆弱性的计算方法、装置、存储介质及服务器
CN201911050203.0 2019-10-31

Publications (1)

Publication Number Publication Date
WO2021082966A1 true WO2021082966A1 (zh) 2021-05-06

Family

ID=75641246

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/121862 WO2021082966A1 (zh) 2019-10-31 2020-10-19 资产脆弱性的计算方法、装置、存储介质及服务器

Country Status (2)

Country Link
CN (1) CN112751809A (zh)
WO (1) WO2021082966A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115225533A (zh) * 2022-07-26 2022-10-21 深圳证券通信有限公司 安全分析方法及相关装置
CN115296929A (zh) * 2022-09-28 2022-11-04 北京珞安科技有限责任公司 一种工业防火墙管理系统及方法
CN116050841A (zh) * 2023-01-28 2023-05-02 国家信息中心 信息安全风险评估方法、装置、终端设备及存储介质
CN116232768A (zh) * 2023-05-08 2023-06-06 汉兴同衡科技集团有限公司 一种信息安全评估方法、系统、电子设备及存储介质
US11706241B1 (en) * 2020-04-08 2023-07-18 Wells Fargo Bank, N.A. Security model utilizing multi-channel data
US11720686B1 (en) 2020-04-08 2023-08-08 Wells Fargo Bank, N.A. Security model utilizing multi-channel data with risk-entity facing cybersecurity alert engine and portal
US11777992B1 (en) 2020-04-08 2023-10-03 Wells Fargo Bank, N.A. Security model utilizing multi-channel data

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103581186A (zh) * 2013-11-05 2014-02-12 中国科学院计算技术研究所 一种网络安全态势感知方法及系统
CN104346565A (zh) * 2013-07-30 2015-02-11 北京神州泰岳软件股份有限公司 一种漏洞扫描方法及系统
US9141805B2 (en) * 2011-09-16 2015-09-22 Rapid7 LLC Methods and systems for improved risk scoring of vulnerabilities
CN105427172A (zh) * 2015-12-04 2016-03-23 北京华热科技发展有限公司 一种风险评估方法及系统
CN106878316A (zh) * 2017-02-28 2017-06-20 新华三技术有限公司 一种风险量化方法及装置
CN109246153A (zh) * 2018-11-09 2019-01-18 中国银行股份有限公司 网络安全态势分析模型和网络安全评估方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9141805B2 (en) * 2011-09-16 2015-09-22 Rapid7 LLC Methods and systems for improved risk scoring of vulnerabilities
CN104346565A (zh) * 2013-07-30 2015-02-11 北京神州泰岳软件股份有限公司 一种漏洞扫描方法及系统
CN103581186A (zh) * 2013-11-05 2014-02-12 中国科学院计算技术研究所 一种网络安全态势感知方法及系统
CN105427172A (zh) * 2015-12-04 2016-03-23 北京华热科技发展有限公司 一种风险评估方法及系统
CN106878316A (zh) * 2017-02-28 2017-06-20 新华三技术有限公司 一种风险量化方法及装置
CN109246153A (zh) * 2018-11-09 2019-01-18 中国银行股份有限公司 网络安全态势分析模型和网络安全评估方法

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11706241B1 (en) * 2020-04-08 2023-07-18 Wells Fargo Bank, N.A. Security model utilizing multi-channel data
US11720686B1 (en) 2020-04-08 2023-08-08 Wells Fargo Bank, N.A. Security model utilizing multi-channel data with risk-entity facing cybersecurity alert engine and portal
US11777992B1 (en) 2020-04-08 2023-10-03 Wells Fargo Bank, N.A. Security model utilizing multi-channel data
CN115225533A (zh) * 2022-07-26 2022-10-21 深圳证券通信有限公司 安全分析方法及相关装置
CN115225533B (zh) * 2022-07-26 2023-09-19 深圳证券通信有限公司 安全分析方法及相关装置
CN115296929A (zh) * 2022-09-28 2022-11-04 北京珞安科技有限责任公司 一种工业防火墙管理系统及方法
CN115296929B (zh) * 2022-09-28 2023-01-13 北京珞安科技有限责任公司 一种工业防火墙管理系统及方法
CN116050841A (zh) * 2023-01-28 2023-05-02 国家信息中心 信息安全风险评估方法、装置、终端设备及存储介质
CN116232768A (zh) * 2023-05-08 2023-06-06 汉兴同衡科技集团有限公司 一种信息安全评估方法、系统、电子设备及存储介质
CN116232768B (zh) * 2023-05-08 2023-08-01 汉兴同衡科技集团有限公司 一种信息安全评估方法、系统、电子设备及存储介质

Also Published As

Publication number Publication date
CN112751809A (zh) 2021-05-04

Similar Documents

Publication Publication Date Title
WO2021082966A1 (zh) 资产脆弱性的计算方法、装置、存储介质及服务器
US11677773B2 (en) Prioritized remediation of information security vulnerabilities based on service model aware multi-dimensional security risk scoring
US10491623B2 (en) Social network security monitoring
US10587640B2 (en) System and method for attribution of actors to indicators of threats to a computer system and prediction of future threat actions
RU2477929C2 (ru) Система и способ предотвращения инцидентов безопасности на основании рейтингов опасности пользователей
US10708290B2 (en) System and method for prediction of future threat actions
US7735141B1 (en) Intrusion event correlator
Chen et al. Value driven security threat modeling based on attack path analysis
US10104112B2 (en) Rating threat submitter
US11637841B2 (en) Actionability determination for suspicious network events
Tounsi What is cyber threat intelligence and how is it evolving?
US11861018B2 (en) Method and system for dynamic testing with diagnostic assessment of software security vulnerability
Kim et al. A framework for event prioritization in cyber network defense
Wang et al. Threat Analysis of Cyber Attacks with Attack Tree+.
US11570198B2 (en) Detecting and quantifying vulnerabilities in a network system
Mukherjee et al. Attack difficulty metric for assessment of network security
Mohaisen et al. Rethinking information sharing for actionable threat intelligence
Mu et al. Analysis of response factors in intrusion response decision-making
US11539737B2 (en) Adaptive security for resource constraint devices
Khemaissia et al. Network countermeasure selection under blockchain based privacy preserving
Taveras Cyber Risk Management, Procedures and Considerations to Address the Threats of a Cyber Attack
Nicho et al. Applying system dynamics to model advanced persistent threats
Gheorghică et al. A new framework for enhanced measurable cybersecurity in computer networks
Raulerson Modeling cyber situational awareness through data fusion
Zhang Defensive strategy selection based on attack-defense game model in network security

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20880940

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20880940

Country of ref document: EP

Kind code of ref document: A1