WO2019218875A1 - 单台在网设备风险评估方法及*** - Google Patents

单台在网设备风险评估方法及*** Download PDF

Info

Publication number
WO2019218875A1
WO2019218875A1 PCT/CN2019/085191 CN2019085191W WO2019218875A1 WO 2019218875 A1 WO2019218875 A1 WO 2019218875A1 CN 2019085191 W CN2019085191 W CN 2019085191W WO 2019218875 A1 WO2019218875 A1 WO 2019218875A1
Authority
WO
WIPO (PCT)
Prior art keywords
risk
score
network
level
tested
Prior art date
Application number
PCT/CN2019/085191
Other languages
English (en)
French (fr)
Inventor
涂大志
郭景楠
王新成
王志
Original Assignee
深圳市联软科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市联软科技股份有限公司 filed Critical 深圳市联软科技股份有限公司
Publication of WO2019218875A1 publication Critical patent/WO2019218875A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

  • the invention belongs to the field of internet technology, and particularly relates to a method and system for risk assessment of a single network device.
  • the evaluation granularity of the above two methods is too coarse, and the general network risk assessment is the risk status within a certain period of time, but the equipment may be frequently alerted during certain time periods, but the risk level or deduction is the same.
  • the number of alarms cannot be reasonably added to the inspection.
  • the results of multiple alarms cannot be comprehensively considered, so the network security administrator cannot be effectively provided.
  • the present invention provides a method and system for risk assessment of a single in-network device, which can be added to analyze the number of alarms, and can comprehensively consider various types of alarms, and the evaluation method is more effective.
  • a single on-net device risk assessment method includes the following steps:
  • the detection result obtained in the preset evaluation time includes the check item of the alarm in the detection result, the risk level of the check item, and the number of times the single station is in the network device.
  • the stored detection result is analyzed according to a preset evaluation model, and the device behavior loss value is obtained;
  • the detecting the single unit according to the check item performs real-time detection on the network device, and the detection result specifically includes:
  • the risk level of the check item in which the alarm occurs is scored, and the alarm score is obtained;
  • the detection result includes the alarm score.
  • the all the detection results are analyzed according to the preset evaluation model, and the device behavior loss value is specifically included:
  • the device behavior loss value is calculated by:
  • Behavior_loss (max_level+sum_level ⁇ 0.1) ⁇ max_level ⁇ tanh(check_count);
  • behavior_loss is the value of the device behavior loss of the single device in the network to be tested
  • max_level is the highest alarm score in the detection result of the single device in the network
  • sum_level is the detection result of the single device in the network to be tested.
  • the sum of the alarm scores, check_count is the cumulative number of alarms on the network device to be tested.
  • the calculating the risk score of the single device in the network device according to the device behavior loss value specifically includes:
  • the device behavior loss value of the single device in the network to be tested is subtracted, and the risk score is obtained.
  • the second aspect is a single on-net device risk assessment system, including:
  • Setting unit used to set multiple inspection items and the risk level of each inspection item
  • the detecting unit is configured to perform real-time detection on the network device to be tested according to the check item, and obtain the detection result;
  • the statistical unit is configured to store the detection result obtained in the preset evaluation time, including the check item in which the alarm occurs in the detection result, the risk level of the check item, and the number of times the single station is in the network device.
  • the evaluation unit is configured to analyze the stored detection result according to the preset evaluation model to obtain the device behavior loss value, and is also used to calculate the risk score of the single network device to be tested according to the device behavior loss value.
  • the detecting the single unit according to the check item performs real-time detection on the network device, and the detection result specifically includes:
  • the risk level of the check item in which the alarm occurs is scored, and the alarm score is obtained;
  • the detection result includes the alarm score.
  • the all the detection results are analyzed according to the preset evaluation model, and the device behavior loss value is specifically included:
  • the device behavior loss value is calculated by:
  • Behavior_loss (max_level+sum_level ⁇ 0.1) ⁇ max_level ⁇ tanh(check_count);
  • behavior_loss is the value of the device behavior loss of the single device in the network to be tested
  • max_level is the highest alarm score in the detection result of the single device in the network
  • sum_level is the detection result of the single device in the network to be tested.
  • the sum of the alarm scores, check_count is the cumulative number of alarms on the network device to be tested.
  • the calculating the risk score of the single device in the network device according to the device behavior loss value specifically includes:
  • the device behavior loss value of the single device in the network to be tested is subtracted, and the risk score is obtained.
  • the method and system for assessing the risk of a single in-network device provided by the present invention discard the idea of taking the highest alarm score in all the check items in the prior art, and periodically detect the network device for a certain period of time. All the test results are counted, and the number of alarms can be added for analysis, and the evaluation method is more effective.
  • FIG. 1 is a flow chart of an evaluation method provided in Embodiment 1.
  • FIG. 2 is a block diagram of a module of an evaluation system provided in Embodiment 4.
  • the term “if” can be interpreted as “when” or “on” or “in response to determining” or “in response to detecting” depending on the context. .
  • the phrase “if determined” or “if detected [condition or event described]” may be interpreted in context to mean “once determined” or “in response to determining” or “once detected [condition or event described] ] or “in response to detecting [conditions or events described]”.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • a single on-net device risk assessment method includes the following steps:
  • the alarms of the check items include three aspects: “non-compliance behavior”, “abnormal behavior”, and “dangerous behavior”. For example, if a change in the IP/MAC address of the network device, a change in the device name, a change in the operating system, etc. are detected, an abnormal behavior is considered.
  • Different check items define the risk level according to the degree of threat, and the risk level is low for the check items with low threat level. For high-threat inspection items, the risk level is high.
  • a single in-network device includes a PC device, a network device, a mobile device, an IoT device, an ICS device, and the like.
  • S2 Perform real-time detection on the network device according to the check item, and obtain the detection result
  • the test results include all the compliance behaviors, non-compliance behaviors, abnormal behaviors, and dangerous behavior check items, and also record the risk level of the check items of the alarm behavior.
  • the detection is performed in real time, so that the security of the network device can be detected in real time.
  • S3 storing the detection result obtained in the preset evaluation time, including the check item in which the alarm occurs in the detection result, the risk level of the check item, and the number of times the single station is in the network device to generate an alarm;
  • the check items of the statistical alarms facilitate subsequent risk assessment.
  • the number of alarms that occur on a single network device that is, the cumulative number of check items that have an alarm in all test reports.
  • the detection result can be analyzed periodically.
  • the analysis time can be set, and the analysis time can be analyzed once every hour and two hours, and the risk status of the single device on the network device is updated. If the evaluation time is set to 24 hours, it means that the risk status of the single device under test on the day is updated. That is to say, the single device in the network to be tested has been tested according to the check item. If it is analyzed once every hour, the test result obtained by the single device on the network to be tested is obtained for analysis, and the single device in the network to be tested is updated. Risk status. This ensures that the risk status of the single network device under test is updated in real time.
  • S5 Calculate the risk score of the single device in the network to be tested according to the value of the device behavior loss.
  • the method discards the idea of taking the highest alarm score in all the check items in the prior art, and periodically detects the network device, performs statistics on all the detection results in a certain period of time, and can add the number of alarms for analysis, and the evaluation method is more effective. .
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • the detecting a single station according to the check item is detected on the network device, and the detection result is specifically included;
  • the risk level of the check item in which the alarm occurs is scored, and the alarm score is obtained;
  • the detection result includes the alarm score.
  • the risk level is more intuitive through scoring, and the higher the risk level, the higher the score.
  • the risk level of the device access during non-working hours is 4 points
  • the risk level of the installed enterprise software is 6 points.
  • the risk level is 4. If the check item A has 2 alarms, the risk level is upgraded to 5.
  • the method provided by the embodiment of the present invention is a brief description, and the part of the embodiment is not mentioned, and the corresponding content in the first embodiment can be referred to.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • the analyzing the all the detection results according to the preset evaluation model, and obtaining the device behavior loss value specifically includes:
  • the device behavior loss value is calculated by:
  • Behavior_loss (max_level+sum_level ⁇ 0.1) ⁇ max_level ⁇ tanh(check_count);
  • behavior_loss is the value of the device behavior loss of the single device in the network to be tested
  • max_level is the highest alarm score in the detection result of the single device in the network
  • sum_level is the detection result of the single device in the network to be tested.
  • the sum of the alarm scores, check_count is the cumulative number of alarms on the network device to be tested.
  • the number of detection items increases with the increase of the deployment time.
  • the results obtained from the evaluation model are always positive, between [0,100].
  • the value of the behavioral loss of the computing device obtained by the above formula can be increased as the number of occurrences of the alarm of the check item increases. That is, if the number of alarms of a single device to be tested on the network device increases, the risk level is higher.
  • the calculating, according to the device behavior loss value, the risk score of the single device in the network device to be tested includes:
  • the device behavior loss value of the single device in the network to be tested is subtracted, and the risk score is obtained.
  • the full score value can be set to 100 points, and the risk score is equal to 100 minus the device behavior loss value.
  • the safest situation for network devices is 100 points, and the most dangerous situation is 0 points.
  • the score classification and qualitative description are personalized by the user.
  • the method provided by the embodiment of the present invention is a brief description, and the part of the embodiment is not mentioned, and the corresponding content in the second embodiment can be referred to.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • Embodiment 4 provides a single in-network device risk assessment system, including:
  • Setting unit used to set multiple inspection items and the risk level of each inspection item
  • the detecting unit is configured to perform real-time detection on the network device to be tested according to the check item, and obtain the detection result;
  • the statistical unit is configured to store the detection result obtained in the preset evaluation time, including the check item in which the alarm occurs in the detection result, the risk level of the check item, and the number of times the single station is in the network device.
  • the evaluation unit is configured to analyze the stored detection result according to the preset evaluation model to obtain the device behavior loss value, and is also used to calculate the risk score of the single network device to be tested according to the device behavior loss value.
  • the detecting the single unit according to the check item performs real-time detection on the network device, and the detection result specifically includes:
  • the risk level of the check item in which the alarm occurs is scored, and the alarm score is obtained;
  • the detection result includes the alarm score.
  • the all the detection results are analyzed according to the preset evaluation model, and the device behavior loss value is specifically included:
  • the device behavior loss value is calculated by:
  • Behavior_loss (max_level+sum_level ⁇ 0.1) ⁇ max_level ⁇ tanh(check_count);
  • behavior_loss is the value of the device behavior loss of the single device in the network to be tested
  • max_level is the highest alarm score in the detection result of the single device in the network
  • sum_level is the detection result of the single device in the network to be tested.
  • the sum of the alarm scores, check_count is the cumulative number of alarms on the network device to be tested.
  • the calculating the risk score of the single device in the network device according to the device behavior loss value specifically includes:
  • the device behavior loss value of the single device in the network to be tested is subtracted, and the risk score is obtained.
  • the disclosed systems and methods can be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention contributes in essence or to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本发明提供的单台在网设备风险评估方法及***，该方法中，设置多个检查项、以及每个检查项的风险等级；根据检查项对待测单台在网设备进行实时检测，得到检测结果；存储预设的评估时间内得到的检测结果，包括检测结果中出现告警的检查项、该检查项的风险等级、以及待测单台在网设备出现告警的次数；根据预设的评估模型对存储的检测结果进行分析，得到设备行为损失值；根据设备行为损失值计算待测单台在网设备的风险分值。该方法抛弃现有技术中取所有检查项中的最高告警分值的思路，定时对网络设备进行检测，对某时间段内所有的检测结果进行统计，能够加入告警次数进行分析，评估方法更有效。

Description

单台在网设备风险评估方法及*** 技术领域
本发明属于互联网技术领域，具体涉及单台在网设备风险评估方法及***。
背景技术
现有技术中，单台在网设备风险评价主要有以下几种方式：
1.设定检测规则，设定多条检测项，根据检测项对网络设备进行检测，通过每条检测项的威胁程度人为确定风险等级，作为网络设备风险衡量指标；
2.设定设备检查项目，所有检查项目设定分值，单一检测项的告警无法直观的展现设备风险总体状况。
以上两种方法的评价粒度太粗疏，而且一般网络风险评价均是在某个时间段内的风险状态，但是设备可能在某时段内，若干危险检测会频繁告警，但风险等级或扣分相同，无法将告警次数合理地加入考察，无法综合考虑多种告警的结果，于是无法对网络安全管理员提供有效的参考。
发明内容
针对现有技术中的缺陷，本发明提供单台在网设备风险评估方法及***，能够加入告警次数进行分析，能够综合考虑多种告警的类型，评估方法更有效。
第一方面，一种单台在网设备风险评估方法，包括以下步骤：
设置多个检查项、以及每个检查项的风险等级；
根据检查项对待测单台在网设备进行实时检测，得到检测结果；
存储预设的评估时间内得到的检测结果，包括检测结果中出现告警的检查项、该检查项的风险等级、以及待测单台在网设备出现告警的次数；
根据预设的评估模型对存储的检测结果进行分析，得到设备行为损失值；
根据设备行为损失值计算待测单台在网设备的风险分值。
进一步地，所述根据检查项对待测单台在网设备进行实时检测，得到检测结果具体包括；
根据检查项对待测单台在网设备进行实时检测；
对出现告警的检查项的风险等级进行评分，得到告警分值；
记录告警分值；
所述检测结果包括所述告警分值。
进一步地，所述根据预设的评估模型对所有的检测结果进行分析，得到设备行为损失值具体包括：
设置分析时间；
当分析时间到达时，通过下式计算设备行为损失值：
behavior_loss＝(max_level+sum_level×0.1)×max_level×tanh(check_count)；
其中，behavior_loss为待测单台在网设备的设备行为损失值，max_level为待测单台在网设备的检测结果中最高的告警分值，sum_level为待测单台在网设备的检测结果中所有告警分值之和，check_count为待测单台在网设备出现告警的累计次数，
Figure PCTCN2019085191-appb-000001
进一步地，所述根据设备行为损失值计算待测单台在网设备的风险分值具体包括：
设置满分分值；
采用扣分法，在满分分值的基础上，减去待测单台在网设备的设备行为损失值，得到所述风险分值。
第二方面，一种单台在网设备风险评估***，包括：
设置单元：用于设置多个检查项、以及每个检查项的风险等级；
检测单元：用于根据检查项对待测单台在网设备进行实时检测，得到检测结果；
统计单元：用于存储预设的评估时间内得到的检测结果，包括检测结果中出现告警的检查项、该检查项的风险等级、以及待测单台在网设备出现告警的次数；
评估单元：用于根据预设的评估模型对存储的检测结果进行分析，得到设备行为损失值；还用于根据设备行为损失值计算待测单台在网设备的风险分值。
进一步地，所述根据检查项对待测单台在网设备进行实时检测，得到检测结果具体包括；
根据检查项对待测单台在网设备进行实时检测；
对出现告警的检查项的风险等级进行评分，得到告警分值；
记录告警分值；
所述检测结果包括所述告警分值。
进一步地，所述根据预设的评估模型对所有的检测结果进行分析，得到设备行为损失值具体包括：
设置分析时间；
当分析时间到达时，通过下式计算设备行为损失值：
behavior_loss＝(max_level+sum_level×0.1)×max_level×tanh(check_count)；
其中，behavior_loss为待测单台在网设备的设备行为损失值，max_level为待测单台在网设备的检测结果中最高的告警分值，sum_level为待测单台在网设备的检测结果中所有告警分值之和，check_count为待测单台在网设备出现告警的累计次数，
Figure PCTCN2019085191-appb-000002
进一步地，所述根据设备行为损失值计算待测单台在网设备的风险分值具体包括：
设置满分分值；
采用扣分法，在满分分值的基础上，减去待测单台在网设备的设备行为损失值，得到所述风险分值。
由上述技术方案可知，本发明提供的单台在网设备风险评估方法及***，抛弃现有技术中取所有检查项中的最高告警分值的思路，定时对网络设备进行检测，对某时间段内所有的检测结果进行统计，能够加入告警次数进行分析，评估方法更有效。
附图说明
为了更清楚地说明本发明具体实施方式或现有技术中的技术方案，下面将对具体实施方式或现有技术描述中所需要使用的附图作简单地介绍。在所有附图中，类似的元件或部分一般由类似的附图标记标识。附图中，各元件或部分并不一定按照实际的比例绘制。
图1为实施例一提供的评估方法的流程图。
图2为实施例四提供的评估***的模块框图。
具体实施方式
下面将结合附图对本发明技术方案的实施例进行详细的描述。以下实施例仅用于更加清楚地说明本发明的技术方案，因此只作为示例，而不能以此来限制本发明的保护范围。需要注意的是，除非另有说明，本申请使用的技术术语或者科学术语应当为本发明所属领域技术人员所理解的通常意义。
应当理解，当在本说明书和所附权利要求书中使用时，术语“包括”和“包含”指示所描述特征、整体、步骤、操作、元素和/或组件的存在，但并不排除一个或多个其它特征、整体、步骤、操作、元素、组件和/或其集合的存在或添加。
如在本说明书和所附权利要求书中所使用的那样，术语“如果”可以依据上下文被解释为“当...时”或“一旦”或“响应于确定”或“响应于检测到”。类似地，短语“如果确定”或“如果检测到[所描述条件或事件]”可以依据上下文被解释为意指“一旦确定”或“响应于确定”或“一旦检测到[所 描述条件或事件]”或“响应于检测到[所描述条件或事件]”。
实施例一：
参见图1，一种单台在网设备风险评估方法，包括以下步骤：
S1:设置多个检查项、以及每个检查项的风险等级；
具体地，检查项出现告警包括“不合规行为”、“异常行为”、“危险行为”三个方面。例如如果检测到网络设备的IP/MAC地址变化、设备名发生变化、操作***发生变化等，则认为出现异常行为。不同的检查项根据其威胁程度定义风险等级，对于威胁程度低的检查项，其风险等级低。对于威胁程度高的检查项，其风险等级高。单台在网设备包含PC设备、网络设备、移动设备、IoT设备、ICS设备等。
S2:根据检查项对待测单台在网设备进行实时检测，得到检测结果；
具体地，待测单台在网设备在进行检测时，需要对所有的检查项进行检测。检测结果中包含了所有合规行为、不合规行为、异常行为、危险行为的检查项，还记录了告警行为的检查项的风险等级。在根据检查项进行检测时，是实时进行检测，这样能实时检测网络设备的安全性。
S3:存储预设的评估时间内得到的检测结果，包括检测结果中出现告警的检查项、该检查项的风险等级、以及待测单台在网设备出现告警的次数；
具体地，统计告警的检查项，方便后续进行风险评估。单台在网设备出现告警的次数即所有检测报告中出现告警的检查项的累计数量。
S4:根据预设的评估模型对存储的检测结果进行分析，得到设备行为损失值；
具体地，可以定时对检测结果进行分析。例如：例如设置分析时间，分析时间可以为一个小时、两个小时分析一次，对待测单台在网设备的风险状态进行更新。如果评估时间设置为24小时，即表示对当天待测单台在网设备的风险状态进行更新。也就是说待测单台在网设备一直根据检查项进行检测，如果一个小时分析一次，则获取待测单台在网设备当天获得的检测结果进行分析， 并更新待测单台在网设备的风险状态。这样保证了待测单台在网设备的风险状态是实时更新的。
S5:根据设备行为损失值计算待测单台在网设备的风险分值。
该方法抛弃现有技术中取所有检查项中的最高告警分值的思路，定时对网络设备进行检测，对某时间段内所有的检测结果进行统计，能够加入告警次数进行分析，评估方法更有效。
实施例二：
实施例二提供的方法，在实施例一的基础上，增加以下内容：
所述根据检查项对待测单台在网设备进行检测，得到检测结果具体包括；
根据检查项对待测单台在网设备进行实时检测；
对出现告警的检查项的风险等级进行评分，得到告警分值；
记录告警分值；
所述检测结果包括所述告警分值。
具体地，风险等级通过评分体现更加直观，风险等级越高，分值越高。例如：设备在非工作时间接入的风险等级为4分，安装了违规的企业软件的风险等级为6分。当检查项A出现1次告警时，风险等级是4，如果检查项A出现2次告警时，风险等级升级变成5。
本发明实施例所提供的方法，为简要描述，该实施例部分未提及之处，可参考实施例一中相应内容。
实施例三：
实施例三提供的方法，在实施例二的基础上，增加以下内容：
所述根据预设的评估模型对所有的检测结果进行分析，得到设备行为损失值具体包括：
设置分析时间；
当分析时间到达时，通过下式计算设备行为损失值：
behavior_loss＝(max_level+sum_level×0.1)×max_level×tanh(check_count)；
其中，behavior_loss为待测单台在网设备的设备行为损失值，max_level为待测单台在网设备的检测结果中最高的告警分值，sum_level为待测单台在网设备的检测结果中所有告警分值之和，check_count为待测单台在网设备出现告警的累计次数，
Figure PCTCN2019085191-appb-000003
具体地，由于网络设备在客户现场部署后，随着部署时间的增加，其检测项数量越来越大。而在建立评估模型时，不能估计部署后网络设备的检查项数量上限。所以，该方法中双曲正切模型完全不受告警次数上限对评估模型健壮性的影响。评估模型得到的结果始终为正数，介于[0，100]。通过上述公式得到的计算设备行为损失值能够随着该检查项出现告警的次数增大而增大。即如果待测单台在网设备出现告警的次数越多，其风险等级越高。
在分析时，将评估时间内的所有检测结果作为评估模型的输入。例如：如果分析时间到达时，待测单台在网设备有3份检测结果中，出现告警的检查项的次数分别为5、7、4。3份检测结果中；最高的风险等级的分值为6；3份检测结果中，出现告警的检查项的风险等级的分值之和分别为25,50,22。则max_level＝6，sum_level＝25+50+22＝97，check_count＝5+7+4＝16。
可选地，所述根据设备行为损失值计算待测单台在网设备的风险分值具体包括：
设置满分分值；
采用扣分法，在满分分值的基础上，减去待测单台在网设备的设备行为损失值，得到所述风险分值。
具体地，满分分值可以设置为100分，风险分值等于100减去设备行为损失值。设备行为损失值越大，风险分值越低，网络设备的风险越高。反之，设备行为损失值越小，风险分值越高，网络设备的风险越低。网络设备最安全的情况为100分，最危险的情况为0分。分值等级划分及定性描述由用户个性化配置。
本发明实施例所提供的方法，为简要描述，该实施例部分未提及之处，可 参考实施例二中相应内容。
实施例四：
参见图2，实施例四提供了一种单台在网设备风险评估***，包括：
设置单元：用于设置多个检查项、以及每个检查项的风险等级；
检测单元：用于根据检查项对待测单台在网设备进行实时检测，得到检测结果；
统计单元：用于存储预设的评估时间内得到的检测结果，包括检测结果中出现告警的检查项、该检查项的风险等级、以及待测单台在网设备出现告警的次数；
评估单元：用于根据预设的评估模型对存储的检测结果进行分析，得到设备行为损失值；还用于根据设备行为损失值计算待测单台在网设备的风险分值。
进一步地，所述根据检查项对待测单台在网设备进行实时检测，得到检测结果具体包括；
根据检查项对待测单台在网设备进行实时检测；
对出现告警的检查项的风险等级进行评分，得到告警分值；
记录告警分值；
所述检测结果包括所述告警分值。
进一步地，所述根据预设的评估模型对所有的检测结果进行分析，得到设备行为损失值具体包括：
设置分析时间；
当分析时间到达时，通过下式计算设备行为损失值：
behavior_loss＝(max_level+sum_level×0.1)×max_level×tanh(check_count)；
其中，behavior_loss为待测单台在网设备的设备行为损失值，max_level为待测单台在网设备的检测结果中最高的告警分值，sum_level为待测单台在网设备的检测结果中所有告警分值之和，check_count为待测单台在网设备出现告警的 累计次数，
Figure PCTCN2019085191-appb-000004
进一步地，所述根据设备行为损失值计算待测单台在网设备的风险分值具体包括：
设置满分分值；
采用扣分法，在满分分值的基础上，减去待测单台在网设备的设备行为损失值，得到所述风险分值。
本发明实施例所提供的装置，其实现原理及产生的技术效果和前述方法实施例相同，为简要描述，装置实施例部分未提及之处，可参考前述方法实施例中相应内容。
在本申请所提供的几个实施例中，应该理解到，所揭露的***和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本发明实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发 明的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围，其均应涵盖在本发明的权利要求和说明书的范围当中。

Claims (8)

  1. 一种单台在网设备风险评估方法，其特征在于，包括以下步骤：
    设置多个检查项、以及每个检查项的风险等级；
    根据检查项对待测单台在网设备进行实时检测，得到检测结果；
    存储预设的评估时间内得到的检测结果，包括检测结果中出现告警的检查项、该检查项的风险等级、以及待测单台在网设备出现告警的次数；
    根据预设的评估模型对存储的检测结果进行分析，得到设备行为损失值；
    根据设备行为损失值计算待测单台在网设备的风险分值。
  2. 根据权利要求1所述单台在网设备风险评估方法，其特征在于，
    所述根据检查项对待测单台在网设备进行实时检测，得到检测结果具体包括；
    根据检查项对待测单台在网设备进行实时检测；
    对出现告警的检查项的风险等级进行评分，得到告警分值；
    记录告警分值；
    所述检测结果包括所述告警分值。
  3. 根据权利要求2所述单台在网设备风险评估方法，其特征在于，
    所述根据预设的评估模型对所有的检测结果进行分析，得到设备行为损失值具体包括：
    设置分析时间；
    当分析时间到达时，通过下式计算设备行为损失值：
    behavior_loss＝(max_level+sum_level×0.1)×max_level×tanh(check_count)；
    其中，behavior_loss为待测单台在网设备的设备行为损失值，max_level为待测单台在网设备的检测结果中最高的告警分值，sum_level为待测单台在网设备的检测结果中所有告警分值之和，check_count为待测单台在网设备出现告警的累计次数，
    Figure PCTCN2019085191-appb-100001
  4. 根据权利要求1-3中任一权利要求所述单台在网设备风险评估方法，其特征在于，
    所述根据设备行为损失值计算待测单台在网设备的风险分值具体包括：
    设置满分分值；
    采用扣分法，在满分分值的基础上，减去待测单台在网设备的设备行为损失值，得到所述风险分值。
  5. 一种单台在网设备风险评估***，其特征在于，包括：
    设置单元：用于设置多个检查项、以及每个检查项的风险等级；
    检测单元：用于根据检查项对待测单台在网设备进行实时检测，得到检测结果；
    统计单元：用于存储预设的评估时间内得到的检测结果，包括检测结果中出现告警的检查项、该检查项的风险等级、以及待测单台在网设备出现告警的次数；
    评估单元：用于根据预设的评估模型对存储的检测结果进行分析，得到设备行为损失值；还用于根据设备行为损失值计算待测单台在网设备的风险分值。
  6. 根据权利要求5所述单台在网设备风险评估***，其特征在于，
    所述根据检查项对待测单台在网设备进行实时检测，得到检测结果具体包括；
    根据检查项对待测单台在网设备进行实时检测；
    对出现告警的检查项的风险等级进行评分，得到告警分值；
    记录告警分值；
    所述检测结果包括所述告警分值。
  7. 根据权利要求6所述单台在网设备风险评估***，其特征在于，
    所述根据预设的评估模型对所有的检测结果进行分析，得到设备行为损失值具体包括：
    设置分析时间；
    当分析时间到达时，通过下式计算设备行为损失值：
    behavior_loss＝(max_level+sum_level×0.1)×max_level×tanh(check_count)；
    其中，behavior_loss为待测单台在网设备的设备行为损失值，max_level为待测单台在网设备的检测结果中最高的告警分值，sum_level为待测单台在网设备的检测结果中所有告警分值之和，check_count为待测单台在网设备出现告警的累计次数，
    Figure PCTCN2019085191-appb-100002
  8. 根据权利要求5-7中任一权利要求所述单台在网设备风险评估***，其特征在于，
    所述根据设备行为损失值计算待测单台在网设备的风险分值具体包括：
    设置满分分值；
    采用扣分法，在满分分值的基础上，减去待测单台在网设备的设备行为损失值，得到所述风险分值。
PCT/CN2019/085191 2018-05-14 2019-04-30 单台在网设备风险评估方法及*** WO2019218875A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810455479.6 2018-05-14
CN201810455479.6A CN108683662B (zh) 2018-05-14 2018-05-14 单台在网设备风险评估方法及***

Publications (1)

Publication Number Publication Date
WO2019218875A1 true WO2019218875A1 (zh) 2019-11-21

Family

ID=63806390

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/085191 WO2019218875A1 (zh) 2018-05-14 2019-04-30 单台在网设备风险评估方法及***

Country Status (2)

Country Link
CN (1) CN108683662B (zh)
WO (1) WO2019218875A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108683662B (zh) * 2018-05-14 2020-08-14 深圳市联软科技股份有限公司 单台在网设备风险评估方法及***
CN110443515A (zh) * 2019-08-09 2019-11-12 杭州安恒信息技术股份有限公司 基于威胁指数的物联网安全检测方法与***
CN111865660A (zh) * 2020-06-12 2020-10-30 广东电网有限责任公司 一种用于网络设备的运行风险评价方法和***

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105205732A (zh) * 2015-09-28 2015-12-30 中国南方电网有限责任公司 一种基于设备风险特征模型的风险评估和检修方法
CN106203666A (zh) * 2015-04-30 2016-12-07 中国南方电网有限责任公司 一种数据网络设备风险评估方法及装置
CN107451402A (zh) * 2017-07-13 2017-12-08 北京交通大学 一种基于告警数据分析的设备健康度评估方法及装置
CN108009711A (zh) * 2017-11-23 2018-05-08 平安科技（深圳）有限公司 风险评估方法、装置、计算机设备及可读存储介质
CN108683662A (zh) * 2018-05-14 2018-10-19 深圳市联软科技股份有限公司 单台在网设备风险评估方法及***

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9015090B2 (en) * 2005-09-06 2015-04-21 Daniel Chien Evaluating a questionable network communication
US20140143864A1 (en) * 2012-11-21 2014-05-22 Snoopwall Llc System and method for detecting, alerting and blocking data leakage, eavesdropping and spyware
CN104092469A (zh) * 2014-07-22 2014-10-08 西安电子科技大学 基于等弦长直线逼近的简化Log-BP迭代译码方法
CN107172004A (zh) * 2016-03-08 2017-09-15 中兴通讯股份有限公司 一种网络安全设备的风险评估方法和装置
CN106790198A (zh) * 2016-12-30 2017-05-31 北京神州绿盟信息安全科技股份有限公司 一种信息***风险评估方法及***
CN107204876B (zh) * 2017-05-22 2020-09-29 成都网络空间安全技术有限公司 一种网络安全风险评估方法
CN107911231B (zh) * 2017-10-25 2020-12-25 北京神州绿盟信息安全科技股份有限公司 一种威胁数据的评估方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106203666A (zh) * 2015-04-30 2016-12-07 中国南方电网有限责任公司 一种数据网络设备风险评估方法及装置
CN105205732A (zh) * 2015-09-28 2015-12-30 中国南方电网有限责任公司 一种基于设备风险特征模型的风险评估和检修方法
CN107451402A (zh) * 2017-07-13 2017-12-08 北京交通大学 一种基于告警数据分析的设备健康度评估方法及装置
CN108009711A (zh) * 2017-11-23 2018-05-08 平安科技（深圳）有限公司 风险评估方法、装置、计算机设备及可读存储介质
CN108683662A (zh) * 2018-05-14 2018-10-19 深圳市联软科技股份有限公司 单台在网设备风险评估方法及***

Also Published As

Publication number Publication date
CN108683662A (zh) 2018-10-19
CN108683662B (zh) 2020-08-14

Similar Documents

Publication Publication Date Title
US7437281B1 (en) System and method for monitoring and modeling system performance
US7082381B1 (en) Method for performance monitoring and modeling
US10592308B2 (en) Aggregation based event identification
WO2019218875A1 (zh) 单台在网设备风险评估方法及***
US8457928B2 (en) Automatic determination of dynamic threshold for accurate detection of abnormalities
US8751417B2 (en) Trouble pattern creating program and trouble pattern creating apparatus
US8635498B2 (en) Performance analysis of applications
US7197428B1 (en) Method for performance monitoring and modeling
JP5768983B2 (ja) 契約違反予測システム、契約違反予測方法および契約違反予測プログラム
CN112188531A (zh) 异常检测方法、装置、电子设备及计算机存储介质
US7369967B1 (en) System and method for monitoring and modeling system performance
CN116747528B (zh) 一种游戏后台用户监管方法及***
CN111898647A (zh) 一种基于聚类分析的低压配电设备误告警识别方法
CN107276779B (zh) 一种监控方法、***及设备
CN108092985A (zh) 网络安全态势分析方法、装置、设备及计算机存储介质
US9817973B2 (en) Method and device for monitoring virus trend abnormality
KR101281460B1 (ko) 통계적 공정 관리도를 이용하여 이상증후를 탐지하는 방법
US9397921B2 (en) Method and system for signal categorization for monitoring and detecting health changes in a database system
CN107465652B (zh) 一种操作行为检测方法、服务器及***
CN110489260A (zh) 故障识别方法、装置及bmc
CN117252640A (zh) 熔断降级方法、规则引擎***和电子设备
JP2014153736A (ja) 障害予兆検出方法、プログラムおよび装置
CN114610560B (zh) ***异常监控方法、装置和存储介质
CN113961565A (zh) 数据检测方法、***、计算机***及可读存储介质
US10284572B2 (en) Management method, management device, and management program

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19804101

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 14/04/2021)

122 Ep: pct application non-entry in european phase

Ref document number: 19804101

Country of ref document: EP

Kind code of ref document: A1