CN103996006A - Information system security risk assessment method and device - Google Patents

Abstract

The invention discloses a method for assessing the security risk of an information system, constructing a threat behavior pattern library, matching the calling behavior recorded in the information system with the threat behavior in the threat behavior pattern library, and obtaining the judgment value of each matching calling behavior, Determine the weight of the threat behavior according to the judgment value of each call behavior on the match; combine the weight of the threat behavior with the weight of the vulnerability and the weight of the compensation measure to obtain the risk level; the invention also discloses an information system security risk assessment The device, through the solution of the present invention, can measure the security risk of the information system in multiple dimensions, greatly make up for the shortage of existing risk assessment and quantification, improve the accuracy and credibility of threat judgment, and can solve the problem of information system risk quantification The core problem enables users to understand the risk status of information system operation more conveniently and objectively, and makes information system security risks perceivable.

Description

Method and device for information system security risk assessment

technical field

The present invention relates to information security technology, in particular to a method and device for information system security risk assessment.

Background technique

With the rapid development of IT technology, the development of the entire national economy is inseparable from the operation and support of information systems. How to ensure the safe operation of these information systems has become a top priority; according to the requirements of the "2006-2020 National Informatization Development Strategy", Comprehensively strengthening the construction of the national information security guarantee system requires all organizations to adhere to active defense and comprehensive prevention, explore and grasp the inherent laws of informatization and information security, and actively respond to information security challenges.

In order to realize the initiative of information security, the key is to solve how to evaluate the information system security risk or the situation of early perception of risk. The risk status is related to many factors, mainly including: the vulnerability factors of the information system itself, the threat factors outside the system, control measures and remedial measures and other factors; these factors interact and influence each other.

The existing technology mainly evaluates information system security risks through the following three methods: 1. From the perspective of threats, that is, judging the security event volume of related equipment, mainly analyzing logs from security equipment and IT equipment, and extracting high-level risks from them. Second, from the perspective of vulnerability, that is, to evaluate the vulnerability of network facilities, host resources, code resources, etc. related to the carrying information system, so as to obtain the level of risk status; Comprehensive evaluation of asset value.

The existing risk assessment system has major defects and deficiencies, which are mainly reflected in the following aspects:

1. The evaluation index either relies on a single factor or is too complex to reflect the real risk situation; from the perspective of threats, it can reflect the real situation of external attacks. However, due to the large number of external threats and complex sources, there are new types of attacks, There are also very old attacks, and the applicability of the attacks needs to be accurately screened, so the evaluation of the risk status is generally high, which is not conducive to the development of threat handling and remedial measures; from the perspective of vulnerability, it can truly reflect the loopholes of the information system However, since the vulnerability is static, threats and attacks are required to form a risk, so the evaluation of the risk situation is often distorted, which is not conducive to investing effective resources in risk control, and the cost is too high; from threats, vulnerabilities A comprehensive evaluation with asset value can reflect the level of risk status, but since this comprehensive evaluation involves a three-dimensional system, and the three factors are many-to-many, the mapping relationship and calculation are extremely complicated, so it is difficult to achieve in actual use .

2. The current evaluation system often only focuses on risk threat, vulnerability and asset value, but often ignores the very important link of remedial measures, which is actually an important factor in risk control.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a method and device for information system security risk assessment, which can measure information system security risks in multiple dimensions.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

A method for assessing information system security risks provided by the present invention, the method includes:

Construct a threat behavior pattern library, match the calling behavior recorded in the information system with the threat behavior in the threat behavior pattern library, obtain the judgment value of each matching calling behavior, and determine the threat behavior right according to the matching judgment value of each calling behavior value;

Combine the weight of threat behavior with the weight of vulnerability and the weight of remedial measures to obtain the risk level.

In the above solution, the construction of the threat behavior pattern library is as follows: with specific threat behaviors as the classification principle, each type of threat behavior is mapped to a system function call set, and each system function call set includes more than one triplet < The module number, function number, and detail number> represent the call behavior of the system application programming interface API function, and all threat behaviors form a threat behavior pattern library.

In the above solution, the matching of the call behavior recorded by the information system with the threat behavior in the threat behavior pattern library is as follows: converting the format of the call behavior recorded by the information system into the triplet <module number, function number, detailed rule number> format to match the transformed invocation behaviors with threat behaviors in the Threat Behavior Patterns library.

In the above scheme, the determination value of each calling behavior on the acquisition matching is: the average value of each calling behavior on the matching is calculated, and the judgment value of each calling behavior is obtained according to the average value of each calling behavior.

In the above scheme, the risk level obtained by combining the weight of the threat behavior with the weight of the vulnerability and the weight of the remedial measures is: according to the risk level formula including the weight of the threat behavior, the weight of the vulnerability, and the weight of the remedial measures , to obtain the risk level;

Risk level (V)==Round1{Log2[(A×2 ^The +B×2 ^Vul +C×2 ^Con )/3]}×Asset(value)

Among them, The represents the weight of threat behavior; Vul represents the weight of vulnerability; Con represents the weight of remedial measures; the Round function is a function of rounding the logarithmic value according to the specified number of digits, and Round1 means retaining 1 decimal place; Asset(value) Represents asset value; A is the coefficient of the weight of threat behavior; B is the coefficient of the weight of vulnerability; C is the coefficient of the weight of remedial measures.

An information system security risk assessment device provided by the present invention includes: a construction module, a matching module, a determination value acquisition module, a determination module, and a risk level acquisition module; wherein,

The construction module is used to construct a threat behavior pattern library;

The matching module is used to match the call behavior recorded by the information system with the threat behavior in the threat behavior pattern library, and send each matching call behavior to the judgment value acquisition module;

The judgment value acquisition module is used to obtain the judgment value of each call behavior on the match;

The determining module is configured to determine a threat behavior weight value according to the determination value;

The risk level acquisition module is used to combine the weight of threat behavior with the weight of vulnerability and the weight of remedial measures to obtain the risk level.

In the above solution, the construction modules are specifically used to use specific threat behaviors as classification principles, and each type of threat behavior maps a system function call set, and each system function call set includes more than one triple < module number, function number, detailed rules number> to represent the call behavior of the system API function, and all threat behaviors form a threat behavior pattern library.

In the above solution, the matching module is specifically used to convert the call behavior recorded by the information system in the format of triplet <module number, function number, detailed rule number>, and convert the converted call behavior to the threat behavior pattern library. threatening behaviors.

In the above solution, the risk level acquisition module is specifically used to obtain the risk level according to the risk level formula including the weight of threat behavior, the weight of vulnerability, and the weight of remedial measures;

Risk level (V)==Round1{Log2[(A×2 ^The +B×2 ^Vul +C×2 ^Con )/3]}×Asset(value)

Among them, The represents the weight of threat behavior; Vul represents the weight of vulnerability; Con represents the weight of remedial measures; the Round function is a function of rounding the logarithmic value according to the specified number of digits, and Round1 means retaining 1 decimal place; Asset(value) Represents asset value; A is the coefficient of the weight of threat behavior; B is the coefficient of the weight of vulnerability; C is the coefficient of the weight of remedial measures.

The present invention provides a method and device for information system security risk assessment, which constructs a threat behavior pattern library, matches the calling behavior recorded in the information system with the threat behavior in the threat behavior pattern library, and obtains the judgment of each matching calling behavior value, and determine the threat behavior weight according to the judgment value of each matching call behavior; combine the threat behavior weight with the vulnerability weight and the weight of the remedial measures to obtain the risk level; Measurement can greatly make up for the lack of existing risk assessment quantification, improve the accuracy and credibility of threat judgment, and solve the core problem of information system risk quantification, so that users can understand the risk status of information system operation more conveniently and objectively. Information system security risks are perceivable.

Description of drawings

Fig. 1 is a schematic flow chart of the method for information system security risk assessment provided by the present invention;

Fig. 2 is a schematic structural diagram of a threat behavior pattern library provided by the present invention;

FIG. 3 is a schematic structural diagram of an information system security risk assessment device provided by the present invention.

Detailed ways

The basic idea of the present invention is to construct a threat behavior pattern library, match the calling behaviors recorded in the information system with the threat behaviors in the threat behavior pattern library, obtain the judgment value of each matching calling behavior, and The judgment value of the threat behavior determines the weight of the threat behavior; the risk level is obtained by combining the weight of the threat behavior with the weight of the vulnerability and the weight of the remedial measures.

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

The present invention realizes a method for information system security risk assessment, as shown in Figure 1, the method includes the following steps:

Step 101: constructing a threat behavior pattern library;

Specifically, the specific threat behavior is used as the classification principle, as shown in Figure 2, each type of threat behavior A maps a system function call set S, and each system function call set S includes more than one triple < module number, function number, detailed rules number > to represent the call behavior of the system API function, the call behavior included in the system function call set S is a known threat behavior, and all threat behaviors A form a threat behavior pattern library;

The specific threats include: eavesdropping, remote espionage, deliberate disclosure, hacking, system/network overload, and the like.

Step 102: matching the call behavior recorded by the information system with the threat behavior in the threat behavior pattern library;

Specifically, the format of the calling behavior recorded by the conversion information system is the format of the triplet <module number, function number, detail number>, and the converted calling behavior is matched with the threat behavior in the threat behavior pattern library.

Step 103: Obtain the judgment value of each call behavior on the match;

Specifically, count the occurrence mean value of each call behavior on the matching, and obtain the judgment value of each call behavior according to the appearance average value of each call behavior; here, the judgment value is the number of successful attacks or the number of failed attacks;

The judgment value of each call behavior obtained according to the appearance average value of each call behavior is: within the appearance average value of each call behavior, the attack result of each call behavior is counted, and the attack result is used as the judgment value;

The attack result is the number of successful attacks or the number of failed attacks.

Step 104: Determine the threat behavior weight value according to the judgment value of each matching calling behavior;

Specifically, when the determination value of the matching invocation behavior is greater than a preset threshold, the invocation behavior is marked as a threatening behavior, the number of all invocation behaviors marked as threatening behaviors is counted, and the weight of the threatening behavior is determined.

Step 105: Combining the weight of the threat behavior with the weight of the vulnerability and the weight of the remedial measures to obtain the risk level;

Specifically, the risk level is obtained according to the risk level formula including the weight of threat behavior, the weight of vulnerability, and the weight of remedial measures;

Risk level (V)==Round1{Log2[(A×2 ^The +B×2 ^Vul +C×2 ^Con )/3]}×Asset(value)

Among them, The represents the weight of threat behavior; Vul represents the weight of vulnerability; Con represents the weight of remedial measures; the Round function is a function of rounding the logarithmic value according to the specified number of digits, and Round1 means retaining 1 decimal place; Asset(value) Represents asset value; A is the coefficient of the weight of threatening behavior; B is the coefficient of the weight of vulnerability; C is the coefficient of the weight of compensation measures; according to the international basis for weight evaluation, it can be set as: A =0.7, B=0.5, C=0.8;

The weight of the vulnerability is generally determined according to the vulnerability level assessed in the International Vulnerability Database (CVE);

The weight of the remedial measures is generally assigned according to the strength of the remedial measures (the effectiveness of risk avoidance), and the higher the value, the better the effect of risk avoidance.

In order to realize the above method, the present invention also provides a device for information system security risk assessment, which is generally set on a hardware device that uses Linux Server to provide API services, as shown in Figure 3, the device includes: a construction module 31, a matching Module 32, judgment value acquisition module 33, determination module 34, risk level acquisition module 35; wherein,

The construction module 31 is configured to construct a threat behavior pattern library;

The matching module 32 is configured to match the call behavior recorded by the information system with the threat behavior in the threat behavior pattern library, and send each matching call behavior to the judgment value acquisition module 33;

The judgment value acquisition module 33 is used to obtain the judgment value of each calling behavior on the match;

The determining module 34 is configured to determine a threat behavior weight value according to the determination value;

The risk level acquisition module 35 is configured to combine the weight of the threat behavior with the weight of the vulnerability and the weight of the remedial measures to obtain the risk level.

The construction module 31 is specifically used to use a specific threat behavior as a classification principle, and each type of threat behavior maps a system function call set, and each system function call set includes more than one triple < module number, function number, detailed rules number > to indicate the calling behavior of the system API function, the calling behavior of the system function call set includes known threat behaviors, and all the threat behaviors form a threat behavior pattern library.

The matching module 32 is specifically used to convert the calling behavior recorded by the information system into the format of the triplet <module number, function number, detailed rules number>, and compare the converted calling behavior with the threat behavior in the threat behavior pattern library. to match.

The risk level acquisition module 35 is specifically configured to obtain the risk level according to the risk level formula including the weight of threat behavior, the weight of vulnerability, and the weight of remedial measures;

Risk level (V)==Round1{Log2[(A×2 ^The +B×2 ^Vul +C×2 ^Con )/3]}×Asset(value)

Among them, The represents the weight of threat behavior; Vul represents the weight of vulnerability; Con represents the weight of remedial measures; the Round function is a function of rounding the logarithmic value according to the specified number of digits, and Round1 means retaining 1 decimal place; Asset(value) Represents asset value; A is the coefficient of the weight of threatening behavior; B is the coefficient of the weight of vulnerability; C is the coefficient of the weight of compensation measures; according to the international basis for weight evaluation, it can be set as: A =0.7, B=0.5, C=0.8.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (9)

1. A method for information system security risk assessment, the method comprising:

constructing a threat behavior pattern library, matching the calling behaviors recorded by the information system with the threat behaviors in the threat behavior pattern library, acquiring the judgment values of the matched calling behaviors, and determining the weight of the threat behaviors according to the judgment values of the matched calling behaviors;

and combining the weight of the threat behavior with the weight of the vulnerability and the weight of the remedy measure to obtain the risk level.

2. The method of claim 1, wherein the library of threat behavior patterns is constructed by: the specific threat behaviors are used as a classification principle, each type of threat behavior is mapped to a system function call set, each system function call set comprises more than one call behavior of a system Application Programming Interface (API) function represented by a triple (a module number, a function number and a rule number), and all the threat behaviors form a threat behavior pattern library.

3. The method of claim 2, wherein matching the invocation behavior of the information system record with the threat behavior in the threat behavior pattern library is: and converting the format of the call behavior recorded by the information system into the format of a triple < module number, function number and rule number >, and matching the converted call behavior with the threat behavior in the threat behavior pattern library.

4. The method of claim 1, wherein the decision value for each call behavior on the get match is: and counting the occurrence average value of each matched calling behavior, and obtaining the judgment value of each calling behavior according to the occurrence average value of each calling behavior.

5. The method according to claim 1, wherein the risk level obtained by combining the weight of the threat behavior with the weight of the vulnerability and the weight of the remedy is: obtaining a risk level according to a risk level formula comprising a threat behavior weight, a vulnerability weight and a remedy weight;

risk rating (V) ═ Round1{ Log2[ (ax2) }^The+B×2^Vul+C×2^Con)/3]}×Asset(value)

Wherein, The represents a threat behavior weight; vul represents the weight of vulnerability; con represents the weight of the compensation measure; round function is a function rounded to the numerical value by the number of digits specified, Round1 denotes the reserved 1-digit decimal number; asset (value) represents asset value; a is the coefficient of the weight of the threat behavior; b is the coefficient of the weight of the vulnerability; and C is the coefficient of the weight of the compensation measure.

6. An apparatus for information system security risk assessment, the apparatus comprising: the system comprises a construction module, a matching module, a judgment value acquisition module, a determination module and a risk grade acquisition module; wherein,

the construction module is used for constructing a threat behavior pattern library;

the matching module is used for matching the calling behaviors recorded by the information system with the threat behaviors in the threat behavior pattern library and sending the matched calling behaviors to the judgment value acquisition module;

the judgment value acquisition module is used for acquiring the judgment value of each matched calling behavior;

the determining module is used for determining a threat behavior weight according to the judging value;

and the risk level acquisition module is used for combining the weight of the threat behavior with the weight of the vulnerability and the weight of the remedy measure to obtain the risk level.

7. The apparatus according to claim 6, wherein the configuration module is specifically configured to use the specific threat behaviors as a classification rule, and each type of threat behavior maps a system function call set, and each system function call set includes more than one call behavior of a system API function represented by a triple < module number, function number, and rule number >, and all the threat behaviors constitute the threat behavior pattern library.

8. The apparatus according to claim 7, wherein the matching module is specifically configured to convert the format of the call behavior recorded by the information system into a format of a triple < module number, function number, rule number >, and match the converted call behavior with the threat behavior in the threat behavior pattern library.

9. The device according to claim 6, wherein the risk level obtaining module is specifically configured to obtain a risk level according to a risk level formula that includes a threat behavior weight, a vulnerability weight, and a remedy weight;

risk rating (V) ═ Round1{ Log2[ (ax2) }^The+B×2^Vul+C×2^Con)/3]}×Asset(value)

Wherein, The represents a threat behavior weight; vul represents the weight of vulnerability; con represents the weight of the compensation measure; round function is a function rounded to the numerical value by the number of digits specified, Round1 denotes the reserved 1-digit decimal number; asset (value) represents asset value; a is the coefficient of the weight of the threat behavior; b is the coefficient of the weight of the vulnerability; and C is the coefficient of the weight of the compensation measure.