CN107172004A - The methods of risk assessment and device of a kind of Network Security Device - Google Patents

Abstract

The invention discloses a kind of methods of risk assessment of Network Security Device and device, by determining predetermined risk storehouse, extract effective configuration information related to the risk in equipment to be assessed, and the risk for triggering the equipment to be assessed is obtained according to the risk analysis result of effective configuration information, the risk that the predetermined risk storehouse risk of analysis and the equipment to be assessed have been triggered, take corresponding computational methods, obtain the secure state value value-at-risk of the equipment to be assessed, by the value-at-risk for analyzing risk, incidence relation between risk, the triggering times for every risk that the risk item of the equipment to be assessed has been triggered obtain the secure state value of equipment to be assessed correspondingly to be calculated, so that more directly perceived, accurately, effectively show current device safe condition.

Description

Method and device for risk assessment of network security equipment

technical field

The invention relates to the technical field of network security, in particular to a risk assessment method and device for network security equipment.

Background technique

At present, with the continuous development of Internet technology, network security issues have become increasingly prominent. Security products such as firewalls, intrusion prevention systems, and anti-viruses will be deployed in multiple locations in the enterprise network. Business requirements will change from time to time, and authoritative organizations such as Common Vulnerabilities & Exposures (CVE) and China National Vulnerability Database (CNVD) release newly discovered vulnerabilities all the time. Both require enterprise network managers to change the configuration of network security devices, so as to ensure the security of enterprise networks.

In the prior art, enterprise network managers will change the configuration of network security devices by opening a certain port of the firewall in order to communicate with business partners, or closing a certain port to avoid being exploited by a certain loophole, etc. , and at the same time check the configuration of network security devices through specific products, so as to find loopholes in the configuration in time.

However, using the existing technology, the analysis and consideration of the configuration results of the network security equipment through specific products is not comprehensive, so that the final evaluation results cannot reflect the security status of the network security equipment in an accurate, effective and multi-faceted manner.

Contents of the invention

In order to solve the above technical problems, the present invention provides a risk assessment method and device for network security equipment, which can more intuitively, accurately and effectively indicate the current equipment security status.

In order to achieve the purpose of the present invention, in the first aspect, the present invention provides a method for risk assessment of network security equipment, the method comprising:

determining a predetermined risk library, where the risk library includes a plurality of risk items;

Extracting effective configuration information related to the risk item in the device to be evaluated, and obtaining risk items triggered by the device to be evaluated according to a risk analysis result of the effective configuration information;

Analyzing the risk items in the predetermined risk library and the risk items triggered by the equipment to be evaluated respectively, and adopting corresponding calculation methods to obtain the security state value of the equipment to be evaluated.

Compared with the prior art, the present invention provides a risk assessment method for network security equipment. By determining a predetermined risk library, effective configuration information related to the risk item in the equipment to be assessed is extracted, and according to the effective configuration information According to the risk analysis result, the risk items triggering the equipment to be evaluated are obtained, the risk items in the predetermined risk library and the risk items triggered by the equipment to be evaluated are respectively analyzed, and the corresponding calculation method is adopted to obtain the safety of the equipment to be evaluated. The risk value of the status value, in this way, analyze the risk value of the risk item, the relationship between the risk items, and the trigger times of each risk item that the risk item of the equipment to be evaluated has been triggered to calculate accordingly to obtain the safety of the equipment to be evaluated The status value makes it more intuitive, accurate and effective to indicate the current device security status.

In a second aspect, the present invention provides a risk assessment device for network security equipment, which comprises: a determination module, an extraction module and an assessment module;

The determining module is configured to determine a predetermined risk library, the risk library includes configuration information of multiple risk items, and the configuration information includes identification codes and descriptions of risk items;

The extraction module is configured to extract effective configuration information related to the risk item in the device to be evaluated, and obtain risk items triggered by the device to be evaluated according to a risk analysis result of the effective configuration information;

The assessment module is configured to separately analyze the risk items in the predetermined risk library and the risk items triggered by the equipment to be assessed, and adopt corresponding calculation methods to obtain the security status value of the equipment to be assessed.

Compared with the prior art, the present invention provides a risk assessment device for network security equipment. The predetermined risk library is determined by the determination module, and the effective configuration information related to the risk item in the equipment to be evaluated is extracted by the extraction module, and According to the risk analysis result of the effective configuration information, the risk item that triggers the device to be evaluated is obtained, and the evaluation module separately analyzes the risk item in the predetermined risk library and the risk item that has been triggered by the device to be evaluated, and adopts a corresponding calculation method to obtain the Describe the risk value of the safety state value of the equipment to be evaluated, and analyze the risk value of the risk item, the relationship between the risk items, and the number of triggers of each risk item that has been triggered by the risk item of the equipment to be evaluated to calculate accordingly Obtaining the security status value of the equipment to be evaluated makes it more intuitive, accurate and effective to indicate the current security status of the equipment.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The accompanying drawings are used to provide a further understanding of the technical solution of the present invention, and constitute a part of the description, and are used together with the embodiments of the application to explain the technical solution of the present invention, and do not constitute a limitation to the technical solution of the present invention.

FIG. 1 is a schematic flowchart of Embodiment 1 of a risk assessment method for a network security device provided by the present invention;

FIG. 2 is a schematic structural diagram of Embodiment 1 of a risk assessment device for network security equipment provided by the present invention.

detailed description

In order to make the purpose, technical solution and advantages of the present invention more clear, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined arbitrarily with each other.

The steps shown in the flowcharts of the figures may be performed in a computer system, such as a set of computer-executable instructions. Also, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

The method involved in the embodiment of the present invention can be applied to a single device in a network security system, and the network security device can be a router, a firewall, a behavior manager, a core switch, etc., but is not limited thereto.

The method involved in the embodiment of the present invention aims to solve the problem that the analysis and consideration of the configuration results of network security equipment through specific products in the prior art is not comprehensive, so that the final evaluation results cannot reflect the network security equipment in an accurate, effective and multi-faceted manner. technical issues of the state of security.

The technical solution of the present invention will be described in detail below with specific embodiments. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

FIG. 1 is a schematic flowchart of Embodiment 1 of a method for risk assessment of a network security device provided by the present invention. This embodiment relates to the specific process of implementing the risk assessment method for network security equipment. As shown in Figure 1, the method includes:

S101. Determine a predetermined risk library, where the risk library includes multiple risk items.

Specifically, users can manage and control the standard risk library provided by the system according to the unified security policy, or customize the risk library to meet the needs of the enterprise according to business needs. The risk library includes all vulnerability information of the device. Here, each Vulnerability is a risk item, for example: the administrator password of the device is the default value, the device has opened the Telnet service, etc., but it is not limited to this.

Specifically, each risk item has the identification code and description of the risk item. Each risk item (also referred to as: vulnerability) is analyzed in detail and represented by corresponding fields. Here, the fields contained in each risk item There are: risk item identification code, description content, risk value brought by risk item, relationship between risk item and risk item, etc., but not limited thereto.

S102. Extract effective configuration information related to the risk item in the device to be evaluated, and obtain risk items triggered by the device to be evaluated according to a risk analysis result of the effective configuration information.

Specifically, according to the unified security policy management and control system, you can remotely connect to the device to be evaluated through SSH, extract the original configuration information of the device to be evaluated according to the configuration information of the risk item in the risk library, and extract the information related to the risk item in the device to be evaluated. effective information, that is, to extract all relevant effective configuration information that may have vulnerabilities to form standardized data, and perform risk analysis on the standardized data according to the predetermined risk library, and obtain the risk items that have been triggered by the device to be evaluated, for example, the risk library If there is a risk item about the validity period of the administrator password, it is necessary to extract the valid data in the original configuration information of the device to be evaluated, that is, the information of the validity period of the password, and set the field of the validity period of the password in a standardized format, and the field The value is the value of the collected password validity period, but it is not limited thereto.

S103. Separately analyze the risk items in the predetermined risk library and the risk items triggered by the equipment to be evaluated, and adopt corresponding calculation methods to obtain the security state value of the equipment to be evaluated.

Specifically, the risk items in the selected risk library can be analyzed according to the risk library selected by the user, and the risk items triggered by the device to be evaluated can be analyzed, and the risk value of the risk items and the relationship between risk items can be analyzed , the risk value of the triggering risk item, the association relationship among the triggering risk items, etc., and adopt a corresponding calculation method for the respectively analyzed results to obtain the security state value of the device to be evaluated.

In the risk assessment method for network security equipment provided by an embodiment of the present invention, the effective configuration information related to the risk item in the equipment to be assessed is extracted by determining a predetermined risk library, and obtained according to the risk analysis results of the effective configuration information. Triggering the risk items of the equipment to be evaluated, analyzing the risk items in the predetermined risk library and the risk items that have been triggered by the equipment to be evaluated, and adopting a corresponding calculation method to obtain the risk value of the safety status value of the equipment to be evaluated, by Analyze the risk value of the risk item, the relationship between the risk items, and the number of triggers of each risk item that has been triggered by the risk item of the device to be evaluated, and calculate accordingly to obtain the security status value of the device to be evaluated, making it more intuitive , Accurately and effectively indicate the current equipment security status.

Further, on the basis of the above-mentioned embodiments, before the predetermined risk library is determined in the above-mentioned step 101, it also includes:

Risk libraries of various configuration types are collected in advance, and the configuration types include baseline libraries and/or access control list ACL libraries.

Specifically, the risk assessment in the embodiment of the present invention is triggered from the perspective of risk items, and judges whether there are risk items in the configuration of the equipment to be evaluated through a predetermined analysis method, and judges the risk value of the equipment to be evaluated based on the risk values of these risk items. Security status value, therefore, the configuration information of the device to be evaluated needs to be collected and described in preprocessing, and a risk library required for configuration types such as baseline analysis and/or ACL risk analysis is formed. The formation of the risk library refers to the current well-known vulnerabilities Libraries, such as CVE; you can also refer to device configuration specifications, such as NIST's firewall configuration specifications, and you can also refer to some general standards, such as baseline standards, compliance standards, PCI standards, etc., but not limited thereto.

Specifically, the pre-collected risk library can be classified according to the configuration type, and the risk library is specifically divided into the baseline library of the baseline module and the ACL risk library, so that they can be used for baseline analysis and ACL risk analysis respectively.

Further, on the basis of the above-mentioned embodiments, analyzing the risk items in the predetermined risk library includes:

Count the total number of risk items in the predetermined risk library;

Use the CVSS3.0 scoring method to analyze and obtain the risk value of the risk item in the predetermined risk library;

Determine the association relationship between any two risk items in the predetermined risk library, wherein triggering the first risk item will definitely trigger the second risk item, and triggering the second risk item will not trigger the first risk item risk item, it is determined that there is a relationship between the first risk item and the second risk item.

Specifically, the risk library used for analysis here can be the standard library and risk general library provided by the unified security policy management and control system, or a custom risk library suitable for the user's own enterprise combined by the user according to his business needs. Statistics The total number of risk items in the predetermined risk library, and use the CVSS3.0 scoring method to analyze and obtain the risk value of the risk items in the predetermined risk library. The unified security policy management and control system adopts the latest official CVSS3.0 scoring method, from the vulnerability Considering the attack path, attack complexity, privilege, user interaction, confidentiality, integrity, availability, etc., using the CVSS3. Five levels of high, medium, low, and minor are used to intuitively judge the severity of the current vulnerability, and the recognized CVSS3.0 scoring method is adopted to make the risk value of the vulnerability more accurate, reliable and credible.

Among them, the relationship between risk items and risk items is mainly used to analyze the relationship between different risk items (that is, loopholes) in the predetermined risk library. The definition of the relationship here is: For any two risk items (that is, vulnerabilities) A and B, if all the risk library rules that trigger risk item A must trigger risk item B, and the risk library rules that trigger risk item B do not necessarily trigger risk item A, risk A is considered There is an association relationship with risk item B, where risk item B includes risk item A. It can be seen from the definition that if the inclusion relationship is not considered, when the security score of the device is calculated, the ACL rules that trigger the included risk items (that is, vulnerabilities) will be calculated multiple times, resulting in the risk score of the device The higher the value, the lower the safety score. In practice, according to the definition of the above association relationship, the risk item in the risk database is analyzed for the association relationship, and the analysis steps are as follows:

(1) For any two risk items A and B in the predetermined risk database, analyze whether there is a relationship between the two risk items according to the definition of the relationship;

(2) If there is a relationship between risk items A and B in (1), and B includes A, then add the vulnerability ID of risk item A to the "vulnerability relationship" field of risk item B.

For example: risk item R1 checks whether the service is open from the external network to the internal network is an ANY type rule, risk item R2 checks whether the Telnet service is open from the external network to the internal network, and risk item R3 checks whether the X11 service is open from the external network to the internal network, through analysis The relationship between R1, R2, and R3 can draw a conclusion: the ACL rule that triggers risk item R1 will inevitably trigger risk items R2, R3, therefore, the value R1 needs to be added to the "Vulnerability Association" field of risk items R2 and R3 . If the relationship between them is not considered here, the ACL rule triggering the risk item R1 will be calculated multiple times (in the example, it can be concluded that each ACL rule triggering R1 is calculated 3 times). Taking this inclusion relationship into consideration, the double-calculated ACL rules are removed, and the accuracy of the analysis results of the ACL module of the system equipment and the comprehensive security status of the equipment is improved.

Further, on the basis of the above embodiments, analyzing the risk items triggered by the device to be evaluated includes:

If the predetermined risk library includes an access control list ACL library, analyze one or more of the trigger times of each risk item triggered by the device to be evaluated, the risk value of the risk item, and the relationship between the risk items indivual.

Specifically, if there are multiple types of ACL risk libraries in the predetermined risk library, the user can analyze the number of triggers for each risk item of the device to be evaluated, the risk value of the risk item, and the risk item according to the selected ACL risk library. One or more of the three. It should be noted that different risk databases are used for analysis, and the detected vulnerability information is also different. Below will be described in detail by embodiment, specifically as follows:

(1) Carry out risk analysis on the standardized ACL policy data according to the risk library selected by the user, and count the identification number of the ACL policy that triggers each risk item (that is, a loophole);

(2) Process the results in step (1) according to the relationship between the risk item and the risk item, remove the ID number of the double-counted ACL policy, and obtain the ID number of the ACL policy that triggers each risk item after processing ;

(3) According to the processing results in (2), count the number of times each risk item is triggered, and one ACL policy ID number represents one trigger. For example, for a risk item with a low risk value, it is triggered 1 time and triggered 100 times, and the evaluation of the security impact of this risk item on the system is different. A risk item with a higher number of triggers indicates that this risk item is used. The higher the number of times, and the more times it is used, it means that there are relatively more malicious uses, thus increasing the risk value of the device to be evaluated.

(4) According to the analysis results of (1), (2) and (3), obtain the ACL security status value of the equipment to be evaluated.

For the above analysis process (4), a calculation process is given below, specifically as follows:

Count the total number M of risk items in the predetermined risk library and the total number x _i (i=1,2,...,n) of ACL rules that trigger each risk item, according to the calculation formula Obtain safe state value, wherein, described S _n is the total score of the risk item of triggering, and described S _t is the total score of risk item of non-triggering, and described said The weight value R _i is the risk value of the risk item, (i=1,2,3,...,n) is the trigger risk item, n is less than or equal to M, (i=n+1,...,M) is Untriggered risk items, _xi takes values 1, 2, 3,….

In the above process, by analyzing the triggered risk items (that is, vulnerabilities), the risk value of the risk items, and the number of times the risk items are triggered by the ACL risk analysis, the security status of the ACL module of the system equipment is analyzed, and the corresponding The security status value of .

Compared with existing technologies, this method considers the relationship between risk items and the number of times risk items are triggered during analysis, making the analysis more comprehensive. The calculation of the risk value adopts CVSS3.0 scoring technology, which is more reliable and credible than the method of taking empirical values. In addition, the calculated system security state value is more intuitive, accurate and effective to indicate the current equipment security state.

Further, on the basis of the above embodiments, analyzing the risk items triggered by the device to be evaluated includes:

If the predetermined risk library includes the baseline library, analyze the risk value of the risk item triggered by the device to be evaluated.

Specifically, if it is determined that the predetermined risk database is a variety of baseline risk databases, the user can analyze the risk value of each risk item according to the selected baseline risk database, and perform the baseline module based on the normalized baseline module data. Risk Analysis. The baseline library used for analysis here can be the baseline library that comes with the unified security policy management and control system, or it can be a baseline library customized by users according to their own business needs. Different baseline libraries are selected, and the final evaluation results are also different. Below will be described in detail by embodiment, specifically as follows:

(1) Select all baseline libraries related to the baseline from the risk library, and the user performs baseline analysis on the normalized baseline data of the equipment to be evaluated according to the selected baseline library;

(2) Calculate the security status value according to the triggered risk item (that is, the loophole) and the risk value of the risk item checked out in (1);

(3) For the above-mentioned analysis process (2), a calculation process is given below, specifically as follows: the total number M of risk items in the predetermined risk library is counted, according to the calculation formula:

Obtain the safety state value, wherein, said S' _n is the total score of the triggered risk item, and said S _t ' is the total score of the untriggered risk item, said said The weight value R _i is the risk value of the risk item, (i=1,2,3,...,n) is the trigger risk item, n is less than or equal to M, (i=n+1,...,M) is Untriggered risk items.

In the above process, the security status of the baseline module of the system equipment is analyzed by analyzing the triggered risk items (ie loopholes) detected by the baseline analysis, the risk values of the risk items, and the corresponding security status values are obtained.

This method uses CVSS3.0 scoring technology to calculate the risk value of risk items (that is, loopholes) during analysis. Compared with the method of taking empirical values, this method is more reliable and credible. In addition, the calculated system security state value is more intuitive, accurate and effective to indicate the current equipment security state.

Further, on the basis of the above-mentioned embodiments, if it is determined that the predetermined risk library includes the baseline library and the access control list ACL library, respectively analyze the risk items in the predetermined risk library and the risk items triggered by the device to be evaluated, and take The corresponding calculation method is used to obtain the security state value of the device to be evaluated, which will be described in detail below through an embodiment, specifically as follows:

(1) judge whether the equipment to be evaluated supports ACL risk analysis, if it supports, then perform the security status analysis of the ACL module, the specific execution method is the same as the ACL risk library in the above-mentioned embodiment, if not supported, then do not execute;

(2) The security status analysis of the baseline module is performed on the equipment to be analyzed, and the specific execution method is the same as the baseline library in the embodiment;

(3) According to the analysis results of (1) and (2), analyze the comprehensive security state of the equipment.

For the above analysis process (3), calculate according to the calculation formula:

Wherein, the S _n is the total score of the risk item triggered when the access control list ACL library, the S _t is the total score of the risk item not triggered when the ACL library is the access control list, and the S' _n is the baseline library. The total score of the triggered risk items, and the S _t ' is the total score of the untriggered risk items when it is the baseline library.

Through the analysis of the comprehensive security status of the equipment to be evaluated, the information of the triggered risk items (that is, vulnerabilities), the risk value of the risk items, and the number of times the risk items are triggered are analyzed by the baseline analysis and ACL analysis, and the comprehensive security status of the system equipment is analyzed. And get the corresponding security state value.

Compared with the existing technology, this method considers the relationship between risk items and the number of times the risk items are triggered during the analysis, and the analysis is more comprehensive. The calculation of the risk value adopts CVSS3.0 scoring technology, which is more reliable and credible than the method of taking empirical values. In addition, the calculated system security state value is more intuitive, accurate and effective to indicate the current equipment security state.

Figure 2 is a schematic structural diagram of Embodiment 1 of a risk assessment device for network security equipment provided by the present invention. As shown in Figure 2, a risk assessment device for network security equipment includes a determination module 10, an extraction module 20 and an assessment module 30;

The determination module 10 is configured to determine a predetermined risk library, the risk library includes configuration information of multiple risk items, and the configuration information includes identification codes and descriptions of risk items;

The extraction module 20 is configured to extract effective configuration information related to the risk item in the device to be evaluated, and obtain the risk item triggered by the device to be evaluated according to the risk analysis result of the effective configuration information;

The assessment module 30 is configured to separately analyze the risk items in the predetermined risk library and the risk items triggered by the equipment to be assessed, and adopt corresponding calculation methods to obtain the security status value of the equipment to be assessed.

A risk assessment device for network security equipment provided by an embodiment of the present invention includes: a determination module, an extraction module, and an evaluation module. According to the effective configuration information of the effective configuration information, and according to the risk analysis result of the effective configuration information, the risk item that triggers the device to be evaluated is obtained, and the evaluation module separately analyzes the risk item in the predetermined risk library and the risk item that has been triggered by the device to be evaluated, and takes corresponding measures. According to the calculation method, the risk value of the safety state value of the equipment to be evaluated is obtained, and the risk value of the risk item, the relationship between the risk items, and the triggering of each risk item that has been triggered by the risk item of the equipment to be evaluated are analyzed. The number of times is calculated accordingly to obtain the security status value of the equipment to be evaluated, which makes it more intuitive, accurate and effective to indicate the current security status of the equipment.

Further, on the basis of the above embodiments, it also includes: a preprocessing module 40;

The preprocessing module 40 is configured to pre-collect risk libraries of various configuration types before determining a predetermined risk library, and the configuration types include at least a baseline library and/or an access control list ACL library.

The device provided by the embodiment of the present invention can execute the above-mentioned method embodiment, and its implementation principle and technical effect are similar, and will not be repeated here.

Further, on the basis of the above-mentioned embodiments, the evaluation module 30 is set to analyze the risk items in the predetermined risk library, which means:

The evaluation module is configured to count the total number of risk items in the predetermined risk library;

Use the CVSS3.0 scoring method to analyze and obtain the risk value of the risk item in the predetermined risk library;

Determine the association relationship between any two risk items in the predetermined risk library, wherein triggering the first risk item will definitely trigger the second risk item, and triggering the second risk item will not trigger the first risk item risk item, it is determined that there is a relationship between the first risk item and the second risk item.

Further, on the basis of the above-mentioned embodiments, the evaluation module 30 is configured to analyze the risk items triggered by the device to be evaluated, which means:

The evaluation module is configured to analyze the number of triggers of each risk item triggered by the device to be evaluated, the risk value of the risk item, and the relationship between the risk items if the predetermined risk library includes an access control list ACL library. one or more of the three.

The device provided by the embodiment of the present invention can execute the above-mentioned method embodiment, and its implementation principle and technical effect are similar, and will not be repeated here.

Further, on the basis of the above embodiments, the evaluation module 30 is configured to analyze the risk items triggered by the device to be evaluated, which means:

The evaluation module 30 is configured to analyze the risk value of the risk item triggered by the device to be evaluated if the predetermined risk library includes a baseline library.

The device provided by the embodiment of the present invention can execute the above-mentioned method embodiment, and its implementation principle and technical effect are similar, and will not be repeated here.

Although the embodiments disclosed in the present invention are as above, the described content is only an embodiment adopted for understanding the present invention, and is not intended to limit the present invention. Anyone skilled in the field of the present invention can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed by the present invention, but the scope of patent protection of the present invention must still be The scope defined by the appended claims shall prevail.

Claims (10)

1. a kind of methods of risk assessment of Network Security Device, it is characterised in that including：

Predetermined risk storehouse is determined, the risk storehouse includes a plurality of risk；

Extract effective configuration information related to the risk in equipment to be assessed, and according to effectively matching somebody with somebody The risk analysis result of confidence breath obtains the risk of the equipment triggering to be assessed；

The risk in predetermined risk storehouse and the risk of the equipment triggering to be assessed are analyzed respectively, are taken Corresponding computational methods, obtain the secure state value of the equipment to be assessed.

2. according to the method described in claim 1, it is characterised in that it is determined that predetermined risk storehouse it Before, in addition to：

The risk storehouse of each Configuration Type is collected in advance, and the Configuration Type at least includes baseline library and/or access Control list ACL storehouses.

3. method according to claim 2, it is characterised in that the wind in the predetermined risk storehouse of analysis Dangerous item, including：

The sum of risk in the predetermined risk storehouse of statistics；

The value-at-risk of the risk obtained in predetermined risk storehouse is analyzed using CVSS3.0 methods of marking；

The incidence relation between any two risks in predetermined risk storehouse is determined, wherein, trigger first Risk item inherently triggering Article 2 risk, and trigger the Article 2 risk item and will not trigger described the One risk, it is determined that there is association between first risk and the Article 2 risk.

4. method according to claim 3, it is characterised in that the analysis equipment triggering to be assessed Risk, including：

If predetermined risk storehouse includes access control list ACL storehouse, the equipment triggering to be assessed is analyzed Every risk triggering times, the value-at-risk of risk and risk between incidence relation this three One or more in person.

5. method according to claim 3, it is characterised in that the analysis equipment triggering to be assessed Risk, including：

If predetermined risk storehouse includes baseline library, the wind of the risk of the equipment triggering to be assessed is analyzed Danger value.

6. the risk assessment device of a kind of Network Security Device, it is characterised in that the device includes：It is determined that Module, extraction module and evaluation module；

The determining module, is arranged at and determines predetermined risk storehouse, and the risk storehouse includes a plurality of risk Configuration information, the configuration information includes the identification code and description content of risk；

The extraction module, is arranged at and extracts related to the risk in equipment to be assessed effective match somebody with somebody Confidence ceases, and obtains the wind that the equipment to be assessed is triggered according to the risk analysis result of effective configuration information Dangerous item；

The evaluation module, is arranged at and analyzes risk in predetermined risk storehouse respectively and described to be assessed The risk of equipment triggering, takes corresponding computational methods, obtains the safe condition of the equipment to be assessed Value.

7. device according to claim 6, it is characterised in that also include：Pretreatment module；

The pretreatment module, is arranged at it is determined that before predetermined risk storehouse, each configuration class is collected in advance The risk storehouse of type, the Configuration Type at least includes baseline library and/or access control list ACL storehouse.

8. device according to claim 7, it is characterised in that the evaluation module is arranged at analysis Risk in predetermined risk storehouse, refers to：

The evaluation module is arranged at the sum of the risk in the risk storehouse for counting predetermined；

The value-at-risk of the risk obtained in predetermined risk storehouse is analyzed using CVSS3.0 methods of marking；

The incidence relation between any two risks in predetermined risk storehouse is determined, wherein, trigger first Risk item inherently triggering Article 2 risk, and trigger the Article 2 risk item and will not trigger described the One risk, it is determined that there is association between first risk and the Article 2 risk.

9. device according to claim 8, it is characterised in that the evaluation module is arranged at analysis The risk of the equipment triggering to be assessed, refers to：

If the evaluation module is arranged at predetermined risk storehouse including access control list ACL storehouse, analysis Triggering times, the value-at-risk of risk and the risk of every risk of the equipment triggering to be assessed With one or more in the incidence relation of risk this three.

10. device according to claim 8, it is characterised in that the evaluation module is arranged at point The risk of the equipment triggering to be assessed is analysed, is referred to：

If the evaluation module is arranged at predetermined risk storehouse including baseline library, described to be assessed set is analyzed The value-at-risk of the risk of standby triggering.