CN113259334B - Network system security vulnerability correlation modeling and analyzing method - Google Patents

Abstract

The invention discloses a modeling and analyzing method for security vulnerability relevance of a network system, which is implemented according to the following steps: step 1, selecting a network scene, and detecting a network vulnerability existing in the specific network scene; step 2, performing relevance analysis on the loopholes obtained in the step 1, and performing tangent plane on the loopholes in two dimensions of a system level and a network level; step 3, merging the system section and the network section, adding vulnerability hazards as a third dimension, and establishing a three-dimensional evaluation model; and 4, analyzing the model in the step 3, establishing a vulnerability hazard degree evaluation mechanism, and evaluating the health state of the system. The problem that the network hazard degree measurement standard is not accurate enough in the prior art is solved.

Description

A network system security vulnerability correlation modeling and analysis method

technical field

The invention belongs to the technical field of network attack and defense, and relates to a network system security vulnerability correlation modeling and analysis method.

Background technique

With the continuous development of the Internet and the increasingly complex network attack methods, network security problems are becoming more and more serious. Attackers often exploit low-level software vulnerabilities to trigger high-level software vulnerabilities to damage or control network systems. The network security situation is becoming more and more serious, and security incidents occur frequently. Assessing and protecting network security faces enormous challenges.

For the exploitation of network and system vulnerabilities, the impact of different user rights is different, the sequence in which the vulnerabilities are exploited is different, and the harmfulness is also different. How to mine network system vulnerabilities and analyze the harm of vulnerabilities is becoming more and more complicated. Therefore, it is currently necessary to identify the vulnerabilities of the system itself and the correlation between vulnerabilities in diverse and complex attacks. The existing vulnerability correlation analysis method adopts the "shopping basket analysis method" in the field of e-commerce. By studying the vulnerabilities that have been generated, the different vulnerabilities are correlated and the relationship between the two is explored. However, this method also has certain limitations. For example, it is not formal enough, and it does not have a good understanding of the causes and consequences of vulnerability exploitation. Formal analysis of network vulnerability correlation is also a major challenge in the field of network security.

The methods of network attacks are increasingly diverse and complex, and prediction, analysis, and defense are becoming more and more difficult. From a single vulnerability jeopardizing the system to multiple vulnerabilities that are interconnected and exploited by attackers together, the security of the system is compromised. This paper proposes a method that has not yet been adopted. It analyzes the vulnerabilities in the system and network dimensions, establishes a graph model, and then evaluates the vulnerability of the vulnerability. It solves the problem that the traditional method has low analysis efficiency, less information obtained, and the analysis method is not systematic enough, and the vulnerability cannot be obtained. The problem of deep cryptic relevance.

At present, in the field of network security, the assessment of the hazard level of network vulnerabilities is becoming more and more important.

The existing security vulnerability risk assessment system only makes a simple assessment of the degree of harm of the vulnerability. The CVSS score, a general vulnerability scoring system released by NVD, gives a score between 0.0 and 10.0. The larger the value, the more dangerous the vulnerability is. The more serious the consequences are; the CVSS system uses the vulnerability basic score, life cycle score and environmental score to calculate the CVSS score, thereby providing a standard to measure the severity of the vulnerability.

How to design a more accurate and useful vulnerability damage degree assessment mechanism from complex and diverse vulnerabilities, and better measure the damage degree of a single vulnerability and multiple associated vulnerabilities at the system architecture and network level to the entire system network, has become a challenge for network security research. new challenges.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a network system security vulnerability correlation modeling and analysis method, which solves the problem that the network damage degree measurement standard in the prior art is not accurate enough.

The technical scheme adopted by the present invention is a method for modeling and analyzing the correlation of security vulnerabilities in a network system, which is specifically implemented according to the following steps:

Step 1. Select a network scenario to detect network vulnerabilities existing in a specific network scenario;

Step 2. Carry out correlation analysis on the vulnerabilities obtained in step 1, and analyze the vulnerabilities in two dimensions: system level and network level;

Step 3. Combine the system aspect and the network aspect, and add vulnerability hazards as the third dimension to establish a three-dimensional evaluation model;

Step 4: Analyze the model in step 3, and establish a vulnerability damage degree assessment mechanism to assess the health status of the system.

The feature of the present invention also lies in:

Step 1 is specifically implemented as follows: it is assumed that there are three-hop vulnerability penetrations of A, B, and C in the attack event, in which each hop vulnerability penetration event belongs to the penetration of the same device on the penetration path, and the cause and effect of the vulnerability are analyzed and judged. ^* X and X ^* of vulnerability X form a vulnerability penetration chain, and formally describe the penetration process.

Step 2 is implemented according to the following steps:

Step 2.1, carry out the system dimension aspect of the formed vulnerability chain:

The system architecture is divided into network service layer, application service layer, system service layer, operating system layer, and hardware layer from top to bottom. According to the system architecture level where the vulnerability is located, each hop vulnerability is mapped, and the vulnerability is represented by a node in the system architecture. In the figure, the predecessor-successor relationship between nodes is represented by lines with arrows, which reflect the direction and process of penetration, and map vulnerabilities to different levels of the system architecture, thereby forming a system slice model of vulnerabilities;

Step 2.2, establish a network slice model:

According to the network dimension, the vulnerability can be divided into application layer, transport layer, network layer, data link layer and physical layer from top to bottom. Mapping is carried out according to the penetration of the vulnerability and the network level to which it belongs; during the mapping process, the vulnerability nodes with predecessor-successor relationships are indicated by arrows, thus completing the construction of the network slice graph model.

Step 3 is implemented according to the following steps:

Step 3.1, merge the system and network aspects obtained after step 2, note that the combined system aspect and network aspect are mapped through the same attack penetration path, and the composite model is constructed in the polar coordinate axis;

Step 3.2, a two-dimensional graph model is formed so far, showing the penetration method and location of the vulnerability chain at the system and network levels, deeply and accurately analyzing the vulnerability correlation and assessing the degree of harm of the vulnerability; A third dimension is added to the two-dimensional polar coordinate system, and vulnerability hazards are used as the third dimension to improve the vulnerability correlation model diagram.

Step 4 is implemented according to the following steps:

Step 4.1, according to the model obtained in step 3, and establish an assessment mechanism that comprehensively considers the harm of the system, the network and the vulnerability itself;

Step 4.2, set the penetration of the vulnerability in the system aspect to satisfy the vector S=(A1, B1, C1), and the penetration in the network aspect to satisfy the vector P=(A2, B2, C2), where A1, B1, C1, A2, B2 , C2 indicates that the vulnerability is at the system or network level, so as to obtain the transformation map of vulnerability penetration;

Step 4.3, set the hazards of the system and network aspects as two fixed values a, b, a and b depend on the evaluator's emphasis on the system and the network, and satisfy the normalization condition, namely: a+b=1;

Step 4.4, calculate the assessment value of the vulnerability damage degree of the system aspect and the network aspect; adopt the weighted calculation method;

Step 4.5, according to the vulnerability assessment model, carry out vulnerability hazard assessment; set the vulnerability assessment value V, the present invention proposes a method for calculating V as follows, calculating the weighted hazard sum of the vulnerability hazards in the system and the network level, and multiplying the vulnerability itself hazard D by the left, That is: V=D·(a·S+b·P), D is an n-dimensional row vector composed of vulnerability hazards, and each element of the row vector represents the CVSS vulnerability level from vulnerability 1 to vulnerability n in turn from left to right Hazard score, and then calculate the modulo of the evaluation value to more three-dimensionally and objectively represent the degree of harm of network vulnerabilities.

The beneficial effects of the present invention are as follows: the present invention is a method for modeling and analyzing the correlation of security vulnerabilities in a network system, which solves the problems of single network vulnerability scoring, informal vulnerability correlation analysis, and network hazard degree measurement standards existing in the prior art. Inaccurate question. For specific scenarios, the gradual penetration of vulnerabilities in network attack defense, the correlation analysis of the vulnerabilities is carried out, and then the system architecture and network level aspect modeling of the vulnerabilities are performed, and finally the two aspect graph models are merged and evaluated. It is a method for multi-dimensional division and deep correlation analysis of vulnerabilities to analyze vulnerabilities in the system dimension and network dimension, analyze vulnerability penetration and assess the degree of network damage. The assessment of the hazard of network vulnerabilities has changed from a traditional simple score to a comprehensive evaluation value, with higher accuracy, more comprehensive evaluation perspective, and more thorough vulnerability analysis, which is highly useful and practical.

Description of drawings

Fig. 1 is the flow chart of a kind of network system security vulnerability correlation modeling and analysis method of the present invention;

Fig. 2 is a flow chart of step 4 in a network system security vulnerability correlation modeling and analysis method of the present invention;

Fig. 3 is the predecessor and successor diagram of a kind of network system security vulnerability correlation modeling and analysis method of the present invention;

Fig. 4 is the graph model that adopts a kind of network system security vulnerability correlation modeling and analysis method of the present invention to carry out the system dimension slice generation to the vulnerability;

FIG. 5 is a graph model generated by using a network system security vulnerability correlation modeling and analysis method of the present invention to generate network dimension slices for vulnerabilities.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

The method for modeling and analyzing the correlation of security vulnerabilities in a network system of the present invention firstly defines the predecessor and successor of the vulnerability.

Definition 1.1: ^* B is called the precursor of B if and only if: the occurrence of vulnerability X leads to the occurrence of vulnerability B, and vulnerability X is called ^* B;

Definition 1.2: B ^* is called the successor of B if and only if: the occurrence of vulnerability B leads to the occurrence of vulnerability Y, and vulnerability Y is called B ^* .

A network system security vulnerability correlation modeling and analysis method of the present invention, as shown in Figure 1, is specifically implemented according to the following steps:

Step 1. Select a network scenario to detect network vulnerabilities existing in a specific network scenario;

Step 1 is specifically implemented as follows: It is assumed that there are three-hop vulnerability penetrations of A, B, and C in the attack event, in which each hop vulnerability penetration event belongs to the penetration of the same device on the penetration path, and the cause and effect of the vulnerability are analyzed and judged. ^* X and X* of vulnerability X form a vulnerability penetration chain, and formally describe the penetration process.

Step 2. Carry out correlation analysis on the vulnerabilities obtained in step 1, and analyze the vulnerabilities in two dimensions: system level and network level;

Step 2 is implemented according to the following steps:

Step 2.1, carry out the system dimension aspect of the formed vulnerability chain:

The system architecture is divided into network service layer, application service layer, system service layer, operating system layer, and hardware layer from top to bottom. According to the system architecture level where the vulnerability is located, each hop vulnerability is mapped, and the vulnerability is represented by a node in the system architecture. In the figure, the predecessor-successor relationship between nodes is represented by lines with arrows, which reflect the direction and process of penetration, and map vulnerabilities to different levels of the system architecture, thereby forming a system slice model of vulnerabilities;

Step 2.2, establish a network slice model:

According to the network dimension, the vulnerability can be divided into application layer, transport layer, network layer, data link layer and physical layer from top to bottom. Mapping is carried out according to the penetration of the vulnerability and the network level to which it belongs; during the mapping process, the vulnerability nodes with predecessor-successor relationships are indicated by arrows, thus completing the construction of the network slice graph model.

Step 3. Combine the system aspect and the network aspect, and add vulnerability hazards as the third dimension to establish a three-dimensional evaluation model;

Step 3 is implemented according to the following steps:

Step 3.1, merge the system and network aspects obtained after step 2, note that the combined system aspect and network aspect are mapped through the same attack penetration path, and the composite model is constructed in the polar coordinate axis;

Step 3.2, a two-dimensional graph model is formed so far, showing the penetration method and location of the vulnerability chain at the system and network levels, deeply and accurately analyzing the vulnerability correlation and assessing the degree of harm of the vulnerability; A third dimension is added to the two-dimensional polar coordinate system, and vulnerability hazards are used as the third dimension to improve the vulnerability correlation model diagram.

Step 4: Analyze the model in step 3, and establish a vulnerability damage degree assessment mechanism to assess the health status of the system.

As shown in Figure 3, step 4 is implemented according to the following steps:

Step 4.1, according to the model obtained in step 3, and establish an assessment mechanism that comprehensively considers the harm of the system, the network and the vulnerability itself;

Step 4.2, set the penetration of the vulnerability in the system aspect to satisfy the vector S=(A1, B1, C1), and the penetration in the network aspect to satisfy the vector P=(A2, B2, C2), where A1, B1, C1, A2, B2 , C2 indicates that the vulnerability is at the system or network level, so as to obtain the transformation map of vulnerability penetration;

Step 4.3, set the hazards of the system and network aspects as two fixed values a, b, a and b depend on the evaluator's emphasis on the system and the network, and satisfy the normalization condition, namely: a+b=1;

Step 4.4, calculate the assessment value of the vulnerability damage degree of the system aspect and the network aspect; adopt the weighted calculation method;

Step 4.5, according to the vulnerability assessment model, carry out vulnerability hazard assessment; set the vulnerability assessment value V, and calculate V as follows: Calculate the weighted hazard sum of vulnerability hazards at the system and network levels, and multiply the vulnerability itself hazard D by the left, namely: V =D·(a·S+b·P), D is an n-dimensional row vector composed of vulnerability hazards, each element of the row vector represents the CVSS vulnerability level hazard score from vulnerability 1 to vulnerability n in turn from left to right, After that, the modulus of the evaluation value is calculated to more three-dimensionally and objectively represent the damage degree of the network vulnerability.

Example

In the network system, the leakage of some user information will activate the system loopholes and then infiltrate them. Some infiltration results can even be used again. Step by step, they can penetrate deep into the system to obtain higher rights. In order to cover up the infiltration behavior, the infiltrator The infiltration traces are erased. In order to facilitate the next attack, the infiltrator will leave a back door.

Note that A is the vulnerability caused by the system version being too low. The attacker uses this vulnerability to cause an overflow vulnerability B in the system. Through the overflow, the infiltrator can obtain the system shell, and then use the shell to trigger the privilege escalation vulnerability C. The infiltrator logs in through ordinary users. System, escalate privileges, obtain administrator information, log in to the background, make changes to the database or other information of the website, and finally the attacker successfully escalates privileges. According to definition 1.1, vulnerability A is represented as ^* B, and according to definition 1.2, vulnerability C is represented as B ^* . ^* B, B, and B ^* are closely related and act on the system together, causing great harm to the network and the system.

Take the vulnerabilities in the vulnerability library to the system dimension aspect to form the vulnerability system aspect;

The system architecture is divided into network service layer, application service layer, system service layer, operating system layer, and hardware layer from top to bottom. As shown in Figure 4, the vulnerability points and arrows in the figure represent the predecessor, successor and penetration process of the vulnerability. The graph model represents the different levels of the system layer from the inner circle to the outer circle. A1, B1, and C1 form a vulnerability chain, and A1 is an exploit. The lower version of the system performs an overflow event, B1 is a system overflow exposure shell event, and C1 is a privilege escalation event using a shell vulnerability. According to definition 1.1, vulnerability A1 is represented as ^* B1, and according to definition 1.2, vulnerability C1 is represented as B1 ^* , set When the weight of ^* B1 in the ring diagram is 7, the weight of B1 in the ring diagram is 8, and the weight of B1 ^* in the ring diagram is 9, and the vector S=(7,8,9) is obtained, assuming this The evaluation of the vulnerability chain has the same emphasis on the system and the network, then the damage weight of the system aspect is recorded as 1/2, and the damage degree evaluation value aS is obtained.

Build a slice graph model of the network dimension.

According to the network dimension, the vulnerability is sliced. The network layer can consider the application layer, transport layer, network layer, data link layer, and physical layer from top to bottom. Map according to the penetration of the vulnerability and the network level to which it belongs. In the mapping process, arrows are used to indicate the penetration direction and process, thus completing the construction of the network slice graph model. As shown in Figure 5, the graph model represents the different levels of the network system from the inner circle to the outer circle. A2 is an overflow event using a low version of the system, B2 is a system overflow exposing shell event, and C2 is a privilege escalation event using a shell vulnerability. According to definition 1.1, vulnerability A2 is represented as ^* B2, and according to definition 1.2, vulnerability C2 is represented as B2 ^* , set the weight of ^* B2 in the ring diagram to 6, the weight of B2 in the ring diagram to 8, and the weight of B2 ^* in the ring diagram to be 10, get the vector P=(6,8,10 ), assuming that the evaluation of this vulnerability chain has the same emphasis on the system and the network, the damage weight of the network aspect is recorded as 1/2, and the damage degree evaluation value bP is obtained.

Merge the system and network aspect graph models obtained after step 2. Note that the combined system aspect model and network aspect model are mapped through the same attack penetration path, which is a deep and high-accuracy analysis of vulnerability correlations. and preparedness for hazards.

In view of the different hazard levels of different vulnerability chains, the third dimension is added to the two-dimensional polar coordinates, and the vulnerability hazard D is used as the third dimension to improve the construction of the vulnerability correlation analysis graph model.

According to step 4, the specific example is as follows:

Analyze the model obtained after step 3, and establish an evaluation mechanism that comprehensively considers the damage degree of the system, the network, and the vulnerability itself;

According to the known conditions, the penetration hazard degree of the vulnerability chain in the system aspect satisfies the vector S=(A1, B1, C1), and the penetration hazard degree in the network aspect satisfies the vector P=(A2, B2, C2), where A1, B1, C1, A2, B2, C2 indicate that the vulnerability is at the system or network level, so as to obtain the penetration transformation diagram of the vulnerability, as shown in Figure 3;

The hazards of the system and network aspects are set as two fixed values a and b, and the two values satisfy the normalization condition, that is: a+b=1. Set in this vulnerability chain, the degree of emphasis on the hazards of the system and the network is set. The same, namely: a=b=1/2;

Using the evaluation value of the weighted degree, according to this vulnerability example, the damage degree of the system aspect is obtained as a.S, and the damage degree of the network aspect is b.P;

用来表示整个网络系统产生的漏洞的危害程度，进而评估网络的健康状态。According to the vulnerability assessment model, perform vulnerability hazard assessment. Setting the vulnerability assessment value V, the present invention proposes a method for calculating V according to the model diagram as follows, calculating the weighted sum of the vulnerability hazards of the system architecture and the network level, and multiplying the vulnerability itself damage D by the left, namely: V=D·(a·S+ b·P), D is an n-dimensional row vector composed of vulnerability hazards. Each element of the row vector represents the CVSS vulnerability level hazard score from vulnerability 1 to vulnerability n in turn from left to right, and then the modulus of the evaluation value is calculated, indicating The severity of network vulnerabilities. In this case, since there are three loopholes in the loophole chain, D is set as a three-dimensional row vector D = (5, 3, 3), then the degree of damage V = D · (a · S + bP) = (5, 3, 3)·{1/2·(7,8,9)+1/2·(6,8,10)}, calculate the value of the vector value V as (143/2,88,209/2), and then calculate| V| is

It is used to express the damage degree of the vulnerabilities generated by the entire network system, and then evaluate the health status of the network.

By adopting the method for modeling and analyzing the correlation of network system security vulnerabilities of the present invention, the vulnerabilities in the network are utilized and the correlation analysis is performed to obtain the predecessor and successor diagram of the vulnerabilities, as shown in FIG. 3 . According to the system level and network level to which the vulnerability belongs, the vulnerability chain is sliced and the degree of harm of the vulnerability to the system and network is comprehensively assessed. Analytical model. Set up a new more accurate hazard assessment method to assess network system security vulnerabilities. Through the method for modeling and analyzing the correlation of network system security vulnerabilities of the present invention, the vulnerability in a specific penetration scenario is modeled in terms of system and network dimensions, and combined with the application scenario, the degree of harm of the vulnerability can be quickly and accurately evaluated, and then the evaluation The health status of the network.

The existing research ideas of vulnerability security assessment are only simple correlation analysis of vulnerabilities, and scoring with reference to their life cycle and environment. A method for modeling and analyzing the correlation of security vulnerabilities in a network system of the present invention takes a new approach. The vulnerability chain is cut into the system dimension and the network dimension and a graph model is constructed, which solves the problems of simplification and low accuracy of traditional evaluation of vulnerabilities by CVSS scoring. It has certain reference for the evaluation of vulnerability hazard level in future network security and the measurement of network health status.

According to the needs of users, according to the method for modeling and analyzing the correlation of network system security vulnerabilities of the present invention, the system aspect and each layer of the network aspect can be further divided into sub-layers, and the vulnerability chain can be described in more detail. Good research prospects and research value.

The invention provides a network system security vulnerability correlation modeling and analysis method, which solves the problems existing in the prior art that the network vulnerability scoring is single, the vulnerability correlation analysis is informal, and the network hazard degree measurement standard is not accurate enough. For specific scenarios, the gradual penetration of vulnerabilities in network attack defense, the correlation analysis of the vulnerabilities is carried out, and then the system architecture and network level aspect modeling of the vulnerabilities are performed, and finally the two aspect graph models are merged and evaluated. It is a method for multi-dimensional division and deep correlation analysis of vulnerabilities to analyze vulnerabilities in the system dimension and network dimension, analyze vulnerability penetration and assess the degree of network damage. The assessment of the hazard of network vulnerabilities has changed from a traditional simple score to a comprehensive evaluation value, with higher accuracy, more comprehensive evaluation perspective, and more thorough vulnerability analysis, which is highly useful and practical.

Claims (2)

1. A network system security vulnerability correlation modeling and analyzing method is characterized by comprising the following steps:

step 1, selecting a network scene, and detecting a network vulnerability existing in the network scene;

step 2, performing relevance analysis on the loopholes obtained in the step 1, and performing tangent plane on the loopholes in two dimensions of a system level and a network level;

step 3, merging the system section and the network section, adding vulnerability hazards as a third dimension, and establishing a three-dimensional evaluation model;

step 4, analyzing the model in the step 3, establishing a vulnerability hazard degree evaluation mechanism, and evaluating the health state of the system;

the step 2 is specifically implemented according to the following steps:

step 2.1, performing a systematic dimensional tangent plane on the formed vulnerability chain:

system frameThe structure is divided into a network service layer, an application service layer, a system service layer, an operating system layer and a hardware layer from top to bottom, each jump vulnerability is mapped according to the system architecture level where the vulnerability is located, the vulnerability is represented in the system architecture diagram by nodes, the precursor successor relation between the nodes is represented by lines with arrows, the penetration direction and process are reflected, and the vulnerability is mapped to different layers of the system architecture, so that a system sectional graph model of the vulnerability is formed; wherein,^*b is called the predecessor vulnerability of vulnerability B if and only if: the occurrence of leak X leads to the occurrence of leak B, which is called leak X^*B；B^*The successor called vulnerability B if and only if: the generation of the leak B causes the generation of a leak Y, and the leak Y is called B^*；

Step 2.2, establishing a network section graph model:

cutting the vulnerability according to network dimension, wherein the network layer is divided into an application layer, a transmission layer, a network layer, a data link layer and a physical layer from top to bottom; mapping according to the penetration condition of the vulnerability and the network hierarchy to which the vulnerability belongs; in the mapping process, vulnerability nodes with predecessor successor relations are indicated by arrows, so that the construction of a network section graph model is completed;

the step 3 is specifically implemented according to the following steps:

step 3.1, merging the system tangent plane and the network tangent plane obtained in the step 2, wherein the system tangent plane and the network tangent plane which are noticed to be merged are mapped through the same attack penetration path, and a synthetic model is constructed in a polar coordinate axis;

3.2, forming a two-dimensional graph model, displaying the penetration mode and the position of the vulnerability chain on the system and network layers, and deeply and accurately analyzing vulnerability relevance and evaluating the hazard degree of the vulnerability; adding a third dimension into the two-dimensional polar coordinate system in view of different damage grades of the vulnerability, and using vulnerability damage as the third dimension to perfect a vulnerability correlation model diagram;

the step 4 is specifically implemented according to the following steps:

4.1, establishing an evaluation mechanism comprehensively considering the system, the network and the damage of the bug per se according to the model obtained in the step 3;

step 4.2, setting the penetration of the vulnerability in a system section to meet a vector S (A1, B1 and C1) and setting the penetration of the vulnerability in a network section to meet a vector P (A2, B2 and C2), wherein A1, B1, C1, A2, B2 and C2 represent that the vulnerability is in the system or network level, and thus obtaining a conversion map of vulnerability penetration;

step 4.3, setting the damage of the system and the network section as two fixed values a, b, wherein the a and b depend on the degree of the emphasis of the evaluator on the system and the network, and the normalization condition is met, namely: a + b is 1;

4.4, calculating vulnerability hazard degree evaluation values of the system section and the network section; adopting a weighting calculation method;

step 4.5, evaluating vulnerability hazards according to the vulnerability evaluation model; setting a vulnerability assessment value V, and calculating the V by calculating the weighted hazard sum of vulnerability hazards in a system and a network layer and multiplying the vulnerability hazard D by the vulnerability: and V is D (a.S + b.P), D is an n-dimensional row vector consisting of vulnerability hazards, each element of the row vector sequentially represents CVSS vulnerability grade hazard scores from vulnerability 1 to vulnerability n from left to right, and then a model of an evaluation value is calculated to represent the hazard degree of the network vulnerability.

2. The method for modeling and analyzing the relevance of the security vulnerabilities of the network system according to claim 1, wherein the step 1 is implemented specifically as follows: setting penetration of A, B, C three-jump penetration of attack event, wherein each jump penetration belongs to penetration of the same equipment on penetration path, analyzing the precursor consequence of the penetration, and judging the penetration X^*X and X^*Forming a leak penetration chain, and formally describing a penetration process.

Images